IB 

Union Calendar No. 236 

111TH CONGRESS 

2D SESSION H. R. 4061 

[Report No. 111–405] 

To advance cybersecurity research, development, and technical standards, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

NOVEMBER 7, 2009 

Mr. LIPINSKI (for himself, Mr. MCCAUL, Mr. WU, Mr. EHLERS, Ms. EDDIE

BERNICE JOHNSON of Texas, Mr. SMITH of Nebraska, Mr. GORDON of 

Tennessee, Mr. HALL of Texas, Mr. LUJA ́N, and Mr. ROTHMAN of New 

Jersey) introduced the following bill; which was referred to the Committee 

on Science and Technology 

JANUARY 27, 2010 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on November 7, 2009] 


jlentini on DSKJ8SOYB1PROD with BILLS
2 

•HR 4061 RH

A BILL 

To advance cybersecurity research, development, and 

technical standards, and for other purposes. 


jlentini on DSKJ8SOYB1PROD with BILLS
3 

•HR 4061 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity Enhance5 ment Act of 2009’’. 

6 TITLE I—RESEARCH AND 

7 DEVELOPMENT 

8 SEC. 101. DEFINITIONS. 

9 In this title: 

10 (1) NATIONAL COORDINATION OFFICE.—The term 

11 National Coordination Office means the National Co12 ordination Office for the Networking and Information 

13 Technology Research and Development program. 

14 (2) PROGRAM.—The term Program means the 

15 Networking and Information Technology Research 

16 and Development program which has been established 

17 under section 101 of the High-Performance Com18 puting Act of 1991 (15 U.S.C. 5511). 

19 SEC. 102. FINDINGS. 

20 Section 2 of the Cyber Security Research and Develop21 ment Act (15 U.S.C. 7401) is amended— 

22 (1) by amending paragraph (1) to read as fol23 lows: 

24 ‘‘(1) Advancements in information and commu25 nications technology have resulted in a globally interVerDate Nov 24 2008 21:05 Jan 27, 2010 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6203 E:\BILLS\H4061.RH H4061

jlentini on DSKJ8SOYB1PROD with BILLS
4 

•HR 4061 RH

1 connected network of government, commercial, sci2 entific, and education infrastructures, including crit3 ical infrastructures for electric power, natural gas 

4 and petroleum production and distribution, tele5 communications, transportation, water supply, bank6 ing and finance, and emergency and government serv7 ices.’’; 

8 (2) in paragraph (2), by striking ‘‘Exponential 

9 increases in interconnectivity have facilitated en10 hanced communications, economic growth,’’ and in11 serting ‘‘These advancements have significantly con12 tributed to the growth of the United States economy’’; 

13 (3) by amending paragraph (3) to read as fol14 lows: 

15 ‘‘(3) The Cyberspace Policy Review published by 

16 the President in May, 2009, concluded that our infor17 mation technology and communications infrastruc18 ture is vulnerable and has ‘suffered intrusions that 

19 have allowed criminals to steal hundreds of millions 

20 of dollars and nation-states and other entities to steal 

21 intellectual property and sensitive military informa22 tion’.’’; 

23 (4) by redesignating paragraphs (4) through (6) 

24 as paragraphs (5) through (7), respectively; 


jlentini on DSKJ8SOYB1PROD with BILLS
5 

•HR 4061 RH

1 (5) by inserting after paragraph (3) the fol2 lowing new paragraph: 

3 ‘‘(4) In a series of hearings held before Congress 

4 in 2009, experts testified that the Federal cybersecu5 rity research and development portfolio was too fo6 cused on short-term, incremental research and that it 

7 lacked the prioritization and coordination necessary 

8 to address the long-term challenge of ensuring a se9 cure and reliable information technology and commu10 nications infrastructure.’’; and 

11 (6) by amending paragraph (7), as so redesig12 nated by paragraph (4) of this section, to read as fol13 lows: 

14 ‘‘(7) While African-Americans, Hispanics, and 

15 Native Americans constitute 33 percent of the college16 age population, members of these minorities comprise 

17 less than 20 percent of bachelor degree recipients in 

18 the field of computer sciences.’’. 

