Reporting requirements

(a) Annual report Not later than 1 year after the publication of any Industry Best Practices developed under section 4, and annually thereafter, the Assistant Secretary, in consultation with the Working Group, shall submit to the relevant congressional committees and publish a public version on the website of NTIA a report that includes— (1) an overview of the development of Industry Best Practices, and any updates or modifications of Industry Best Practices; (2) data on participation of eligible entities in the certification process; (3) a summary of early reassessment activity, if any; (4) an assessment of the adoption of Industry Best Practices; and (5) the effectiveness of Industry Best Practices and certification in enhancing cybersecurity across the telecommunications sector. (b) Event-Triggered report Not later than 90 days after a substantial revision to Industry Best Practices or a significant cyber-incident, as defined in Presidential Policy Directive–41 (July 26, 2016; relating to United States cyber incident coordination), affecting the telecommunications sector, the Assistant Secretary, in consultation with the Working Group, shall submit to Congress a report that includes, to the greatest extent practicable, the consensus views and recommendations of the Working Group to improve cybersecurity across the telecommunications sector.