; and (B) shall be met in order for an executive agency to purchase such a non-compliant device. (2) Requirements In defining the set of conditions that must be met for non-compliant devices required under paragraph (1), the Director, in consultation with NIST and relevant industry entities, may consider the use of conditions, including— (A) network segmentation or micro-segmentation; (B) the adoption of system level security controls, including operating system containers and microservices; (C) multi-factor authentication