; (B) national security systems; or (C) a procured internet of things device described in subsection (f)(2)(B) that the Chief Information Officer of an agency determines is— (i) necessary for research purposes; or (ii) secured using alternative and effective methods appropriate to the function of the internet of things device. . (b) Report on exemptions Section 3554(c)(1) of title 44, United States Code, as amended by this Act, is further amended— (1) in subparagraph (C), by striking and at the end; (2) in subparagraph (D), by striking the period at the end and inserting ; and ; and (3) by adding at the end the following: (E) with respect to any exemption from the requirements of subsection (f)(3) that is effective on the date of submission of the report, the number of information systems that have received an exemption from those requirements. . (c) Duration of certification effective date Paragraph (3) of section 3554(f) of title 44, United States Code, as added by this Act, shall take effect on the date that is 1 year after the date of enactment of this Act. (d) Federal Cybersecurity Enhancement Act of 2015 update Section 222(3)(B) of the Federal Cybersecurity Enhancement Act of 2015 ( 6 U.S.C. 1521(3)(B) ) is amended by inserting and the Committee on Oversight and Accountability before of the House of Representatives. 19. Federal Chief Information Security Officer (a) Amendment Chapter 36 of title 44, United States Code, is amended by adding at the end the following: 3617. Federal Chief Information Security Officer (a) Establishment There is established a Federal Chief Information Security Officer, who shall serve in— (1) the Office of the Federal Chief Information Officer of the Office of Management and Budget