; (2) identifies non-Federal best practices used by large entity operations centers and entities providing operation centers as a service; and (3) includes recommendations for the Cybersecurity and Infrastructure Security Agency and any other relevant agency to improve the efficiency and effectiveness of security operations centers shared service offerings. 18. Federal cybersecurity requirements (a) Codifying Federal cybersecurity requirements in title 44 (1) Amendment to Federal Cybersecurity Enhancement Act of 2015 Section 225 of the Federal Cybersecurity Enhancement Act of 2015 ( 6 U.S.C. 1523 ) is amended by striking subsections (b) and (c). (2) Title 44 Section 3554 of title 44, United States Code, as amended by this Act, is further amended by adding at the end the following: (f) Specific cybersecurity requirements at agencies (1) In general Consistent with policies, standards, guidelines, and directives on information security under this subchapter, and except as provided under paragraph (3), the head of each agency shall— (A) identify sensitive and mission critical data stored by the agency consistent with the inventory required under section 3505(c); (B) assess access controls to the data described in subparagraph (A), the need for readily accessible storage of the data, and the need of individuals to access the data; (C) encrypt or otherwise render indecipherable to unauthorized users the data described in subparagraph (A) that is stored on or transiting agency information systems; (D) implement a single sign-on trusted identity platform for individuals accessing each public website of the agency that requires user authentication, as developed by the Administrator of General Services in collaboration with the Secretary; and (E) implement identity management consistent with section 504 of the Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7464 ), including multi-factor authentication, for— (i) remote access to a information system