G:\M\17\LANGEV\LANGEV_068.XMLAMENDMENT TO RULES COMM. PRINT 117–31OFFERED BY MR. LANGEVIN OF RHODE ISLAND
Add at the end of division F the following:
1SEC. 50105. CRITICAL TECHNOLOGY SECURITY CENTERS.

2(a) CRITICAL TECHNOLOGY SECURITY CENTERS.—

3 Title III of the Homeland Security Act of 2002 (6 U.S.C.
4 181 et seq.) is amended by adding at the end the following
5 new section:
6‘‘SEC. 323. CRITICAL TECHNOLOGY SECURITY CENTERS.

7‘‘(a) ESTABLISHMENT.—Not later than 180 days

8 after the date of the enactment of this section, the Sec9 retary, acting through the Under Secretary for Science
10 and Technology, and in coordination with the Director of
11 the Cybersecurity and Infrastructure Security Agency,
12 shall award grants, contracts, or cooperative agreements
13 to covered entities for the establishment of not fewer than
14 four cybersecurity-focused Critical Technology Security
15 Centers to evaluate and test the security of devices and
16 technologies that underpin national critical functions.
17‘‘(b) INITIAL CENTERS.—With respect to the Critical

18 Technology Security Centers referred to in subsection (a),19 four of such centers shall be as follows:

g:V\F\012722\F012722.017.xml
January 27, 2022 (12:25 p.m.)
VerDate Nov 24 2008

12:25 Jan 27, 2022

Jkt 000000(830505|4)
PO 00000

Frm 00001

Fmt 6652

Sfmt 6201

C:\USERS\MAECKSTEIN\APPDATA\ROAMING\SOFTQUAD\XMETAL\11.0\GEN\C\LANGEVG:\M\17\LANGEV\LANGEV_068.XML21‘‘(1) The Center for Network Technology Secu-

2rity, to study the security of information and com-

3

munications technology that underpins national crit-

4

ical functions related to communications.

5‘‘(2) The Center for Connected Industrial Con-

6trol System Security, to study the security of con-7

nected programmable data logic controllers, super-

8

visory control and data acquisition servers, and9other networked industrial equipment.

10‘‘(3) The Center for Open Source Software Se-

11curity, to study vulnerabilities in open source soft-

12

ware used to support national critical functions.

13‘‘(4) The Center for Federal Critical Software

14

Security, to study the security of software used by15

the Federal Government that performs functions

16

critical to trust (such as affording or requiring ele-

17

vated system privileges or direct access to net-18

working and computing resources).

19‘‘(c) ADDITIONAL CENTERS.—The Under Secretary

20 may, in coordination with the Director, award grants, con21 tracts, or cooperative agreements to covered entities for
22 the establishment of additional Critical Technology Secu23 rity Centers to address technologies vital to national crit24 ical functions.

g:V\F\012722\F012722.017.xml
January 27, 2022 (12:25 p.m.)
VerDate Nov 24 2008

12:25 Jan 27, 2022

Jkt 000000(830505|4)
PO 00000

Frm 00002

Fmt 6652

Sfmt 6201

C:\USERS\MAECKSTEIN\APPDATA\ROAMING\SOFTQUAD\XMETAL\11.0\GEN\C\LANGEVG:\M\17\LANGEV\LANGEV_068.XML

31‘‘(d) SELECTION OF CRITICAL TECHNOLOGIES.—Be-2 fore awarding a grant, contract, or cooperative agreement
3 to a covered entity to establish a Critical Technology Secu4 rity Center, the Under Secretary shall consult with the5 Director, who shall provide the Under Secretary a list of
6 technologies within the remit of the center that support
7 national critical functions.
8‘‘(e) RESPONSIBILITIES.—In studying the security of

9 technologies within its remit, each center shall have the10 following responsibilities:11‘‘(1) Conducting rigorous security testing to12

identify vulnerabilities in such technologies.

13‘‘(2) Reporting new vulnerabilities found and14

the tools, techniques, and practices used to uncover15

such vulnerabilities to the developers of such tech-16

nologies in question and to the Cybersecurity and17

Infrastructure Security Agency.

18‘‘(3) With respect to such technologies, devel-

19

oping new capabilities for vulnerability discovery,

20

management, and mitigation.

21‘‘(4) Assessing the security of software essential

22

to national critical functions.

23‘‘(5) Supporting existing communities of inter-24

est, including by granting funds, in remediating

25

vulnerabilities discovered within such technologies.

g:V\F\012722\F012722.017.xml
January 27, 2022 (12:25 p.m.)
VerDate Nov 24 2008

12:25 Jan 27, 2022

Jkt 000000(830505|4)
PO 00000

Frm 00003

Fmt 6652

Sfmt 6201

C:\USERS\MAECKSTEIN\APPDATA\ROAMING\SOFTQUAD\XMETAL\11.0\GEN\C\LANGEVG:\M\17\LANGEV\LANGEV_068.XML41‘‘(6) Utilizing findings to inform and support2

the future work of the Cybersecurity and Infrastruc-3

ture Security Agency.

