; and (2) an identification of the resources necessary for such implementation, including for implementing the phase of the modernization program specified in subsection (b)(2)(C). 1516. Establishment of certain identity, credential, and access management activities as program of record (a) Establishment of program of record (1) Program of record Except as provided in subsection (b), not later than 120 days after the date of the enactment of this Act, the Secretary of Defense shall establish a program of record, governed by standard Department of Defense requirements and practices, and transition all covered activities to such program of record. (2) Objectives The program of record under subsection (a) shall include, at a minimum, covered activities undertaken to achieve the following objectives: (A) Correcting weaknesses in authentication and credentialing security, including with respect to the program of the Department of Defense known as the Public Key Infrastructure program (or any successor program), identified by the Director of Operational Test and Evaluation in a report submitted to Congress in April, 2023, titled FY14–21 Observations of the Compromise of Cyber Credentials . (B) Implementing improved authentication technologies, such as biometric and behavioral authentication techniques and other non-password-based solutions. (3) Briefing Not later than 150 days after the date of the enactment of this Act, the Secretary of Defense shall provide to the congressional defense committees a briefing on the covered activities to be included under the program of record under subsection (a). (b) Waiver authority (1) Authority The Secretary of Defense may waive the requirement under subsection (a) if the Secretary of Defense determines that the objectives listed in paragraph (2) of such subsection would be better achieved, and the level of rigor of the operational testing and oversight requirements applicable to such objectives would be improved, through a management approach other than the establishment of a