; and (B) incapable of being modified or revoked by the user or manufacturer lawfully operating the information system, except through a firmware update. (6) Gateway product The term gateway product means a node or device that connects to multiple networks using standard protocols. (7) Hardware The term hardware means the physical components of an information system. (8) NIST The term NIST means the National Institute of Standards and Technology. (9) Non-compliant device The term non-compliant device means a covered device that does not meet the baseline security requirements established in section 3(a)(2)(A). (10) Properly authenticated update The term properly authenticated update means an update, remediation, or technical fix to a hardware, firmware, or software component issued by a product vendor or service provider used to correct particular problems with the component, and that, in the case of software or firmware, contains some method of authenticity protection, such as a digital signature, so that unauthorized updates and rollbacks of authorized updates can be automatically detected and rejected. (11) Security vulnerability The term security vulnerability means any attribute of hardware, firmware, software, process, or procedure or a combination of 2 or more of these attributes that could enable or facilitate the defeat or compromise of the confidentiality, integrity, or availability of an information system or the information or physical devices of an information system to which an information system is connected. (12) Software The term software means a computer program and associated data that may be dynamically written or modified. (13) Vendor The term vendor , with respect to a technology, product, system, service, or application, means— (A) in the case of a purchase by the Government, the entity that developed the technology, product, system, service, or application