; or (C) to create or continue a special access program contrary to the requirements of an active Executive order. 502. Information technology system security (a) Definitions In this section: (1) Incident The term incident has the meaning given the term in section 3552(b) of title 44, United States Code. (2) Information system The term information system has the meaning given the term in section 3502 of title 44, United States Code. (3) Penetration test The term penetration test means a test methodology in which assessors attempt to circumvent or defeat the security features of an information system. (b) Consultations process Not later than 60 days after the date of the enactment of this Act, the Secretary shall establish a process for conducting semiannual consultations with the Secretary of Defense, the Director of National Intelligence, the Secretary of Homeland Security, and any other department or agency representative that the Secretary determines to be appropriate regarding the security of United States Government and nongovernmental information systems used or operated by the Department, a contractor of the Department, or another organization on behalf of the Department, including any such systems or networks facilitating the use of sensitive or classified information. (c) Independent penetration testing of information systems In coordination with the consultations under subsection (b), the Secretary shall commission independent, semiannual penetration tests, which shall be carried out by an appropriate Federal agency other than the Department, such as the Department of Homeland Security or the National Security Agency, to ensure that adequate policies and protections are implemented to detect and prevent penetrations or compromises of such information systems, including malicious intrusions by any unauthorized individual, state actor, or other entity. (d) Waiver The Secretary may waive the requirement under subsection (c) for up to 180 days if the Secretary— (1) determines that such requirement would