; and (B) with respect to the following considerations for unmanned aircraft systems: (i) Secure Development. (ii) Identity management. (iii) Patch management. (iv) Configuration management. (v) Supply chain security. (vi) Corporate cyber hygiene. (vii) Software and hardware transparency. (4) Considering relevant guidelines In developing the guidelines under paragraph (1), the Under Secretary shall consider relevant standards, guidelines, and best practices developed by the private sector, agencies, and public-private partnerships, including the following: (A) National Institute of Standards and Technology Special Publication 800–213 (relating to IoT device cybersecurity guidance for the Federal Government). (B) National Institute of Standards and Technology Special Publication 800–37 (relating to risk management framework for information systems and organizations). (C) The Green UAS Frameworks of the Association for Uncrewed Vehicle Systems International (AUVSI), as amended and extended. (D) The Cross-Sector Cybersecurity Performance Goals of The Cybersecurity and Infrastructure Security Agency. (5) Consultation In developing the guidelines required by paragraph (1), the Under Secretary shall consult with the Administrator of the Federal Aviation Administration, the Attorney General, and the heads of such other departments and agencies of the Federal Government as the Under Secretary considers appropriate. (b) Review of Federal agency information security policies and principles (1) Requirement (A) In general Not later than 1 year after the date on which the Under Secretary completes the development of the guidelines required under subsection (a), the Director shall require not less than 1 agency, on a pilot basis, to implement policies and principles based on the guidelines with respect to unmanned aircraft systems owned or controlled by the agency. (B) Exception A pilot implementation under subparagraph (A) shall not apply to any unmanned aircraft system comprised of any national security system. (2) Policies