19 SEC. 103. CYBERSECURITY STRATEGIC RESEARCH AND DE20 VELOPMENT PLAN. 

21 (a) IN GENERAL.—Not later than 12 months after the 

22 date of enactment of this Act, the agencies identified in sub23 section 101(a)(3)(B)(i) through (x) of the High-Performance 

24 Computing Act of 1991 (15 U.S.C. 5511(a)(3)(B)(i) 

25 through (x)) or designated under section 101(a)(3)(B)(xi) 


jlentini on DSKJ8SOYB1PROD with BILLS
6 

•HR 4061 RH

1 of such Act, working through the National Science and 

2 Technology Council and with the assistance of the National 

3 Coordination Office, shall transmit to Congress a strategic 

4 plan based on an assessment of cybersecurity risk to guide 

5 the overall direction of Federal cybersecurity and informa6 tion assurance research and development for information 

7 technology and networking systems. Once every 3 years 

8 after the initial strategic plan is transmitted to Congress 

9 under this section, such agencies shall prepare and transmit 

10 to Congress an update of such plan. 

11 (b) CONTENTS OF PLAN.—The strategic plan required 

12 under subsection (a) shall— 

13 (1) specify and prioritize near-term, mid-term 

14 and long-term research objectives, including objectives 

15 associated with the research areas identified in sec16 tion 4(a)(1) of the Cyber Security Research and De17 velopment Act (15 U.S.C. 7403(a)(1)) and how the 

18 near-term objectives complement research and develop19 ment areas in which the private sector is actively en20 gaged; 

21 (2) describe how the Program will focus on inno22 vative, transformational technologies with the poten23 tial to enhance the security, reliability, resilience, and 

24 trustworthiness of the digital infrastructure; 


jlentini on DSKJ8SOYB1PROD with BILLS
7 

•HR 4061 RH

1 (3) describe how the Program will foster the 

2 transfer of research and development results into new 

3 cybersecurity technologies and applications for the 

4 benefit of society and the national interest, including 

5 through the dissemination of best practices and other 

6 outreach activities; 

7 (4) describe how the Program will establish and 

8 maintain a national research infrastructure for cre9 ating, testing, and evaluating the next generation of 

10 secure networking and information technology sys11 tems; 

12 (5) describe how the Program will facilitate ac13 cess by academic researchers to the infrastructure de14 scribed in paragraph (4), as well as to relevant data, 

15 including event data; and 

16 (6) describe how the Program will engage females 

17 and individuals identified in section 33 or 34 of the 

18 Science and Engineering Equal Opportunities Act 

19 (42 U.S.C. 1885a or 1885b) to foster a more diverse 

20 workforce in this area. 

21 (c) DEVELOPMENT OF ROADMAP.—The agencies de22 scribed in subsection (a) shall develop and annually update 

23 an implementation roadmap for the strategic plan required 

24 in this section. Such roadmap shall— 


jlentini on DSKJ8SOYB1PROD with BILLS
8 

•HR 4061 RH

1 (1) specify the role of each Federal agency in 

2 carrying out or sponsoring research and development 

3 to meet the research objectives of the strategic plan, 

4 including a description of how progress toward the re5 search objectives will be evaluated; 

6 (2) specify the funding allocated to each major 

7 research objective of the strategic plan and the source 

8 of funding by agency for the current fiscal year; and 

9 (3) estimate the funding required for each major 

10 research objective of the strategic plan for the fol11 lowing 3 fiscal years. 

12 (d) RECOMMENDATIONS.—In developing and updating 

13 the strategic plan under subsection (a), the agencies in14 volved shall solicit recommendations and advice from— 

15 (1) the advisory committee established under sec16 tion 101(b)(1) of the High-Performance Computing 

17 Act of 1991 (15 U.S.C. 5511(b)(1)); and 

18 (2) a wide range of stakeholders, including in19 dustry, academia, including representatives of minor20 ity serving institutions, and other relevant organiza21 tions and institutions. 

22 (e) APPENDING TO REPORT.—The implementation 

23 roadmap required under subsection (c), and its annual up24 dates, shall be appended to the report required under section 


jlentini on DSKJ8SOYB1PROD with BILLS
9 

•HR 4061 RH

1 101(a)(2)(D) of the High-Performance Computing Act of 

2 1991 (15 U.S.C. 5511(a)(2)(D)). 

