shall take effect on the date that is 90 days after the date of the enactment of this Act. 3. Risk assessments for information technology made available to other agencies (a) In general Not later than one year after the date of the enactment of this Act, the head of any executive agency that makes information technology available for procurement by other executive agencies shall— (1) identify information technology products made available to other agencies that pose the greatest risk to national security or the public interest