I 

113TH CONGRESS 

1ST SESSION H. R. 2556 

To provide for the establishment of Vertical Centers of Excellence on Cybersecurity to create solutions to, and promote best practices for, industryspecific cybersecurity challenges. 

IN THE HOUSE OF REPRESENTATIVES 

JUNE 27, 2013 

Mr. HONDA introduced the following bill; which was referred to the Committee 

on Science, Space, and Technology 

A BILL 

To provide for the establishment of Vertical Centers of Excellence on Cybersecurity to create solutions to, and promote best practices for, industry-specific cybersecurity 

challenges. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Excellence in Cyberse5 curity Act’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds the following: 


pwalker on DSK7TPTVN1PROD with BILLS
2 

•HR 2556 IH

1 (1) Cybercrime is one of the preeminent threats 

2 facing the United States today, and presents a cu3 mulative national security, economic, and individual 

4 threat unlike any before it. 

5 (2) The total global cost of cybercrime is esti6 mated to be $1,000,000,000,000 per year and rep7 resents one of the greatest transfers of wealth in the 

8 history of the world. 

9 (3) Cybercrime surveys have found that the so10 lutions to cybersecurity threats are multi-pronged 

11 and go beyond increased data sharing and threat 

12 analysis. 

13 (4) Many leaders of organizations do not know 

14 who is responsible for the cybersecurity needs of 

15 their organization or industry. These leaders also 

16 underestimate the capabilities of their adversaries in 

17 cybercrime and the strategic, financial, reputational, 

18 and regulatory risks those adversaries pose to orga19 nizations. 

20 (5) Security experts are not effectively commu21 nicating best practices to address cyberthreats, 

22 cyberattacks, and defensive technologies. 

23 (6) Cybersecurity experts believe there are 4 

24 key factors that impact the vulnerability of an orga25 nization to cybercrime: 


pwalker on DSK7TPTVN1PROD with BILLS
3 

•HR 2556 IH

1 (A) Understanding the changes to and best 

2 practices for the current threat environment. 

3 (B) Strategy and execution of a cybersecu4 rity program. 

5 (C) The identification of key assets in need 

6 of protection. 

7 (D) The ability to develop relationships 

8 with similar organizations to develop protection 

9 within the industry ecosystem. 

10 (7) It is essential that the United States 

11 prioritize the development of organizational relation12 ships and best practices of specific industries to help 

13 protect those industries against threats to cybersecu14 rity. 

15 SEC. 3. VERTICAL CENTERS OF EXCELLENCE ON CYBER16 SECURITY. 

17 (a) ESTABLISHMENT.—The Director of the National 

18 Institute of Standards and Technology shall establish 5 

19 Vertical Centers of Excellence on Cybersecurity. 

20 (b) MISSION.—Each Center shall convene experts 

21 and individuals in the industry that is the focus of the 

22 work of that Center for the purposes of— 

23 (1) identifying and analyzing existing and fu24 ture cybersecurity challenges faced by various indus25 tries; 


pwalker on DSK7TPTVN1PROD with BILLS
4 

•HR 2556 IH

1 (2) creating solutions and promoting best prac2 tices to address such challenges; and 

3 (3) collaborating with individuals in those in4 dustries to share knowledge. 

5 (c) REQUIREMENTS.—In establishing each Center 

6 under subsection (a), the Director, not later than 6 

7 months after the date of enactment of this Act, shall se8 lect— 

9 (1) a particular industry that faces cybersecuri10 ty challenges to be the focus of the work of that 

11 Center; 

12 (2) a manager to be responsible for the admin13 istrative functions of that Center; and 

14 (3) the location of that Center pursuant to sub15 section (d). 

