I 

111TH CONGRESS 

1ST SESSION H. R. 4061 

To advance cybersecurity research, development, and technical standards, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

NOVEMBER 7, 2009 

Mr. LIPINSKI (for himself, Mr. MCCAUL, Mr. WU, Mr. EHLERS, Ms. EDDIE

BERNICE JOHNSON of Texas, Mr. SMITH of Nebraska, Mr. GORDON of 

Tennessee, Mr. HALL of Texas, Mr. LUJA ́N, and Mr. ROTHMAN of New 

Jersey) introduced the following bill; which was referred to the Committee 

on Science and Technology 

A BILL 

To advance cybersecurity research, development, and 

technical standards, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity En5 hancement Act of 2009’’. 

6 TITLE I—RESEARCH AND 

7 DEVELOPMENT 

8 SEC. 101. DEFINITIONS. 

9 In this title: 


smartinez on DSKB9S0YB1PROD with BILLS
2 

•HR 4061 IH

1 (1) NATIONAL COORDINATION OFFICE.—The 

2 term National Coordination Office means the Na3 tional Coordination Office for the Networking and 

4 Information Technology Research and Development 

5 program. 

6 (2) PROGRAM.—The term Program means the 

7 Networking and Information Technology Research 

8 and Development program which has been estab9 lished under section 101 of the High-Performance 

10 Computing Act of 1991 (15 U.S.C. 5511). 

11 SEC. 102. FINDINGS. 

12 Section 2 of the Cyber Security Research and Devel13 opment Act (15 U.S.C. 7401) is amended— 

14 (1) by amending paragraph (1) to read as fol15 lows: 

16 ‘‘(1) Advancements in information and commu17 nications technology have resulted in a globally 

18 interconnected network of government, commercial, 

19 scientific, and education infrastructures, including 

20 critical infrastructures for electric power, natural 

21 gas and petroleum production and distribution, tele22 communications, transportation, water supply, bank23 ing and finance, and emergency and government 

24 services.’’; 


smartinez on DSKB9S0YB1PROD with BILLS
3 

•HR 4061 IH

1 (2) in paragraph (2), by striking ‘‘Exponential 

2 increases in interconnectivity have facilitated en3 hanced communications, economic growth,’’ and in4 serting ‘‘These advancements have significantly con5 tributed to the growth of the United States econ6 omy’’; 

7 (3) by amending paragraph (3) to read as fol8 lows: 

9 ‘‘(3) The Cyberspace Policy Review published 

10 by the President in May, 2009, concluded that our 

11 information technology and communications infra12 structure is vulnerable and has ‘suffered intrusions 

13 that have allowed criminals to steal hundreds of mil14 lions of dollars and nation-states and other entities 

15 to steal intellectual property and sensitive military 

16 information’.’’; 

17 (4) by redesignating paragraphs (4) through 

18 (6) as paragraphs (5) through (7), respectively; 

19 (5) by inserting after paragraph (3) the fol20 lowing new paragraph: 

21 ‘‘(4) In a series of hearings held before Con22 gress in 2009, experts testified that the Federal cy23 bersecurity research and development portfolio was 

24 too focused on short-term, incremental research and 

25 that it lacked the prioritization and coordination 


smartinez on DSKB9S0YB1PROD with BILLS
4 

•HR 4061 IH

1 necessary to address the long-term challenge of en2 suring a secure and reliable information technology 

3 and communications infrastructure.’’; and 

4 (6) by amending paragraph (7), as so redesig5 nated by paragraph (4) of this section, to read as 

6 follows: 

7 ‘‘(7) While African-Americans, Hispanics, and 

8 Native Americans constitute 33 percent of the col9 lege-age population, members of these minorities 

10 comprise less than 20 percent of bachelor degree re11 cipients in the field of computer sciences.’’. 

