89–006 

111TH CONGRESS REPORT " ! HOUSE OF REPRESENTATIVES 2d Session 111–405 

CYBERSECURITY ENHANCEMENT ACT OF 2009 

JANUARY 27, 2010.—Committed to the Committee of the Whole House on the State 

of the Union and ordered to be printed 

Mr. GORDON of Tennessee, from the Committee on Science and 

Technology, submitted the following 

R E P O R T 

[To accompany H.R. 4061] 

[Including cost estimate of the Congressional Budget Office] 

The Committee on Science and Technology, to whom was referred the bill (H.R. 4061) to advance cybersecurity research, development, and technical standards, and for other purposes, having 

considered the same, report favorably thereon with an amendment 

and recommend that the bill as amended do pass. 

CONTENTS 

Page 

I. Bill ................................................................................................................ 2 

II. Purpose of the Bill ...................................................................................... 9 

III. Background and Need for the Legislation ................................................ 9 

IV. Hearing Summary ....................................................................................... 10 

V. Committee Actions ...................................................................................... 12 

VI. Summary of Major Provisions of the Bill .................................................. 13 

VII. Section-by-Section Analysis ........................................................................ 13 

VIII. Committee Views ........................................................................................ 15 

IX. Cost Estimate .............................................................................................. 17 

X. Congressional Budget Office Cost Estimate ............................................. 17 

XI. Compliance with Public Law 104–4 .......................................................... 19 

XII. Committee Oversight Findings and Recommendations ........................... 19 

XIII. Statement on General Performance Goals and Objectives ...................... 19 

XIV. Constitutional Authority Statement .......................................................... 19 

XV. Federal Advisory Committee Statement ................................................... 20 

XVI. Congressional Accountability Act .............................................................. 20 

XVII. Earmark Identification ............................................................................... 20 

XVIII. Statement on Preemption of State, Local, or Tribal Law ........................ 20 

XIX. Changes in Existing Law Made by the Bill, as Reported ........................ 20 

XX. Committee Recommendations .................................................................... 27 

XXI. Proceedings of the Subcommittee Markups .............................................. 28 

a. Research and Science Education Subcommittee .................................. 28 


jbell on DSKDVH8Z91PROD with REPORTS
2 

b. Technology and Innovation Subcommittee ........................................... 64 

XXII. Proceedings of the Full Committee Markup ............................................. 80 

I. BILL

The amendment is as follows: 

Strike all after the enacting clause and insert the following: 

SECTION 1. SHORT TITLE. 

This Act may be cited as the ‘‘Cybersecurity Enhancement Act of 2009’’. 

TITLE I—RESEARCH AND DEVELOPMENT 

SEC. 101. DEFINITIONS. 

In this title: 

(1) NATIONAL COORDINATION OFFICE.—The term National Coordination Office 

means the National Coordination Office for the Networking and Information 

Technology Research and Development program. 

(2) PROGRAM.—The term Program means the Networking and Information 

Technology Research and Development program which has been established 

under section 101 of the High-Performance Computing Act of 1991 (15 U.S.C. 

5511). 

SEC. 102. FINDINGS. 

Section 2 of the Cyber Security Research and Development Act (15 U.S.C. 7401) 

is amended— 

(1) by amending paragraph (1) to read as follows: 

‘‘(1) Advancements in information and communications technology have resulted in a globally interconnected network of government, commercial, scientific, and education infrastructures, including critical infrastructures for electric power, natural gas and petroleum production and distribution, telecommunications, transportation, water supply, banking and finance, and emergency and government services.’’; 

(2) in paragraph (2), by striking ‘‘Exponential increases in interconnectivity 

have facilitated enhanced communications, economic growth,’’ and inserting 

‘‘These advancements have significantly contributed to the growth of the United 

States economy’’; 

(3) by amending paragraph (3) to read as follows: 

‘‘(3) The Cyberspace Policy Review published by the President in May, 2009, 

concluded that our information technology and communications infrastructure 

is vulnerable and has ‘suffered intrusions that have allowed criminals to steal 

hundreds of millions of dollars and nation-states and other entities to steal intellectual property and sensitive military information’.’’; 

(4) by redesignating paragraphs (4) through (6) as paragraphs (5) through (7), 

respectively; 

(5) by inserting after paragraph (3) the following new paragraph: 

‘‘(4) In a series of hearings held before Congress in 2009, experts testified that 

the Federal cybersecurity research and development portfolio was too focused 

on short-term, incremental research and that it lacked the prioritization and coordination necessary to address the long-term challenge of ensuring a secure 

and reliable information technology and communications infrastructure.’’; and 

(6) by amending paragraph (7), as so redesignated by paragraph (4) of this 

section, to read as follows: 

‘‘(7) While African-Americans, Hispanics, and Native Americans constitute 33 

percent of the college-age population, members of these minorities comprise less 

than 20 percent of bachelor degree recipients in the field of computer sciences.’’. 

SEC. 103. CYBERSECURITY STRATEGIC RESEARCH AND DEVELOPMENT PLAN. 

(a) IN GENERAL.—Not later than 12 months after the date of enactment of this 

Act, the agencies identified in subsection 101(a)(3)(B)(i) through (x) of the High-Performance Computing Act of 1991 (15 U.S.C. 5511(a)(3)(B)(i) through (x)) or designated under section 101(a)(3)(B)(xi) of such Act, working through the National 

Science and Technology Council and with the assistance of the National Coordination Office, shall transmit to Congress a strategic plan based on an assessment of 

cybersecurity risk to guide the overall direction of Federal cybersecurity and information assurance research and development for information technology and networking systems. Once every 3 years after the initial strategic plan is transmitted 


jbell on DSKDVH8Z91PROD with REPORTS
3 

to Congress under this section, such agencies shall prepare and transmit to Congress an update of such plan. (b) CONTENTS OF PLAN.—The strategic plan required under subsection (a) shall— (1) specify and prioritize near-term, mid-term and long-term research objec- tives, including objectives associated with the research areas identified in section 4(a)(1) of the Cyber Security Research and Development Act (15 U.S.C. 

7403(a)(1)) and how the near-term objectives complement research and development areas in which the private sector is actively engaged; (2) describe how the Program will focus on innovative, transformational tech- nologies with the potential to enhance the security, reliability, resilience, and 

trustworthiness of the digital infrastructure; (3) describe how the Program will foster the transfer of research and develop- ment results into new cybersecurity technologies and applications for the benefit of society and the national interest, including through the dissemination of 

best practices and other outreach activities; (4) describe how the Program will establish and maintain a national research infrastructure for creating, testing, and evaluating the next generation of secure 

networking and information technology systems; (5) describe how the Program will facilitate access by academic researchers to the infrastructure described in paragraph (4), as well as to relevant data, including event data; and (6) describe how the Program will engage females and individuals identified in section 33 or 34 of the Science and Engineering Equal Opportunities Act (42 

U.S.C. 1885a or 1885b) to foster a more diverse workforce in this area. 

(c) DEVELOPMENT OF ROADMAP.—The agencies described in subsection (a) shall de- velop and annually update an implementation roadmap for the strategic plan required in this section. Such roadmap shall— (1) specify the role of each Federal agency in carrying out or sponsoring re- search and development to meet the research objectives of the strategic plan, 

including a description of how progress toward the research objectives will be 

evaluated; 

(2) specify the funding allocated to each major research objective of the strategic plan and the source of funding by agency for the current fiscal year; and 

(3) estimate the funding required for each major research objective of the 

strategic plan for the following 3 fiscal years. 

(d) RECOMMENDATIONS.—In developing and updating the strategic plan under subsection (a), the agencies involved shall solicit recommendations and advice from— 

(1) the advisory committee established under section 101(b)(1) of the HighPerformance Computing Act of 1991 (15 U.S.C. 5511(b)(1)); and 

(2) a wide range of stakeholders, including industry, academia, including representatives of minority serving institutions, and other relevant organizations 

and institutions. 

(e) APPENDING TO REPORT.—The implementation roadmap required under subsection (c), and its annual updates, shall be appended to the report required under 

section 101(a)(2)(D) of the High-Performance Computing Act of 1991 (15 U.S.C. 

5511(a)(2)(D)). 

SEC. 104. SOCIAL AND BEHAVIORAL RESEARCH IN CYBERSECURITY. 

Section 4(a)(1) of the Cyber Security Research and Development Act (15 U.S.C. 

7403(a)(1)) is amended— 

(1) by inserting ‘‘and usability’’ after ‘‘to the structure’’; 

(2) in subparagraph (H), by striking ‘‘and’’ after the semicolon; 

(3) in subparagraph (I), by striking the period at the end and inserting ‘‘; 

and’’; and 

(4) by adding at the end the following new subparagraph: 

‘‘(J) social and behavioral factors, including human-computer interactions, 

usability, user motivations, and organizational cultures.’’. 

SEC. 105. NATIONAL SCIENCE FOUNDATION CYBERSECURITY RESEARCH AND DEVELOPMENT 

PROGRAMS. 

(a) COMPUTER AND NETWORK SECURITY RESEARCH AREAS.—Section 4(a)(1) of the 

Cyber Security Research and Development Act (15 U.S.C. 7403(a)(1)) is amended in 

subparagraph (A) by inserting ‘‘identity management,’’ after ‘‘cryptography,’’. 

(b) COMPUTER AND NETWORK SECURITY RESEARCH GRANTS.—Section 4(a)(3) of 

such Act (15 U.S.C. 7403(a)(3)) is amended by striking subparagraphs (A) through 

(E) and inserting the following new subparagraphs: 

‘‘(A) $68,700,000 for fiscal year 2010; 

‘‘(B) $73,500,000 for fiscal year 2011; 

‘‘(C) $78,600,000 for fiscal year 2012; 

‘‘(D) $84,200,000 for fiscal year 2013; and 


jbell on DSKDVH8Z91PROD with REPORTS
4 

‘‘(E) $90,000,000 for fiscal year 2014.’’. 

(c) COMPUTER AND NETWORK SECURITY RESEARCH CENTERS.—Section 4(b) of such 

Act (15 U.S.C. 7403(b)) is amended— 

(1) in paragraph (4)— 

(A) in subparagraph (C), by striking ‘‘and’’ after the semicolon; 

(B) in subparagraph (D), by striking the period and inserting ‘‘; and’’; and 

(C) by adding at the end the following new subparagraph: 

‘‘(E) how the center will partner with government laboratories, for-profit 

entities, other institutions of higher education, or nonprofit research institutions.’’; and 

(2) by amending paragraph (7) to read as follows: 

‘‘(7) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation such sums as are necessary to carry 

out this subsection for each of the fiscal years 2010 through 2014.’’. 

(d) COMPUTER AND NETWORK SECURITY CAPACITY BUILDING GRANTS.—Section 

5(a)(6) of such Act (15 U.S.C. 7404(a)(6)) is amended to read as follows: 

‘‘(6) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation such sums as are necessary to carry 

out this subsection for each of the fiscal years 2010 through 2014.’’. 

(e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT GRANTS.—Section 5(b)(2) of such 

Act (15 U.S.C. 7404(b)(2)) is amended to read as follows: 

‘‘(2) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation such sums as are necessary to carry 

out this subsection for each of the fiscal years 2010 through 2014.’’. 

(f) GRADUATE TRAINEESHIPS IN COMPUTER AND NETWORK SECURITY.—Section 

5(c)(7) of such Act (15 U.S.C. 7404(c)(7)) is amended to read as follows: 

‘‘(7) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation such sums as are necessary to carry 

out this subsection for each of the fiscal years 2010 through 2014.’’. 

(g) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CYBERSECURITY.—Section 5(e) of 

such Act (15 U.S.C. 7404(e)) is amended to read as follows: 

‘‘(e) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CYBERSECURITY.— 

‘‘(1) IN GENERAL.—The Director shall carry out a program to encourage young 

scientists and engineers to conduct postdoctoral research in the fields of cybersecurity and information assurance, including the research areas described in 

section 4(a)(1), through the award of competitive, merit-based fellowships. 

‘‘(2) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation such sums as are necessary to carry 

out this subsection for each of the fiscal years 2010 through 2014.’’. 

SEC. 106. FEDERAL CYBER SCHOLARSHIP FOR SERVICE PROGRAM. 

(a) IN GENERAL.—The Director of the National Science Foundation shall carry out 

a Scholarship for Service program to recruit and train the next generation of Federal cybersecurity professionals and to increase the capacity of the higher education 

system to produce an information technology workforce with the skills necessary to 

enhance the security of the Nation’s communications and information infrastructure. 

(b) CHARACTERISTICS OF PROGRAM.—The program under this section shall— 

(1) provide, through qualified institutions of higher education, scholarships 

that provide tuition, fees, and a competitive stipend for up to 2 years to students pursing a bachelor’s or master’s degree and up to 3 years to students pursuing a doctoral degree in a cybersecurity field; 

(2) provide the scholarship recipients with summer internship opportunities 

or other meaningful temporary appointments in the Federal information technology workforce; and 

(3) increase the capacity of institutions of higher education throughout all regions of the United States to produce highly qualified cybersecurity professionals, through the award of competitive, merit-reviewed grants that support 

such activities as— 

(A) faculty professional development, including technical, hands-on experiences in the private sector or government, workshops, seminars, conferences, and other professional development opportunities that will result 

in improved instructional capabilities; 

(B) institutional partnerships, including minority serving institutions; 

and 

(C) development of cybersecurity-related courses and curricula. 

(c) SCHOLARSHIP REQUIREMENTS.— 

(1) ELIGIBILITY.—Scholarships under this section shall be available only to 

students who— 


jbell on DSKDVH8Z91PROD with REPORTS
5 

(A) are citizens or permanent residents of the United States; 

(B) are full-time students in an eligible degree program, as determined by the Director, that is focused on computer security or information assurance at an awardee institution; and 

(C) accept the terms of a scholarship pursuant to this section. (2) SELECTION.—Individuals shall be selected to receive scholarships primarily on the basis of academic merit, with consideration given to financial need and 

to the goal of promoting the participation of individuals identified in section 33 

or 34 of the Science and Engineering Equal Opportunities Act (42 U.S.C. 1885a 

or 1885b). 

(3) SERVICE OBLIGATION.—If an individual receives a scholarship under this 

section, as a condition of receiving such scholarship, the individual upon completion of their degree must serve as a cybersecurity professional within the 

Federal workforce for a period of time equal to the length of the scholarship. 

If a scholarship recipient is not offered employment by a Federal agency or a 

federally funded research and development center, the service requirement can 

be satisfied at the Director’s discretion by— (A) serving as a cybersecurity professional in a State, local, or tribal government agency; or (B) teaching cybersecurity courses at an institution of higher education. (4) CONDITIONS OF SUPPORT.—As a condition of acceptance of a scholarship 

under this section, a recipient shall agree to provide the awardee institution 

with annual verifiable documentation of employment and up-to-date contact information. 

(d) FAILURE TO COMPLETE SERVICE OBLIGATION.— 

(1) GENERAL RULE.—If an individual who has received a scholarship under 

this section— 

(A) fails to maintain an acceptable level of academic standing in the educational institution in which the individual is enrolled, as determined by 

the Director; 

(B) is dismissed from such educational institution for disciplinary reasons; 

(C) withdraws from the program for which the award was made before 

the completion of such program; 

(D) declares that the individual does not intend to fulfill the service obligation under this section; or 

(E) fails to fulfill the service obligation of the individual under this section, 

such individual shall be liable to the United States as provided in paragraph 

(3). 

(2) MONITORING COMPLIANCE.—As a condition of participating in the program, 

a qualified institution of higher education receiving a grant under this section 

shall— 

(A) enter into an agreement with the Director of the National Science 

Foundation to monitor the compliance of scholarship recipients with respect 

to their service obligation; and 

(B) provide to the Director, on an annual basis, post-award employment 

information required under subsection (c)(4) for scholarship recipients 

through the completion of their service obligation. 

(3) AMOUNT OF REPAYMENT.— 

(A) LESS THAN ONE YEAR OF SERVICE.—If a circumstance described in 

paragraph (1) occurs before the completion of 1 year of a service obligation 

under this section, the total amount of awards received by the individual 

under this section shall be repaid or such amount shall be treated as a loan 

to be repaid in accordance with subparagraph (C). 

(B) MORE THAN ONE YEAR OF SERVICE.—If a circumstance described in 

subparagraph (D) or (E) of paragraph (1) occurs after the completion of 1 

year of a service obligation under this section, the total amount of scholarship awards received by the individual under this section, reduced by the 

ratio of the number of years of service completed divided by the number of 

years of service required, shall be repaid or such amount shall be treated 

as a loan to be repaid in accordance with subparagraph (C). 

(C) REPAYMENTS.—A loan described in subparagraph (A) or (B) shall be 

treated as a Federal Direct Unsubsidized Stafford Loan under part D of 

title IV of the Higher Education Act of 1965 (20 U.S.C. 1087a and following), and shall be subject to repayment, together with interest thereon 

accruing from the date of the scholarship award, in accordance with terms 

and conditions specified by the Director (in consultation with the Secretary 

of Education) in regulations promulgated to carry out this paragraph. 


jbell on DSKDVH8Z91PROD with REPORTS
6 

(4) COLLECTION OF REPAYMENT.— (A) IN GENERAL.—In the event that a scholarship recipient is required to 

repay the scholarship under this subsection, the institution providing the 

scholarship shall— (i) be responsible for determining the repayment amounts and for no- tifying the recipient and the Director of the amount owed; and (ii) collect such repayment amount within a period of time as deter- mined under the agreement described in paragraph (2), or the repayment amount shall be treated as a loan in accordance with paragraph 

(3)(C). 

(B) RETURNED TO TREASURY.—Except as provided in subparagraph (C) of this paragraph, any such repayment shall be returned to the Treasury of 

the United States. 

(C) RETAIN PERCENTAGE.—An institution of higher education may retain a percentage of any repayment the institution collects under this paragraph 

to defray administrative costs associated with the collection. The Director 

shall establish a single, fixed percentage that will apply to all eligible entities. 

(5) EXCEPTIONS.—The Director may provide for the partial or total waiver or suspension of any service or payment obligation by an individual under this section whenever compliance by the individual with the obligation is impossible or 

would involve extreme hardship to the individual, or if enforcement of such obligation with respect to the individual would be unconscionable. (e) HIRING AUTHORITY.—For purposes of any law or regulation governing the ap- pointment of individuals in the Federal civil service, upon successful completion of 

their degree, students receiving a scholarship under this section shall be hired 

under the authority provided for in section 213.3102(r) of title 5, Code of Federal 

Regulations, and be exempted from competitive service. Upon fulfillment of the service term, such individuals shall be converted to a competitive service position without competition if the individual meets the requirements for that position. (f) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to appropriated to 

the National Science Foundation to carry out this section— (1) $18,700,000 for fiscal year 2010; 

(2) $20,100,000 for fiscal year 2011; 

(3) $21,600,000 for fiscal year 2012; 

(4) $23,300,000 for fiscal year 2013; and 

(5) $25,000,000 for fiscal year 2014. 

SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT. 