3 SEC. 104. SOCIAL AND BEHAVIORAL RESEARCH IN CYBER4 SECURITY. 

5 Section 4(a)(1) of the Cyber Security Research and 

6 Development Act (15 U.S.C. 7403(a)(1)) is amended— 

7 (1) by inserting ‘‘and usability’’ after ‘‘to the 

8 structure’’; 

9 (2) in subparagraph (H), by striking ‘‘and’’ 

10 after the semicolon; 

11 (3) in subparagraph (I), by striking the period 

12 at the end and inserting ‘‘; and’’; and 

13 (4) by adding at the end the following new sub14 paragraph: 

15 ‘‘(J) social and behavioral factors, including 

16 human-computer interactions, usability, user 

17 motivations, and organizational cultures.’’. 

18 SEC. 105. NATIONAL SCIENCE FOUNDATION CYBERSECU19 RITY RESEARCH AND DEVELOPMENT PRO20 GRAMS. 

21 (a) COMPUTER AND NETWORK SECURITY RESEARCH

22 AREAS.—Section 4(a)(1) of the Cyber Security Research 

23 and Development Act (15 U.S.C. 7403(a)(1)) is amended 

24 in subparagraph (A) by inserting ‘‘identity management,’’ 

25 after ‘‘cryptography,’’. 


jlentini on DSKJ8SOYB1PROD with BILLS
10 

•HR 4061 RH

1 (b) COMPUTER AND NETWORK SECURITY RESEARCH

2 GRANTS.—Section 4(a)(3) of such Act (15 U.S.C. 

3 7403(a)(3)) is amended by striking subparagraphs (A) 

4 through (E) and inserting the following new subpara5 graphs: 

6 ‘‘(A) $68,700,000 for fiscal year 2010; 

7 ‘‘(B) $73,500,000 for fiscal year 2011; 

8 ‘‘(C) $78,600,000 for fiscal year 2012; 

9 ‘‘(D) $84,200,000 for fiscal year 2013; and 

10 ‘‘(E) $90,000,000 for fiscal year 2014.’’. 

11 (c) COMPUTER AND NETWORK SECURITY RESEARCH

12 CENTERS.—Section 4(b) of such Act (15 U.S.C. 7403(b)) 

13 is amended— 

14 (1) in paragraph (4)— 

15 (A) in subparagraph (C), by striking ‘‘and’’ 

16 after the semicolon; 

17 (B) in subparagraph (D), by striking the 

18 period and inserting ‘‘; and’’; and 

19 (C) by adding at the end the following new 

20 subparagraph: 

21 ‘‘(E) how the center will partner with gov22 ernment laboratories, for-profit entities, other in23 stitutions of higher education, or nonprofit re24 search institutions.’’; and 


jlentini on DSKJ8SOYB1PROD with BILLS
11 

•HR 4061 RH

1 (2) by amending paragraph (7) to read as fol2 lows: 

3 ‘‘(7) AUTHORIZATION OF APPROPRIATIONS.— 

4 There are authorized to be appropriated to the Na5 tional Science Foundation such sums as are necessary 

6 to carry out this subsection for each of the fiscal years 

7 2010 through 2014.’’. 

8 (d) COMPUTER AND NETWORK SECURITY CAPACITY

9 BUILDING GRANTS.—Section 5(a)(6) of such Act (15 U.S.C. 

10 7404(a)(6)) is amended to read as follows: 

11 ‘‘(6) AUTHORIZATION OF APPROPRIATIONS.— 

12 There are authorized to be appropriated to the Na13 tional Science Foundation such sums as are necessary 

14 to carry out this subsection for each of the fiscal years 

15 2010 through 2014.’’. 

16 (e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT

17 GRANTS.—Section 5(b)(2) of such Act (15 U.S.C. 

18 7404(b)(2)) is amended to read as follows: 

19 ‘‘(2) AUTHORIZATION OF APPROPRIATIONS.— 

20 There are authorized to be appropriated to the Na21 tional Science Foundation such sums as are necessary 

22 to carry out this subsection for each of the fiscal years 

23 2010 through 2014.’’. 


jlentini on DSKJ8SOYB1PROD with BILLS
12 

•HR 4061 RH

1 (f) GRADUATE TRAINEESHIPS IN COMPUTER AND NET2 WORK SECURITY.—Section 5(c)(7) of such Act (15 U.S.C. 

