; (3) becoming familiar with assigned agency systems, processes, and procedures to better facilitate support to the agency; and (4) other liaison duties to the assigned agency solely in furtherance of Federal cybersecurity or support to the assigned agency as a Sector Risk Management Agency, as assigned by the Director of the Cybersecurity and Infrastructure Security Agency in consultation with the head of the assigned agency. (d) Limitation A liaison assigned under subsection (a) shall not be a contractor. (e) Multiple assignments One individual liaison may be assigned to multiple agency Chief Information Security Officers under subsection (a). (f) Coordination of activities The Director of the Cybersecurity and Infrastructure Security Agency shall consult with the Director on the execution of the duties of the Cybersecurity and Infrastructure Security Agency liaisons to ensure that there is no inappropriate duplication of activities among— (1) Federal cybersecurity support to agencies of the Office of Management and Budget; and (2) the Cybersecurity and Infrastructure Security Agency liaison. (g) Rule of construction Nothing in this section shall be construed to impact the ability of the Director to support agency implementation of Federal cybersecurity requirements pursuant to subchapter II of chapter 35 of title 44, United States Code, as amended by this Act. 11. Federal penetration testing policy (a) In general Subchapter II of chapter 35 of title 44, United States Code, is amended by adding at the end the following: 3559A. Federal penetration testing (a) Guidance The Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, shall issue guidance to agencies that— (1) requires agencies to perform penetration testing on information systems, as appropriate, including on high value assets; (2) provides policies governing the development of— (A) rules of engagement for using penetration testing