; (2) develop tools, processes, and other mechanisms determined appropriate to offer agencies capabilities to implement the requirements of this section; and (3) upon request by an agency, assist the agency in the disclosure to vendors of newly identified security vulnerabilities in vendor products and services. 5. Contractor compliance with coordinated disclosure of security vulnerabilities relating to agency unmanned aircraft systems (a) Prohibition on procurement and use (1) In general Subject to paragraph (2), the head of an agency may not procure or obtain, renew a contract to procure or obtain, or use an unmanned aircraft system if the Chief Information Officer of the agency determines, in conducting the review required under section 11319(b)(1)(C) of title 40, United States Code, of the contract for the unmanned aircraft system, that the use of the unmanned aircraft system prevents compliance with the standards and guidelines developed under section 3(a)(1) of this Act or the guidelines issued under section 4(a)(1) of this Act with respect to the unmanned aircraft system. (2) Exemption for commercial data buys Paragraph (1) shall not apply when the head of an agency acquires data— (A) solely from a commercial or nonprofit entity, the contract or agreement for which does not specify the type of unmanned aircraft system or the specifications for the unmanned aircraft system; (B) that will never connect to any network of the Federal Government