; 15 U.S.C. 278g–3c and 278g–3d); (2) to the maximum extent practicable, be aligned with industry best practices and Standards 29147 and 30111 of the International Standards Organization (or any successor standard) or any other appropriate, relevant, and widely used standard; and (3) not apply to contractors whose contracts are in amounts not greater than the simplified acquisition threshold. (d) Waiver Consistent with section 7(b) of the IoT Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3e(b)), the Chief Information Officer of an Executive department may waive the vulnerability disclosure policy requirement under subsection (b) if the Chief Information Officer determines that the waiver is necessary in the interest of national security or research purposes. (e) Department of Defense Supplement to the Federal Acquisition Regulation (1) Review Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall review the Department of Defense Supplement to the Federal Acquisition Regulation contract requirements and language for contractor vulnerability disclosure programs and develop updates to such requirements designed to ensure that covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines for contractors as required under section 5 of the IoT Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3c