; and (iii) the agency has taken all necessary steps to secure the information system and agency information stored on or transiting it; and (B) the head of the agency has submitted the certification described in subparagraph (A) to the appropriate congressional committees and the authorizing committees of the agency. (4) Duration of certification (A) In general A certification and corresponding exemption of an agency under paragraph (3) shall expire on the date that is 4 years after the date on which the head of the agency submits the certification under paragraph (3)(A). (B) Renewal Upon the expiration of a certification of an agency under paragraph (3), the head of the agency may submit an additional certification in accordance with that paragraph. (5) Rules of construction Nothing in this subsection shall be construed— (A) to alter the authority of the Secretary, the Director, or the Director of the National Institute of Standards and Technology in implementing subchapter II of this title; (B) to affect the standards or process of the National Institute of Standards and Technology; (C) to affect the requirement under section 3553(a)(4); or (D) to discourage continued improvements and advancements in the technology, standards, policies, and guidelines used to promote Federal information security. (g) Exception (1) Requirements The requirements under subsection (f)(1) shall not apply to— (A) the Department of Defense; (B) a national security system; or (C) an element of the intelligence community. (2) Prohibition The prohibition under subsection (f)(2) shall not apply to— (A) Internet of things devices that are or comprise a national security system; (B) national security systems; or (C) a procured Internet of things device described in subsection (f)(2)(B) that the Chief Information Officer of an agency determines is— (i) necessary for research purposes