; (E) in subsection (g)(2)— (i) by striking this subsection shall and inserting “this subsection— (A) shall ; (ii) in subparagraph (A), as so designated, by striking the period at the end and inserting ; and ; and (iii) by adding at the end the following: (B) identify any entity that performs an independent evaluation under subsection (b). ; and (F) by striking subsection (j) and inserting the following: (j) Guidance (1) In general The Director, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, the Chief Information Officers Council, the Council of the Inspectors General on Integrity and Efficiency, and other interested parties as appropriate, shall ensure the development of risk-based guidance for evaluating the effectiveness of an information security program and practices. (2) Priorities The risk-based guidance developed under paragraph (1) shall include— (A) the identification of the most common successful threat patterns; (B) the identification of security controls that address the threat patterns described in subparagraph (A); (C) any other security risks unique to Federal systems; and (D) any other element the Director determines appropriate. ; and (5) in section 3556(a)— (A) in the matter preceding paragraph (1), by inserting within the Cybersecurity and Infrastructure Security Agency after incident center ; and (B) in paragraph (4), by striking 3554(b) and inserting 3554(a)(1)(A) . (d) Conforming amendments (1) Table of sections The table of sections for chapter 35 of title 44, United States Code, is amended by striking the item relating to section 3555 and inserting the following: 3555. Independent evaluation. . (2) OMB reports Section 226(c) of the Cybersecurity Act of 2015 ( 6 U.S.C. 1524(c) ) is amended— (A) in paragraph (1)(B), in the matter preceding clause (i), by striking annually thereafter and inserting thereafter during the years during which a report is required to be submitted under section 3553(c) of title 44, United States Code