; (2) provides policies governing the development of— (A) rules of engagement for using penetration testing; and (B) procedures to use the results of penetration testing to improve the cybersecurity and risk management of the agency; (3) ensures that operational support or a shared service is available; and (4) in no manner restricts the authority of the Secretary of Homeland Security or the Director of the Cybersecurity and Infrastructure Agency to conduct threat hunting pursuant to section 3553 of title 44, United States Code, or penetration testing under this chapter. (b) Exception for national security systems The guidance issued under subsection (a) shall not apply to national security systems. (c) Delegation of authority for certain systems The authorities of the Director described in subsection (a) shall be delegated to— (1) the Secretary of Defense in the case of a system described in section 3553(e)(2)