12 SEC. 103. CYBERSECURITY STRATEGIC RESEARCH AND DE13 VELOPMENT PLAN. 

14 (a) IN GENERAL.—Not later than 12 months after 

15 the date of enactment of this Act, the agencies identified 

16 in subsection 101(a)(3)(B) (i) through (x) of the High17 Performance Computing Act of 1991 (15 U.S.C. 

18 5511(a)(3)(B) (i) through (x)) or designated under section 

19 101(a)(3)(B)(xi) of such Act, working through the Na20 tional Science and Technology Council and with the assist21 ance of the National Coordination Office, shall transmit 

22 to Congress a strategic plan based on an assessment of 

23 cybersecurity risk to guide the overall direction of Federal 

24 cybersecurity and information assurance research and de25 velopment for information technology and networking sysVerDate Nov 24 2008 05:49 Nov 08, 2009 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H4061.IH H4061

smartinez on DSKB9S0YB1PROD with BILLS
5 

•HR 4061 IH

1 tems. Once every 3 years after the initial strategic plan 

2 is transmitted to Congress under this section, such agen3 cies shall prepare and transmit to Congress an update of 

4 such plan. 

5 (b) CONTENTS OF PLAN.—The strategic plan re6 quired under subsection (a) shall— 

7 (1) specify and prioritize near-term, mid-term 

8 and long-term research objectives, including objec9 tives associated with the research areas identified in 

10 section 4(a)(1) of the Cyber Security Research and 

11 Development Act (15 U.S.C. 7403(a)(1)) and how 

12 the near-term objectives complement research and 

13 development areas in which the private sector is ac14 tively engaged; 

15 (2) describe how the Program will focus on in16 novative, transformational technologies with the po17 tential to enhance the security, reliability, resilience, 

18 and trustworthiness of the digital infrastructure; 

19 (3) describe how the Program will foster the 

20 transfer of research and development results into 

21 new cybersecurity technologies and applications for 

22 the benefit of society and the national interest, in23 cluding through the dissemination of best practices 

24 and other outreach activities; 


smartinez on DSKB9S0YB1PROD with BILLS
6 

•HR 4061 IH

1 (4) describe how the Program will establish and 

2 maintain a national research infrastructure for cre3 ating, testing, and evaluating the next generation of 

4 secure networking and information technology sys5 tems; 

6 (5) describe how the Program will facilitate ac7 cess by academic researchers to the infrastructure 

8 described in paragraph (4), as well as to event data; 

9 and 

10 (6) describe how the Program will engage fe11 males and individuals identified in section 33 or 34 

12 of the Science and Engineering Equal Opportunities 

13 Act (42 U.S.C. 1885a or 1885b) to foster a more di14 verse workforce in this area. 

15 (c) DEVELOPMENT OF ROADMAP.—The agencies de16 scribed in subsection (a) shall develop and annually update 

17 an implementation roadmap for the strategic plan re18 quired in this section. Such roadmap shall— 

19 (1) specify the role of each Federal agency in 

20 carrying out or sponsoring research and development 

21 to meet the research objectives of the strategic plan, 

22 including a description of how progress toward the 

23 research objectives will be evaluated; 

24 (2) specify the funding allocated to each major 

25 research objective of the strategic plan and the 


smartinez on DSKB9S0YB1PROD with BILLS
7 

•HR 4061 IH

1 source of funding by agency for the current fiscal 

2 year; and 

3 (3) estimate the funding required for each 

4 major research objective of the strategic plan for the 

5 following 3 fiscal years. 

6 (d) RECOMMENDATIONS.—In developing and updat7 ing the strategic plan under subsection (a), the agencies 

8 involved shall solicit recommendations and advice from— 

9 (1) the advisory committee established under 

10 section 101(b)(1) of the High-Performance Com11 puting Act of 1991 (15 U.S.C. 5511(b)(1)); and 

12 (2) a wide range of stakeholders, including in13 dustry, academia, including representatives of mi14 nority serving institutions, and other relevant orga15 nizations and institutions. 

