; and (v) any other information the Director determines to be necessary. (3) Voluntary consensus standards The Director shall ensure that, to the maximum extent practicable, the baseline security described in paragraph (2)(A) reflects and aligns with existing voluntary consensus standards. (4) Waiver of requirement by agencies The Director may establish a process for the Chief Information Officer of an executive agency to waive the requirements under this subsection for a case in which a petition is submitted by an entity seeking to enter into a contract with the executive agency and the following requirements are met: (A) A waiver is granted only in limited circumstances, including when an entity demonstrates that a covered device meets a desired level of security through means other than those required under paragraph (2)(A) or when the executive agency reasonably believes that procurement of a covered device with limited data processing and software functionality would be unfeasible or economically impractical. (B) The Chief Information Officer of an executive agency that approves a waiver under this paragraph shall provide the entity a written statement that the executive agency accepts any risk resulting from use of the covered device. (5) Alignment with FISMA In issuing the guidelines required under paragraph (1), the Director, in consultation with the Administrator of General Services, shall ensure that such guidelines are, to the greatest extent practicable, consistent with, non-duplicative of, and in compliance with any applicable established information security policies, procedures, standards, and compliance requirements under the subchapter II of chapter 35 of title 44, United States Code. (b) Alternate conditions To mitigate cybersecurity risks (1) In general Not later than one year after the date of the enactment of this Act, the Director, in consultation with NIST, shall define a set of conditions that— (A) ensure a non-compliant device can be used with a level of security that is equivalent or