; and (B) has computer processing capabilities that can collect, send, or receive data. (7) NIST The term NIST means the National Institute of Standards and Technology. (8) Properly authenticated update The term properly authenticated update means an update, remediation, or technical fix to a hardware, firmware, or software component issued by a product vendor or service provider used to correct particular problems with the component, and that, in the case of software or firmware, contains some method of authenticity protection, such as a digital signature, so that unauthorized updates can be automatically detected and rejected. (9) Security vulnerability The term security vulnerability means any attribute of hardware, firmware, software, process, or procedure or combination of 2 or more of these factors that could enable or facilitate the defeat or compromise of the confidentiality, integrity, or availability of an information system or its information or physical devices to which it is connected. (10) Software The term software means a computer program and associated data that may be dynamically written or modified. 3. Contractor responsibilities with respect to Internet-connected device cybersecurity (a) Clauses required in Internet-Connected devices (1) In general Not later than 180 days after the date of the enactment of this Act, the Director, in consultation with the Secretary of Defense, the Administrator of General Services, the Secretary of Commerce, the Secretary of Homeland Security, and any other intelligence or national security agency that the Director determines to be necessary, shall issue guidelines for each executive agency to require the following clauses in any contract, except as provided in paragraph (2), for the acquisition of Internet-connected devices: (A) Verification required (i) In general A clause that requires the contractor providing the Internet-connected device to provide written certification that the device— (I) except as provided under clause (ii), does not contain, at the