devices: (A) Verification required (i) In general A clause that requires the contractor providing the Internet-connected device to provide written certification that the device— (I) except as provided under clause (ii), does not contain, at the time of submitting the proposal, any hardware, software, or firmware component with any known security vulnerabilities or defects listed in— (aa) the National Vulnerability Database of NIST