Not later than 180 days after the date of enactment of this Act the President shall transmit to the Congress a report addressing the cybersecurity workforce needs of 

the Federal Government. The report shall include— 

(1) an examination of the current state of and the projected needs of the Federal cybersecurity workforce, including a comparison of the different agencies 

and departments, and an analysis of the capacity of such agencies and departments to meet those needs; 

(2) an analysis of the sources and availability of cybersecurity talent, a comparison of the skills and expertise sought by the Federal Government and the 

private sector, and an examination of the current and future capacity of United 

States institutions of higher education to provide cybersecurity professionals 

with those skills sought by the Federal Government and the private sector; 

(3) an examination of the effectiveness of the National Centers of Academic 

Excellence in Information Assurance Education, the Centers of Academic Excellence in Research, and the Federal Cyber Scholarship for Service programs in 

promoting higher education and research in cybersecurity and information assurance and in producing a growing number of professionals with the necessary 

cybersecurity and information assurance expertise; 

(4) an analysis of any barriers to the Federal Government recruiting and hiring cybersecurity talent, including barriers relating to compensation, the hiring 

process, job classification, and hiring flexibilities; and 

(5) recommendations for Federal policies to ensure an adequate, well-trained 

Federal cybersecurity workforce. 

SEC. 108. CYBERSECURITY UNIVERSITY-INDUSTRY TASK FORCE. 

(a) ESTABLISHMENT OF UNIVERSITY-INDUSTRY TASK FORCE.—Not later than 180 

days after the date of enactment of this Act, the Director of the Office of Science 

and Technology Policy shall convene a task force to explore mechanisms for carrying 

out collaborative research and development activities for cybersecurity through a 

consortium or other appropriate entity with participants from institutions of higher 

education and industry. 


jbell on DSKDVH8Z91PROD with REPORTS
7 

(b) FUNCTIONS.—The task force shall— 

(1) develop options for a collaborative model and an organizational structure 

for such entity under which the joint research and development activities could 

be planned, managed, and conducted effectively, including mechanisms for the 

allocation of resources among the participants in such entity for support of such 

activities; 

(2) propose a process for developing a research and development agenda for 

such entity, including guidelines to ensure an appropriate scope of work focused 

on nationally significant challenges and requiring collaboration; 

(3) define the roles and responsibilities for the participants from institutions 

of higher education and industry in such entity; 

(4) propose guidelines for assigning intellectual property rights and for the 

transfer of research and development results to the private sector; and 

(5) make recommendations for how such entity could be funded from Federal, 

State, and nongovernmental sources. 

(c) COMPOSITION.—In establishing the task force under subsection (a), the Director 

of the Office of Science and Technology Policy shall appoint an equal number of individuals from institutions of higher education and from industry with knowledge and 

expertise in cybersecurity. 

(d) REPORT.—Not later than 12 months after the date of enactment of this Act, 

the Director of the Office of Science and Technology Policy shall transmit to the 

Congress a report describing the findings and recommendations of the task force. 

SEC. 109. CYBERSECURITY CHECKLIST DEVELOPMENT AND DISSEMINATION. 

Section 8(c) of the Cyber Security Research and Development Act (15 U.S.C. 

7406(c)) is amended to read as follows: 

‘‘(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— 

‘‘(1) IN GENERAL.—The Director of the National Institute of Standards and 

Technology shall develop or identify and revise or adapt as necessary, checklists, configuration profiles, and deployment recommendations for products and 

protocols that minimize the security risks associated with each computer hardware or software system that is, or is likely to become, widely used within the 

Federal Government. 

‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Director of the National Institute of 

Standards and Technology shall establish priorities for the development of 

checklists under this subsection. Such priorities may be based on the security 

risks associated with the use of each system, the number of agencies that use 

a particular system, the usefulness of the checklist to Federal agencies that are 

users or potential users of the system, or such other factors as the Director determines to be appropriate. 

‘‘(3) EXCLUDED SYSTEMS.—The Director of the National Institute of Standards 

and Technology may exclude from the requirements of paragraph (1) any computer hardware or software system for which the Director determines that the 

development of a checklist is inappropriate because of the infrequency of use of 

the system, the obsolescence of the system, or the inutility or impracticability 

of developing a checklist for the system. 

‘‘(4) AUTOMATION SPECIFICATIONS.—The Director of the National Institute of 

Standards and Technology shall develop automated security specifications (such 

as the Security Content Automation Protocol) with respect to checklist content 

and associated security related data. 

‘‘(5) DISSEMINATION OF CHECKLISTS.—The Director of the National Institute of 

Standards and Technology shall ensure that Federal agencies are informed of 

the availability of any product developed or identified under the National 

Checklist Program for any information system, including the Security Content 

Automation Protocol and other automated security specifications. 

‘‘(6) AGENCY USE REQUIREMENTS.—The development of a checklist under paragraph (1) for a computer hardware or software system does not— 

‘‘(A) require any Federal agency to select the specific settings or options 

recommended by the checklist for the system; 

‘‘(B) establish conditions or prerequisites for Federal agency procurement 

or deployment of any such system; 

‘‘(C) imply an endorsement of any such system by the Director of the National Institute of Standards and Technology; or 

‘‘(D) preclude any Federal agency from procuring or deploying other computer hardware or software systems for which no such checklist has been 

developed or identified under paragraph (1).’’. 


jbell on DSKDVH8Z91PROD with REPORTS
8 

SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY CYBERSECURITY RESEARCH AND DEVELOPMENT. 

Section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 

278g–3) is amended by redesignating subsection (e) as subsection (f), and by inserting after subsection (d) the following: 

‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of the research activities conducted in accordance with subsection (d)(3), the Institute shall— 

‘‘(1) conduct a research program to develop a unifying and standardized identity, privilege, and access control management framework for the execution of 

a wide variety of resource protection policies and that is amenable to implementation within a wide variety of existing and emerging computing environments; 

‘‘(2) carry out research associated with improving the security of information 

systems and networks; 

‘‘(3) carry out research associated with improving the testing, measurement, 

usability, and assurance of information systems and networks; and 

‘‘(4) carry out research associated with improving security of industrial control 

systems.’’. 

TITLE II—ADVANCEMENT OF CYBERSECURITY 

TECHNICAL STANDARDS 

SEC. 201. DEFINITIONS. 

In this title: 

(1) DIRECTOR.—The term ‘‘Director’’ means the Director of the National Institute of Standards and Technology. 

(2) INSTITUTE.—The term ‘‘Institute’’ means the National Institute of Standards and Technology. 

SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL STANDARDS. 

The Director, in coordination with appropriate Federal authorities, shall— 

(1) ensure coordination of United States Government representation in the 

international development of technical standards related to cybersecurity; and 

(2) not later than 1 year after the date of enactment of this Act, develop and 

transmit to the Congress a proactive plan to engage international standards 

bodies with respect to the development of technical standards related to cybersecurity. 

SEC. 203. PROMOTING CYBERSECURITY AWARENESS AND EDUCATION. 

(a) PROGRAM.—The Director, in collaboration with relevant Federal agencies, industry, educational institutions, and other organizations, shall develop and implement a cybersecurity awareness and education program to increase public awareness of cybersecurity risks, consequences, and best practices through— 

(1) the widespread dissemination of cybersecurity technical standards and 

best practices identified by the Institute; and 

(2) efforts to make cybersecurity technical standards and best practices usable 

by individuals, small to medium-sized businesses, State, local, and tribal governments, and educational institutions. 

(b) MANUFACTURING EXTENSION PARTNERSHIP.—The Director shall, to the extent 

appropriate, implement subsection (a) through the Manufacturing Extension Partnership program under section 25 of the National Institute of Standards and Technology Act (15 U.S.C. 278k). 

(c) REPORT TO CONGRESS.—Not later than 90 days after the date of enactment of 

this Act, the Director shall transmit to the Congress a report containing a strategy 

for implementation of this section. 

SEC. 204. IDENTITY MANAGEMENT RESEARCH AND DEVELOPMENT. 

The Director shall establish a program to support the development of technical 

standards, metrology, testbeds, and conformance criteria, taking into account appropriate user concerns, to— 

(1) improve interoperability among identity management technologies; 

(2) strengthen authentication methods of identity management systems; 

(3) improve privacy protection in identity management systems, including 

health information technology systems, through authentication and security 

protocols; and 

(4) improve the usability of identity management systems. 


jbell on DSKDVH8Z91PROD with REPORTS
9 

II. PURPOSE OF THE BILL

The purpose of this bill is to improve cybersecurity in the Federal, private, and public sectors through: coordination and 

prioritization of federal cybersecurity research and development activities; strengthening of the cybersecurity workforce; coordination 

of U.S. representation in international cybersecurity technical 

standards development; and reauthorization of cybersecurity related programs at the National Science Foundation (NSF) and the 

National Institute of Standards and Technology (NIST). 

III. BACKGROUND AND NEED FOR THE LEGISLATION

Information technology (IT) has evolved rapidly over the last decade, leading to markedly increased connectivity and productivity. 

The benefits provided by these advancements have led to the widespread use and incorporation of information technologies across 

major sectors of the economy. This level of connectivity and the dependence of our critical infrastructures on IT have also increased 

the vulnerability of these systems. Reports of cyber criminals and 

possibly nation-states accessing sensitive information and disrupting services have risen steadily over the last decade, heightening concerns over the adequacy of our cybersecurity measures. 

The Office of Management and Budget cites that federal agencies 

spend $6 billion on cybersecurity to protect a $72 billion IT infrastructure. In addition, the Federal government funds approximately $350 million in cybersecurity research and development 

(R&D) each year. Despite this Federal spending, the Government 

Accountability Office testified as recently as June 2009 that the 

U.S. IT infrastructure is vulnerable to attack and the Federal agencies tasked with its protection are not fulfilling their responsibilities. 

On May 29, 2009, the Obama Administration released the Cyberspace Policy Review, a 60-day review of cyberspace policies across 

the Federal government. The findings of the review include: 

strengthening partnerships between the Federal government and 

the private sector to guarantee a secure and reliable infrastructure, 

increasing public awareness of the risks associated with cybersecurity, expanding and training the Federal cybersecurity workforce, 

advancing cybersecurity R&D, and better coordination among Federal agencies. 

Specifically, the review recommends the development of an R&D 

framework that focuses on strategies for innovative technologies 

and calls for a single entity to coordinate United States representation in international cybersecurity technical standards setting bodies. In the mid-term, it recommends that Federal agencies expand 

support for cybersecurity education and R&D to ensure the Nation’s continued ability to compete in the information age economy. 

The task of coordinating unclassified cybersecurity R&D lies with 

the Networking and Information Technology Research and Development (NITRD) program, which was originally authorized in statute by the High-Performance Computing Act of 1991 (P.L. 102– 

194). The NITRD program, which consists of 13 Federal agencies, 

coordinates a broad spectrum of R&D activities related to information technology. It also includes an interagency working group and 

program component area focused specifically on cybersecurity and 


jbell on DSKDVH8Z91PROD with REPORTS
10 

information R&D. However, many expert panels, including the 

President’s Council of Advisors on Science and Technology, have argued that the portfolio of Federal investments in cybersecurity 

R&D is not properly balanced and is focused on short-term reactive 

technologies at the expense of long-term, fundamental R&D. 

With a budget of $127 million for FY 2010, NSF is the principal 

agency supporting unclassified cybersecurity R&D and education. 

NSF’s cybersecurity research activities are primarily funded 

through the Directorate for Computer & Information Science & Engineering (CISE). CISE supports cybersecurity R&D through a targeted program, Trustworthy Computing, as well as through a number of its core activities in Computer Systems Research, Computing 

Research Infrastructure, and Network and Science Engineering. In 

addition to its basic research activities, NSF’s Directorate for Education & Human Resources (EHR) manages the Scholarship for 

Service program which provides funding to colleges and universities for the award of 2-year scholarships in information assurance 

and computer security fields. 

NIST is tasked with protecting the Federal information technology network by developing and promulgating cybersecurity 

standards for Federal non-classified network systems (Federal Information Processing Standard [FIPS]), identifying methods for assessing effectiveness of security requirements, conducting tests to 

validate security in information systems, and conducting outreach 

exercises. Experts have stated that NIST’s technical standards and 

best practices are too highly technical for general public use, and 

making this information more usable to average computer users 

with less technical expertise will help raise the base level of cybersecurity knowledge among individuals, business, education, and 

government. 

Currently, the United States is represented on international bodies dealing with cybersecurity by an array of organizations, including the Department of State, Department of Commerce, Federal 

Communications Commission, and the United States Trade Representative without a coordinated and comprehensive strategy or 

plan. The Cyberspace Policy Review called for a comprehensive 

international cybersecurity strategy that defines what cybersecurity standards we need, where they are being developed, and ensures that the United States Federal government has agency representation for each. At a hearing before the Committee’s Technology and Innovation Subcommittee, witnesses stated that NIST 

is the appropriate Federal agency to coordinate the development of 

this strategy due to its status as a non-regulatory agency known 

and respected among international and private sector stakeholders. 

In the 107th Congress, the Science and Technology Committee 

developed the Cyber Security Research and Development Act (P.L. 

107–305). The bill created new programs and expanded existing 

programs at NSF and NIST for computer and network security. 

The authorizations established under the Cyber Security Research 

and Development Act expired in fiscal year 2007. 

IV. HEARING SUMMARY

During the 111th Congress, the Committee on Science and Technology held four hearings relevant to H.R. 4061. 


jbell on DSKDVH8Z91PROD with REPORTS
11 

On June 10, 2009, the Subcommittee on Research and Science 

Education held a hearing focused on priorities and existing gaps in 

the cybersecurity research and development portfolio, as well as 

the adequacy of cybersecurity education and workforce training 

programs. The Subcommittee heard from witnesses from academia 

and the private sector, including: (1) Dr. Seymour Goodman, Professor of International Affairs and Computing and Co-Director, 

Georgia Tech Information Security Center, Georgia Institute of 

Technology; (2) Ms. Liesyl Franz, Vice President, Information Security and Global Public Policy, TechAmerica; (3) Dr. Anita D’Amico, 

Director, Secure Decisions Division, Applied Visions, Inc.; (4) Dr. 

Fred Schneider, Samuel B. Eckert Professor of Computer Science, 

Department of Computer Science, Cornell University; (5) Mr. Timothy Brown, Vice President and Chief Architect, CA Security Management. 

On June 16, 2009, the Subcommittee on Research and Science 

Education and the Subcommittee on Technology and Innovation 

held a joint hearing entitled ‘‘Agency Response to Cyberspace Policy Review.’’ The hearing reviewed the response of the Department 

of Homeland Security (DHS), NIST, NSF, and the Defense Advanced Research Projects Agency (DARPA) to the findings and recommendations in the Administration’s Cyberspace Policy Review. 

There were four witnesses: (1) Ms. Cita Furlani, Director, Information Technology Laboratory, NIST; (2) Dr. Jeannette Wing, Assistant Director, Directorate for Computer & Information Science & 

Engineering, NSF; (3) Dr. Robert F. Leheny, Acting Director, 

DARPA; and (4) Dr. Peter Fonash, Acting Deputy Assistant Secretary, Office of Cyber Security Communications, DHS. 

On June 25, 2009, the Subcommittee on Technology and Innovation held a hearing to assess the cybersecurity efforts of DHS and 

NIST. Witnesses from the hearing indicated that cybersecurity performance should be more systematically assessed through enhanced metrics and success criteria. Witnesses also highlighted the 

need to improve the monitoring of Federal networks and the role 

Federal cybersecurity activities can have on privately-owned critical infrastructure. There were four witnesses: (1) Mr. Greg 

Wilshusen, Director, Information Security Issues, Government Accountability Office (GAO); (2) Mr. Mark Bregman, Executive Vice 

President and Chief Technology Officer, Symantec Corporation; (3) 

Mr. Scott Charney, Corporate Vice President, Trustworthy Computing Group, Microsoft Corporation; and (4) Mr. Jim Harper, Director, Information Policy Studies, Cato Institute. 

On October 22, 2009, the Subcommittee on Technology and Innovation held a hearing entitled ‘‘Cybersecurity Activities at NIST’s 

Information Technology Laboratories.’’ The hearing examined recommendations made in the Cyberspace Policy Review, culminating 

in three recommendations for NIST: (1) NIST should coordinate 

U.S. Federal representation in international cybersecurity technical 

standards development because it has the technical expertise required; (2) NIST should carry out cybersecurity awareness activities; and (3) NIST should increase efforts in the area of identity 

management. Six witnesses testified: (1) Ms. Cita Furlani, Director, 

Information Technology Laboratory, NIST; (2) Dr. Susan Landau, 

Distinguished Engineer, Sun Microsystems; (3) Professor Fred 

Schneider, Samuel B. Eckert Professor, Computer Science, Cornell 


jbell on DSKDVH8Z91PROD with REPORTS
12 

University; (4) Dr. Phyllis Schneck, Vice President, Threat Intelligence, McAfee; (5) Mr. William Wyatt Starnes, Founder and CEO, 

SignaCert, Inc.; (6) Mr. Mark Bohannon, General Counsel and Senior Vice President, Public Policy, Software and Information Industry Association. 

V. COMMITTEE ACTIONS

As summarized in Section IV of this report, the Committee on 

Science and Technology heard testimony relevant to H.R. 4061 in 

the 111th Congress at hearings held on June 10, June 16, June 25 

and October 22, 2009. 

H.R. 4061 is a combination of two Committee discussion drafts: 

the Cybersecurity Research and Development Amendments Act of 

2009 and the Cybersecurity Coordination and Awareness Act of 

2009. 

On September, 23, 2009, the Subcommittee on Research and 

Science Education met to consider the Cybersecurity Research and 

Development Amendments Act of 2009 and the following amendments to the bill: 

• Mr. Lipinski offered an amendment to reauthorize NSF’s cybersecurity research centers program, and to clarify the responsibilities and requirements of scholarship recipients and awardee 

institutions in the monitoring and reporting of information related 

to a scholarship recipient’s service obligation. The amendment was 

agreed to by a voice vote. 

• Ms. Johnson offered an amendment requiring that the strategic plan describe how the program will increase the diversity of 

the cybersecurity workforce and specifying that the goal of promoting diversity be considered in the selection of scholarship recipients. The amendment was agreed to by a voice vote. 

Mr. Lipinski moved that the Subcommittee favorably report the 

bill, as amended, to the full Committee. The motion was agreed to 

by a voice vote. 

On November 4, 2009, the Subcommittee on Technology and Innovation met to consider the Cybersecurity Coordination and 

Awareness Act of 2009. The Subcommittee considered a joint manager’s amendment offered by Representatives Wu and Smith to 

make technical and clarifying changes, which was agreed to by a 

voice vote. 

Mr. Wu moved that the Subcommittee favorably report the bill, 

as amended, to the full Committee with the recommendation that 

the bill pass. The motion was agreed to by voice vote. 

On November 7, 2009, Representative Lipinski, for himself, Mr. 

McCaul, Mr. Wu , Mr. Ehlers, Ms. Johnson, Mr. Smith (NE), Mr. 

Gordon, Mr. Hall, Mr. Luja

 ́

n, and Mr. Rothman, introduced H.R. 

4061, the Cybersecurity Enhancement Act of 2009, a bill to advance 

cybersecurity research, development, and technical standards, and 

for other purposes. 

