H. R. 2029—724 of the location from which the Secretary or a private entity providing assistance to the Secretary under paragraph (2) accesses such information, notwithstanding any other provision of law that would otherwise restrict or prevent the head of an agency from disclosing such information to the Secretary or a private entity providing assistance to the Secretary under paragraph (2); ‘‘(2) may enter into contracts or other agreements with, or otherwise request and obtain the assistance of, private entities to deploy, operate, and maintain technologies in accordance with subsection (b); ‘‘(3) may retain, use, and disclose information obtained through the conduct of activities authorized under this section only to protect information and information systems from cybersecurity risks; ‘‘(4) shall regularly assess through operational test and evaluation in real world or simulated environments available advanced protective technologies to improve detection and prevention capabilities, including commercial and noncommercial technologies and detection technologies beyond signaturebased detection, and acquire, test, and deploy such technologies when appropriate; ‘‘(5) shall establish a pilot through which the Secretary may acquire, test, and deploy, as rapidly as possible, technologies described in paragraph (4); and ‘‘(6) shall periodically update the privacy impact assessment required under section 208(b) of the E-Government Act of 2002 (44 U.S.C. 3501 note). ‘‘(d) PRINCIPLES.—In carrying out subsection (b), the Secretary shall ensure that— ‘‘(1) activities carried out under this section are reasonably necessary for the purpose of protecting agency information and agency information systems from a cybersecurity risk; ‘‘(2) information accessed by the Secretary will be retained no longer than reasonably necessary for the purpose of protecting agency information and agency information systems from a cybersecurity risk; ‘‘(3) notice has been provided to users of an agency information system concerning access to communications of users of the agency information system for the purpose of protecting agency information and the agency information system; and ‘‘(4) the activities are implemented pursuant to policies and procedures governing the operation of the intrusion detection and prevention capabilities. ‘‘(e) PRIVATE ENTITIES.— ‘‘(1) CONDITIONS.—A private entity described in subsection (c)(2) may not— ‘‘(A) disclose any network traffic transiting or traveling to or from an agency information system to any entity other than the Department or the agency that disclosed the information under subsection (c)(1), including personal information of a specific individual or information that identifies a specific individual not directly related to a cybersecurity risk; or ‘‘(B) use any network traffic transiting or traveling to or from an agency information system to which the private entity gains access in accordance with this section