are implemented to detect and prevent penetrations or compromises of such information systems, including malicious intrusions by any unauthorized individual, state actor, or other entity. (d) Waiver The Secretary may waive the requirement under subsection (c) for up to 180 days if the Secretary— (1) determines that such requirement would have adverse effects on national security or the diplomatic mission of the Department