; and (2) through grants and cooperative agreements entered into with non-Federal entities. (b) Information security The policy developed under subsection (a) shall include the following specifications, which to the extent practicable, shall be based on industry standards and technical guidance from the National Institute of Standards and Technology, to address the risks associated with processing, storing, and transmitting Federal information in an unmanned aircraft system: (1) Protections to ensure controlled access to an unmanned aircraft system. (2) Protecting software, firmware, and hardware by ensuring changes to an unmanned aircraft system are properly managed, including by ensuring an unmanned aircraft system can be updated using a secure, controlled, and configurable mechanism. (3) Cryptographically securing sensitive collected, stored, and transmitted data, including proper handling of privacy data and other controlled unclassified information. (4) Appropriate safeguards necessary to protect sensitive information, including during and after use of an unmanned aircraft system. (5) Appropriate data security to ensure that data is not transmitted to or stored in non-approved locations. (6) The ability to opt out of the uploading, downloading, or transmitting of data that is not required by law or regulation and an ability to choose with whom and where information is shared when it is required. (c) Requirement The policy developed under subsection (a) shall reflect an appropriate risk-based approach to information security related to use of an unmanned aircraft system. (d) Revision of acquisition regulations Not later than 180 days after the date on which the policy required under subsection (a) is issued— (1) the Federal Acquisition Regulatory Council shall revise the Federal Acquisition Regulation, as necessary, to implement the policy