; and (2) to the Director of National Intelligence in the case of systems described in section 3553(e)(3). (i) Revision of Federal acquisition regulation The Federal Acquisition Regulation shall be revised as necessary to implement the provisions under this section. . (b) Clerical amendment The table of sections for chapter 35 of title 44, United States Code, is amended by adding after the item relating to section 3559A, as added by this Act, the following: 3559B. Federal vulnerability disclosure policies. . (c) Conforming update and repeal (1) Guidelines on the disclosure process for security vulnerabilities relating to information systems, including internet of things devices Section 5 of the IoT Cybersecurity Improvement Act of 2020 ( 15 U.S.C. 278g–3c ) is amended by striking subsections (d) and (e). (2) Implementation and contractor compliance The IoT Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3a et seq.) is amended— (A) by striking section 6 ( 15 U.S.C. 278g–3d ); and (B) by striking section 7 ( 15 U.S.C. 278g–3e ). 13. Implementing zero trust architecture (a) Briefings Not later than 1 year after the date of enactment of this Act, the Director shall provide to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committees on Oversight and Accountability and Homeland Security of the House of Representatives a briefing on progress in increasing the internal defenses of agency systems, including— (1) shifting away from trusted networks to implement security controls based on a presumption of compromise, including through the transition to zero trust architecture; (2) implementing principles of least privilege in administering information security programs; (3) limiting the ability of entities that cause incidents to move laterally through or between agency systems; (4) identifying incidents quickly; (5) isolating and removing unauthorized entities from agency systems as quickly as practicable, accounting for intelligence or law enforcement purposes