; (2) this responsibility is to be carried out by working collaboratively within and among executive agencies, industry, and academia; and (3) the strength of the Government’s cybersecurity and the positive benefits of digital technology transformation depend on proactively addressing cybersecurity throughout the Government’s acquisition and operation of IoT devices. 3. Contractor minimum security requirements for covered devices (a) Standard security clause required in covered devices (1) In general Not later than 180 days after the date of the enactment of this Act, the Director in consultation with the Secretary of Defense, the Administrator of General Services, the Secretary of Commerce, the Secretary of Homeland Security, and any other intelligence or national security agency that the Director determines to be necessary shall issue guidelines for each executive agency that require the inclusion of a standard security clause in any contract (except as provided in paragraph (4)) for the acquisition of covered devices. (2) Contents of standard security clause The standard security clause required under paragraph (1) shall— (A) establish baseline security requirements that address aspects of device security relating to covered devices, including— (i) a requirement that software or firmware components accept properly authenticated and trusted updates from the vendor; (ii) requirements relating to identity and access management, including a prohibition of the use of fixed or hard-coded credentials used for remote administration, the delivery of updates, or communication; (iii) a requirement that the contractor participate in a coordinated vulnerability disclosure program training on the guidelines issued pursuant to subsection (f); and (iv) any other requirement the Director determines to be appropriate; (B) require contractors to provide written attestation that the device meets such requirements as established under subparagraph (A)