; and (2) the Director of the Office of Management and Budget shall, in consultation with the Director of the National Institute of Standards and Technology, revise such policies. 5. National Institute of Standards and Technology guidance on coordinated disclosure of security vulnerabilities relating to Internet of Things devices (a) In general Not later than 180 days after the date of the enactment of this Act, the Director of the National Institute of Standards and Technology shall, in consultation with such cybersecurity researchers and private-sector industry experts as the Director considers appropriate, publish guidance on policies and procedures for the reporting, coordinating, publishing, and receiving of information about— (1) a security vulnerability relating to a covered device used by the Federal Government; and (2) the resolution of such security vulnerability. (b) Elements The guidance published under subsection (a) shall include the following: (1) Policies and procedures described in subsection (a) that, to the maximum extent practicable, are aligned with Standards 29147 and 30111 of the International Standards Organization, or any successor standards. Such policies and procedures shall include policies and procedures for a contractor or vendor providing a covered device to the Federal Government on— (A) receiving information about a potential security vulnerability relating to the covered device