On November 18, 2009, the Committee on Science and Technology met to consider H.R. 4061 and the following amendments to 

the bill: 

• An amendment in the nature of a substitute offered by Mr. Lipinski. The amendment makes several technical and clarifying 

changes to the bill, including the addition of items that were part 


jbell on DSKDVH8Z91PROD with REPORTS
13 

of the Committee print reported by the Subcommittee on Research 

and Science Education. The amendment was adopted by voice vote. 

• An amendment offered by Mr. Luja

 ́

n clarifying that capacity 

building grants offered through the Scholarship for Service program should be available to qualified institutions of higher education ‘‘throughout all regions of the United States,’’ and that tribal 

governments are included as recipients of information on best practices and technical standards disseminated by NIST. The amendment was adopted by voice vote. 

• An amendment offered by Mr. McCaul clarifying the manner 

in which security checklists produced by NIST shall be disseminated, and emphasizing that the implementation of such checklists 

by federal agencies should remain flexible. The amendment was 

adopted by voice vote. 

• An amendment offered by Mr. Wu requiring the identity management R&D program established by NIST improves the 

‘‘usability of identity management systems.’’ The amendment was 

adopted by voice vote. 

Mr. Wu moved that the Committee favorably report the bill, H.R. 

4061, as amended, to the House. The motion was agreed to by a 

voice vote. 

VI. SUMMARY OF MAJOR PROVISIONS OF THE BILL

• Requires agencies participating in the NITRD program to develop, update, and implement a strategic plan guiding the overall 

direction of Federal cybersecurity and information assurance R&D. 

• Reauthorizes cybersecurity workforce and traineeship programs at NSF, including through the Advanced Technological Education program, the Integrative Graduate Education and Research 

Traineeship program and the Graduate Research Fellowship program. 

• Requires the President to conduct an assessment of cybersecurity workforce needs across the Federal government and formally 

authorizes NSF to carry out the Scholarship for Service program. 

• Reauthorizes cybersecurity research at NSF, including through 

the Trustworthy Computing program. 

• Requires the Director of the Office of Science and Technology 

Policy to convene a university-industry task force to explore mechanisms for carrying out collaborative R&D. 

• Requires NIST to develop and implement a plan to coordinate 

U.S. representation in the development of international cybersecurity technical standards. Requires NIST to develop and implement 

a cybersecurity awareness and education program for the dissemination of user-friendly cybersecurity best practices and technical 

standards. 

VII. SECTION-BY-SECTION ANALYSIS

TITLE I—RESEARCH AND DEVELOPMENT

Sec. 101. Definitions 

Defines the terms National Coordination Office and Program in 

the title. 


jbell on DSKDVH8Z91PROD with REPORTS
14 

Sec. 102. Findings 

Describes the findings of this title. 

Sec. 103. Cybersecurity strategic R&D plan 

Requires the agencies to develop, update and implement a stra- tegic plan for cybersecurity research and development (R&D). Requires that the strategic plan be based on an assessment of cybersecurity risk, that it specify and prioritize near-term, mid-term and 

long-term research objectives, and that it describe how the nearterm objectives complement R&D occurring in the private sector. Requires the agencies to solicit input from an advisory committee and outside stakeholders in the development of the strategic plan. 

Additionally, requires the agencies to describe how they will promote innovation, foster technology transfer, and maintain a national infrastructure for the development of secure, reliable, and resilient networking and information technology systems. Requires the development of an implementation roadmap that 

specifies the role of each agency and the level of funding needed 

to meet each of the research objectives outlined in the strategic 

plan. 

Sec. 104. Social and behavioral research in cybersecurity 

Requires the National Science Foundation (NSF) to support research on the social and behavioral aspects of cybersecurity as part 

of its total cybersecurity research portfolio. 

Sec. 105. NSF cybersecurity R&D programs 

Reauthorizes the cybersecurity research program at the NSF and includes identity management as one of the research areas supported. 

Reauthorizes programs at NSF that provide funding for capacity building grants, graduate student fellowships, graduate student 

traineeships and research centers in cybersecurity. Requires NSF to establish a postdoctoral fellowship program in cybersecurity. 

Sec. 106. Federal cyber scholarship for service program 

Authorizes the cybersecurity scholarship for service program at NSF. The program provides grants to institutions of higher education for the award of scholarships to students pursuing undergraduate and graduate degrees in cybersecurity fields and requires 

an equal number of years of service as a cybersecurity professional 

in the federal government as a condition of the scholarship. The program also provides capacity building grants to institu- tions of higher education, supporting such activities as faculty professional development and the development of cybersecurity-related 

curricula and courses. 

Sec. 107. Cybersecurity workforce assessment 

Requires the President to issue a report assessing the current 

and future cybersecurity workforce needs of the federal government, including a comparison of the skills sought by Federal agencies and the private sector; an examination of the supply of cybersecurity talent and the capacity of institutions of higher education 

to produce cybersecurity professionals; and the identification of any 


jbell on DSKDVH8Z91PROD with REPORTS
15 

barriers to the recruitment and hiring of cybersecurity professionals. 

Sec. 108. Cybersecurity University—Industry Task Force 

Establishes a university-industry task force to explore mecha- nisms and models for carrying out public-private research partnerships in the area of cybersecurity. 

Sec. 109. Cybersecurity checklist and dissemination 

Updates NIST’s authority for the National Checklist Program (NCP), which provides detailed guidance on setting the security 

configuration of operating systems and applications and requires 

NIST to develop automated security specifications with respect to 

checklist content. 

Sec. 110. NIST Cybersecurity R&D 

Amends the National Institute of Standards and Technology Act to authorize NIST, as part of its in-house research program, to continue efforts to develop a unifying and standardized identity, privilege, and access control management framework. Authorizes NIST 

to conduct research related to improving the security of information 

and networked systems, including the security of industrial control 

systems. 

TITLE II—ADVANCEMENT OF CYBERSECURITY TECHNICAL STANDARDS

Sec. 201. Definitions 

Defines the terms Director and Institute in the title. 

Sec. 202. International cybersecurity technical standards 

Requires NIST to develop and implement a plan to ensure a coordinated United States Government representation in international cybersecurity technical standards development. This plan 

is due to Congress no later than one year after enactment. 

Sec. 203. Promoting cybersecurity awareness and education 

Requires NIST to deliver a plan to Congress within 90 days de- scribing how it will develop and implement a cybersecurity awareness and education program. Requires the program to be aimed at 

disseminating cybersecurity best practices and standards and shall 

include how NIST will make these usable by individuals, small 

business, state and local governments, and educational institutions. 

Requires the plan to include how NIST can utilize established 

Manufacturing Extension Partnership networks to have cybersecurity information readily available to small manufacturing companies. 

Sec. 204. Identity management research and development 

Requires NIST to engage in research and development programs 

to improve identity management systems. 

VIII. COMMITTEE VIEWS

Cybersecurity strategic R&D plan and implementation roadmap 

The Committee expects the strategic plan to be a useful guide for 

setting program priorities and estimating time scales for reaching 


jbell on DSKDVH8Z91PROD with REPORTS
16 

program objectives. The strategic plan should not be limited to time 

scales of 2–3 years, but should include mid-term and long-term research objectives based on known research gaps and an assessment 

of cybersecurity risks to ensure that R&D objectives are informed 

and prioritized by the Nation’s needs. Furthermore, the Committee 

intends for the development of the plan to be informed by the research needs of industry and academia and expects the National 

Coordination Office to actively solicit stakeholder input through 

meetings, requests for information and other appropriate means. 

The Committee believes the development of an implementation 

roadmap is essential to the furtherance of cybersecurity and information assurance R&D. The roadmap should be aligned with the 

program’s strategic plan and overall objectives, and should be detailed enough to clearly define the roles and responsibilities of individual Federal agencies in the achievement of the overall R&D objectives. While each Federal agency has its own mission and objectives in the area of cybersecurity and information assurance, the 

Committee considers the development of an implementation roadmap essential to comprehensively addressing our cybersecurity 

challenges. 

Cybersecurity education and workforce 

Over the next several years, the Bureau of Labor Statistics estimates that the number of jobs requiring a background in computer 

science or mathematics will average approximately 150,000 annually. However, the number of computer science undergraduate degrees granted has dropped 34 percent from 2002 to 2006. Additionally, according to the report entitled, ‘‘Cyber In-Security: Strengthening the Federal Cybersecurity Workforce,’’ there is a shortfall of 

between 500 and 1000 cybersecurity professionals each year across 

the Federal government. The Committee believes that the required 

assessment of Federal cybersecurity workforce needs, necessary 

skills, and the capacity of our colleges and universities to produce 

cybersecurity professionals is an essential first step in ensuring an 

adequate, well-trained workforce. 

When promoting cybersecurity awareness and education for the 

public, NIST should fully utilize existing resources within the Federal government, private industry, academia, and independent organizations to minimize duplicative effort. 

Cybersecurity University—Industry Task Force 

In considering options for a collaborative model for carrying out 

cybersecurity research and development, it is the Committee’s intention that the objective of such a potential entity would be to 

supplement, not supplant, the traditional functions and activities of 

the individual participating entities. Therefore, in developing 

guidelines in accordance with subsection (b)(2) of section 108, it is 

the Committee’s expectation that the task force work to identify activities that (1) would address nationally significant challenges that 

advance common objectives; and (2) require collaboration that could 

not otherwise be reasonably addressed by individual entities acting 

independently. 


jbell on DSKDVH8Z91PROD with REPORTS
17 

NIST’s checklist development and dissemination 

The Committee believes that advancements of technology have 

presented an opportunity to evolve security checklists into automated auditing programs capable of verifying information security 

policy compliance, as well as the measurement and management of 

vulnerabilities. NIST’s Security Content Automation Protocol program is an excellent example of a public-private partnership developing interoperable security specifications to automate the assessment, documentation, and reporting of information security requirements. The Committee also believes that NIST should be 

more proactive in disseminating checklists to other Federal agencies. 

United States Federal Government representation 

The Committee intends that NIST will develop an international 

cybersecurity technical standards engagement strategy, in coordination with relevant Federal agencies that: addresses the needs 

outlined in the Cyberspace Policy Review; accounts for the constant 

evolution and introduction of technology; and fosters technical cybersecurity standards that maintain security without interfering 

with the freedom of the internet. NIST will not dictate specific 

agency representation in international standards development, but 

should ensure that there is adequate United States government 

representation and coordination for all appropriate development activities. Given the global nature of networked systems, it is imperative that the Federal government has a coordinated, comprehensive 

strategy to address international cybersecurity technical standards 

needs. 

IX. COST ESTIMATE

A cost estimate and comparison prepared by the Director of the 

Congressional Budget Office under section 402 of the Congressional 

Budget Act of 1974 has been timely submitted to the Committee on 

Science and Technology prior to the filing of this report and is included in Section X of this report pursuant to House Rule XIII, 

clause 3(c)(3). 

H.R. 4061 does not contain new budget authority, credit authority, or changes in revenues or tax expenditures. Assuming that the 

sums authorized under the bill are appropriated, H.R.4061 does authorize additional discretionary spending, as described in the Congressional Budget Office report on the bill, which is contained in 

Section X of this report. 

X. CONGRESSIONAL BUDGET OFFICE COST ESTIMATE

H.R. 4061—Cybersecurity Enhancement Act of 2009 

Summary: H.R. 4061 would reauthorize several National Science 

Foundation (NSF) programs that aim to enhance cybersecurity (the 

protection of computers and computer networks from unauthorized 

access). The bill also would require the National Institute of Standards and Technology (NIST) to establish a cybersecurity awareness 

program and implement standards for managing personal identifying information stored on computer systems. Finally, the bill 


jbell on DSKDVH8Z91PROD with REPORTS
18 

would establish a task force to recommend actions to improve cybersecurity research and development. Based on information from NSF and NIST and assuming appro- priation of the necessary amounts, CBO estimates that implementing H.R. 4061 would cost $639 million over the 2010–2014 period and $320 million after 2014. Enacting the legislation would 

not affect direct spending or revenues. H.R. 4061 contains no intergovernmental or private-sector man- dates as defined in the Unfunded Mandates Reform Act (UMRA) 

and would impose no costs on state, local, or tribal governments. Estimated Cost to the Federal Government: The estimated budg- etary impact of H.R. 4061 is shown in the following table. The costs 

of this legislation fall within budget function 250 (general science, 

space, and technology). 

By fiscal year, in millions of dollars— 

2010 2011 2012 2013 2014 2010– 

2014 

CHANGES IN SPENDING SUBJECT TO APPROPRIATION 

NSF Cybersecurity Research Grants: 

Authorization Level .................................................. 69 74 79 84 90 396 

Estimated Outlays ................................................... 9 41 61 71 79 261 

NSF Cybersecurity Scholarships for Service: 

Authorization Level 1 ................................................ 4 20 22 23 25 94 

Estimated Outlays ................................................... * 3 11 17 21 53 

Other NSF Programs: 

Estimated Authorization Level ................................. 87 87 87 88 89 438 

Estimated Outlays ................................................... 9 49 70 81 86 295 

Subtotal NSF Programs: 

Estimated Authorization Level ........................ 160 181 188 195 204 928 

Estimated Outlays .......................................... 18 93 142 169 186 609 

NIST Programs: 

Estimated Authorization Level ................................. 6 6 6 6 6 30 

Estimated Outlays ................................................... 5 6 6 6 6 29 

Cybersecurity Task Force: 

Estimated Authorization Level ................................. * * * * * 1 

Estimated Outlays ................................................... * * * * * 1 

Total Changes under H.R. 4061: 

Estimated Authorization Level ........................ 166 187 194 201 210 959 

Estimated Outlays .......................................... 23 99 148 175 192 639 

1 H.R. 4061 would authorize the appropriation of $19 million for NSF Cybersecurity Scholarships for Service in 2010. NSF has received an 

appropriation of $15 million for those scholarships for 2010. CBO expects that under the bill the agency could receive an additional appropriation of $4 million to fund those scholarships in 2010. 

Note: NSF = National Science Foundation. NIST = National Institute of Standards and Technology. * = less than $500,000. Amounts may not sum to totals because of rounding. 

Basis of estimate: For this estimate, CBO assumes that H.R. 

4061 will be enacted by the middle of calendar year 2010 and that 

the necessary amounts will be appropriated each fiscal year. Estimated outlays are based on historical spending patterns for similar 

NSF and NIST programs. H.R. 4061 would authorize appropriations for several NSF grant programs aimed at enhancing cybersecurity. The bill would authorize appropriations totaling $396 million over the 2010–2014 period 

to improve research on cybersecurity. The bill also would authorize 

the appropriation of an additional $94 million over that period to 

provide scholarships to students who pursue higher education related to cybersecurity and commit to public service after graduating. Finally, the bill would authorize such sums as may be necessary for activities related to improving cybersecurity, including 

constructing research facilities and enhancing cybersecurity training for faculty and students at colleges and universities. Based on 


jbell on DSKDVH8Z91PROD with REPORTS
19 

information from NSF regarding the cost of conducting similar activities and assuming appropriation of the authorized and necessary amounts, CBO estimates that implementing the NSF programs authorized under the bill would cost $609 million over the 

2010–2014 period and $319 million after 2014. 

H.R. 4061 also would direct NIST to conduct a cybersecurity research program, establish standards and protocols to enhance cybersecurity, and to promote cybersecurity awareness and education. 

Based on information from NIST regarding the cost of conducting 

similar activities and assuming appropriation of the necessary 

amounts, CBO estimates that implementing those programs would 

cost $29 million over the 2010–2014 period and $1 million after 

2014. 

Finally, H.R. 4061 would establish a task force of academic and 

industry experts to advise the Office of Science and Technology Policy on issues related to cybersecurity. Based on information regarding the cost of funding similar activities, CBO estimates that carrying out this provision would cost $1 million over the 2010–2014 

period. 

Intergovernmental and private-sector impact: H.R. 4061 contains 

no intergovernmental or private-sector mandates as defined in 

UMRA. The bill would benefit public institutions of higher education by authorizing grants for research on computer security. 

Estimate prepared by: Federal costs: Jeff LaFave; Impact on 

state, local, and tribal governments: Elizabeth Cove Delisle; Impact 

on the private sector: Amy Petz. 

Estimate approved by: Theresa Gullo, Deputy Assistant Director 

for Budget Analysis. 

XI. COMPLIANCE WITH PUBLIC LAW 104–4 

H.R. 4061 contains no unfunded mandates. 

XII. COMMITTEE OVERSIGHT FINDINGS AND RECOMMENDATIONS

The oversight findings and recommendations of the Committee 

on Science and Technology are reflected in the body of this report. 

XIII. STATEMENT ON GENERAL PERFORMANCE GOALS AND

OBJECTIVES

Pursuant to clause (3)(c) of House rule XIII, the goals of H.R. 

4061 are to improve cybersecurity in the Federal, private, and public sectors through: coordination and prioritization of federal cybersecurity research and development activities; strengthening of the 

cybersecurity workforce; coordination of U.S. representation in 

international cybersecurity technical standards development; and 

reauthorization of cybersecurity related programs at the National 

Science Foundation and the National Institute of Standards and 

Technology. 

XIV. CONSTITUTIONAL AUTHORITY STATEMENT

Article I, section 8 of the Constitution of the United States 

grants Congress the authority to enact H.R. 4061. 


jbell on DSKDVH8Z91PROD with REPORTS
20 

XV. FEDERAL ADVISORY COMMITTEE STATEMENT

The functions of the advisory committee authorized in H.R. 4061 

are not currently being nor could they be performed by one or more 

agencies or by enlarging the mandate of another existing advisory 

committee. 

XVI. CONGRESSIONAL ACCOUNTABILITY ACT

The Committee finds that H.R. 4061 does not relate to the terms 

and conditions of employment or access to public services or accommodations within the meaning of section 102(b)(3) of the Congressional Accountability Act (Public Law 104–1). 

XVII. EARMARK IDENTIFICATION

H.R. 4061 does not contain any congressional earmarks, limited 

tax benefits, or limited tariff benefits as defined in clause 9 of rule 

XXI. 

XVIII. STATEMENT ON PREEMPTION OF STATE, LOCAL, OR TRIBAL

LAW

This bill is not intended to preempt any state, local, or tribal law. 

XIX. CHANGES IN EXISTING LAW MADE BY THE BILL, AS REPORTED

In compliance with clause 3(e) of rule XIII of the Rules of the 

House of Representatives, changes in existing law made by the bill, 

as reported, are shown as follows (existing law proposed to be omitted is enclosed in black brackets, new matter is printed in italic, 

existing law in which no change is proposed is shown in roman): 

CYBER SECURITY RESEARCH AND DEVELOPMENT ACT 

* * * * * * * 

SEC. 2. FINDINGS. 

The Congress finds the following: 

¿(1) Revolutionary advancements in computing and communications technology have interconnected government, commercial, scientific, and educational infrastructures—including critical infrastructures for electric power, natural gas and petroleum production and distribution, telecommunications, transportation, water supply, banking and finance, and emergency 

and government services—in a vast, interdependent physical 

and electronic network.

