Cybersecurity requirements

(a) In general The Director of the Administrative Office of the United States Courts shall ensure the cybersecurity of the system described under section 2 of this Act in consultation with the relevant cybersecurity expert agencies in the executive branch and consistent with the relevant cybersecurity laws (including regulations), policies, and standards that would apply if the system would be operated by an agency in the executive branch, including section 225(b)(1)(D) of the Federal Cybersecurity Enhancement Act of 2015 (6 U.S.C. 1523(b)(1)(D)). (b) Waiver The Director of the Administrative Office of the United States Courts may waive an executive branch cybersecurity requirement if— (1) the requirement would be infeasible to implement or result in the executive branch gaining access to confidential or nonpublic judicial branch information; and (2) the Director— (A) takes alternative actions to mitigate the cybersecurity risks that the requirement would address; and (B) not less frequently than annually— (i) notifies the congressional committees described in section 205(g)(2) of the E-Government Act of 2002 (44 U.S.C. 3501 note) of the nature of any exceptions and alternative actions implemented; and (ii) certifies that the intent of the requirement has been achieved through alternate means. (c) Rule of construction Nothing in this section shall require the judicial branch to provide the executive branch with privileged access to any judicial branch information system.