; (B) the adoption of system level security controls, including operating system containers and microservices; (C) multi-factor authentication; and (D) network access control and edge systems, such as gateways, that can isolate, disable, or remediate connected devices. (3) Specification of additional precautions To address the long-term risk of non-compliant devices acquired in accordance with an exception under this subsection, the Director, in consultation with NIST and private-sector industry experts and, with respect to medical devices regulated under the Federal Food, Drug, and Cosmetics Act, in consultation with the Commissioner of Food and Drugs, may stipulate additional requirements for management and use of non-compliant devices, including deadlines for the removal, replacement, or disabling of non-compliant devices (or their Internet-connectivity), as well as minimal requirements for gateway products to ensure the integrity and security of the non-compliant devices. (4) Existing third-party security standard (A) In general If a voluntary consensus standard for the security of covered devices provides an equivalent or greater level of security to that described in subsection (a)(2), the Director shall modify the requirements under subsection (a)(1) and the security clause under subsection (a)(2) to reflect conformity with that voluntary consensus standard. (B) Written certification A contractor providing a covered device shall provide third-party written certification that the device complies with the security requirements of the industry certification method of the third party. (C) NIST NIST, in consultation with the Director and the heads of other appropriate executive agencies, shall determine— (i) accreditation standards for third-party certifiers