(1) Advancements in information and communications technology have resulted in a globally interconnected network of 

government, commercial, scientific, and education infrastructures, including critical infrastructures for electric power, natural gas and petroleum production and distribution, telecommunications, transportation, water supply, banking and finance, and emergency and government services. 

(2) ¿Exponential increases in interconnectivity have facilitated enhanced communications, economic growth, These advancements have significantly contributed to the growth of the 

United States economy and the delivery of services critical to 


jbell on DSKDVH8Z91PROD with REPORTS
21 

the public welfare, but have also increased the consequences of 

temporary or prolonged failure. 

¿(3) A Department of Defense Joint Task Force concluded 

after a 1997 United States information warfare exercise that 

the results ‘‘clearly demonstrated our lack of preparation for a 

coordinated cyber and physical attack on our critical military 

and civilian infrastructure’’.

(3) The Cyberspace Policy Review published by the President in May, 2009, concluded that our information technology and 

communications infrastructure is vulnerable and has ‘‘suffered 

intrusions that have allowed criminals to steal hundreds of millions of dollars and nation-states and other entities to steal intellectual property and sensitive military information’’. (4) In a series of hearings held before Congress in 2009, ex- perts testified that the Federal cybersecurity research and development portfolio was too focused on short-term, incremental research and that it lacked the prioritization and coordination 

necessary to address the long-term challenge of ensuring a secure and reliable information technology and communications 

infrastructure. 

¿(4) (5) Computer security technology and systems imple- mentation lack— 

(A) * * * 

* * * * * * * 

¿(5) (6) Accordingly, Federal investment in computer and network security research and development must be significantly increased to— (A) * * * 

* * * * * * * 

¿(6) While African-Americans, Hispanics, and Native Americans constitute 25 percent of the total United States workforce 

and 30 percent of the college-age population, members of these 

minorities comprise less than 7 percent of the United States 

computer and information science workforce. (7) While African-Americans, Hispanics, and Native Americans constitute 33 percent of the college-age population, members of these minorities comprise less than 20 percent of bachelor degree recipients in the field of computer sciences. 

* * * * * * * 

SEC. 4. NATIONAL SCIENCE FOUNDATION RESEARCH. 

(a) COMPUTER AND NETWORK SECURITY RESEARCH GRANTS.— (1) IN GENERAL.—The Director shall award grants for basic research on innovative approaches to the structure and 

usability of computer and network hardware and software that 

are aimed at enhancing computer security. Research areas may 

include— 

(A) authentication, cryptography, identity management, and other secure data communications technology; 

* * * * * * * 

(H) remote access and wireless security; ¿and

(I) enhancement of law enforcement ability to detect, in- vestigate, and prosecute cyber-crimes, including those that 

involve piracy of intellectual property¿. ; and 


jbell on DSKDVH8Z91PROD with REPORTS
22 

(J) social and behavioral factors, including human-computer interactions, usability, user motivations, and organizational cultures. 

* * * * * * * 

(3) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation to 

carry out this subsection— 

¿(A) $35,000,000 for fiscal year 2003; 

¿(B) $40,000,000 for fiscal year 2004; 

¿(C) $46,000,000 for fiscal year 2005; 

¿(D) $52,000,000 for fiscal year 2006; and 

¿(E) $60,000,000 for fiscal year 2007.

(A) $68,700,000 for fiscal year 2010; 

(B) $73,500,000 for fiscal year 2011; 

(C) $78,600,000 for fiscal year 2012; 

(D) $84,200,000 for fiscal year 2013; and 

(E) $90,000,000 for fiscal year 2014. 

(b) COMPUTER AND NETWORK SECURITY RESEARCH CENTERS.— 

(1) * * * 

* * * * * * * 

(4) APPLICATIONS.—An institution of higher education, nonprofit research institution, or consortia thereof seeking funding 

under this subsection shall submit an application to the Director at such time, in such manner, and containing such information as the Director may require. The application shall include, 

at a minimum, a description of— 

(A) * * * 

* * * * * * * 

(C) how the Center will contribute to increasing the 

number and quality of computer and network security researchers and other professionals, including individuals 

from groups historically underrepresented in these fields; 

¿and

(D) how the center will disseminate research results 

quickly and widely to improve cyber security in information technology networks, products, and services¿. ; and 

(E) how the center will partner with government laboratories, for-profit entities, other institutions of higher education, or nonprofit research institutions. 

* * * * * * * 

¿(7) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated for the National Science Foundation to 

carry out this subsection— 

¿(A) $12,000,000 for fiscal year 2003; 

¿(B) $24,000,000 for fiscal year 2004; 

¿(C) $36,000,000 for fiscal year 2005; 

¿(D) $36,000,000 for fiscal year 2006; and 

¿(E) $36,000,000 for fiscal year 2007.

(7) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation 


jbell on DSKDVH8Z91PROD with REPORTS
23 

such sums as are necessary to carry out this subsection for each 

of the fiscal years 2010 through 2014. 

* * * * * * * 

SEC. 5. NATIONAL SCIENCE FOUNDATION COMPUTER AND NETWORK 

SECURITY PROGRAMS. 

(a) COMPUTER AND NETWORK SECURITY CAPACITY BUILDING

GRANTS.— 

(1) * * * 

* * * * * * * 

¿(6) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation to 

carry out this subsection— 

¿(A) $15,000,000 for fiscal year 2003; 

¿(B) $20,000,000 for fiscal year 2004; 

¿(C) $20,000,000 for fiscal year 2005; 

¿(D) $20,000,000 for fiscal year 2006; and 

¿(E) $20,000,000 for fiscal year 2007.

(6) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation 

such sums as are necessary to carry out this subsection for each 

of the fiscal years 2010 through 2014. 

(b) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT OF 1992.— 

(1) * * * 

¿(2) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation to 

carry out this subsection— 

¿(A) $1,000,000 for fiscal year 2003; 

¿(B) $1,250,000 for fiscal year 2004; 

¿(C) $1,250,000 for fiscal year 2005; 

¿(D) $1,250,000 for fiscal year 2006; and 

¿(E) $1,250,000 for fiscal year 2007.

(2) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation 

such sums as are necessary to carry out this subsection for each 

of the fiscal years 2010 through 2014. 

(c) GRADUATE TRAINEESHIPS IN COMPUTER AND NETWORK SECURITY RESEARCH.— 

(1) * * * 

* * * * * * * 

¿(7) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation to 

carry out this subsection— 

¿(A) $10,000,000 for fiscal year 2003; 

¿(B) $20,000,000 for fiscal year 2004; 

¿(C) $20,000,000 for fiscal year 2005; 

¿(D) $20,000,000 for fiscal year 2006; and 

¿(E) $20,000,000 for fiscal year 2007.

(7) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation 

such sums as are necessary to carry out this subsection for each 

of the fiscal years 2010 through 2014. 

* * * * * * * 


jbell on DSKDVH8Z91PROD with REPORTS
24 

¿(e) CYBER SECURITY FACULTY DEVELOPMENT TRAINEESHIP PRO- GRAM.— 

¿(1) IN GENERAL.—The Director shall establish a program to 

award grants to institutions of higher education to establish 

traineeship programs to enable graduate students to pursue 

academic careers in cyber security upon completion of doctoral 

degrees. 

¿(2) MERIT REVIEW; COMPETITION.—Grants shall be awarded 

under this section on a merit-reviewed competitive basis. 

¿(3) APPLICATION.—Each institution of higher education desiring to receive a grant under this subsection shall submit an 

application to the Director at such time, in such manner, and 

containing such information as the Director shall require. 

¿(4) USE OF FUNDS.—Funds received by an institution of 

higher education under this paragraph shall— 

¿(A) be made available to individuals on a merit-reviewed competitive basis and in accordance with the requirements established in paragraph (7); 

¿(B) be in an amount that is sufficient to cover annual 

tuition and fees for doctoral study at an institution of higher education for the duration of the graduate traineeship, 

and shall include, in addition, an annual living stipend of 

$25,000; and 

¿(C) be provided to individuals for a duration of no more 

than 5 years, the specific duration of each graduate 

traineeship to be determined by the institution of higher 

education, on a case-by-case basis. 

¿(5) REPAYMENT.—Each graduate traineeship shall— 

¿(A) subject to paragraph (5)(B), be subject to full repayment upon completion of the doctoral degree according to 

a repayment schedule established and administered by the 

institution of higher education; 

¿(B) be forgiven at the rate of 20 percent of the total 

amount of the graduate traineeship assistance received 

under this section for each academic year that a recipient 

is employed as a full-time faculty member at an institution 

of higher education for a period not to exceed 5 years; and 

¿(C) be monitored by the institution of higher education 

receiving a grant under this subsection to ensure compliance with this subsection. 

¿(6) EXCEPTIONS.—The Director may provide for the partial 

or total waiver or suspension of any service obligation or payment by an individual under this section whenever compliance 

by the individual is impossible or would involve extreme hardship to the individual, or if enforcement of such obligation with 

respect to the individual would be unconscionable. 

¿(7) ELIGIBILITY.—To be eligible to receive a graduate 

traineeship under this section, an individual shall— 

¿(A) be a citizen, national, or lawfully admitted permanent resident alien of the United States; and 

¿(B) demonstrate a commitment to a career in higher 

education. 

¿(8) CONSIDERATION.—In making selections for graduate 

traineeships under this paragraph, an institution receiving a 

grant under this subsection shall consider, to the extent posVerDate Nov 24 2008 05:29 Jan 28, 2010 Jkt 089008 PO 00000 Frm 00024 Fmt 6659 Sfmt 6601 E:\HR\OC\HR405.XXX HR405

jbell on DSKDVH8Z91PROD with REPORTS
25 

sible, a diverse pool of applicants whose interests are of an 

interdisciplinary nature, encompassing the social scientific as 

well as the technical dimensions of cyber security. 

¿(9) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation to 

carry out this paragraph $5,000,000 for each of fiscal years 

2003 through 2007. (e) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CYBERSECURITY.— (1) IN GENERAL.—The Director shall carry out a program to encourage young scientists and engineers to conduct 

postdoctoral research in the fields of cybersecurity and information assurance, including the research areas described in section 4(a)(1), through the award of competitive, merit-based fellowships. (2) AUTHORIZATION OF APPROPRIATIONS.—There are authorized to be appropriated to the National Science Foundation 

such sums as are necessary to carry out this subsection for each 

of the fiscal years 2010 through 2014. 

* * * * * * * 

SEC. 8. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY PROGRAMS. 

(a) * * * 

* * * * * * * 

¿(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— ¿(1) IN GENERAL.—The Director of the National Institute of 

Standards and Technology shall develop, and revise as necessary, a checklist setting forth settings and option selections 

that minimize the security risks associated with each computer 

hardware or software system that is, or is likely to become, 

widely used within the Federal Government. 

¿(2) PRIORITIES FOR DEVELOPMENT; EXCLUDED SYSTEMS.—The 

Director of the National Institute of Standards and Technology 

may establish priorities for the development of checklists 

under this paragraph on the basis of the security risks associated with the use of the system, the number of agencies that 

use a particular system, the usefulness of the checklist to Federal agencies that are users or potential users of the system, 

or such other factors as the Director determines to be appropriate. The Director of the National Institute of Standards and 

Technology may exclude from the application of paragraph (1) 

any computer hardware or software system for which the Director of the National Institute of Standards and Technology 

determines that the development of a checklist is inappropriate 

because of the infrequency of use of the system, the obsolescence of the system, or the inutility or impracticability of developing a checklist for the system. 

¿(3) DISSEMINATION OF CHECKLISTS.—The Director of the National Institute of Standards and Technology shall make any 

checklist developed under this paragraph for any computer 

hardware or software system available to each Federal agency 

that is a user or potential user of the system. 

¿(4) AGENCY USE REQUIREMENTS.—The development of a 

checklist under paragraph (1) for a computer hardware or software system does not— 


jbell on DSKDVH8Z91PROD with REPORTS
26 

¿(A) require any Federal agency to select the specific settings or options recommended by the checklist for the system; 

¿(B) establish conditions or prerequisites for Federal 

agency procurement or deployment of any such system; 

¿(C) represent an endorsement of any such system by 

the Director of the National Institute of Standards and 

Technology; nor 

¿(D) preclude any Federal agency from procuring or deploying other computer hardware or software systems for 

which no such checklist has been developed.

(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— 

(1) IN GENERAL.—The Director of the National Institute of 

Standards and Technology shall develop or identify and revise 

or adapt as necessary, checklists, configuration profiles, and deployment recommendations for products and protocols that minimize the security risks associated with each computer hardware or software system that is, or is likely to become, widely 

used within the Federal Government. 

(2) PRIORITIES FOR DEVELOPMENT.—The Director of the National Institute of Standards and Technology shall establish 

priorities for the development of checklists under this subsection. Such priorities may be based on the security risks associated with the use of each system, the number of agencies that 

use a particular system, the usefulness of the checklist to Federal agencies that are users or potential users of the system, or 

such other factors as the Director determines to be appropriate. 

(3) EXCLUDED SYSTEMS.—The Director of the National Institute of Standards and Technology may exclude from the requirements of paragraph (1) any computer hardware or software system for which the Director determines that the development of a checklist is inappropriate because of the infrequency 

of use of the system, the obsolescence of the system, or the 

inutility or impracticability of developing a checklist for the system. 

(4) AUTOMATION SPECIFICATIONS.—The Director of the National Institute of Standards and Technology shall develop 

automated security specifications (such as the Security Content 

Automation Protocol) with respect to checklist content and associated security related data. 

(5) DISSEMINATION OF CHECKLISTS.—The Director of the National Institute of Standards and Technology shall ensure that 

Federal agencies are informed of the availability of any product 

developed or identified under the National Checklist Program 

for any information system, including the Security Content Automation Protocol and other automated security specifications. 

(6) AGENCY USE REQUIREMENTS.—The development of a 

checklist under paragraph (1) for a computer hardware or software system does not— 

(A) require any Federal agency to select the specific settings or options recommended by the checklist for the system; 

(B) establish conditions or prerequisites for Federal agency procurement or deployment of any such system; 


jbell on DSKDVH8Z91PROD with REPORTS
27 

(C) imply an endorsement of any such system by the Director of the National Institute of Standards and Technology; or (D) preclude any Federal agency from procuring or deploying other computer hardware or software systems for 

which no such checklist has been developed or identified 

under paragraph (1). 

* * * * * * * 

NATIONAL INSTITUTE OF STANDARDS AND 

TECHNOLOGY ACT 

* * * * * * * 

SEC. 20. (a) * * * 

* * * * * * * 

(e) INTRAMURAL SECURITY RESEARCH.—As part of the research activities conducted in accordance with subsection (d)(3), the Institute 

shall— 

(1) conduct a research program to develop a unifying and 

standardized identity, privilege, and access control management framework for the execution of a wide variety of resource 

protection policies and that is amenable to implementation 

within a wide variety of existing and emerging computing environments; 

(2) carry out research associated with improving the security 

of information systems and networks; (3) carry out research associated with improving the testing, 

measurement, usability, and assurance of information systems 

and networks; and 

(4) carry out research associated with improving security of 

industrial control systems. 

¿(e) (f) As used in this section— 

(1) * * * 

* * * * * * * 

XX. COMMITTEE RECOMMENDATIONS

On November 18, 2009, the Committee on Science and Technology favorably reported H.R. 4061 by voice vote and recommended its enactment. 


jbell on DSKDVH8Z91PROD with REPORTS
(28) 

XXI. a. PROCEEDINGS OF THE MARKUP BY 

THE SUBCOMMITTEE ON RESEARCH AND 

SCIENCE EDUCATION ON COMMITTEE 

PRINT, THE CYBERSECURITY RESEARCH 

AND DEVELOPMENT AMENDMENTS ACT OF 

2009 

WEDNESDAY, SEPTEMBER 23, 2009 

HOUSE OF REPRESENTATIVES, SUBCOMMITTEE ON RESEARCH AND SCIENCE EDUCATION, COMMITTEE ON SCIENCE, Washington, DC. 

The Subcommittee met, pursuant to call, at 10:09 a.m., in Room 

2318 of the Rayburn House Office Building, Hon. Daniel Lipinski 

[Chairman of the Subcommittee] presiding. Chairman LIPINSKI. The Subcommittee will come to order. 

Good morning. Pursuant to notice, the Subcommittee on Research and Science Education meets to consider the following 

measure: the Committee Print of the Cybersecurity Research and 

Development Amendments Act of 2009. We will now proceed to the 

markup. 

This morning the Subcommittee will consider the Committee 

Print of the Cybersecurity Research and Development Amendments 

Act of 2009. The Subcommittee has held a series of hearings exam- ining the state of cybersecurity R&D (Research and Development). 

At these hearings, witnesses emphasized the need to better coordinate and prioritize the federal R&D portfolio, to improve partnerships between the Federal Government and the private sector, and 

to train an IT workforce that can meet the growing needs of both 

the public and private sectors. Our witnesses also stressed that cybersecurity research needs to encompass all stages of hardware and 

software design, from project management to social and behavioral 

factors arising from human-computer interactions. 

The legislation we are considering today addresses these concerns. First, it requires federal agencies to develop and implement 

a strategic plan for the federal cybersecurity R&D portfolio. The 

plan must be based on an assessment of cybersecurity risk, to 

make sure that taxpayer dollars fund the R&D needed to meet the 

strategic needs of our country and to keep Internet users safe from 

cybercrime. The strategic plan will contain a description of how the 

program will transfer technology from our national labs and universities to industry, and how our federal R&D objectives complement, rather than duplicate, R&D occurring in the private secVerDate Nov 24 2008 05:29 Jan 28, 2010 Jkt 089008 PO 00000 Frm 00028 Fmt 6604 Sfmt 6604 E:\HR\OC\HR405.XXX HR405

jbell on DSKDVH8Z91PROD with REPORTS
29 

tor. In addition to developing a strategic plan informed by industry 

and academia, the bill establishes a university-industry task force 

to explore mechanisms and models for carrying out collaborative 

research in cybersecurity. The legislation addresses cybersecurity workforce needs for the Federal Government, and for the Nation as a whole, by requiring 

an assessment of needs and providing scholarships and fellowships 

to students to pursue advanced degrees in cybersecurity-related 

fields. 

Finally, the bill reauthorizes and expands the National Science Foundation’s (NSF) Trustworthy Computing program, placing a 

new emphasis on research into the social and behavioral aspects of 

cybersecurity, an important area identified by our witnesses. Cyber threats are constantly evolving and cybersecurity R&D must evolve in concert through a combination of near-term fixes 

and long-term projects that build a more secure foundation. The 

Cybersecurity R&D Amendments Act will ensure an overall vision 

and an implementation plan for the federal cybersecurity R&D 

portfolio, and will train the next generation of cybersecurity professionals. 

I want to thank Members for their participation this morning, and I look forward to a productive markup. 

With that, I will now recognize Dr. Ehlers to present his opening remarks. 

[The prepared statement of Chairman Lipinski follows:] 

PREPARED STATEMENT OF CHAIRMAN DANIEL LIPINSKI

This morning the Research and Science Education Subcommittee will consider the Cybersecurity Research and Development Amendments Act of 2009. The Subcommittee has held a series of hearings examining the state of cybersecu- rity R&D. At these hearings witnesses emphasized the need to better coordinate and 

prioritize the federal R&D portfolio, improve partnerships between the Federal Government and the private sector, and train an IT workforce that can meet the growing needs of both the public and private sectors. Our witnesses also stressed that 

cybersecurity research needs to encompass all stages of hardware and software design, from project management to social and behavioral factors arising from humancomputer interactions. 