16 (e) APPENDING TO REPORT.—The implementation 

17 roadmap required under subsection (c), and its annual up18 dates, shall be appended to the report required under sec19 tion 101(a)(2)(D) of the High-Performance Computing 

20 Act of 1991 (15 U.S.C. 5511(a)(2)(D)). 

21 SEC. 104. SOCIAL AND BEHAVIORAL RESEARCH IN CYBER22 SECURITY. 

23 Section 4(a)(1) of the Cyber Security Research and 

24 Development Act (15 U.S.C. 7403(a)(1)) is amended— 


smartinez on DSKB9S0YB1PROD with BILLS
8 

•HR 4061 IH

1 (1) by inserting ‘‘and usability’’ after ‘‘to the 

2 structure’’; 

3 (2) in subparagraph (H), by striking ‘‘and’’ 

4 after the semicolon; 

5 (3) in subparagraph (I), by striking the period 

6 at the end and inserting ‘‘; and’’; and 

7 (4) by adding at the end the following new sub8 paragraph: 

9 ‘‘(J) social and behavioral factors, includ10 ing human-computer interactions, usability, 

11 user motivations, and organizational cultures.’’. 

12 SEC. 105. NATIONAL SCIENCE FOUNDATION CYBERSECU13 RITY RESEARCH AND DEVELOPMENT PRO14 GRAMS. 

15 (a) COMPUTER AND NETWORK SECURITY RESEARCH

16 AREAS.—Section 4(a) of the Cyber Security Research and 

17 Development Act (15 U.S.C. 7403(a)(1)) is amended in 

18 subparagraph (A) by inserting ‘‘identity management,’’ 

19 after ‘‘cryptography,’’. 

20 (b) COMPUTER AND NETWORK SECURITY RESEARCH

21 GRANTS.—Section 4(a)(3) of such Act (15 U.S.C. 

22 7403(a)(3)) is amended by striking subparagraphs (A) 

23 through (E) and inserting the following new subpara24 graphs: 

25 ‘‘(A) $68,700,000 for fiscal year 2010; 


smartinez on DSKB9S0YB1PROD with BILLS
9 

•HR 4061 IH

1 ‘‘(B) $73,500,000 for fiscal year 2011; 

2 ‘‘(C) $78,600,000 for fiscal year 2012; 

3 ‘‘(D) $84,200,000 for fiscal year 2013; 

4 and 

5 ‘‘(E) $90,000,000 for fiscal year 2014.’’. 

6 (c) COMPUTER AND NETWORK SECURITY RESEARCH

7 CENTERS.—Section 4(b) of such Act (15 U.S.C. 7403(b)) 

8 is amended— 

9 (1) in paragraph (4)— 

10 (A) in subparagraph (C), by inserting 

11 ‘‘and’’ after the semicolon; 

12 (B) in subparagraph (D), by striking the 

13 period and inserting ‘‘; and’’; and 

14 (C) by striking subparagraph (D); 

15 (2) by adding at the end the following new sub16 paragraph: 

17 ‘‘(E) how the center will partner with gov18 ernment laboratories, for-profit entities, other 

19 institutions of higher education, or nonprofit re20 search institutions.’’; and 

21 (3) by amending paragraph (7) to read as fol22 lows: 

23 ‘‘(7) AUTHORIZATION OF APPROPRIATIONS.— 

24 There are authorized to be appropriated to the Na25 tional Science Foundation such sums as are necVerDate Nov 24 2008 04:12 Nov 08, 2009 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H4061.IH H4061

smartinez on DSKB9S0YB1PROD with BILLS
10 

•HR 4061 IH

1 essary to carry out this subsection for each of the 

2 fiscal years 2010 through 2014.’’. 

3 (d) COMPUTER AND NETWORK SECURITY CAPACITY

4 BUILDING GRANTS.—Section 5(a)(6) of such Act (15 

5 U.S.C. 7404(a)(6)) is amended to read as follows: 

6 ‘‘(6) AUTHORIZATION OF APPROPRIATIONS.— 

7 There are authorized to be appropriated to the Na8 tional Science Foundation such sums as are nec9 essary to carry out this subsection for each of the 

10 fiscal years 2010 through 2014.’’. 

