; and (ii) the Director acts upon any petition submitted under clause (i) in a timely manner. (3) Security vulnerability The term security vulnerability means any attribute of hardware, firmware, software, or combination of 2 or more of these factors that could enable the compromise of the confidentiality, integrity, or availability of an information system or its information or physical devices to which it is connected. 3. National Institute of Standards and Technology considerations and recommendations regarding managing Internet of Things cybersecurity risks (a) Completion of ongoing efforts relating to considerations for managing internet of things cybersecurity risks (1) In general The Director of the National Institute of Standards and Technology shall ensure that the efforts of the Institute in effect on the date of the enactment of this Act regarding considerations for managing Internet of Things cybersecurity risks, especially regarding examples of possible cybersecurity capabilities of Internet of Things devices, are completed no later than September 30, 2019. (2) Matters addressed In ensuring efforts are completed under paragraph (1), the Director shall also ensure that such efforts address, at a minimum, the following considerations for covered devices: (A) Secure Development. (B) Identity management. (C) Patching. (D) Configuration management. (b) Development of recommended standards for use of internet of things devices by Federal Government (1) In general Not later than March 31, 2020, the Director of the Institute shall develop recommendations for the Federal Government on the appropriate use and management by the Federal Government of Internet of Things devices owned or controlled by the Federal Government, including minimum information security requirements for managing cybersecurity risks associated with such devices. (2) Consistency with ongoing efforts The Director of the Institute shall ensure that the recommendations and standards developed under paragraph (1) are consistent with the