The legislation we are considering today addresses these concerns. First, it requires federal agencies to develop and implement a strategic plan for the federal cybersecurity R&D portfolio. The plan must be based on an assessment of cybersecurity risk, to make sure that taxpayer dollars fund the R&D needed to meet the strategic needs of our country and to keep Internet users safe from cybercrime. The 

strategic plan will also contain a description of how the program will transfer technology from our national labs and universities to industry, and how our federal 

R&D objectives complement, rather than duplicate, R&D occurring in the private 

sector. 

In addition to developing a strategic plan informed by industry and academia, the 

bill establishes a university-industry task force to explore mechanisms and models 

for carrying out collaborative research in cybersecurity. 

The legislation addresses cybersecurity workforce needs for the Federal Government, and for the Nation as a whole, by requiring an assessment of needs and providing scholarships and fellowships to students to pursue advanced degrees in cybersecurity-related fields. 

Finally, the bill reauthorizes and expands NSF’s Trustworthy Computing program, placing a new emphasis on research into the social and behavioral aspects 

of cybersecurity, an important area identified by our witnesses. 

Cyber threats are constantly evolving and cybersecurity R&D must evolve in concert through a combination of near-term fixes and long-term projects that build a 

more secure foundation. The Cybersecurity R&D Amendments Act will ensure an 

overall vision and an implementation plan for the federal cybersecurity R&D portfolio and will train the next generation of cybersecurity professionals. 


jbell on DSKDVH8Z91PROD with REPORTS
30 

I want to thank Members for their participation this morning and I look forward to a productive markup. 

Mr. EHLERS. Thank you, Mr. Chairman. Today we are examining legislation to reauthorize the Cybersecurity Research and Development Act. With the rapid evolution of information technology fields, it is critical that we adopt policies that keep us ahead of impending 

cyber threats. This subcommittee has held a series of hearings this year focused on the state of federal cybersecurity research and development. The 

testimonies we received from industry experts and federal agency 

officials all pointed to a serious lack of coordination in our cybersecurity strategies. Building on the information we have gleaned, I 

am hopeful this legislation will effectively refine our efforts by establishing a strategic research and development plan and roadmap. 

As an educator, I am particularly interested in how we will further 

support the education and training of students in this rapidly 

changing field. Consequently, I am pleased that the draft legislation codifies a scholarship program at the National Science Foundation to promote undergraduate and graduate degrees in cybersecurity fields. 

I personally did not realize how important this was until I met 

a year ago with a professor of computer science in which he pointed 

out the declining enrollments of students in computer science and 

the decline has been going on for several years to the point that 

there is a severe shortage of computer scientists, and obviously if 

you are going to deal with cybersecurity, you have to not only be 

a computer scientist but a very bright computer scientist, so I am 

very pleased with the National Science Foundation program established in this legislation. 

As we become more dependent on virtual information and services, security becomes more difficult to manage. Attaining and 

maintaining a safe and trustworthy information technology and 

communications infrastructure is imperative and we must not forget that it is an ongoing challenge. I look forward to refining and 

promoting this legislation as it moves through the legislative process. 

I would like to add a note here also regarding cybersecurity. I do 

not claim to be an expert in the field but some years ago I was on 

a NATO taskforce studying the issue and I ended up being assigned the task of writing a report. It was astounding to me to recognize how vulnerable we were to cybersecurity attacks and also 

how ill prepared we were to deal with the problem. We have made 

some progress since that time but we have quite a ways to go, and 

it is down right frightening to recognize what damage can be done 

through cybersecurity attacks. So I am very pleased to support this 

bill and to participate in bringing it to the House. With that, I yield 

back. 

[The prepared statement of Mr. Ehlers follows:] 

PREPARED STATEMENT OF REPRESENTATIVE VERNON J. EHLERS

Today we are examining legislation to reauthorize the Cybersecurity Research and 

Development Act. With the rapid evolution of information technology fields, it is critical that we adopt policies that keep us ahead of impending cyber threats. 

This subcommittee has held a series of hearings this year focused on the state 

of federal cybersecurity research and development. The testimonies we received 


jbell on DSKDVH8Z91PROD with REPORTS
31 

from industry experts and federal agency officials all pointed to a serious lack of 

coordination in our cybersecurity strategies. Building on the information we have 

gleaned, I am hopeful this legislation will effectively refine our efforts by establishing a strategic research and development plan and roadmap. As an educator, I 

am particularly interested in how we will further support the education and training of students in this rapidly changing field. Consequently, I am pleased that the 

draft legislation codifies a scholarship program at the National Science Foundation 

to promote undergraduate and graduate degrees in cybersecurity fields. 

As we become more dependent on virtual information and services, security becomes more difficult to manage. Attaining and maintaining a safe and trustworthy 

information technology and communications infrastructure is imperative, and we 

must not forget that it is an ongoing challenge. I look forward to refining and promoting this legislation as it moves through the legislative process. 

Chairman LIPINSKI. Thank you, Dr. Ehlers. I think at every 

hearing and markup we learn more and more of the expertise that 

you do have in a lot of different areas in science and technology. 

We appreciate your contributions, and certainly we know with everything that is now available, everything that is done electronically, cyber attacks are more and more of a security issue, so that 

is why it is so important we move forward with legislation. 

Does anyone else wish to be recognized? 

With that, we will move on to the markup. I ask unanimous consent that the Committee Print is considered as read and open to 

amendment at any point and that the Members proceed with the 

amendments in the order of the roster. Without objection, so ordered. 

The first amendment on the roster is a Manager’s Amendment 

offered by the Chair. The Clerk will report the amendment. 

The CLERK. Amendment to the Committee Print, amendment 

number 042, offered by Mr. Lipinski of Illinois. 

Chairman LIPINSKI. I ask unanimous consent to dispense with 

the reading. Without objection, so ordered. 

I recognize myself for five minutes to explain the amendment. 

This amendment makes technical corrections to the Committee 

Print, including language for the reauthorization of NSF Cybersecurity Research Centers program for fiscal years 2010 through 

2014. It also clarifies the responsibilities and requirements of scholarship recipients and awardee institutions in the monitoring and 

reporting of information related to a scholarship recipient’s service 

obligation, and I urge my colleagues to support this amendment. 

Is there any further discussion on the amendment? 

Mr. EHLERS. Mr. Chairman, I support the amendment and urge 

that we adopt it. 

Chairman LIPINSKI. Thank you, Dr. Ehlers. Any other discussion 

on the amendment? If no, the vote will occur on the amendment. 

All in favor, say aye. Those opposed, say no. The ayes have it and 

the amendment is agreed to. 

The second amendment on the roster is an amendment offered 

by the gentlelady from Texas, Ms. Johnson. Are you ready to proceed with your amendment? 

Ms. JOHNSON. Yes, Mr. Chairman, I have an amendment at the 

desk. 

Chairman LIPINSKI. The Clerk will report the amendment. 

The CLERK. Amendment to the Committee Print, amendment 

number 084, offered by Ms. Eddie Bernice Johnson of Texas. 


jbell on DSKDVH8Z91PROD with REPORTS
32 

Chairman LIPINSKI. I ask unanimous consent to dispense with 

the reading. Without objection, so ordered. 

I recognize the gentlelady for five minutes to explain the amendment. 

Ms. JOHNSON. Thank you very much, Mr. Chairman, and our 

Ranking Member and fellow Member of the Subcommittee. 

My amendment to the Cybersecurity Research and Development 

Amendments Act of 2009 contains several changes to the legislation. All changes are intended to make this initiative more inclusive to under-represented minorities. 

This week, the Congressional Black Caucus is busy with meetings, panel discussions, briefings and other events that are part of 

the annual legislative conference. As a matter of fact, I am hosting 

my 17th Science and Technology Brain Trust. It will be held at the 

Washington Conventional Center and on Capitol Hill. A wide variety of discussions are occurring this week on policies that are of interest to the African-American community and to the broader policy community. The CBC Foundation is the host, and the Science 

and Technology Brain Trust is Friday at 9:00 a.m. in Room 143A, 

if anyone is willing. Mr. Norm Augustine will be there as well as 

several other panelists. At this free event that is open to the public, 

we will be discussing models of education excellence, and this 

would be one of the things that we would continue to emphasize— 

that is, more diversity. 

Along these lines, programs such as the Federal Scholarship For 

Service program as well as the research program can do much to 

engage under-represented minorities in the area of computer 

science. My amendment affects four parts of the bill. First, it states 

that the Cybersecurity Strategic Research and Development Plan 

should include a description of how the research program will include women and minorities to help to foster a more diverse workforce in this area. Secondly, my amendment says that in developing 

the plan, the agencies involved shall seek advice from minorityserving institutions in addition to stakeholders in the industry, 

academia and other relevant organizations, and third, it addresses 

the Federal Scholarship For Service program which seeks to recruit 

and train the next generation of federal cybersecurity professionals 

and increase the capacity of the higher education system in training such a workforce. The bill states that merit review grants will 

support several different activities to increase the capacity of colleges and universities to train such individuals. My amendment 

states that one of those activities in support of institutional partnerships—especially including minority-serving institutions, because these institutions historically receive a disproportionately 

small share of federal research and education funding—more 

should be done to help them. 

And finally, my amendment addresses the selection process for 

the Cyber Scholarship For Service program. Scholarship awards 

will reflect the goal of promoting broader participation in underrepresented minorities, and Mr. Chairman, I understand that you 

will support these changes and I want to express my gratitude for 

your partnership in this endeavor. We really must be proactive to 

devise federal policies and programs that promote inclusiveness of 

diverse groups. 


jbell on DSKDVH8Z91PROD with REPORTS
33 

House Concurrent Resolution 53 that I introduced this March 

celebrates the strides that Latin-American and African-American 

students have made in terms of educational attainment in computer science. In 2006, African-Americans made up 12.4 percent of 

the candidates receiving computer science degrees, a portion almost 

equal to that representation in the United States population, which 

is 12.8 percent. This good news can be examined in more detail in 

an article published by the National Society of Black Engineers 

called Blacks and Computer Science: The Secrets of Their Success. 

The progress has been slow, Mr. Chairman, but I believe that we 

are making a difference, and I want to thank you again for your 

support, and I urge my colleagues to support this amendment also, 

and I yield back the remainder of time. Thank you. 

Chairman LIPINSKI. Thank you, Ms. Johnson. 

Is there any further discussion of this amendment? Dr. Ehlers. 

Mr. EHLERS. Mr. Chairman, I support the amendment and urge 

its adoption. 

Chairman LIPINSKI. Thank you, Dr. Ehlers. 

Any further discussion on the amendment? I thank the 

gentlelady for her amendment, which I support, and thank the 

gentlelady for her work on this issue. Seeing as there is no further 

discussion, the vote will occur on the amendment. All those in 

favor, say aye. Those opposed, say no. The ayes have it and the 

amendment is agreed to. 

Are there any other amendments? If no, then the vote is on the 

Committee Print as amended. All those in favor will say aye. All 

those opposed will say no. In the opinion of the Chair, the ayes 

have it. 

I recognize myself to offer a motion. I move that the Subcommittee favorably report the Committee Print as amended to the 

Full Committee. Furthermore, I move that staff be instructed to 

prepare the Subcommittee report and make necessary technical 

and conforming change to the Committee Print in accordance with 

the recommendations of the Subcommittee. 

The question is on the motion to report the Committee Print favorably. Those in favor of the motion will signify by saying aye. Opposed, no. The ayes have it and the print is favorably reported. 

Without objection, the motion to reconsider is laid upon the table. 

Members will have two subsequent calendar days in which to submit supplemental Minority or additional views on the measure. I 

want to thank all the Members for their attendance. It was a very 

quick markup but a very critical, important issue and I look forward to working with all of you as we move forward on this. 

This concludes our Subcommittee markup. 

[Whereupon, at 10:24 a.m., the Subcommittee was adjourned.] 


jbell on DSKDVH8Z91PROD with REPORTS

jbell on DSKDVH8Z91PROD with REPORTS
(35) 

Appendix: 

COMMITTEE PRINT, SECTION-BY-SECTION ANALYSIS, AMENDMENT

ROSTER


jbell on DSKDVH8Z91PROD with REPORTS
36 


jbell on DSKDVH8Z91PROD with REPORTScyberc.eps
37 


jbell on DSKDVH8Z91PROD with REPORTScyberd.eps
38 


jbell on DSKDVH8Z91PROD with REPORTScybere.eps
39 


jbell on DSKDVH8Z91PROD with REPORTScyberf.eps
40 


jbell on DSKDVH8Z91PROD with REPORTScyberg.eps
41 


jbell on DSKDVH8Z91PROD with REPORTScyberh.eps
42 


jbell on DSKDVH8Z91PROD with REPORTScyberi.eps
43 


jbell on DSKDVH8Z91PROD with REPORTScyberj.eps
44 


jbell on DSKDVH8Z91PROD with REPORTScyberk.eps
45 


jbell on DSKDVH8Z91PROD with REPORTScyberl.eps
46 


jbell on DSKDVH8Z91PROD with REPORTScyberm.eps
47 


jbell on DSKDVH8Z91PROD with REPORTScybern.eps
48 


jbell on DSKDVH8Z91PROD with REPORTScybero.eps
49 


jbell on DSKDVH8Z91PROD with REPORTScyberp.eps
50 


jbell on DSKDVH8Z91PROD with REPORTScyberq.eps
51 


jbell on DSKDVH8Z91PROD with REPORTScyberr.eps
52 


jbell on DSKDVH8Z91PROD with REPORTScybers.eps
53 


jbell on DSKDVH8Z91PROD with REPORTScybert.eps
54 


jbell on DSKDVH8Z91PROD with REPORTScyberu.eps
55 


jbell on DSKDVH8Z91PROD with REPORTScyberv.eps
56 

SECTION-BY-SECTION ANALYSIS OF

CYBERSECURITY RESEARCH AND DEVELOPMENT

AMENDMENTS ACT OF 2009 

SECTION 1. SHORT TITLE. 

Cybersecurity Research and Development Amendments Act of 2009 

SECTION 2. DEFINITIONS 

Defines terms used in this Act. 

SECTION 3. FINDINGS 

Describes findings of this Act. 

SECTION 4. CYBERSECURITY STRATEGIC R&D PLAN 

Requires the agencies to develop, update and implement a strategic plan for cybersecurity research and development (R&D). Requires that the strategic plan be 

based on an assessment of cybersecurity risk, that it specify and prioritize nearterm, mid-term and long-term research objectives, and that it describe how the 

near-term objectives complement R&D occurring in the private sector. 

Requires the agencies to solicit input from an advisory committee and outside 

stakeholders in the development of the strategic plan. Additionally, it requires the 

agencies to describe how they will promote innovation, foster technology transfer, 

and maintain a national infrastructure for the development of secure, reliable, and 

resilient networking and information technology systems. 

Requires the development of an implementation roadmap that specifies the role 

of each agency and the level of funding needed to meet each of the research objectives outlined in the strategic plan. 

SECTION 5. SOCIAL AND BEHAVIORAL RESEARCH IN CYBERSECURITY 

Requires the National Science Foundation (NSF) to support research on the social 

and behavioral aspects of cybersecurity as part of their total cybersecurity research 

portfolio. 

SECTION 6. NSF CYBERSECURITY R&D PROGRAMS 

Reauthorizes the cybersecurity research program at the NSF and includes identity 

management as one of the research areas supported. 

Reauthorizes programs at NSF that provide funding for capacity building grants, 

graduate student fellowships, graduate student traineeships and research centers in 

cybersecurity. 

Requires NSF to establish a postdoctoral fellowship program in cybersecurity. 

SECTION 7. FEDERAL CYBER SCHOLARSHIP FOR SERVICE PROGRAM 

Authorizes the cybersecurity scholarship for service program at NSF. The program provides grants to institutions of higher education for the award of scholarships to students pursuing undergraduate and graduate degrees in cybersecurity 

fields and requires an equal number of years of service as a cybersecurity professional in the Federal Government as a condition of the scholarship. 

The program also provides capacity building grants to institutions of higher education, supporting such activities as faculty professional development and the development of cybersecurity-related curricula and courses. 

SECTION 8. CYBERSECURITY WORKFORCE ASSESSMENT 

Requires the President to issue a report assessing the current and future cybersecurity workforce needs of the Federal Government, including comparison of the 

skills needed by each federal agency, the supply of cybersecurity talent, and any 

barriers to the recruitment and hiring of cybersecurity professionals. 

SECTION 9. CYBERSECURITY UNIVERSITY-INDUSTRY TASK FORCE 

Establishes a university-industry task force to explore mechanisms and models for 

carrying out public-private research partnerships in the area of cybersecurity. 


jbell on DSKDVH8Z91PROD with REPORTS
57 


jbell on DSKDVH8Z91PROD with REPORTScybera.eps
58 


jbell on DSKDVH8Z91PROD with REPORTScyberb.eps
59 


jbell on DSKDVH8Z91PROD with REPORTScyberw.eps
60 


jbell on DSKDVH8Z91PROD with REPORTScyberx.eps
61 


jbell on DSKDVH8Z91PROD with REPORTScybery.eps
62 


jbell on DSKDVH8Z91PROD with REPORTScyberz.eps
63 


jbell on DSKDVH8Z91PROD with REPORTScyberaa.eps
(64) 

XXI. b. PROCEEDINGS OF THE MARKUP BY 

THE SUBCOMMITTEE ON TECHNOLOGY AND 

INNOVATION ON THE COMMITTEE PRINT, 

THE CYBERSECURITY COORDINATION AND 

AWARENESS ACT 

WEDNESDAY, NOVEMBER 4, 2009 

HOUSE OF REPRESENTATIVES, 

SUBCOMMITTEE ON TECHNOLOGY AND INNOVATION, 

COMMITTEE ON SCIENCE, 

Washington, DC. 

The Subcommittee met, pursuant to call, at 10:44 a.m., in Room 

2318 of the Rayburn House Office Building, Hon. David Wu [Chairman of the Subcommittee] presiding. 

Chairman WU. Pursuant to notice, the Subcommittee on Technology and Innovation meets this morning to consider the Committee Print, the Cybersecurity Coordination and Awareness Act. I 

recognize myself for five minutes. 

The Committee Print implements recommendations made in the 

Cybersecurity Policy Review, which was completed in May of this 

year in the recent Subcommittee hearing, and also amends the Cybersecurity Research and Development Act of 2002. 

Twenty-two years ago, this committee paved the way for federal 

cybersecurity efforts with the Computer Security Act of 1987, which 

charged NIST with developing technical standards to protect nonclassified information on federal computer systems and was the 

first of 13 major laws relating to cybersecurity. The Cyberspace 

Policy Review recommended coordination of U.S. Government representation in international cybersecurity technical standards development. Currently, responsibilities are parsed among different 

agencies without any consistent policy. The convergence of telecommunication, the Internet, and video devices requires a corresponding convergence in cybersecurity technical standards development. A coordinated policy will ensure that these representatives 

operate with the overarching need of the U.S. infrastructure in 

mind. Two weeks ago, witnesses testified in front of this Subcommittee that NIST is suited for the role of coordinator due to its 

extensive technical expertise, established relationships with international bodies, and its existence as a non-regulatory body. 

