; (V) by inserting after clause (ii) the following: (iii) manage information security, cybersecurity budgets, and risk and compliance activities and explain those concepts to the head of the agency and the executive team of the agency; ; and (VI) in clause (iv), as so redesignated, by striking information security duties as that official's primary duty and inserting information, computer network, and technology security duties as the Chief Information Security Officers' primary duty ; (iv) in paragraph (5), by striking annually and inserting not less frequently than quarterly ; and (v) in paragraph (6), by striking official delegated and inserting Chief Information Security Officer delegated ; (B) in subsection (b)— (i) by striking paragraph (1) and inserting the following: (1) the ongoing and continuous assessment of agency system risk required under subsection (a)(1)(A), which may include using guidance and automated tools consistent with standards and guidelines promulgated under section 11331 of title 40, as applicable; ; (ii) in paragraph (2)— (I) by striking subparagraph (B); (II) by redesignating subparagraphs (C) and (D) as subparagraphs (B) and (C), respectively; (III) in subparagraph (B), as so redesignated, by striking and at the end; and (IV) in subparagraph (C), as so redesignated— (aa) by redesignating clauses (iii) and (iv) as clauses (iv) and (v), respectively; (bb) by inserting after clause (ii) the following: (iii) binding operational directives and emergency directives issued by the Secretary under section 3553; ; and (cc) in clause (iv), as so redesignated, by striking as determined by the agency; and and inserting “as determined by the agency, considering the agency risk assessment required under subsection (a)(1)(A); (iii) in paragraph (5)(A), by inserting , including penetration testing, as appropriate, after shall include testing ; (iv) by redesignating paragraphs (7) and (8) as paragraphs (8) and (9), respectively