; Public Law 117–328 ) at the time of the briefing required under subsection (a)(1); and (2) as a component of the briefing required under paragraph (1), an update to the list required under subsection (a)(2). 9. Data and logging retention for incident response (a) Guidance Not later than 2 years after the date of enactment of this Act the Director, in consultation with the National Cyber Director and the Director of the Cybersecurity and Infrastructure Security Agency, shall update guidance to agencies regarding requirements for logging, log retention, log management, sharing of log data with other appropriate agencies, or any other logging activity determined to be appropriate by the Director. (b) National security systems The Secretary of Defense shall issue guidance that meets or exceeds the standards required in guidance issued under subsection (a) for National Security Systems. 10. CISA agency liaisons (a) In general Not later than 120 days after the date of enactment of this Act, the Director of the Cybersecurity and Infrastructure Security Agency shall assign not less than 1 cybersecurity professional employed by the Cybersecurity and Infrastructure Security Agency to be the Cybersecurity and Infrastructure Security Agency liaison to the Chief Information Security Officer of each agency. (b) Qualifications Each liaison assigned under subsection (a) shall have knowledge of— (1) cybersecurity threats facing agencies, including any specific threats to the assigned agency; (2) risk assessments of agency systems; and (3) other Federal cybersecurity initiatives. (c) Duties The duties of each liaison assigned under subsection (a) shall include— (1) providing, as requested, assistance and advice to the agency Chief Information Security Officer; (2) supporting, as requested, incident response coordination between the assigned agency and the Cybersecurity and Infrastructure Security Agency; (3) becoming familiar with assigned agency systems, processes, and procedures to better facilitate support to the agency