; or (B) has not implemented a binding operational directive. (n) Review of Office of Management and Budget guidance and policy (1) Conduct of review Not less frequently than once every 3 years, the Director of the Office of Management and Budget shall review the efficacy of the guidance and policy promulgated by the Director in reducing cybersecurity risks, including a consideration of reporting and compliance burden on agencies. (2) Congressional notification The Director of the Office of Management and Budget shall notify the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Accountability of the House of Representatives of changes to guidance or policy resulting from the review under paragraph (1). (3) GAO review The Government Accountability Office shall review guidance and policy promulgated by the Director to assess its efficacy in risk reduction and burden on agencies. (o) Automated standard implementation verification When the Director of the National Institute of Standards and Technology issues a proposed standard or guideline pursuant to paragraphs (2) or (3) of section 20(a) of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g–3(a) ), the Director of the National Institute of Standards and Technology shall consider developing and, if appropriate and practical, develop specifications to enable the automated verification of the implementation of the controls. (p) Inspectors general access to federal risk assessments The Director of the Cybersecurity and Infrastructure Security Agency shall, upon request, make available Federal risk assessment information under subsection (i) to the Inspector General of the Department of Homeland Security and the inspector general of any agency that was included in the Federal risk assessment. ; (3) in section 3554— (A) in subsection (a)— (i) in paragraph (1)— (I) by redesignating subparagraphs (A), (B), and (C) as subparagraphs (B), (C), and (D), respectively