Except as provided in paragraph (2), for any cyber device that has the capability to be accessed remotely by the manufacturer or any other entity: (i) Implement multi-factor authentication for accessing any cyber capability of the device. (ii) Secure data in motion and data at rest with data encryption, and other best practices, approved by the National Institute of Standards and Technology. (iii) Install automated tools to track access, or identify attempts at unauthorized access, to any cyber capability of the device. (iv) Adopt whitelisting approaches and changeable passwords for accessing any cyber capability of the device. (v) Comply with the remote access provisions recommended by the National Institute of Standards and Technology, in the document entitled Security for Telecommuting and Broadband Communications (NIST Special Publication 800–46) , published in August 2002. (2) Exceptions A manufacturer may submit a petition to the Secretary to exempt a cyber device from any requirement under paragraph (1)(C). The Secretary may grant such an exemption if it determines that the manufacturer can prove the exemption would pose not more than a minimal risk to patient health, minimal risk to privacy, and minimal risk of a cyber vulnerability. (d) Cybersecurity fixes or updates (1) Re-clearance or reapproval Unless at the request of the Secretary due to a unique and extenuating circumstance, any cybersecurity fix or update shall not require a new notification under section 510(k) or application for premarket approval under section 515(c). (2) Free cybersecurity fixes or updates A manufacturer of a cyber device shall provide any cybersecurity fix or update to the device free of charge until— (A) the date on which any agreement to provide such fixes or updates, entered into between the manufacturer (or a third party authorized by the manufacturer) and a provider, expires