; and (2) acted in compliance with the guidelines required to be issued by the National Protection and Programs Directorate, and adopted by the contractor described in paragraph (1), under section 3(b) of the Internet of Things (IoT) Cybersecurity Improvement Act of 2017. . (d) Inventory of devices (1) In general Not later than 180 days after the date of the enactment of this Act, the head of each executive agency shall establish and maintain an inventory of Internet-connected devices used by the agency procured under this Act. (2) Guidelines Not later than 30 days after the date of the enactment of this Act, the Director of the Office of Management and Budget, in consultation with the Secretary of Homeland Security, shall issue guidelines for executive agencies to develop and manage the inventories required under paragraph (1), based on the Continuous Diagnostics and Mitigation (CDM) program used by the Department of Homeland Security. (3) Device databases (A) In general Not later than 180 days after the date of enactment of this Act, the Director of the Office of Management and Budget shall establish and maintain— (i) a publicly accessible database of devices and the respective manufacturers of such devices for which limitations of liability exist under this Act; and (ii) a publicly accessible database of devices and the respective manufacturers of such devices about which the government has received formal notification of security support ceasing, as required under section 3(a)(1)(E)(iii). (B) Updates The Director of the Office of Management and Budget shall update the databases established under subparagraph (A) not less frequently than once every 30 days. 4. Use of best practices in identification and tracking of vulnerabilities for purposes of the national vulnerability database The Director of NIST shall ensure that NIST establishes, maintains, and uses best practices in the identification and tracking of vulnerabilities for purposes of the National Vulnerability Database of NIST.