3 7404(c)(7)) is amended to read as follows: 

4 ‘‘(7) AUTHORIZATION OF APPROPRIATIONS.— 

5 There are authorized to be appropriated to the Na6 tional Science Foundation such sums as are necessary 

7 to carry out this subsection for each of the fiscal years 

8 2010 through 2014.’’. 

9 (g) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CY10 BERSECURITY.—Section 5(e) of such Act (15 U.S.C. 

11 7404(e)) is amended to read as follows: 

12 ‘‘(e) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CY13 BERSECURITY.— 

14 ‘‘(1) IN GENERAL.—The Director shall carry out 

15 a program to encourage young scientists and engi16 neers to conduct postdoctoral research in the fields of 

17 cybersecurity and information assurance, including 

18 the research areas described in section 4(a)(1), 

19 through the award of competitive, merit-based fellow20 ships. 

21 ‘‘(2) AUTHORIZATION OF APPROPRIATIONS.— 

22 There are authorized to be appropriated to the Na23 tional Science Foundation such sums as are necessary 

24 to carry out this subsection for each of the fiscal years 

25 2010 through 2014.’’. 


jlentini on DSKJ8SOYB1PROD with BILLS
13 

•HR 4061 RH

1 SEC. 106. FEDERAL CYBER SCHOLARSHIP FOR SERVICE 

2 PROGRAM. 

3 (a) IN GENERAL.—The Director of the National 

4 Science Foundation shall carry out a Scholarship for Serv5 ice program to recruit and train the next generation of Fed6 eral cybersecurity professionals and to increase the capacity 

7 of the higher education system to produce an information 

8 technology workforce with the skills necessary to enhance 

9 the security of the Nation’s communications and informa10 tion infrastructure. 

11 (b) CHARACTERISTICS OF PROGRAM.—The program 

12 under this section shall— 

13 (1) provide, through qualified institutions of 

14 higher education, scholarships that provide tuition, 

15 fees, and a competitive stipend for up to 2 years to 

16 students pursing a bachelor’s or master’s degree and 

17 up to 3 years to students pursuing a doctoral degree 

18 in a cybersecurity field; 

19 (2) provide the scholarship recipients with sum20 mer internship opportunities or other meaningful 

21 temporary appointments in the Federal information 

22 technology workforce; and 

23 (3) increase the capacity of institutions of higher 

24 education throughout all regions of the United States 

25 to produce highly qualified cybersecurity profesVerDate Nov 24 2008 21:05 Jan 27, 2010 Jkt 089200 PO 00000 Frm 00013 Fmt 6652 Sfmt 6203 E:\BILLS\H4061.RH H4061

jlentini on DSKJ8SOYB1PROD with BILLS
14 

•HR 4061 RH

1 sionals, through the award of competitive, merit-re2 viewed grants that support such activities as— 

3 (A) faculty professional development, in4 cluding technical, hands-on experiences in the 

5 private sector or government, workshops, semi6 nars, conferences, and other professional develop7 ment opportunities that will result in improved 

8 instructional capabilities; 

9 (B) institutional partnerships, including 

10 minority serving institutions; and 

11 (C) development of cybersecurity-related 

12 courses and curricula. 

13 (c) SCHOLARSHIP REQUIREMENTS.— 

14 (1) ELIGIBILITY.—Scholarships under this sec15 tion shall be available only to students who— 

16 (A) are citizens or permanent residents of 

17 the United States; 

18 (B) are full-time students in an eligible de19 gree program, as determined by the Director, 

20 that is focused on computer security or informa21 tion assurance at an awardee institution; and 

22 (C) accept the terms of a scholarship pursu23 ant to this section. 

24 (2) SELECTION.—Individuals shall be selected to 

25 receive scholarships primarily on the basis of acaVerDate Nov 24 2008 21:05 Jan 27, 2010 Jkt 089200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6203 E:\BILLS\H4061.RH H4061

jlentini on DSKJ8SOYB1PROD with BILLS
15 

•HR 4061 RH

1 demic merit, with consideration given to financial 

2 need and to the goal of promoting the participation 

3 of individuals identified in section 33 or 34 of the 

4 Science and Engineering Equal Opportunities Act 

5 (42 U.S.C. 1885a or 1885b). 

6 (3) SERVICE OBLIGATION.—If an individual re7 ceives a scholarship under this section, as a condition 

8 of receiving such scholarship, the individual upon 

9 completion of their degree must serve as a cybersecu10 rity professional within the Federal workforce for a 

11 period of time equal to the length of the scholarship. 

