; and (2) the Director of National Intelligence in the case of a system described in section 3553(e)(3). . (b) Existing guidance (1) In general Compliance with guidance issued by the Director relating to penetration testing before the date of enactment of this Act shall be deemed to be compliance with section 3559A of title 44, United States Code, as added by this Act. (2) Immediate new guidance not required Nothing in section 3559A of title 44, United States Code, as added by this Act, shall be construed to require the Director to issue new guidance to agencies relating to penetration testing before the date described in paragraph (3). (3) Guidance updates Notwithstanding paragraphs (1) and (2), not later than 2 years after the date of enactment of this Act, the Director shall review and, as appropriate, update existing guidance requiring penetration testing by agencies. (c) Clerical amendment The table of sections for chapter 35 of title 44, United States Code, is amended by adding after the item relating to section 3559 the following: 3559A. Federal penetration testing. . (d) Penetration testing by the Secretary of Homeland Security Section 3553(b) of title 44, United States Code, as amended by this Act, is further amended by inserting after paragraph (8) the following: (9) performing penetration testing that may leverage manual expert analysis to identify threats and vulnerabilities within information systems— (A) without consent or authorization from agencies; and (B) with prior notification to the head of the agency; . 12. Vulnerability disclosure policies (a) In general Chapter 35 of title 44, United States Code, is amended by inserting after section 3559A, as added by this Act, the following: 3559B. Federal vulnerability disclosure policies (a) Purpose