11 (e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT

12 GRANTS.—Section 5(b)(2) of such Act (15 U.S.C. 

13 7404(b)(2)) is amended to read as follows: 

14 ‘‘(2) AUTHORIZATION OF APPROPRIATIONS.— 

15 There are authorized to be appropriated to the Na16 tional Science Foundation such sums as are nec17 essary to carry out this subsection for each of the 

18 fiscal years 2010 through 2014.’’. 

19 (f) GRADUATE TRAINEESHIPS IN COMPUTER AND

20 NETWORK SECURITY.—Section 5(c)(7) of such Act (15 

21 U.S.C. 7404(c)(7)) is amended to read as follows: 

22 ‘‘(7) AUTHORIZATION OF APPROPRIATIONS.— 

23 There are authorized to be appropriated to the Na24 tional Science Foundation such sums as are necVerDate Nov 24 2008 04:12 Nov 08, 2009 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H4061.IH H4061

smartinez on DSKB9S0YB1PROD with BILLS
11 

•HR 4061 IH

1 essary to carry out this subsection for each of the 

2 fiscal years 2010 through 2014.’’. 

3 (g) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CY4 BERSECURITY.—Section 5(e) of such Act (15 U.S.C. 

5 7404(e)) is amended to read as follows: 

6 ‘‘(e) POSTDOCTORAL RESEARCH FELLOWSHIPS IN

7 CYBERSECURITY.— 

8 ‘‘(1) IN GENERAL.—The Director shall carry 

9 out a program to encourage young scientists and en10 gineers to conduct postdoctoral research in the fields 

11 of cybersecurity and information assurance, includ12 ing the research areas described in section 4(a)(1), 

13 through the award of competitive, merit-based fel14 lowships. 

15 ‘‘(2) AUTHORIZATION OF APPROPRIATIONS.— 

16 There are authorized to be appropriated to the Na17 tional Science Foundation such sums as are nec18 essary to carry out this subsection for each of the 

19 fiscal years 2010 through 2014.’’. 

20 SEC. 106. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 

21 FORCE. 

22 (a) ESTABLISHMENT OF UNIVERSITY-INDUSTRY

23 TASK FORCE.—Not later than 180 days after the date of 

24 enactment of this Act, the Director of the Office of Science 

25 and Technology Policy shall convene a task force to exVerDate Nov 24 2008 05:49 Nov 08, 2009 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H4061.IH H4061

smartinez on DSKB9S0YB1PROD with BILLS
12 

•HR 4061 IH

1 plore mechanisms for carrying out collaborative research 

2 and development activities for cybersecurity through a 

3 consortium or other appropriate entity with participants 

4 from institutions of higher education and industry. 

5 (b) FUNCTIONS.—The task force shall— 

6 (1) develop options for a collaborative model 

7 and an organizational structure for such entity 

8 under which the joint research and development ac9 tivities could be planned, managed, and conducted 

10 effectively, including mechanisms for the allocation 

11 of resources among the participants in such entity 

12 for support of such activities; 

13 (2) propose a process for developing a research 

14 and development agenda for such entity, including 

15 guidelines to ensure an appropriate scope of work fo16 cused on nationally significant challenges and requir17 ing collaboration; 

18 (3) define the roles and responsibilities for the 

19 participants from institutions of higher education 

20 and industry in such entity; 

21 (4) propose guidelines for assigning intellectual 

22 property rights and for the transfer of research and 

23 development results to the private sector; and 


smartinez on DSKB9S0YB1PROD with BILLS
13 

•HR 4061 IH

1 (5) make recommendations for how such entity 

2 could be funded from Federal, State, and nongovern3 mental sources. 

4 (c) COMPOSITION.—In establishing the task force 

5 under subsection (a), the Director of the Office of Science 

6 and Technology Policy shall appoint an equal number of 

7 individuals from institutions of higher education and from 

8 industry with knowledge and expertise in cybersecurity. 

