; and (II) disseminate resolution information about vulnerabilities in the product or online service of the contractor; and (ii) guidance, including example content, on the information items that should be produced through the implementation of the vulnerability disclosure process of the contractor; and (B) require that research on the cybersecurity of an Internet-connected device provided by a contractor to the United States Government shall be conducted on the same class, model, or type of the device provided to the United States Government and not on the actual device provided to the United States Government. (c) Limitation of liability (1) Rule of construction Nothing in this subsection, or the amendments made by this subsection, shall be construed to establish additional obligations or criminal penalties for individuals engaged in researching the cybersecurity of Internet-connected devices. (2) Computer fraud and abuse act Section 1030 of title 18, United States Code, is amended— (A) in subsection (j)(2), by adding a period at the end; and (B) by adding at the end the following new subsection: (k) This section shall not apply to a person who— (1) in good faith, engaged in researching the cybersecurity of an Internet-connected device of the class, model, or type provided by a contractor to a department or agency of the United States