; and (II) whether the standards described in subclause (I) provide appropriate security and is aligned with the guidelines issued under this subsection. (C) Existing agency security evaluation standards (i) In general If an executive agency employs a security evaluation process or criteria for Internet-connected devices that the agency believes provides an equivalent or greater level of security to that described in paragraph (1)(A), an executive agency may, upon the approval of the Director, continue to use that process or standard in lieu of the requirements under paragraph (1). (ii) NIST NIST, in coordination with the Director and other appropriate executive agencies, shall determine whether the process or criteria described in clause (i) provides appropriate security and are aligned with the guidelines issued under this subsection. (3) Report to Congress Not later than 5 years after the date of enactment of this Act, the Director shall submit to Congress a report on the effectiveness of the guidelines required to be issued under paragraph (1), which shall include recommendations for legislative language needed to update the guideline requirements described in paragraph (1). (4) Waiver authority Beginning on the date that is 5 years after the date of enactment of this Act, the Director may waive, in whole or in part, the requirements of the guidelines issued under this subsection, for an executive agency. (b) Guidelines regarding the coordinated disclosure of security vulnerabilities and defects (1) In general Not later than 60 days after the date of the enactment of this Act, the National Protection and Programs Directorate, in consultation with cybersecurity researchers and private-sector industry experts, shall issue guidelines for each agency with respect to any Internet-connected device in use by the United States Government regarding cybersecurity coordinated disclosure requirements that shall be required of contractors providing such software devices to the United States Government. (2) Contents The