; and (ii) whether the standards described in clause (i) provide appropriate security and are aligned with the guidelines issued under subsection (a). (5) Existing agency security evaluation standards (A) In general If an executive agency employs a security evaluation process or criteria for covered devices that the agency believes provides an equivalent or greater level of security to the baseline security requirements described in subsection (a)(2), an executive agency may, upon the approval of the Director, continue to use that process or criteria in lieu of the requirements under subsection (a)(2). (B) NIST NIST, in consultation with the Director and the heads of other appropriate executive agencies, shall determine whether the process or criteria described in subparagraph (A) provides appropriate security and is aligned with the guidelines issued under subsection (a). (c) Guidelines for lowest price technically acceptable source selection Not later than 180 days after the date of the enactment of this Act, the Director, in consultation with the Administrator of General Services, shall issue guidelines for each executive agency to limit, to the maximum extent practicable, the use of lowest price technically acceptable source selection criteria in the case of a procurement that is predominately for the acquisition of a covered device. (d) Report to Congress Not later than 5 years after the date of the enactment of this Act, the Director shall submit to Congress a report on the effectiveness of the guidelines required to be issued under subsections (a) and (c), which shall include recommendations, if any, for legislation necessary to improve cybersecurity in executive agency acquisition of covered devices. (e) General waiver authority for Director Beginning on the date that is 5 years after the date of the enactment of this Act, the Director may waive, in whole or in part, the requirements of the guidelines or set of conditions issued under this section, for an executive agency. (f) Guidelines regarding the