; and (bb) any additional database selected by the Director that tracks security vulnerabilities and defects, is credible, and is similar to the National Vulnerability Database; (II) relies on software or firmware components capable of accepting properly authenticated and trusted updates from the vendor; (III) uses only non-deprecated industry-standard protocols and technologies for functions such as— (aa) communications, such as standard ports for network traffic; (bb) encryption; and (cc) interconnection with other devices or peripherals; and (IV) does not include any fixed or hard-coded credentials used for remote administration, the delivery of updates, or communication. (ii) Limited exception for disclosed vulnerabilities (I) Application for waiver At the time of submitting a proposal to an executive agency, a contractor may submit a written application for a waiver from the requirement under clause (i)(I) for the purpose of disclosing a known vulnerability to the executive agency. (II) Contents An application submitted under subclause (I) shall— (aa) identify the specific known vulnerability; (bb) include any mitigation actions that may limit or eliminate the ability for an adversary to exploit the vulnerability