; and (iv) any other requirement the Director determines to be appropriate; (B) require contractors to provide written attestation that the device meets such requirements as established under subparagraph (A); (C) to the maximum extent practicable, ensure that the requirements established under subparagraph (A) are— (i) tailored to address the characteristics of different types of devices, including risk and intended function; (ii) based on technology-neutral, outcome-based security principles; (iii) developed through a transparent process that incorporates input from relevant stakeholders in industry and academia; (iv) aligned with internationally recognized technical standards; and (v) updated regularly based on developments in technology and security methodologies; (D) an identification of contractor responsibilities to ensure that a covered device software or firmware component is updated or replaced, consistent with other provisions in the contract governing the term of support, in a manner that allows for any future security vulnerability or defect in any part of the software or firmware to be patched, based on risk, in order to fix or remove a vulnerability or defect in the software or firmware component in a properly authenticated and secure manner; and (E) a requirement for the contractor to provide the purchasing agency with general information on the ability of the device to be updated, such as— (i) the manner in which the device receives security updates; (ii) the business terms, including any fees for ongoing security support, under which security updates will be provided for a covered device; (iii) the anticipated timeline for ending security support associated with the covered device; (iv) formal notification when security support has ceased