; and (12) may remove the certification of a covered product as a covered product certified under the Cyber Shield program if the manufacturer of the certified covered product falls out of conformity with the benchmarks established under paragraph (1) for the covered product, as determined by the Secretary. (d) Deadlines Not later than 2 years after the date of enactment of this Act, the Secretary shall establish cybersecurity and data security benchmarks for covered products under subsection (c)(1), which shall take effect not later than 60 days after the date on which the Secretary establishes the cybersecurity and data security benchmarks. (e) Administration The Secretary, in consultation with the Advisory Committee, may enter into a contract with a third party to administer the Cyber Shield program if— (1) the third party is an impartial administrator; and (2) entering into the contract improves the cybersecurity and data security of covered products. (f) Program evaluation (1) In general Not later than 3 years after the date on which the Secretary establishes cybersecurity and data security benchmarks for covered products under subsection (c)(1), and not less frequently than every 3 years thereafter, the Inspector General of the Department of Commerce shall— (A) evaluate the Cyber Shield program; and (B) submit a report on the results of the evaluation carried out under subparagraph (A) to— (i) the Committee on Commerce, Science, and Transportation of the Senate; and (ii) the Committee on Energy and Commerce of the House of Representatives. (2) Requirements In conducting an evaluation under paragraph (1)(A), the Inspector General of the Department of Commerce shall— (A) with respect to the cybersecurity and data security benchmarks established under subsection (c)(1)— (i) evaluate the extent to which the cybersecurity and data security benchmarks address cybersecurity and data security threats