16 (d) LOCATION REQUIREMENTS.—The Director shall 

17 seek to ensure that each Center is located a sufficient geo18 graphical distance from another Center and shall select 

19 a location for each Center based on— 

20 (1) proximity to the geographical location of a 

21 number of businesses operating in the industry se22 lected pursuant to subsection (c)(1); 

23 (2) accessibility to the experts selected pursuant 

24 to section 5; and 


pwalker on DSK7TPTVN1PROD with BILLS
5 

•HR 2556 IH

1 (3) the capacity of the facilities at the Center 

2 to convene, and promote collaboration among, ex3 perts and individuals in that industry. 

4 (e) PARTNERSHIPS.—The Director may establish 

5 partnerships with public or nonprofit entities to provide 

6 services for a Center established under subsection (a). 

7 SEC. 4. DUTIES OF CENTERS. 

8 (a) IN GENERAL.—The Director and the manager of 

9 each Center shall jointly select a group of experts, con10 sistent with the requirements in section 5, to carry out 

11 the duties described in subsection (b). 

12 (b) DUTIES OF EXPERTS.—The experts at each Cen13 ter shall— 

14 (1) identify and analyze existing and future cy15 bersecurity challenges faced by the industry selected 

16 pursuant to section 2(c)(1); 

17 (2) create solutions to those cybersecurity chal18 lenges that are cost-effective, repeatable, and scal19 able; 

20 (3) collaborate, convene discussions, and share 

21 knowledge with individuals in that industry to ac22 complish the work of the Center; and 

23 (4) create educational programs to promote 

24 best practices in cybersecurity for such individuals. 


pwalker on DSK7TPTVN1PROD with BILLS
6 

•HR 2556 IH

1 (c) REQUIREMENTS OF CENTERS.—Each Center 

2 shall— 

3 (1) work within the Cybersecurity Framework 

4 created pursuant to section 7 of Executive Order 

5 13636, entitled ‘‘Improving Critical Infrastructure 

6 Cybersecurity’’ (78 Fed. Reg. 11739); 

7 (2) collaborate with each of the other Centers 

8 to share relevant information; 

9 (3) encourage the development of relationships 

10 among individuals in the industry selected pursuant 

11 to section 2(c)(1); and 

12 (4) share the best practices and lessons learned 

13 from the work of the Center with those individuals. 

14 (d) CONFIDENTIALITY.—The Director, in consulta15 tion with individuals in the industry selected pursuant to 

16 section 2(c)(1), shall establish procedures to ensure the 

17 confidentiality of the information handled by the Centers. 

18 The Centers shall be exempt from the requirements set 

19 forth in section 552(b) of title 5, United States Code 

20 (commonly known as the Freedom of Information Act). 

21 SEC. 5. REQUIREMENTS FOR EXPERTS. 

22 (a) NUMBER AND COMPENSATION.—The Director 

23 shall determine— 

24 (1) the number of experts at each Center; and 

25 (2) the compensation for each expert selected. 


pwalker on DSK7TPTVN1PROD with BILLS
7 

•HR 2556 IH

1 (b) QUALIFICATIONS.—Experts shall have experience 

2 in government, academia, or the particular industry that 

3 is the focus of the work of the Center, and any other quali4 fications the Director may determine. 

5 SEC. 6. REPORT. 

6 Not later than 1 year after the date of enactment 

7 of this Act, the Director shall submit a report to Congress 

8 describing the cybersecurity challenges, solutions, and best 

9 practices addressed by each Center. 

10 SEC. 7. DEFINITIONS. 

11 In this Act: 

12 (1) CENTER.—The term ‘‘Center’’ means a 

13 Vertical Center of Excellence on Cybersecurity es14 tablished under section 2(a). 

15 (2) DIRECTOR.—The term ‘‘Director’’ means 

16 the Director of the National Institute of Standards 

17 and Technology. 

18 SEC. 8. AUTHORIZATION OF APPROPRIATIONS. 

19 There are authorized to be appropriated to the Direc20 tor for each of fiscal years 2014 through 2019 

21 $25,000,000 to carry out this Act. Amounts appropriated 

22 pursuant to this section shall be subdivided into 5 equal 

23 amounts to be distributed to each Center. 

Æ 


pwalker on DSK7TPTVN1PROD with BILLS