; or (2) under a contract awarded pursuant to a solicitation issued not less than 180 days after the date of enactment of this Act. (b) Exemptions (1) Automatic This Act shall not apply to classified source code or source code developed primarily for use in a national security system, as defined in section 11103 of title 40, United States Code. (2) Explanation required (A) In general The Chief Information Officer of an agency may exempt from the requirements of this Act any source code for which a limited exemption described in subparagraph (B) applies, after documenting the limited exemption and providing to the Federal Chief Information Officer a brief narrative justification, with redactions as appropriate. (B) Limited exemptions The limited exemptions described in this subparagraph are the following: (i) The sharing or discovery of the source code is restricted by Federal law or regulation, including the Export Administration Regulations, the International Traffic in Arms Regulations, regulations of the Transportation Security Administration relating to the protection of Sensitive Security Information, and the Federal laws and regulations governing classified information. (ii) The sharing or discovery of the source code would create an identifiable risk to individual privacy. 6. Guidance The Director of the Office of Management and Budget shall issue guidance, consistent with the purpose of this Act, that establishes best practices and uniform procedures across agencies under section 4(d). 7. GAO report on information technology practices (a) Initial report Not later than 1 year after the date of enactment of this Act, the Comptroller General of the United States shall submit to Congress a report that includes an assessment of— (1) duplicative software procurement across and within agencies, including estimates of the frequency, severity, and dollar value of the duplicative software procurement