; (2) the status of compliance of the affected Federal information system with applicable security requirements at the time of the major incident; (3) if the major incident involved a breach, a description of the affected information, an estimate of the number of individuals potentially impacted, and any assessment to the risk of harm to such individuals; (4) an update to the assessment of the risk to agency operations, or to impacts on other agency or non-Federal entity operations, affected by the major incident; and (5) the detection, response, and remediation actions of the agency, including any support provided by the Cybersecurity and Infrastructure Security Agency under section 3594(d), if applicable. (d) Additional update If the head of an agency, the Director, or the National Cyber Director determines that there is any significant change in the understanding of the scope, scale, or consequence of a major incident for which the head of the agency submitted a written notification and update under subsections (b) and (c), the head of the agency shall submit to the appropriate congressional entities a written update that includes information relating to the change in understanding. (e) Biennial report Each agency shall submit as part of the biennial report required under section 3554(c)(1) a description of each major incident that occurred during the 2-year period preceding the date on which the biennial report is submitted. (f) Report delivery (1) In general Any written notification or update required to be submitted under this section— (A) shall be submitted in an electronic format; and (B) may be submitted in a paper format. (2) Classification status Any written notification or update required to be submitted under this section— (A) shall be— (i) unclassified; and (ii) submitted through unclassified electronic means pursuant to paragraph (1)(A)