9 (d) REPORT.—Not later than 12 months after the 

10 date of enactment of this Act, the Director of the Office 

11 of Science and Technology Policy shall transmit to the 

12 Congress a report describing the findings and rec13 ommendations of the task force. 

14 SEC. 107. CYBERSECURITY CHECKLIST DEVELOPMENT AND 

15 DISSEMINATION. 

16 Section 8(c) of the Cybersecurity Research and De17 velopment Act (15 U.S.C. 7406(c)) is amended to read 

18 as follows: 

19 ‘‘(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— 

20 ‘‘(1) IN GENERAL.—The Director of the Na21 tional Institute of Standards and Technology shall 

22 develop or identify and revise or adapt as necessary, 

23 checklists, configuration profiles, and deployment 

24 recommendations for products and protocols that 

25 minimize the security risks associated with each 


smartinez on DSKB9S0YB1PROD with BILLS
14 

•HR 4061 IH

1 computer hardware or software system that is, or is 

2 likely to become, widely used within the Federal 

3 Government. 

4 ‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di5 rector of the National Institute of Standards and 

6 Technology shall establish priorities for the develop7 ment of checklists under this subsection. Such prior8 ities may be based on the security risks associated 

9 with the use of each system, the number of agencies 

10 that use a particular system, the usefulness of the 

11 checklist to Federal agencies that are users or po12 tential users of the system, or such other factors as 

13 the Director determines to be appropriate. 

14 ‘‘(3) EXCLUDED SYSTEMS.—The Director of 

15 the National Institute of Standards and Technology 

16 may exclude from the requirements of paragraph (1) 

17 any computer hardware or software system for 

18 which the Director determines that the development 

19 of a checklist is inappropriate because of the infre20 quency of use of the system, the obsolescence of the 

21 system, or the inutility or impracticability of devel22 oping a checklist for the system. 

23 ‘‘(4) AUTOMATION SPECIFICATIONS.—The Di24 rector of the National Institute of Standards and 

25 Technology shall develop automated security speciVerDate Nov 24 2008 04:12 Nov 08, 2009 Jkt 089200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6201 E:\BILLS\H4061.IH H4061

smartinez on DSKB9S0YB1PROD with BILLS
15 

•HR 4061 IH

1 fications (such as the Security Content Automation 

2 Protocol) with respect to checklist content and asso3 ciated security related data. 

4 ‘‘(5) DISSEMINATION OF CHECKLISTS.—The 

5 Director of the National Institute of Standards and 

6 Technology shall ensure that any product developed 

7 under the National Checklist Program for any infor8 mation system, including the Security Content Auto9 mation Protocol and other automated security speci10 fications, is made available to Federal agencies. 

11 ‘‘(6) AGENCY USE REQUIREMENTS.—Federal 

12 agencies shall use checklists developed or identified 

13 under paragraph (1) to secure computer hardware 

14 and software systems. This paragraph does not— 

15 ‘‘(A) require any Federal agency to select 

16 the specific settings or options recommended by 

17 the checklist for the system; 

18 ‘‘(B) establish conditions or prerequisites 

19 for Federal agency procurement or deployment 

20 of any such system; 

21 ‘‘(C) imply an endorsement of any such 

22 system by the Director of the National Institute 

23 of Standards and Technology; or 

24 ‘‘(D) preclude any Federal agency from 

25 procuring or deploying other computer hardVerDate Nov 24 2008 04:12 Nov 08, 2009 Jkt 089200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6201 E:\BILLS\H4061.IH H4061

smartinez on DSKB9S0YB1PROD with BILLS
16 

•HR 4061 IH

1 ware or software systems for which no such 

2 checklist has been developed or identified under 

3 paragraph (1).’’. 

