; and (E) implement identity management consistent with section 504 of the Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7464 ), including multi-factor authentication, for— (i) remote access to an information system; and (ii) each user account with elevated privileges on an information system. (2) Prohibition (A) Definition In this paragraph, the term internet of things has the meaning given the term in section 3559B. (B) Prohibition Consistent with policies, standards, guidelines, and directives on information security under this subchapter, and except as provided under paragraph (3), the head of an agency may not procure, obtain, renew a contract to procure or obtain in any amount, notwithstanding section 1905 of title 41, United States Code, or use an internet of things device if the Chief Information Officer of the agency determines during a review required under section 11319(b)(1)(C) of title 40 of a contract for an internet of things device that the use of the device prevents compliance with the standards and guidelines developed under section 4 of the IoT Cybersecurity Improvement Act ( 15 U.S.C. 278g–3b ) with respect to the device. (3) Exception The requirements under paragraph (1) shall not apply to an information system for which— (A) the head of the agency, without delegation, has certified to the Director with particularity that— (i) operational requirements articulated in the certification and related to the information system would make it excessively burdensome to implement the cybersecurity requirement; (ii) the cybersecurity requirement is not necessary to secure the information system or agency information stored on or transiting it; and (iii) the agency has taken all necessary steps to secure the information system and agency information stored on or transiting it