; and (2) by striking 2021 and inserting 2025 . (b) Extension on sunset Subsection (i)(1) of such section is amended by striking September 30, 2021 and inserting September 30, 2025 . 1628. Email and Internet website security and authentication (a) Implementation of plan required Except as provided by subsection (b), the Secretary of Defense shall develop and implement the plan outlined in Binding Operational Directive 18–01, issued by the Secretary of Homeland Security on October 16, 2017, relating to email security and authentication and Internet website security, according to the schedule established by the Binding Operational Directive for the rest of the Executive Branch beginning with the date of enactment of this Act. (b) Elements The actions required of the Secretary of Defense under subsection (a) include the following: (1) The adoption of the START Transport Layer Security (STARTTLS) protocol for encryption. (2) Enforcement of Sender Policy Framework (SPF), Domain Keys Identified Mail (DKIM), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) for email authentication. (3) Implementation of Hypertext Transfer Protocol Strict Transport Security (HSTS). (c) Waiver The Secretary may waive the requirements of subsection (a) if the Secretary submits to the congressional defense committees a certification that existing or planned security measures for the Department of Defense either meet or exceed the information security requirements of Binding Operational Directive 18–01. (d) Future binding operational directives The Chief Information Officer of the Department of Defense shall notify the congressional defense committees within 180 days of the issuance by the Secretary of Homeland Security after the date of the enactment of this Act of any Binding Operational Directive for cybersecurity whether the Department of Defense will comply with the Directive or how the Department of Defense plans to meet or exceed the security objectives of the Directive. 1629. Matters pertaining to the