In general Not later than one year after the date of the enactment of this Act, the Director, in consultation with NIST, shall define a set of conditions that— (A) ensure a non-compliant device can be used with a level of security that is equivalent or greater to the baseline security requirements described in subsection (a)(2)