; (3) includes a Major IT Business Case under the requirements established by the Office of Management and Budget Exhibit 300; (4) complies with the acquisition rules, requirements, guidelines, and systems acquisition management practices of the Government; (5) complies with all Office of Management and Budget, Department of Homeland Security and National Institute of Standards and Technology requirements related to securing the agency’s information system as described in 44 U.S.C. 3554 ; and (6) is reviewed and commented upon within 90 days of plan development by the Inspector General of the Office of Personnel Management, and such comments are submitted to the Director of the Office of Personnel Management before the date of such submission: Provided further, That, not later than 6 months after the date of enactment of this Act, the Comptroller General shall submit to the Committees on Appropriations of the Senate and the House of Representatives a report that— (A) evaluates— (i) the steps taken by the Office of Personnel Management to prevent, mitigate, and respond to data breaches involving sensitive personnel records and information; (ii) the Office’s cybersecurity policies and procedures in place on the date of enactment of this Act, including policies and procedures relating to IT best practices such as data encryption, multifactor authentication, and continuous monitoring; (iii) the Office’s oversight of contractors providing IT services; and (iv) the Office’s compliance with government-wide initiatives to improve cybersecurity