; Public Law 116–207 ). (2) Revisions Not later than 60 days after the date on which the review required under subsection (a) is completed, the Secretary shall revise the DFARS as necessary to incorporate requirements for covered contractors to receive information about a potential security vulnerability relating to an information system owned or controlled by a contractor. (3) Elements The Secretary shall ensure that the revision to the DFARS described in this subsection is carried out in accordance with the requirements of paragraphs (1), (2), and (3) of subsection (c). (4) Waiver The Chief Information Officer of the Department of Defense may waive the security vulnerability disclosure requirements under paragraph (2) if the Chief Information Officer determines that the waiver is necessary in the interest of national security or research purposes. (f) Definitions In this section: (1) Covered contractor The term covered contractor means a contractor (as defined in section 7101 of title 41, United States Code) whose contract is in an amount the same as or greater than the simplified acquisition threshold. (2) DFARS The term DFARS means the Department of Defense Supplement to the Federal Acquisition Regulation. (3) Executive department The term Executive department has the meaning given that term in section 101 of title 5, United States Code. (4) FAR The term FAR means the Federal Acquisition Regulation. (5) NIST The term NIST means the National Institute of Standards and Technology. (6) OMB The term OMB means the Office of Management and Budget. (7) Security vulnerability The term security vulnerability has the meaning given that term in section 2200 of the Homeland Security Act of 2002 ( 6 U.S.C. 650 ). (8) Simplified acquisition threshold The term simplified acquisition threshold has the meaning given that term in section 134 of title 41, United States Code.