networks. (d) Establishing user activity monitoring behavior thresholds (1) In general The Secretary shall require each head of a Department component to implement standard triggers, alerts, and controls developed by the Under Secretary of Defense for Intelligence and Security based on insider threat behavior models approved by the Under Secretary. (2) Approval of deviations A head of a Department component that seeks to adopt a practice pursuant to paragraph (1) that deviates from standard triggers, alerts, and controls described in such paragraph by being less stringent shall submit to the Under Secretary a request for approval for such deviation along with a written justification for such deviation. (e) Periodic testing The Secretary shall require each head of a Department component, not less frequently than once every two years— (1) to conduct insider threat testing using threat-realistic tactics, techniques, and procedures