The Cyberspace Policy Review also called for a cybersecurity 

awareness and education campaign. NIST could be a valuable resource to all Internet users in providing them with the same guidance as it gives federal agencies. This committee print tasks NIST 


jbell on DSKDVH8Z91PROD with REPORTS
65 

with developing a plan to disseminate cybersecurity technical 

standards and best practices to the general public. However, while 

NIST is a great resource for technical standards and best practices, 

witnesses have stated that NIST guidance is often too technical for 

the average Internet user. Therefore, the print also tasks NIST 

with making its standards and best practices usable by those with 

less technical expertise. The dissemination of more user-friendly 

standards will help raise the base level of cybersecurity knowledge 

among individuals, business, educational institutions and governments. 

The Cyberspace Policy Review also notes that cybersecurity cannot be improved without first improving identity management. The 

Committee Print also amends the Cybersecurity R&D Act of 2002 

to reinforce the important R&D work currently done by NIST that 

specifically reflects witness testimony on the importance of NIST 

work automated security specifications such as those in the S–CAP 

program. We also update language in the Act to reflect more-modern technological terms. 

I urge my colleagues to support this bill and look forward to 

working with Members on both sides of the aisle to improve this 

legislation as we move forward. 

Now I recognize Mr. Smith to present his opening remarks. 

[The prepared statement of Chairman Wu follows:] 

PREPARED STATEMENT OF CHAIRMAN DAVID WU

Good afternoon. Today the Subcommittee will consider a committee print, the Cybersecurity Coordination and Awareness Act. This committee print implements recommendations made in the Cyberspace Policy Review and the recent Subcommittee 

hearing, and also amends the Cybersecurity Research and Development Act of 2002. 

Twenty-two years ago, this committee paved the way for federal cybersecurity efforts with the Computer Security Act of 1987, which charged NIST with developing 

technical standards to protect non-classified information on federal computer systems and was the first of 13 major laws related to cybersecurity. 

The Cyberspace Policy Review recommended coordination of U.S. Government 

representation in international cybersecurity technical standards development. Currently, responsibilities are parsed among different agencies without any consistent 

policy. The convergence of telecommunication, Internet, and video devices requires 

a corresponding convergence in cybersecurity technical standards development. A coordinated policy will ensure that these representatives operate with the overarching 

need of the U.S. infrastructure in mind. Two weeks ago, witnesses testified in front 

of this subcommittee that NIST is suited for the role of coordinator due to its extensive technical expertise, established relationships with international bodies, and existence as a non-regulatory body. 

The Cyberspace Policy Review also called for a cybersecurity awareness and education campaign. NIST could be a valuable resource to all Internet users in providing them with the same guidance as it gives federal agencies. The Committee 

Print tasks NIST with developing a plan to disseminate cybersecurity technical 

standards and best practices to the general public. However, while NIST is a great 

resource for technical standards and best practices, witnesses have stated that NIST 

guidance is often too technical for the average Internet user. Therefore, the print 

also tasks NIST with making its standards and best practices usable by those with 

less technical expertise. The dissemination of more user-friendly standards will help 

raise the base level of cybersecurity knowledge among individuals, business, education, and government. 

The Cyberspace Policy Review also states that cybersecurity cannot be improved 

without first improving identity management. NIST currently performs work on 

identity management systems such as biometrics, but this print will task NIST with 

improving the inter-operability of these systems to encourage more widespread use. 

By focusing on the usability and privacy aspects of identity management, this committee print will ensure that biometric and other systems will be accepted by the 


jbell on DSKDVH8Z91PROD with REPORTS
66 

public because they will have confidence in the security of their personal information. 

The Committee Print also amends the Cybersecurity R&D Act of 2002 to reinforce 

the important R&D work currently done by NIST and specifically reflects witness 

testimony on the importance of NIST’s work with automated security specifications, 

such as those in the S–CAP program. The amendment will also update language 

in the Act to reflect more modern technological terms. 

Mr. SMITH. Mr. Chairman, thank you for calling this markup this morning of the Cybersecurity Coordination and Awareness Act. The 

Committee print we are marking up makes a number of modest 

but important changes to NIST’s information security programs 

and authorities. 

Throughout the summer and into the fall, the Subcommittee held numerous hearings in which we heard from federal agencies and 

leading private-sector experts regarding the current state of computer and network security efforts and how they can be improved. 

These discussions made clear any successful comprehensive effort 

to improve cybersecurity must include NIST. From its critical capabilities and expertise in research and development and in standards development to its reputation as a proven and trusted entity 

within the Federal Government, the private sector and internationally, NIST is well suited to take on this expanded role in this 

arena. 

This legislation will help to do just that by authorizing new or expanded activities in three areas: one, coordination of U.S. Government representation in international standards development forums; two, improve dissemination of cybersecurity best practices to 

small businesses, State and local governments, educational institutions and the general public; and three, research and standards development in identity management. Identity management is a particularly important area which warrants increased attention, especially as it relates to the security 

and management of personally identifiable information now a common aspect of our computer systems. To this end, I appreciate the 

Chairman’s willingness to work with me to refine this section and 

incorporate language explicitly stating privacy protection, including 

privacy as it relates to health IT systems, should be part of NIST’s 

identity management efforts. Together, the provisions of this Committee Print will strengthen and clarify NIST’s cybersecurity roles and responsibilities representing a small but important step in our efforts to address cybersecurity issues. I want to thank the Chairman for working closely with Repub- licans on this legislation. I certainly look forward to continued cooperative efforts as we move forward to consideration by Full Committee and on the Floor. Thank you. [The prepared statement of Mr. Smith follows:] 

PREPARED STATEMENT OF REPRESENTATIVE ADRIAN SMITH

Mr. Chairman, thank you for calling this markup this morning of the Cybersecu- rity Coordination and Awareness Act. The Committee Print we are marking up makes a number of modest but important changes to NIST’s information security 

programs and authorities. 

Throughout the summer and into the fall, the Subcommittee held numerous hearings in which we heard from federal agencies and leading private sector experts regarding the current state of computer and network security efforts and how they 

could be improved. 


jbell on DSKDVH8Z91PROD with REPORTS
67 

These discussions made clear any successful, comprehensive effort to improve cybersecurity must include NIST. From its critical capabilities and expertise in research and standards development, to its reputation as a proven and trusted entity 

within the Federal Government, the private sector, and internationally, NIST is 

well-suited to take on an expanded role in this area. 

This legislation will help to do just that by authorizing new or expanded activities 

in three areas: (1) coordination of U.S. Government representation in international 

standards development forums; (2) improved dissemination of cybersecurity best 

practices to small businesses, State and local governments, educational institutions, 

and the general public; and (3) research and standards development in identity 

management. 

Identity management is a particularly important area which warrants increased 

attention, especially as it relates to the security and management of pe4rsonallyt 

identifiable information now a common aspect of our computer systems. To this end, 

I appreciate the Chairman’s willingness to work with me to refine this section and 

incorporate language explicitly stating privacy protection—including privacy as it 

relates to health IT systems—should be part of NIST’s identity management efforts. 

Together, the provisions in this committee print will strengthen and clarify 

NIST’s cybersecurity roles and responsibilities, representing a small but important 

step in our efforts to address cybersecurity issues. 

I want to thank the Chairman for working closely with Republicans on this legislation, and I look forward to continued cooperative efforts as we move to consideration in Full Committee and on the Floor. 

Chairman WU. Thank you, Mr. Smith. It is indeed positive and 

refreshing to find these bipartisan issues and efforts and look forward to working with you going forward. 

Does anyone else wish to be recognized? Hearing none, I ask 

unanimous consent that the Print is considered as read and open 

to amendment at any point and that the Members proceed with 

amendments in the order of the roster. Without objection, so ordered. 

The first amendment on the roster is an Manager’s Amendment 

offered by the Chair. The Clerk will report the amendment. 

The CLERK. Amendment number 026, amendment to the Committee print, offered by Mr. Wu of Oregon and Mr. Smith of Nebraska. 

Chairman WU. I ask unanimous consent to dispense with the 

reading. Without objection, so ordered. I recognize myself for five 

minutes to explain the amendment. 

This manager’s amendment includes two simple provisions that 

we have worked on with the Minority. The first incorporates explicit mention of health information technology systems as part of 

NIST’s work on identity management research and standards development. As we work to increase the adoption of health IT into 

our medical system, it is important to recognize that the increased 

digitization and sharing of records must be accompanied by adequate privacy safeguards. Ensuring that advanced technologies and 

methods used to protect privacy should be central to NIST’s work 

in health care IT. 

The second change is also simple in the legislation’s technical update codifying NIST’s intramural security research activities related to access control management on computer systems. The 

manager’s amendment substitutes the word ‘‘execution’’ in place of 

‘‘enforcement’’ to clarify that these research activities are to support the use of protection policies, not to be part of or to guide their 

enforcement. 


jbell on DSKDVH8Z91PROD with REPORTS
68 

Is there any further discussion of the manager’s amendment? If 

not, the vote occurs on the amendment. All in favor, say aye. Those 

opposed, say no. The ayes have it and the amendment is agreed to. 

Are there any other amendments? If not, the vote is on the Committee Print as amended. All those in favor will say aye. All those 

opposed will say no. In the opinion of the Chair, the ayes have it. 

And I now recognize myself to make a motion. 

I move that the Subcommittee favorably report the Committee 

print as amended to the Full Committee. Furthermore, I move that 

staff be instructed to prepare the Subcommittee report and make 

necessary technical and conforming changes to the print in accordance with the recommendations of the Subcommittee. 

The question is on the motion to report the print favorably. 

Those in favor of the motion will signify by saying aye. Those opposed, no. The ayes have it and the bill is favorably reported. 

Without objection, the motion to reconsider is laid upon the table. 

Members will have two subsequent calendar days in which to submit supplemental Minority or additional views on the measure. 

And I want to thank all the Members for their attendance, and this 

concludes our Subcommittee markup. Thank you. 

[Whereupon, at 10:53 a.m., the Subcommittee was adjourned.] 


jbell on DSKDVH8Z91PROD with REPORTS
(69) 

Appendix: 

COMMITTEE PRINT, SECTION-BY-SECTION ANALYSIS, AMENDMENT

ROSTER


jbell on DSKDVH8Z91PROD with REPORTS
70 


jbell on DSKDVH8Z91PROD with REPORTScptic.eps
71 


jbell on DSKDVH8Z91PROD with REPORTScptid.eps
72 


jbell on DSKDVH8Z91PROD with REPORTScptie.eps
73 


jbell on DSKDVH8Z91PROD with REPORTScptif.eps
74 


jbell on DSKDVH8Z91PROD with REPORTScptig.eps
75 


jbell on DSKDVH8Z91PROD with REPORTScptih.eps
76 


jbell on DSKDVH8Z91PROD with REPORTScptii.eps
77 

SECTION-BY-SECTION ANALYSIS

COMMITTEE PRINT, THE CYBERSECURITY COORDINATION AND AWARENESS ACT

SECTION 1. Short Title 

Sets the title as, ‘‘Cybersecurity Coordination and Awareness Act’’. 

SECTION 2. Definitions 

Defines the terms Director and Institute. 

SECTION 3. International Cybersecurity Technical Standards 

NIST shall develop and implement a plan to ensure a coordinated United States 

Government representation in international cybersecurity technical standards development. This plan is due to Congress no later than one year after enactment. 

SECTION 4. Promoting Cybersecurity Awareness and Education 

NIST shall deliver a plan to Congress within 90 days describing how it will develop and implement a cybersecurity awareness and education program. The program shall be aimed at disseminating cybersecurity best practices and standards 

and shall include how NIST will make these usable by individuals, small business, 

State and local governments, and educational institutions. This plan will include 

how NIST can utilize established Manufacturing Extension Partnership networks to 

have cybersecurity information readily available to small manufacturing companies. 

SECTION 5. Identity Management Research and Development 

NIST shall engage in research and development programs to improve identity 

management systems. 

SECTION 6. Amendment to the Cybersecurity Research and Development 

Act of 2002 

The section amends Sec. 8(c) of the Cybersecurity R&D Act (P.L. 107–305) and updates the technical terms in original statute to reflect the extant technologies and 

networked systems. 


jbell on DSKDVH8Z91PROD with REPORTS
78 


jbell on DSKDVH8Z91PROD with REPORTScptia.eps
79 


jbell on DSKDVH8Z91PROD with REPORTScptib.eps
(80) 

XXII. PROCEEDINGS OF THE FULL COMMITTEE MARKUP ON H.R. 4061, THE CYBERSECURITY ENHANCEMENT ACT OF 2009 

WEDNESDAY, NOVEMBER 18, 2009 

HOUSE OF REPRESENTATIVES, 

COMMITTEE ON SCIENCE, 

Washington, DC. 

The Committee met, pursuant to call, at 10:00 a.m., in Room 

2318 of the Rayburn House Office Building, Hon. Bart Gordon 

[Chairman of the Committee] presiding. 

Chairman GORDON. Good morning. The Committee will come to 

order. 

Pursuant to notice, the Committee on Science and Technology 

meets to consider H.R. 4061, the Cybersecurity Enhancement Act of 

2009. H.R. 4061 is a good bipartisan bill based on input we received in four hearings on cybersecurity. I would like to thank my 

colleagues, Dr. Lipinski, Mr. Wu, Dr. Ehlers and Mr. Smith, for 

their leadership and bipartisan work on the bill. 

As many of you know, October was Cybersecurity Awareness 

Month. I think it is timely that we are considering this legislation 

on the heels of that effort to encourage people to protect their computers and the Nation’s critical cyberinfrastructure. The theme of 

the recent awareness campaign was ‘‘Our Shared Responsibility.’’ 

I find the theme particularly fitting as it also reflects an overarching recommendation in this year’s Administration review of 

cyberspace policy. The common thread through all of the recommendations of the review was the importance of partnerships 

between the Federal Government and the private sector in advancing a more secure cyberspace. 

Specific recommendations of the Administration review included 

developing a skilled cybersecurity workforce, coordinating and 

prioritizing the federal R&D portfolio, improving technology transfer to make sure new technologies make it into the marketplace, 

promoting cybersecurity education and awareness for the general 

public, and coordinating U.S. representation in the development of 

international standards. 

Today’s bill addresses every one of these recommendations. H.R. 

4061 is based on the concept that in order to improve the security 

of our networked systems, which are fundamentally both public 

and private in nature, the Federal Government must work in concert with the private sector. H.R. 4061 will further our efforts in 

this direction and I urge my colleagues to support it. 


jbell on DSKDVH8Z91PROD with REPORTS
81 

Additionally, endorsements so far, and I am sure that we are 

going to be getting several more as the bill goes forward, but so far 

the endorsements come from the Business Software Alliance, the 

Association of Computing Machinery, Computing Research Association and Sun Microsystems. 

Now I recognize my partner, Mr. Hall, to present his opening remarks. 

[The prepared statement of Chairman Gordon follows:] 

PREPARED STATEMENT OF CHAIRMAN BART GORDON

As I mentioned, the Committee will consider H.R. 4061 today. This is a good bipartisan bill based on input we received in four hearings held on cybersecurity. I 

would like to thank my colleagues, Dr. Lipinski, Mr. Wu, Dr. Ehlers and Mr. Smith, 

for their leadership and bipartisan work on the bill. 

As many of you know, October was Cybersecurity Awareness Month. I think it’s 

timely that we are considering this legislation on the heels of that effort to encourage people to protect their computers and the Nation’s critical cyberinfrastructure. 

The theme of the recent awareness campaign was ‘‘Our Shared Responsibility.’’ I 

find the theme particularly fitting as it also reflects an overarching recommendation 

in this year’s Administration review of cyberspace policy. The common thread 

through all of the recommendations of the review was the importance of partnerships between the Federal Government and the private sector in achieving a more 

secure cyberspace. 

Specific recommendations of the Administration review included: 

• Developing a skilled cybersecurity workforce. 

• Coordinating and prioritizing the federal R&D portfolio. 

• Improving technology transfer to make sure new technologies make it into the 

marketplace. 

• Promoting cybersecurity education and awareness for the general public. 

• And, coordinating U.S. representation in the development of international 

standards. 

Today’s bill addresses every one of these recommendations. H.R. 4061 is based on 

the concept that in order to improve the security of our networked systems, which 

are fundamentally both public and private in nature, the Federal Government must 

work in concert with the private sector. H.R. 4061 will further our efforts in this 

direction and I urge my colleagues to support it. 

Mr. HALL. Mr. Chairman, thank you. 

We are all aware of the importance of cybersecurity and how 

much that importance has grown dramatically in recent years as 

most of the critical systems upon which we depend from telecommunications to electricity to banking and commerce rely on secure and reliable computing. 

This committee has a long record of leadership on these issues 

dating back to the 1980s and the agencies and programs we oversee are critical to the success of federal efforts to address cybersecurity vulnerabilities. This bill will help to support these efforts 

through authorization of activities of three general areas: first, 

basic research at the National Science Foundation, which we know 

is a key driver to increasing security over the long-term; second, 

expanded NSF scholarships to increase the size and skills of the cybersecurity workforce; and three, increased R&D standards development and coordination and public outreach at the National Institute of Standards and Technology related to cybersecurity. These 

are modest but important changes that will help us do a better job 

of protecting our communications networks, and I am pleased to 

join my fellow Texan, Mr. McCaul, as a co-sponsor along with our 


jbell on DSKDVH8Z91PROD with REPORTS
82 

Subcommittee Ranking Members, Dr. Ehlers and Representative 

Smith of Nebraska. 

I also want to note my appreciation for what this bill does not do. It avoids calling for any activities that could amount to being 

regulatory in nature. I think this is important. The Committee 

heard from multiple outside witnesses that heavy federal involvement in private-sector cybersecurity processes would actually be 

counterproductive to security. I hope we can ensure this bill continues to restrain from such action as it moves through the legislative process. 

This is a good bill and represents a small but important step in the government’s overall efforts to address cybersecurity issues. I 

want to thank the Chairman for working closely with all of us on 

this legislation. I look forward to continued cooperative efforts as 

we move forward. I yield back my time, sir. [The prepared statement of Mr. Hall follows:] 

PREPARED STATEMENT OF REPRESENTATIVE RALPH M. HALL

Mr. Chairman, thank you for calling the markup this morning for H.R. 4061, the Cybersecurity Enhancement Act of 2009. We are all aware that the importance of cybersecurity has grown dramatically in recent years, as most of the critical systems upon which we depend—from telecommunications to electricity to banking and commerce—rely on secure and reliable 

computing. This committee has a long record of leadership on these issues (dating back to the 1980s), and the agencies and programs we oversee are critical to the success 

of federal efforts to address cybersecurity vulnerabilities. This bill will help to support these efforts through authorization of activities in three general areas: (1) basic research at the National Science Foundation (NSF), 

which we know is a key driver to increasing security over the long-term; (2) expanded NSF scholarships to increase the size and skills of the cybersecurity workforce; and (3) increased R&D, standards development and coordination, and public 

outreach at the National Institute of Standards and Technology (NIST) related to 

cybersecurity. 

