; (bb) the adoption of system level security controls, including operating system containers and microservices; (cc) multi-factor authentication; and (dd) intelligent network solutions and edge systems, such as gateways, that can isolate, disable, or remediate connected devices. (iii) Specification of additional precautions To address the long-term risk of non-compliant Internet-connected devices acquired in accordance with an exception under this paragraph, the Director, in coordination with NIST and private-sector industry experts, may stipulate additional requirements for management and use of non-compliant devices, including deadlines for the removal, replacement, or disabling of non-compliant devices (or their Internet-connectivity), as well as minimal requirements for gateway products to ensure the integrity and security of the non-compliant devices. (B) Existing third-party security standard (i) In general If an existing third-party security standard for Internet-connected devices provides an equivalent or greater level of security to that described in paragraph (1)(A), an executive agency may allow a contractor to demonstrate compliance with that standard in lieu of the requirements under paragraph (1). (ii) Written certification A contractor providing the Internet-connected device shall provide third-party written certification that the device complies with the security requirements of the industry certification method of the third party. (iii) NIST NIST, in coordination with the Director and other appropriate executive agencies, shall determine— (I) accreditation standards for third-party certifiers