12 If a scholarship recipient is not offered employment 

13 by a Federal agency or a federally funded research 

14 and development center, the service requirement can 

15 be satisfied at the Director’s discretion by— 

16 (A) serving as a cybersecurity professional 

17 in a State, local, or tribal government agency; or 

18 (B) teaching cybersecurity courses at an in19 stitution of higher education. 

20 (4) CONDITIONS OF SUPPORT.—As a condition of 

21 acceptance of a scholarship under this section, a re22 cipient shall agree to provide the awardee institution 

23 with annual verifiable documentation of employment 

24 and up-to-date contact information. 

25 (d) FAILURE TO COMPLETE SERVICE OBLIGATION.— 


jlentini on DSKJ8SOYB1PROD with BILLS
16 

•HR 4061 RH

1 (1) GENERAL RULE.—If an individual who has 

2 received a scholarship under this section— 

3 (A) fails to maintain an acceptable level of 

4 academic standing in the educational institution 

5 in which the individual is enrolled, as deter6 mined by the Director; 

7 (B) is dismissed from such educational in8 stitution for disciplinary reasons; 

9 (C) withdraws from the program for which 

10 the award was made before the completion of 

11 such program; 

12 (D) declares that the individual does not in13 tend to fulfill the service obligation under this 

14 section; or 

15 (E) fails to fulfill the service obligation of 

16 the individual under this section, 

17 such individual shall be liable to the United States as 

18 provided in paragraph (3). 

19 (2) MONITORING COMPLIANCE.—As a condition 

20 of participating in the program, a qualified institu21 tion of higher education receiving a grant under this 

22 section shall— 

23 (A) enter into an agreement with the Direc24 tor of the National Science Foundation to monVerDate Nov 24 2008 21:05 Jan 27, 2010 Jkt 089200 PO 00000 Frm 00016 Fmt 6652 Sfmt 6203 E:\BILLS\H4061.RH H4061

jlentini on DSKJ8SOYB1PROD with BILLS
17 

•HR 4061 RH

1 itor the compliance of scholarship recipients with 

2 respect to their service obligation; and 

3 (B) provide to the Director, on an annual 

4 basis, post-award employment information re5 quired under subsection (c)(4) for scholarship re6 cipients through the completion of their service 

7 obligation. 

8 (3) AMOUNT OF REPAYMENT.— 

9 (A) LESS THAN ONE YEAR OF SERVICE.—If 

10 a circumstance described in paragraph (1) oc11 curs before the completion of 1 year of a service 

12 obligation under this section, the total amount of 

13 awards received by the individual under this sec14 tion shall be repaid or such amount shall be 

15 treated as a loan to be repaid in accordance with 

16 subparagraph (C). 

17 (B) MORE THAN ONE YEAR OF SERVICE.— 

18 If a circumstance described in subparagraph (D) 

19 or (E) of paragraph (1) occurs after the comple20 tion of 1 year of a service obligation under this 

21 section, the total amount of scholarship awards 

22 received by the individual under this section, re23 duced by the ratio of the number of years of serv24 ice completed divided by the number of years of 

25 service required, shall be repaid or such amount 


jlentini on DSKJ8SOYB1PROD with BILLS
18 

•HR 4061 RH

1 shall be treated as a loan to be repaid in accord2 ance with subparagraph (C). 

3 (C) REPAYMENTS.—A loan described in 

4 subparagraph (A) or (B) shall be treated as a 

5 Federal Direct Unsubsidized Stafford Loan 

6 under part D of title IV of the Higher Education 

7 Act of 1965 (20 U.S.C. 1087a and following), 

8 and shall be subject to repayment, together with 

9 interest thereon accruing from the date of the 

10 scholarship award, in accordance with terms and 

11 conditions specified by the Director (in consulta12 tion with the Secretary of Education) in regula13 tions promulgated to carry out this paragraph. 

14 (4) COLLECTION OF REPAYMENT.— 

15 (A) IN GENERAL.—In the event that a schol16 arship recipient is required to repay the scholar17 ship under this subsection, the institution pro18 viding the scholarship shall— 

19 (i) be responsible for determining the 

20 repayment amounts and for notifying the 

21 recipient and the Director of the amount 

22 owed; and 

23 (ii) collect such repayment amount 

24 within a period of time as determined 

25 under the agreement described in paragraph 


jlentini on DSKJ8SOYB1PROD with BILLS
19 

•HR 4061 RH

1 (2), or the repayment amount shall be treat2 ed as a loan in accordance with paragraph 

3 (3)(C). 