These are modest but important changes that will help us do a better job of protecting our communications networks, and I am pleased to join my fellow Texan, 

Mr. McCaul, as a co-sponsor, along with our Subcommittee Ranking Members, Dr. 

Ehlers and Representative Smith of Nebraska. 

I also want to note my appreciation for what this bill doesn’t do. It avoids calling 

for any activities that could amount to being regulatory in nature. I think this is 

important. The Committee heard from multiple outside witnesses that heavy federal 

involvement in private sector cybersecurity processes would actually be counterproductive to security. 

I hope we can ensure this bill continues to restrain from such action as it moves 

through the legislative process. 

This is a good bill, and it represents a small but important step in the government’s overall efforts to address cybersecurity issues. I want to thank the Chairman 

for working closely with Republicans on this legislation, and I look forward to continued cooperative efforts as we move forward. 

Chairman GORDON. Thank you, Mr. Hall. 

Does anyone else wish to be recognized? Mr. Lipinski, would you 

like to be recognized on the bill? 

Mr. LIPINSKI. Thank you, Mr. Chairman. 

H.R. 4061 is a product of combined efforts of the Research and 

Science Education Subcommittee and those of my colleagues on the 

Technology and Innovation Subcommittee. I would like to especially thank Dr. Ehlers, Mr. Wu and Mr. Smith for their contributions to the bill we are considering today. 

The two Subcommittees have held a series of hearings on various 

aspects of cybersecurity including the state of R&D, the agency’s 


jbell on DSKDVH8Z91PROD with REPORTS
83 

response to the 60-day review and the specific role of NIST [National Institute of Standards and Technology] in cybersecurity. At 

these hearings, witnesses emphasized the need to better coordinate 

and prioritize the federal R&D portfolio, to improve partnerships 

between the Federal Government and the private sector, to coordinate U.S. representation in international standard-setting bodies, 

and to train an IT [International Technology] workforce that can 

meet the growing needs of both the public and private sectors. The legislation we are considering today addresses these con- cerns. First, it requires federal agencies to develop and implement 

a strategic plan for the federal cybersecurity R&D portfolio. The 

plan must be based on assessment of cybersecurity risk to make 

sure that taxpayer dollars fund the R&D needed to meet the strategic needs of our country and to keep Internet users safe from 

cybercrime. The strategic plan will also contain a description of 

how the program will transfer technology for our national labs and 

universities to industry since technology transfer is perhaps the 

most important component of any successful R&D program. For the same reason, the bill establishes a university-industry taskforce to explore mechanisms and models for carrying out collaborative research in cybersecurity and make sure that the federal 

strategic plan is informed by industry needs. In addition, the legislation addresses cybersecurity workforce needs for the Federal Government and for the Nation as a whole 

by providing fellowships to students pursuing advanced degrees in 

cybersecurity-related fields. The bill reauthorizes and expands the 

NSF’s [National Science Foundation] Trustworthy Computing program, placing new emphasis on research into the social and behavioral aspects of cybersecurity, an important area identified by our 

witnesses. H.R. 4061 also emphasizes research into identity management at both NSF and NIST. 

Finally, the bill addresses public awareness by requiring NIST to 

develop a plan for disseminating best practices and technical standards to the general public in a user-friendly format that will improve their basic cybersecurity knowledge. 

In conclusion, H.R. 4061 is a good bipartisan bill that will help 

to ensure an overall vision for the federal cybersecurity R&D portfolio. It will help train the next generation of cybersecurity professionals, improve cybersecurity technical standards and will 

strengthen public-private partnerships in cybersecurity. This bill 

addresses a very urgent need that is becoming even greater every 

day in our nation and I think we have a very good bill here to address the science and technology aspects of this issue. 

With that, I will yield back. 

[The prepared statement of Mr. Lipinski follows:] 

PREPARED STATEMENT OF REPRESENTATIVE DANIEL LIPINSKI

Thank you, Mr. Chairman. H.R. 4061 is a product of the combined efforts of the 

Research and Science Education Subcommittee and those of my colleagues on the 

Technology and Innovation Subcommittee. I’d like to thank Dr. Ehlers, Mr. Wu and 

Mr. Smith for their contributions to the bill we are considering today. The two Subcommittees have held a series of hearings on various aspects of cybersecurity, including the state of R&D, the agencies’ response to the 60-day review, and the specific role of NIST in cybersecurity. 

At these hearings witnesses emphasized the need to better coordinate and 

prioritize the federal R&D portfolio, to improve partnerships between the Federal 


jbell on DSKDVH8Z91PROD with REPORTS
84 

Government and the private sector, to coordinate U.S. representation in international standard setting bodies, and to train an IT workforce that can meet the 

growing needs of both the public and private sectors. The legislation we are considering today addresses these concerns. First, it re- quires federal agencies to develop and implement a strategic plan for the federal cybersecurity R&D portfolio. The plan must be based on an assessment of cybersecurity risk, to make sure that taxpayer dollars fund the R&D needed to meet the strategic needs of our country and to keep Internet users safe from cybercrime. The 

strategic plan will also contain a description of how the program will transfer technology from our national labs and universities to industry, since technology transfer 

is perhaps the most important component of any successful R&D plan. For the same reason, the bill establishes a university-industry task force to ex- plore mechanisms and models for carrying out collaborative research in cybersecurity and makes sure that federal strategic plan is informed by industry needs. In addition, the legislation addresses cybersecurity workforce needs for the Fed- eral Government, and for the Nation as a whole, by providing fellowships to students pursuing advanced degrees in cybersecurity-related fields. The bill reauthorizes and expands the NSF’s Trustworthy Computing program, placing a new emphasis on research into the social and behavioral aspects of cybersecurity, an important area identified by our witnesses. H.R. 4061 also emphasizes 

research into identity management at both NSF and NIST. Finally, the bill addresses public awareness by requiring NIST to develop a plan for disseminating best practices and technical standards to the general public in a 

user-friendly format that will improve their basic cybersecurity knowledge. In conclusion, H.R. 4061 is a good bipartisan bill that will help to ensure an over- all vision for the federal cybersecurity R&D portfolio, will help train the next generation of cybersecurity professionals, improve cybersecurity technical standards 

and will strengthen public-private partnerships in cybersecurity. 

Chairman GORDON. Thank you, Dr. Lipinski. Does anyone else wish to—Mr. McCaul. 

Mr. MCCAUL. Thank you, Mr. Chairman, and let me thank Mr. 

Lipinski for this bill. I was proud to be a lead co-sponsor on the 

bill, original co-sponsor. 

The Internet provides great opportunities and advances but it 

also presents many challenges and many threats. Cybersecurity I 

think is one of the most important issues we face as a nation, and 

one of the key issues we face when dealing with cybersecurity is 

a lack of an adequately trained workforce, both in the government 

and in the private sector. This bill acts on the research recommendations of the CSIS Commission On Cybersecurity, which I 

co-chaired, and this is the report. Congressman Jim Langevin and 

I co-chaired this along with CSIS. Some of the top experts in the 

Nation developed this report, and I am very pleased to see this bill 

addressing two of those recommendations: one, to develop a federal 

cyber workforce. This bill does that by creating a scholarship program at the NSF that can be repaid with federal service. 

In addition, it improves cybersecurity R&D and coordination, 

which was another recommendation from the Commission, and this 

bill does that by reauthorizing the cyber programs at NSF as well 

as expanding NIST efforts and encouraging cooperation between 

the academic and private sectors with the university and industry 

taskforce. 

So just let me close by again commending the gentleman Mr. Lipinski for introducing the bill and I look forward to its final passage. Thank you. 

Chairman GORDON. Thank you, Mr. McCaul, for your active involvement in putting this bill together. 

Mr. Wu is recognized. 

Mr. WU. Thank you very much, Mr. Chairman. 


jbell on DSKDVH8Z91PROD with REPORTS
85 

I want to recognize your leadership in bringing this bill together 

and Mr. Lipinski’s very fine work. The NIST sections of the bill 

from my Technology and Innovation Subcommittee hearings resulted from some very valuable information that we collected and 

some efforts to add new approaches or strengthen new approaches. 

NIST is the only federal agency which is tasked with protecting the 

government’s non-classified computer systems and it is therefore 

very important that we work together to continuously adapt to the 

current scope of cybersecurity concerns and also prepare for some 

of the concerns of the future, and it is also very important that we 

achieve these goals by maximizing the effectiveness of our programs and resources and continuously tuning them up and not just 

by spending more money, and today’s legislation reflects this strategy. 

The legislation calls for an increased coordination among federal 

agencies and also calls for enhanced education programs, and I 

would just like to add that the education programs I think have 

some of the best potential for enhancing cybersecurity at low cost. 

There are some very technically sophisticated ways of enhancing 

cybersecurity but there are some simple ways also. In my home 

state, some folks were backing up their computer system every 

night and taking the discs home and some of these discs were stolen out of the back of a car and a lot of records were lost. You 

know, some aspects of computer security are rocket science and 

others are fairly simple precautionary steps which most people can 

take. It is the analogy to our FIRE bill that we will have on the 

Floor later today is that while you may need sophisticated fire suppression systems, you don’t have to be a rocket scientist to teach 

folks not to play with matches, and there is an analogy here about 

the sophisticated things that we need to do and the more straightforward education programs that will enhance computer security at 

relatively low cost. 

Again, Mr. Chairman, thank you for your leadership in bringing 

the two halves of this legislation together, and I yield back the balance of my time. 

[The prepared statement of Chairman Wu follows:] 

PREPARED STATEMENT OF CHAIRMAN DAVID WU

Good morning. The NIST sections of this bill result from valuable information received in Technology and Innovation Subcommittee hearings and in collaboration 

with NIST, other government agencies, private industry, and academia. Since NIST 

is the only federal agency tasked with protecting non-classified federal computer 

systems, it is important that we work together to continuously adapt to the current 

scope of cybersecurity concerns and prepare for those on the horizon. It is important 

that we achieve these goals in part by maximizing the effectiveness of programs and 

resources, not just by spending more money. Today’s legislation reflects this strategy by calling for an increased coordination among federal agencies and educating 

the most vulnerable users of our cyber-infrastructure. 

Chairman GORDON. Thank you, Mr. Wu. I had the easy part, you 

all had the hard part, and again, I want to thank Mc. McCaul and 

Mr. Smith, Dr. Ehlers, Dr. Lipinski, Mr. Wu and all the Members 

of your committee and the staff for your work, having all the hearings. You did the groundwork and that is why things turn out well, 

so thank you. 

[The prepared statement of Mr. Mitchell follows:] 


jbell on DSKDVH8Z91PROD with REPORTS
86 

PREPARED STATEMENT OF REPRESENTATIVE HARRY E. MITCHELL

Thank you, Mr. Chairman. 

As the world becomes increasingly connected through the Internet, it is critical 

to ensure that cyberspace remains secure and reliable. 

Today we will markup the Cybersecurity Coordination and Awareness Act, which 

would direct the National Institutes of Standards and Technology (NIST) to develop 

and implement a proactive plan to ensure coordinated engagement in international 

cybersecurity technical standards development. 

Under this proposal, NIST would also be required to deliver a plan to Congress 

describing how it will develop and implement a cybersecurity awareness and education program. The Cybersecurity Coordination and Awareness Act would also direct NIST to engage in research and development programs to improve identity 

management systems. 

I look forward to our discussion of this proposal today. 

I yield back. 

Chairman GORDON. So now I ask unanimous consent that the 

bill is considered as read and open to amendment at any point and 

that the Members proceed with the amendments in the order of the 

roster. Without objection, so ordered. 

The first amendment on the roster is an amendment in the nature of a substitute offered by the gentleman from Illinois, Dr. Lipinski. Are you ready to proceed with your amendment? 

Mr. LIPINSKI. Yes, I am, Mr. Chairman. 

Chairman GORDON. The Clerk will report the amendment. 

The CLERK. Amendment number 046, amendment in the nature 

of a substitute to H.R. 4061, offered by Mr. Lipinski of Illinois. 

Chairman GORDON. I ask unanimous consent to dispense with 

the reading. Without objection, so ordered. 

I recognize the gentleman for five minutes to explain the amendment. 

Mr. LIPINSKI. Thank you, Mr. Chairman. 

This amendment makes some technical corrections in addition to 

reinstating two sections that were part of the bill passed out of the 

Research and Science Education Subcommittee. The sections specifically address cybersecurity workforce concerns. 

First, the amendment requires the President to assess the cybersecurity skills needed by the Federal Government to compare them 

to the skills sought by industry and then to examine the capacity 

of our colleges and universities to produce those qualified cybersecurity professionals. It also requires an assessment of the effectiveness of federal programs such as the National Centers of Academic 

Excellence in information assurance education. They are aimed at 

promoting cybersecurity research and education at our colleges and 

universities. 

Additionally, the amendment attempts to address the estimated 

shortfall in cybersecurity professionals by authorizing the Federal 

Cyber Scholarship for Service program at NSF. This program 

would provide scholarships to undergraduate and graduate students pursing degrees in cybersecurity. It requires them in return 

to serve an equal number of years in the federal IT workforce. The 

amendment clarifies that three-year scholarships are for students 

pursuing doctoral degrees and it specifies that students who are 

unable to meet their service obligation at a federal agency or federally funded R&D center can meet their obligation by serving as a 

cybersecurity professional in a State, local or tribal government 

agency. 


jbell on DSKDVH8Z91PROD with REPORTS
87 

And finally, the amendment ensures that cybersecurity researchers have access to data relevant to development, testing and evaluation of security technologies. 

I urge my colleagues to support this amendment. 

[The prepared statement of Mr. Lipinski follows:] 

PREPARED STATEMENT OF REPRESENTATIVE DANIEL LIPINSKI

This amendment makes some technical corrections in addition to reinstating two 

sections that were part of the bill passed out of the Research and Science Education 

Subcommittee. The sections specifically address cybersecurity workforce concerns. 

First, the amendment requires the President to assess the cybersecurity skills needed by the Federal Government, to compare them to the skills sought by industry, 

and then to examine of the capacity of our colleges and universities to produce those 

qualified cybersecurity professionals. It also requires an assessment of the effectiveness of federal programs such as the National Centers of Academic Excellence in 

Information Assurance Education that are aimed at promoting cybersecurity research and education at our colleges and universities. 

Additionally, the amendment attempts to address the estimated shortfall in cybersecurity professionals by authorizing the Federal Cyber Scholarship for Service program at the NSF. This program provides scholarships to undergraduate and graduate students pursuing degrees in cybersecurity. It requires them, in return, to 

serve an equal number of years in the federal IT workforce. The amendment clarifies that three-year scholarships are for students pursuing doctoral degrees and it 

specifies that students who are unable to meet their service obligation at a federal 

agency or federally funded R&D center can meet their obligation by serving as a 

cybersecurity professional in a State, local or tribal government agency. 

And finally, the amendment ensures that cybersecurity researchers have access 

to data relevant to the development, testing and evaluation of security technologies. 

I urge my colleagues to support this amendment. 

Chairman GORDON. Is there further discussion on the amendment? 

Mr. HALL. Mr. Chairman. 

Chairman GORDON. Yes. Mr. Hall is recognized. 

Mr. HALL. The Subcommittee Chairman’s amendment in the nature of a substitute simply makes some good technical changes and 

incorporates some valuable feedback we received from several folks 

familiar with NSF’s cybersecurity programs. I support the amendment and I urge its adoption. I yield back. 

[The prepared statement of Mr. Hall follows:] 

PREPARED STATEMENT OF REPRESENTATIVE RALPH M. HALL

Mr. Chairman, the Subcommittee Chairman’s amendment in the nature of a substitute simply makes some technical changes and incorporates some valuable feedback we received from several folks familiar with NSF’s cybersecurity programs. I 

support this amendment and urge its adoption. 

Chairman GORDON. Is there further discussion on the amendment? If not, the second amendment on the roster is an amendment offered by the gentleman from New Mexico, Mr. Luja

 ́

n. Are 

you ready to proceed? 

Mr. LUJA

 ́

N. Mr. Chairman, I have an amendment at the desk. 

Chairman GORDON. The Clerk will report the amendment. 

The CLERK. Amendment number 032, amendment to the amendment in the nature of a substitute to H.R. 4061, offered by Mr. 

Luja

 ́

n of New Mexico. 

Chairman GORDON. I ask unanimous consent to dispense with 

the reading. Without objection, so ordered. 

I recognize the gentleman for five minutes to explain the amendment. 


jbell on DSKDVH8Z91PROD with REPORTS
88 

Mr. LUJA

 ́

N. Thank you, Mr. Chairman. 

My amendment today amends two sections of the Cybersecurity 

Enhancement Act of 2009, section 106 and section 203. Section 106 

of the bill establishes the Federal Cyber Scholarship for Service 

program, which will help recruit and train the next generation of 

cybersecurity professionals. This will be done through grant awards 

that support the development of cybersecurity-related curricula, 

faculty, professional development and institutional partnerships 

within institutions of higher education. My amendment today 

specifies that this program increases the capacity of institutions of 

higher education throughout all regions of the United States to 

train cybersecurity professionals. The goal of this amendment is to 

address any potential regional disparities in this program by ensuring that the program increases the ability of colleges and universities from all parts of the country to train highly qualified cybersecurity professionals. New Mexico is home to excellent research universities like the University of New Mexico, New Mexico State University, New Mexico Technical College. It is important that our 

universities in the Southwest as well as other regions of the United 

States are training cybersecurity professionals to become part of a 

geographically diverse talent pool. This will also promote local economic growth as companies, organizations and government agencies like our national laboratories will have better opportunities to 

hire locally trained talent. 

Section 203 of the bill establishes a program to promote cybersecurity awareness and education in order to increase public awareness of cybersecurity risks. The program seeks to make cybersecurity standards and practices usable by individuals, businesses and 

State and local governments. My amendment today adds tribal governments to the list of entities cybersecurity standards and best 

practices are designed to assist. My district in New Mexico is home 

to 18 different tribes and many of these tribes are currently in the 

early stages of information technology development. As our tribes 

increase their level of connectivity and dependence on IT, it is critically important that we educate tribal communities about the risks 

of cyber attacks and how to take necessary precautions to protect 

sensitive information from cyber criminals. Establishing cybersecurity standards and practices that our trial communities will benefit 

from will greatly achieve the objective of this section to promote cybersecurity awareness and education. 

I am proud to be a co-sponsor of the Cybersecurity Enhancement 

Act of 2009, and I want to thank you, Mr. Chairman, Chairman 

Wu, Chairman Lipinski, Ranking Member McCaul and Ranking 

Member Smith for their hard work on this important bill and I 

urge my colleagues to support this amendment today. I yield back 

my time. 

[The prepared statement of Mr. Luja

 ́

n follows:] 

PREPARED STATEMENT OF REPRESENTATIVE BEN R. LUJA

 ́

N

Thank you Mr. Chairman. 

My amendment today amends two sections of the Cybersecurity Enhancement Act 

of 2009, Section 106 and Section 203. 

