; and (B) submit to the congressional defense committees— (i) a report on the results of the study; and (ii) a recommendation with respect to whether the pilot program should be modified. (7) Sunset The authority to conduct the pilot program shall terminate on the date that is four years after the date on which the pilot program commences. 1537. Requirements for implementation of user activity monitoring for certain personnel (a) In general The Secretary of Defense shall require each head of a component of the Department of Defense to fully implement each directive, policy, and program requirement for user activity monitoring and least privilege access controls with respect to the personnel of that component, including Federal employees and contractors, granted access to classified information and classified networks, including the following directives (and any successor directives): (1) The Committee on National Security Systems Directive 504, issued on February 4, 2014, relating to the protection of national security systems from insider threats (including any annex to such directive). (2) Department of Defense Directive 5205.16, issued on September 30, 2014, relating to the insider threat program of the Department of Defense. (b) Additional requirement The Secretary of Defense shall require each head of a component of the Department of Defense to implement, with respect to systems, devices, and personnel of the component, automated controls to detect and prohibit privileged user accounts from performing general user activities not requiring privileged access. (c) Periodic testing The Secretary shall require that, not less frequently than once every two years, each head of a component of the Department of Defense— (1) conducts insider threat testing using threat-realistic tactics, techniques, and procedures