The Director may collect charges for evaluating, certifying, or validating information assurance products under the National Information Assurance Program or successor program.

The charges collected under subsection (a) shall be established through a public rulemaking process in accordance with Office of Management and Budget Circular No. A–25.

Charges collected under subsection (a) shall not exceed the direct costs of the program referred to in that subsection.

The appropriation or fund bearing the cost of the service for which charges are collected under the program referred to in subsection (a) may be reimbursed, or the Director may require advance payment subject to such adjustment on completion of the work as may be agreed upon.

Amounts collected under this section shall be credited to the account or accounts from which costs associated with such amounts have been or will be incurred, to reimburse or offset the direct costs of the program referred to in subsection (a).