4 SEC. 108. NATIONAL INSTITUTE OF STANDARDS AND TECH5 NOLOGY CYBERSECURITY RESEARCH AND 

6 DEVELOPMENT. 

7 Section 20 of the National Institute of Standards and 

8 Technology Act (15 U.S.C. 278g–3) is amended by redes9 ignating subsection (e) as subsection (f), and by inserting 

10 after subsection (d) the following: 

11 ‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 

12 the research activities conducted in accordance with sub13 section (d)(3), the Institute shall— 

14 ‘‘(1) conduct a research program to develop a 

15 unifying and standardized identity, privilege, and ac16 cess control management framework for the execu17 tion of a wide variety of resource protection policies 

18 and that is amenable to implementation within a 

19 wide variety of existing and emerging computing en20 vironments; 

21 ‘‘(2) carry out research associated with improv22 ing the security of information systems and net23 works; 


smartinez on DSKB9S0YB1PROD with BILLS
17 

•HR 4061 IH

1 ‘‘(3) carry out research associated with improv2 ing the testing, measurement, usability, and assur3 ance of information systems and networks; and 

4 ‘‘(4) carry out research associated with improv5 ing security of industrial control systems.’’. 

6 TITLE II—ADVANCEMENT OF CY7 BERSECURITY TECHNICAL 

8 STANDARDS 

9 SEC. 201. DEFINITIONS. 

10 In this title: 

11 (1) DIRECTOR.—The term ‘‘Director’’ means 

12 the Director of the National Institute of Standards 

13 and Technology. 

14 (2) INSTITUTE.—The term ‘‘Institute’’ means 

15 the National Institute of Standards and Technology. 

16 SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 

17 STANDARDS. 

18 The Director, in coordination with appropriate Fed19 eral authorities, shall— 

20 (1) ensure coordination of United States Gov21 ernment representation in the international develop22 ment of technical standards related to cybersecurity; 

23 and 

24 (2) not later than 1 year after the date of en25 actment of this Act, develop and transmit to the 


smartinez on DSKB9S0YB1PROD with BILLS
18 

•HR 4061 IH

1 Congress a proactive plan to engage international 

2 standards bodies with respect to the development of 

3 technical standards related to cybersecurity. 

4 SEC. 203. PROMOTING CYBERSECURITY AWARENESS AND 

5 EDUCATION. 

6 (a) PROGRAM.—The Director, in collaboration with 

7 relevant Federal agencies, industry, educational institu8 tions, and other organizations, shall develop and imple9 ment a cybersecurity awareness and education program to 

10 increase public awareness of cybersecurity risks, con11 sequences, and best practices through— 

12 (1) the widespread dissemination of cybersecu13 rity technical standards and best practices identified 

14 by the Institute; and 

15 (2) efforts to make cybersecurity technical 

16 standards and best practices usable by individuals, 

17 small to medium-sized businesses, State and local 

18 governments, and educational institutions. 

19 (b) MANUFACTURING EXTENSION PARTNERSHIP.— 

20 The Director shall, to the extent appropriate, implement 

21 subsection (a) through the Manufacturing Extension Part22 nership program under section 25 of the National Insti23 tute of Standards and Technology Act (15 U.S.C. 278k). 

24 (c) REPORT TO CONGRESS.—Not later than 90 days 

25 after the date of enactment of this Act, the Director shall 


smartinez on DSKB9S0YB1PROD with BILLS
19 

•HR 4061 IH

1 transmit to the Congress a report containing a strategy 

2 for implementation of this section. 

3 SEC. 204. IDENTITY MANAGEMENT RESEARCH AND DEVEL4 OPMENT. 

5 The Director shall establish a program to support the 

6 development of technical standards, metrology, testbeds, 

7 and conformance criteria, taking into account appropriate 

8 user concerns, to— 

9 (1) improve interoperability among identity 

10 management technologies; 

11 (2) strengthen authentication methods of iden12 tity management systems; and 

13 (3) improve privacy protection in identity man14 agement systems, including health information tech15 nology systems, through authentication and security 

16 protocols. 

Æ 


smartinez on DSKB9S0YB1PROD with BILLS