; (ii) the anticipated timeline for ending security support associated with the Internet-connected device; (iii) formal notification when security support has ceased; and (iv) any additional information recommended by the National Telecommunications and Information Administration. (2) Exceptions (A) Devices with severely limited functionality (i) In general If an executive agency reasonably believes that procurement of an Internet-connected device with limited data processing and software functionality consistent with paragraph (1) would be unfeasible or economically impractical, the executive agency may petition the Director for a waiver to the requirements contained in paragraph (1) in order to purchase a non-compliant Internet-connected device. (ii) Alternate conditions to mitigate cybersecurity risks (I) In general Not later than 180 days after the date of the enactment of this Act, the Director, in close coordination with NIST, shall define a set of conditions that— (aa) ensure an Internet-connected device that does not comply with paragraph (1) can be used with a level of security that is equivalent to the level of security described in paragraph (1)(A); and (bb) shall be met in order for an executive agency to purchase such a non-compliant device. (II) Requirements In defining a set of conditions that must be met for non-compliant devices as required under subclause (I), the Director, in close coordination with NIST and relevant industry entities, may consider the use of conditions including— (aa) network segmentation or micro-segmentation; (bb) the adoption of system level security controls, including operating system containers and microservices; (cc) multi-factor authentication