on the date that is 5 years after the date of the enactment of this Act, the Director may waive, in whole or in part, the requirements of the guidelines or set of conditions issued under this section, for an executive agency. (f) Guidelines regarding the coordinated disclosure of security vulnerabilities and defects (1) In general Not later than 180 days after the date of the enactment of this Act, the Director, in consultation with the Department of Homeland Security and the Department of Justice, and cybersecurity researchers and private-sector industry experts, shall issue guidelines for each executive agency with respect to any covered device in use by the United States Government regarding cybersecurity coordinated disclosure requirements that shall be required of contractors providing such covered devices to those executive agencies. (2) Contents The guidelines required under paragraph (1) shall include policies and procedures for the processing and resolving of potential vulnerability information relating to a covered device, which shall be, to the maximum extent practicable, aligned with Standards 29147 and 30111 of the International Standards Organization, or any successor standard, such as— (A) procedures for the provision of a covered device to executive agencies by a contractor on how to— (i) receive information about potential vulnerabilities in the product or online service of the contractor