Section 106 of the bill establishes the Federal Cyber Scholarship for Service Program which will help recruit and train the next generation of cybersecurity professionals. This will be done through grant awards that support the development of 


jbell on DSKDVH8Z91PROD with REPORTS
89 

cybersecurity-related curricula, faculty professional development, and institutional 

partnerships within institutions of higher education. My amendment today specifies 

that this program increases the capacity of institutions of higher education throughout all regions of the United States to train cybersecurity professionals. The goal 

of this amendment is to address any potential regional disparities in this program 

by ensuring that the program increases the ability of colleges and universities from 

all parts of the country to train highly qualified cybersecurity professionals. New 

Mexico is home to excellent research universities like the University of New Mexico 

and the New Mexico State University. It is important that our universities in the 

Southwest as well as all other regions of the United States are training cybersecurity professionals to become part of a geographically diverse talent pool. 

This will also promote local economic growth as companies, organizations and government agencies will have better opportunities to higher locally trained talent. 

Section 203 of the bill establishes a program to promote cybersecurity awareness 

and education in order to increase public awareness of cybersecurity risks. The program seeks to make cybersecurity standards and practices usable by individuals, 

businesses and State and local governments. My amendment today adds tribal governments to the list of entities cybersecurity standards and best practices are designed to assist. My district in New Mexico is home to eighteen different tribes and 

many of these tribes are currently in the early stages of information technology infrastructure development. As our tribes increase their level of connectivity and dependence on IT, it is critically important that we educate tribal communities about 

the risks of cyber attacks and how to take necessary precautions to protect sensitive 

information from cyber criminals. Establishing cybersecurity standards and practices that our tribal communities will benefit from will greatly achieve the objective 

of this section to promote cybersecurity awareness and education. 

I am proud to co-sponsor the Cybersecurity Enhancement Act of 2009 and I want 

to thank Chairman Gordon, Chairman Wu, Chairman Lipinski, Ranking Member 

Hall, Ranking Member Smith, and Ranking Members Ehlers for their hard work on 

this important bill. I urge my colleagues to support my amendment today. 

Chairman GORDON. Is there further discussion on the amendment? 

Mr. HALL. Mr. Chairman. 

Chairman GORDON. Mr. Hall is recognized. 

Mr. HALL. This amendment is another good Luja

 ́

n amendment 

and it simply adds language ensuring that the scholarship program 

authorized in this bill is geographically diverse. I support the 

amendment and I urge its adoption. I say another good amendment 

because he is a given family from a great state. Thank you. 

[The prepared statement of Mr. Hall follows:] 

PREPARED STATEMENT OF REPRESENTATIVE RALPH M. HALL

Mr. Chairman, this amendment simply adds language ensuring that the scholarship program authorized in the bill is geographically diverse. I support this amendment and urge its adoption. 

Chairman GORDON. Thank you, Mr. Hall. 

Is there further discussion on the amendment? If no, the vote occurs on the amendment. All in favor, say aye. Opposed, no. The 

ayes have it. The amendment is agreed to. 

The third amendment on the roster is an amendment offered by 

the gentleman from Texas, Mr. McCaul. Are you ready to proceed 

with your amendment? 

Mr. MCCAUL. I am, Mr. Chairman. 

Chairman GORDON. The Clerk will report the amendment. 

The CLERK. Amendment number 027, amendment to the amendment in the nature of a substitute to H.R. 4061, offered by Mr. 

McCaul of Texas. 

Chairman GORDON. I ask unanimous consent to dispense with 

the reading. Without objection, so ordered. 


jbell on DSKDVH8Z91PROD with REPORTS
90 

I recognize the gentleman for five minutes to explain his amendment. 

Mr. MCCAUL. Thank you, Mr. Chairman. 

My amendment has to do with the NIST checklist provision in 

this bill. Basically the amendment would clarify that NIST inform 

agencies of the availability of cybersecurity products under the national checklist program and, two, that NIST checklists are not required to be used by agencies. This bill expands NIST’s responsibility for updating and disseminating guidance to federal agencies 

on cybersecurity. There was some concern that the language in the 

bill would prevent NIST from including software developed outside 

of NIST on the checklist distributed to the federal agencies. This 

amendment clarifies that NIST can include software developed by 

an outside source or by the private sector. There is no reason that 

federal agencies should not be allowed to use software developed by 

the private sector if that software is superior and can do the job, 

and with that I yield back. 

Chairman GORDON. Thank you, Mr. McCaul. I think that is the 

theme of the bill is coordination between public and private sector. 

Is there further discussion on the amendment? 

Mr. HALL. Mr. Chairman. 

Chairman GORDON. Mr. Hall is recognized. 

Mr. HALL. I am pleased to support my colleague from Texas and 

the lead Republican co-sponsor of the underlying bill with his 

amendment. I think it is good, sound policy and so does the Business Software Alliance. I ask unanimous consent that their letter 

of support be submitted for the record, Bob Holleyman, the President and CEO. 

[The information follows:] 


jbell on DSKDVH8Z91PROD with REPORTS
91 

Chairman GORDON. Without objection, so ordered. 

Mr. HALL. I support the amendment and urge its adoption. I 

yield back my time. 

[The prepared statement of Mr. Hall follows:] 

PREPARED STATEMENT OF REPRESENTATIVE RALPH M. HALL

Mr. Chairman, I am pleased to support my colleague from Texas—and the lead 

Republican co-sponsor of the underlying bill—with his amendment. I believe it is 

good, sound policy, and so does the Business Software Alliance. I ask unanimous 

consent that their letter of support be submitted for the record. I support this 

amendment and urge its adoption. 


jbell on DSKDVH8Z91PROD with REPORTShr4061a.eps
92 

Chairman GORDON. Is there further discussion on the amendment? If no, all in favor say aye. Opposed, no. The ayes have it. 

The amendment is agreed to. 

The fourth amendment on the roster is offered by the gentleman 

from Oregon, Mr. Wu. Are you ready to proceed with your amendment? 

Mr. WU. I am, Mr. Chairman. 

Chairman GORDON. The Clerk will report the amendment. 

The CLERK. Amendment number 027, amendment to the amendment in the nature of a substitute to H.R. 4061, offered by Mr. Wu 

of Oregon. 

Mr. WU. Mr. Chairman, I ask unanimous consent to dispense 

with the reading. 

Chairman GORDON. Granted, and I recognize the gentleman for 

five minutes to explain the amendment. 

Mr. WU. Thank you very much, Mr. Chairman. 

My amendment adds one task to NIST’s work on identity management research and development. Today’s bill directs NIST to 

improve the inter-operability, the authentication methods and privacy protection of identity management systems. This amendment 

would add usability to this list. The aim is to simplify how these 

systems are installed, set up and used and simply to make these 

methodologies more user-friendly. Improving usability is a key element in growing the widespread adoption of these important security systems, and I yield back the balance of my time, Mr. Chairman. 

[The prepared statement of Chairman Wu follows:] 

PREPARED STATEMENT OF CHAIRMAN DAVID WU

This amendment adds one task to NIST’s work on identity management research 

and development. Currently, today’s bill directs NIST to improve the inter-operability, authentication methods, and privacy protection of identity management systems. By adding usability to this list, we aim to simplify how these systems are installed, set up, and used. Improving usability is a crucial element in growing the 

widespread adoption of these important security systems. 

Chairman GORDON. Is there any further discussion on the 

amendment? 

Mr. HALL. Mr. Chairman. 

Chairman GORDON. Mr. Hall is recognized. 

Mr. HALL. I am agreeable to not having to listen to his reading, 

but this amendment clarifies that NIST activities in the realm of 

identity management include research to improve the usability of 

identity management systems. Now, we all know that the information systems are only useful if people know how to use them effectively. This amendment ensures that as we research ways to improve the security of our cyber networks that we are mindful of the 

human element involved in that success. I support the amendment 

and urge its passage. 

[The prepared statement of Mr. Hall follows:] 

PREPARED STATEMENT OF REPRESENTATIVE RALPH M. HALL

Mr. Chairman, this amendment clarifies that NIST’s activities in the realm of 

identity management include research to improve the usability of identity management systems. We all know that information systems are only useful if people know 

how to use them effectively. This amendment ensures that as we research ways to 


jbell on DSKDVH8Z91PROD with REPORTS
93 

improve the security of our cyber-networks that we are mindful of the human element involved in that success. I support the amendment and urge its passage. 

Chairman GORDON. Thank you, Mr. Hall. 

Is there further discussion on the amendment? If no, the vote. In 

favor, say aye. Opposed, no. The ayes have it and the amendment 

is agreed to. 

Are there other amendments? If not, then the vote occurs on the 

amendment in the nature of a substitute offered by the gentleman 

from Illinois as amended. All in favor, say aye. Opposed, no. The 

ayes have it. The amendment is agreed to. 

The vote is now on the bill, H.R. 4061 as amended. All those in 

favor will say aye. All opposed, no. The ayes have it. 

I now recognize Mr. Wu for a motion. 

Mr. WU. Mr. Chairman, I move that the Committee favorably report H.R. 4061, as amended, to the House with the recommendation that the bill do pass. Furthermore, I move that staff be instructed to prepare the legislative report and make necessary technical and conforming changes and that the Chairman take all necessary steps to bring the bill before the House for consideration. 

Chairman GORDON. The question is on the motion to report the 

bill favorably. Those in favor of the motion will signify by saying 

aye. Opposed, no. The ayes have it and the bill is favorably reported. 

Without objection, the motion to reconsider is laid upon the table. 

Members will have two subsequent calendar days in which to submit supplemental Minority or additional views on this legislation. 

And I want to thank everyone for coming today. I know that you 

have other things to do but we can’t proceed if you are not here. 

I know you get here and you say well, that was easy. It wasn’t so 

easy. These subcommittees put a lot of work on this and it is a 

good bill. Cybersecurity is important and this committee will play 

a major role now in our nation’s cybersecurity. So I thank you, and 

this meeting is concluded. 

[Whereupon, at 10:28 a.m., the Committee was adjourned.] 


jbell on DSKDVH8Z91PROD with REPORTS

jbell on DSKDVH8Z91PROD with REPORTS
(95) 

Appendix: 

H.R. 4061, SECTION-BY-SECTION ANALYSIS, AMENDMENT ROSTER


jbell on DSKDVH8Z91PROD with REPORTS
96 


jbell on DSKDVH8Z91PROD with REPORTShr4061hh.eps
97 


jbell on DSKDVH8Z91PROD with REPORTShr4061ii.eps
98 


jbell on DSKDVH8Z91PROD with REPORTShr4061jj.eps
99 


jbell on DSKDVH8Z91PROD with REPORTShr4061kk.eps
100 


jbell on DSKDVH8Z91PROD with REPORTShr4061ll.eps
101 


jbell on DSKDVH8Z91PROD with REPORTShr4061mm.eps
102 


jbell on DSKDVH8Z91PROD with REPORTShr4061nn.eps
103 


jbell on DSKDVH8Z91PROD with REPORTShr4061oo.eps
104 


jbell on DSKDVH8Z91PROD with REPORTShr4061pp.eps
105 


jbell on DSKDVH8Z91PROD with REPORTShr4061qq.eps
106 


jbell on DSKDVH8Z91PROD with REPORTShr4061rr.eps
107 


jbell on DSKDVH8Z91PROD with REPORTShr4061ss.eps
108 


jbell on DSKDVH8Z91PROD with REPORTShr4061tt.eps
109 


jbell on DSKDVH8Z91PROD with REPORTShr4061uu.eps
110 


jbell on DSKDVH8Z91PROD with REPORTShr4061vv.eps
111 


jbell on DSKDVH8Z91PROD with REPORTShr4061ww.eps
112 


jbell on DSKDVH8Z91PROD with REPORTShr4061xx.eps
113 


jbell on DSKDVH8Z91PROD with REPORTShr4061yy.eps
114 


jbell on DSKDVH8Z91PROD with REPORTShr4061zz.eps
115 

SECTION-BY-SECTION ANALYSIS OF THE

AMENDMENT IN THE NATURE OF A SUBSTITUTE TO

H.R. 4061, WHICH CONTAINS THE CONTENTS OF BOTH CYBERSECURITY PRINTS IN THEIR

ENTIRETY. 

TITLE I—RESEARCH AND DEVELOPMENT 

SEC. 101. DEFINITIONS 

Defines the terms National Coordination Office and Program in the title. 

SEC. 102. FINDINGS 

Describes the findings of this title. 

SEC. 103. CYBERSECURITY STRATEGIC R&D PLAN 

Requires the agencies to develop, update and implement a strategic plan for cybersecurity research and development (R&D). Requires that the strategic plan be 

based on an assessment of cybersecurity risk, that it specify and prioritize nearterm, mid-term and long-term research objectives, and that it describe how the 

near-term objectives complement R&D occurring in the private sector. 

Requires the agencies to solicit input from an advisory committee and outside 

stakeholders in the development of the strategic plan. Additionally, it requires the 

agencies to describe how they will promote innovation, foster technology transfer, 

and maintain a national infrastructure for the development of secure, reliable, and 

resilient networking and information technology systems. 

Requires the development of an implementation roadmap that specifies the role 

of each agency and the level of funding needed to meet each of the research objectives outlined in the strategic plan. 

SEC. 104. SOCIAL AND BEHAVIORAL RESEARCH IN CYBERSECURITY 

Requires the National Science Foundation (NSF) to support research on the social 

and behavioral aspects of cybersecurity as part of their total cybersecurity research 

portfolio. 

SEC. 105. NSF CYBERSECURITY R&D PROGRAMS 

Reauthorizes the cybersecurity research program at the NSF and includes identity 

management as one of the research areas supported. 

Reauthorizes programs at NSF that provide funding for capacity building grants, 

graduate student fellowships, graduate student traineeships and research centers in 

cybersecurity. 

Requires NSF to establish a postdoctoral fellowship program in cybersecurity. 

SEC. 106. FEDERAL CYBER SCHOLARSHIP FOR SERVICE PROGRAM 

Authorizes the cybersecurity scholarship for service program at NSF. The program provides grants to institutions of higher education for the award of scholarships to students pursuing undergraduate and graduate degrees in cybersecurity 

fields and requires an equal number of years of service as a cybersecurity professional in the Federal Government as a condition of the scholarship. 

The program also provides capacity building grants to institutions of higher education, supporting such activities as faculty professional development and the development of cybersecurity-related curricula and courses. 

SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT 

Requires the President to issue a report assessing the current and future cybersecurity workforce needs of the Federal Government, including a comparison of the 

skills needed by each federal agency, the supply of cybersecurity talent, and any 

barriers to the recruitment and hiring of cybersecurity professionals. 

SEC. 108. CYBERSECURITY UNIVERSITY–INDUSTRY TASK FORCE 

Establishes a university-industry task force to explore mechanisms and models for 

carrying out public-private research partnerships in the area of cybersecurity. 

SEC. 109. CYBERSECURITY CHECKLIST AND DISSEMINATION 

Updates NIST’s authority for the National Checklist Program (NCP) which provides detailed guidance on setting the security configuration of operating systems 


jbell on DSKDVH8Z91PROD with REPORTS
116 

and applications and requires NIST to develop automated security specifications 

with respect to checklist content. 

SEC. 110. NIST CYBERSECURITY R&D 

Amends the National Institute of Standards and Technology Act to authorize 

NIST, as part of their in-house research program, to develop a unifying and standardized identity, privilege, and access control management framework. Authorizes 

NIST to conduct research related to improving the security of information and 

networked systems, including the security of industrial control systems. 

TITLE II—ADVANCEMENT OF CYBERSECURITY TECHNICAL STANDARDS 

SEC. 201. DEFINITIONS 

Defines the terms Director and Institute in the title. 

SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL STANDARDS 

NIST shall develop and implement a plan to ensure a coordinated United States 

Government representation in international cybersecurity technical standards development. This plan is due to Congress no later than one year after enactment. 

SEC. 203. PROMOTING CYBERSECURITY AWARENESS AND EDUCATION 

NIST shall deliver a plan to Congress within 90 days describing how it will develop and implement a cybersecurity awareness and education program. The program shall be aimed at disseminating cybersecurity best practices and standards 

and shall include how NIST will make these usable by individuals, small business, 

State and local governments, and educational institutions. This plan will include 

how NIST can utilize established Manufacturing Extension Partnership networks to 

have cybersecurity information readily available to small manufacturing companies. 

SEC. 204. IDENTITY MANAGEMENT RESEARCH AND DEVELOPMENT 

NIST shall engage in research and development programs to improve identity 

management systems. 


jbell on DSKDVH8Z91PROD with REPORTS
117 


jbell on DSKDVH8Z91PROD with REPORTShr4061b.eps
118 


jbell on DSKDVH8Z91PROD with REPORTShr4061f.eps
119 


jbell on DSKDVH8Z91PROD with REPORTShr4061g.eps
120 


jbell on DSKDVH8Z91PROD with REPORTShr4061h.eps
121 


jbell on DSKDVH8Z91PROD with REPORTShr4061i.eps
122 


jbell on DSKDVH8Z91PROD with REPORTShr4061j.eps
123 


jbell on DSKDVH8Z91PROD with REPORTShr4061k.eps
124 


jbell on DSKDVH8Z91PROD with REPORTShr4061l.eps
125 


jbell on DSKDVH8Z91PROD with REPORTShr4061m.eps
126 


jbell on DSKDVH8Z91PROD with REPORTShr4061n.eps
127 


jbell on DSKDVH8Z91PROD with REPORTShr4061o.eps
128 


jbell on DSKDVH8Z91PROD with REPORTShr4061p.eps
129 


jbell on DSKDVH8Z91PROD with REPORTShr4061q.eps
130 


jbell on DSKDVH8Z91PROD with REPORTShr4061r.eps
131 


jbell on DSKDVH8Z91PROD with REPORTShr4061s.eps
132 


jbell on DSKDVH8Z91PROD with REPORTShr4061t.eps
133 


jbell on DSKDVH8Z91PROD with REPORTShr4061u.eps
134 


jbell on DSKDVH8Z91PROD with REPORTShr4061v.eps
135 


jbell on DSKDVH8Z91PROD with REPORTShr4061w.eps
136 


jbell on DSKDVH8Z91PROD with REPORTShr4061x.eps
137 


jbell on DSKDVH8Z91PROD with REPORTShr4061y.eps
138 


jbell on DSKDVH8Z91PROD with REPORTShr4061z.eps
139 


jbell on DSKDVH8Z91PROD with REPORTShr4061aa.eps
140 


jbell on DSKDVH8Z91PROD with REPORTShr4061bb.eps
141 


jbell on DSKDVH8Z91PROD with REPORTShr4061cc.eps
142 


jbell on DSKDVH8Z91PROD with REPORTShr4061dd.eps
143 


jbell on DSKDVH8Z91PROD with REPORTShr4061ee.eps
144 


jbell on DSKDVH8Z91PROD with REPORTShr4061ff.eps
145 


jbell on DSKDVH8Z91PROD with REPORTShr4061gg.eps
146 


jbell on DSKDVH8Z91PROD with REPORTShr4061c.eps
147 


jbell on DSKDVH8Z91PROD with REPORTShr4061d.eps
148 


jbell on DSKDVH8Z91PROD with REPORTShr4061e.eps