The penetration testing report as per Paragraph RM-3.1.29, along with the steps taken to mitigate the risks must be maintained by the licensee for a five year period from the date of the report and must be provided to CBB within three months following the end of the month where the testing took place, i.e. for a June test, the report must be submitted at the latest by 30^th September and for a December test, by 31^st March (see Section BR-4A.2).