4‘‘(f) APPLICATION.—To be eligible for an award of

5 a grant, contract, or cooperative agreement as a Critical
6 Technology Security Center pursuant to subsection (a), a
7 covered entity shall submit to the Secretary an application
8 at such time, in such manner, and including such informa9 tion as the Secretary may require.
10‘‘(g) PUBLIC REPORTING OF VULNERABILITIES.—

11 The Undersecretary shall ensure that vulnerabilities iden12 tified by a Critical Technology Security Center are pub13 licly reported through the National Vulnerability Data14 base, as appropriate.
15‘‘(h) ADDITIONAL GUIDANCE.—The Under Sec-

16 retary, in coordination with the Director, shall develop,
17 and periodically update, guidance, including eligibility and
18 any additional requirements, for how Critical Technology
19 Security Centers may award funds to communities of in20 terest to remediate vulnerabilities under subsection (e)(5).
21‘‘(i) BIANNUAL REPORTS.—Not later than one year

22 after the date of the enactment of this section and every
23 two years thereafter, the Under Secretary shall submit to24 the appropriate congressional committees a report that in-g:V\F\012722\F012722.017.xml
January 27, 2022 (12:25 p.m.)
VerDate Nov 24 2008

12:25 Jan 27, 2022

Jkt 000000(830505|4)
PO 00000

Frm 00004

Fmt 6652

Sfmt 6201

C:\USERS\MAECKSTEIN\APPDATA\ROAMING\SOFTQUAD\XMETAL\11.0\GEN\C\LANGEVG:\M\17\LANGEV\LANGEV_068.XML

5
1 cludes, with respect to each Critical Technology Security
2 Center the following:3‘‘(1) A summary of the work performed by each

4such center.

5‘‘(2) Information relating to the allocation of6

Federal funds at each such center.

7‘‘(3) A description of each vulnerability identi-8fied, including information relating to the cor-9

responding software weakness.

10‘‘(4) An assessment of the criticality of each11

vulnerability identified pursuant to paragraph (3).

12‘‘(5) A list of critical technologies studied by

13each center, including an explanation by the Under

14

Secretary for any deviations from the list of tech-15

nologies provided by the Director before the distribu-

16

tion of funding to the center.

17‘‘(6) A list of tools, techniques, and procedures

18

used by each such center.

19‘‘(j) CONSULTATION WITH RELEVANT AGENCIES.—20 In carrying out this section, the Under Secretary shall
21 consult with the heads of other Federal agencies con22 ducting cybersecurity research, including the following:23‘‘(1) The National Institute of Standards and24Technology.

25‘‘(2) The National Science Foundation.

g:V\F\012722\F012722.017.xml
January 27, 2022 (12:25 p.m.)
VerDate Nov 24 2008

12:25 Jan 27, 2022

Jkt 000000(830505|4)
PO 00000

Frm 00005

Fmt 6652

Sfmt 6201

C:\USERS\MAECKSTEIN\APPDATA\ROAMING\SOFTQUAD\XMETAL\11.0\GEN\C\LANGEVG:\M\17\LANGEV\LANGEV_068.XML61‘‘(3) Relevant agencies within the Department

2of Energy.

3‘‘(4) Relevant agencies within the Department

4of Defense.

5‘‘(k) AUTHORIZATION OF APPROPRIATIONS.—There

6 are authorized to be appropriated to carry out this sec7 tion—8‘‘(1) $40,000,000 for fiscal year 2022;9‘‘(2) $42,000,000 for fiscal year 2023;

10‘‘(3) $44,000,000 for fiscal year 2024;11‘‘(4) $46,000,000 for fiscal year 2025; and12‘‘(5) $49,000,000 for fiscal year 2026.

13‘‘(l) DEFINITIONS.—In this section:14‘‘(1) APPROPRIATE

15TEES.—The16mittees’ means—

17term ‘appropriate congressional com-‘‘(A) the Committee on Homeland Security

18of the House of Representatives; and19‘‘(B) the Committee on Homeland Security

20

and Governmental Affairs of the Senate.

21‘‘(2) COVERED ENTITY.—The term ‘covered en-22

tity’ means a university or federally funded research23

and development center, including a national labora-

24

tory, or a consortia thereof.

g:V\F\012722\F012722.017.xml
January 27, 2022 (12:25 p.m.)
VerDate Nov 24 2008

CONGRESSIONAL COMMIT-

12:25 Jan 27, 2022

Jkt 000000(830505|4)
PO 00000

Frm 00006

Fmt 6652

Sfmt 6201

C:\USERS\MAECKSTEIN\APPDATA\ROAMING\SOFTQUAD\XMETAL\11.0\GEN\C\LANGEVG:\M\17\LANGEV\LANGEV_068.XML71‘‘(3) CRITICAL TECHNOLOGY.—The term ‘crit-2

ical technology’ means technology relating to a na-

3tional critical function.

4‘‘(4) OPEN

SOURCESOFTWARE.—Theterm

5‘open source software’ means software for which the6human-readable source code is freely available for

7use, study, re-use, modification, enhancement, and8

redistribution by the users of such software.’’.

9(b) IDENTIFICATION OF CERTAIN TECHNOLOGY.—

10 Paragraph (1) of section 2202(e) of the Homeland Secu11 rity Act of 2002 (6 U.S.C. 603(e)) is amended by adding
12 at the end the following new subparagraph:13‘‘(S) To identify the technologies within14

the remits of the Critical Technology Security

15

centers as described in section 322 that are

16

vital to national critical functions.’’.

17(c) CLERICAL AMENDMENT.—The table of contents

18 in section 1(b) of the Homeland Security Act of 2002 is19 amended by inserting after the item relating to section
20 321 the following new item:‘‘Sec. 323. Critical Technology Security Centers.’’.

◊g:V\F\012722\F012722.017.xml
January 27, 2022 (12:25 p.m.)
VerDate Nov 24 2008

12:25 Jan 27, 2022

Jkt 000000(830505|4)
PO 00000

Frm 00007

Fmt 6652

Sfmt 6301

C:\USERS\MAECKSTEIN\APPDATA\ROAMING\SOFTQUAD\XMETAL\11.0\GEN\C\LANGEV