; (bb) include any mitigation actions that may limit or eliminate the ability for an adversary to exploit the vulnerability; and (cc) include a justification for secure use of the device notwithstanding the persisting vulnerability. (III) Approval If the head of the purchasing executive agency approves the waiver, the head of the purchasing executive agency shall provide the contractor a written statement that the executive agency accepts such risks resulting from use of the device with the known vulnerability as represented by the contractor. (B) Notification required A clause that requires the contractor providing the Internet-connected device software or firmware component to notify the purchasing agency of any known security vulnerabilities or defects subsequently disclosed to the vendor by a security researcher or of which the vendor otherwise becomes aware for the duration of the contract. (C) Updates A clause that requires such Internet-connected device software or firmware component to be updated or replaced, consistent with other provisions in the contract governing the term of support, in a manner that allows for any future security vulnerability or defect in any part of the software or firmware to be patched in order to fix or remove a vulnerability or defect in the software or firmware component in a properly authenticated and secure manner. (D) Timely repair A clause that requires the contractor to provide a repair or replacement in a timely manner in respect to any new security vulnerability discovered through any of the databases described in subparagraph (A)(i)(I) or from the coordinated disclosure program described in subsection (b) in the event the vulnerability cannot be remediated through an update described in subparagraph (C). (E) Continuation of services A clause that requires the contractor to provide the purchasing agency with general information on the ability of the device to be updated, such as— (i) the manner in which the device receives security updates