; and (ii) disseminate resolution information about vulnerabilities in the product or online service of the contractor; and (B) guidance, including example content, on the information items that should be produced through the implementation of the vulnerability disclosure process of the contractor. (g) Revision of FAR The Federal Acquisition Regulations System shall be revised to require the inclusion of a standard security clause consistent with the requirements of this section. 4. Inventory of devices (a) In general Not later than one year after the date of the enactment of this Act, the head of each executive agency shall establish and maintain an inventory of covered devices used by the agency procured under the requirements of this Act. (b) Guidelines Not later than 30 days after the date of the enactment of this Act, the Director, in consultation with the Secretary of Homeland Security, shall issue guidelines for executive agencies to develop and manage the inventories required under subsection (a), based on the Continuous Diagnostics and Mitigation program used by the Department of Homeland Security. (c) Device databases (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary of Homeland Security, in consultation with the Director shall establish and maintain— (A) a database of non-compliant devices and the manufacturers of such devices