4 (B) RETURNED TO TREASURY.—Except as 

5 provided in subparagraph (C) of this paragraph, 

6 any such repayment shall be returned to the 

7 Treasury of the United States. 

8 (C) RETAIN PERCENTAGE.—An institution 

9 of higher education may retain a percentage of 

10 any repayment the institution collects under this 

11 paragraph to defray administrative costs associ12 ated with the collection. The Director shall estab13 lish a single, fixed percentage that will apply to 

14 all eligible entities. 

15 (5) EXCEPTIONS.—The Director may provide for 

16 the partial or total waiver or suspension of any serv17 ice or payment obligation by an individual under 

18 this section whenever compliance by the individual 

19 with the obligation is impossible or would involve ex20 treme hardship to the individual, or if enforcement of 

21 such obligation with respect to the individual would 

22 be unconscionable. 

23 (e) HIRING AUTHORITY.—For purposes of any law or 

24 regulation governing the appointment of individuals in the 

25 Federal civil service, upon successful completion of their deVerDate Nov 24 2008 21:05 Jan 27, 2010 Jkt 089200 PO 00000 Frm 00019 Fmt 6652 Sfmt 6203 E:\BILLS\H4061.RH H4061

jlentini on DSKJ8SOYB1PROD with BILLS
20 

•HR 4061 RH

1 gree, students receiving a scholarship under this section 

2 shall be hired under the authority provided for in section 

3 213.3102(r) of title 5, Code of Federal Regulations, and be 

4 exempted from competitive service. Upon fulfillment of the 

5 service term, such individuals shall be converted to a com6 petitive service position without competition if the indi7 vidual meets the requirements for that position. 

8 (f) AUTHORIZATION OF APPROPRIATIONS.—There are 

9 authorized to appropriated to the National Science Founda10 tion to carry out this section— 

11 (1) $18,700,000 for fiscal year 2010; 

12 (2) $20,100,000 for fiscal year 2011; 

13 (3) $21,600,000 for fiscal year 2012; 

14 (4) $23,300,000 for fiscal year 2013; and 

15 (5) $25,000,000 for fiscal year 2014. 

16 SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT. 

17 Not later than 180 days after the date of enactment 

18 of this Act the President shall transmit to the Congress a 

19 report addressing the cybersecurity workforce needs of the 

20 Federal Government. The report shall include— 

21 (1) an examination of the current state of and 

22 the projected needs of the Federal cybersecurity work23 force, including a comparison of the different agencies 

24 and departments, and an analysis of the capacity of 

25 such agencies and departments to meet those needs; 


jlentini on DSKJ8SOYB1PROD with BILLS
21 

•HR 4061 RH

1 (2) an analysis of the sources and availability of 

2 cybersecurity talent, a comparison of the skills and 

3 expertise sought by the Federal Government and the 

4 private sector, and an examination of the current and 

5 future capacity of United States institutions of higher 

6 education to provide cybersecurity professionals with 

7 those skills sought by the Federal Government and the 

8 private sector; 

9 (3) an examination of the effectiveness of the Na10 tional Centers of Academic Excellence in Information 

11 Assurance Education, the Centers of Academic Excel12 lence in Research, and the Federal Cyber Scholarship 

13 for Service programs in promoting higher education 

14 and research in cybersecurity and information assur15 ance and in producing a growing number of profes16 sionals with the necessary cybersecurity and informa17 tion assurance expertise; 

18 (4) an analysis of any barriers to the Federal 

19 Government recruiting and hiring cybersecurity tal20 ent, including barriers relating to compensation, the 

21 hiring process, job classification, and hiring flexibili22 ties; and 

23 (5) recommendations for Federal policies to en24 sure an adequate, well-trained Federal cybersecurity 

25 workforce. 


jlentini on DSKJ8SOYB1PROD with BILLS
22 

•HR 4061 RH

1 SEC. 108. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 

2 FORCE. 

3 (a) ESTABLISHMENT OF UNIVERSITY-INDUSTRY TASK

4 FORCE.—Not later than 180 days after the date of enact5 ment of this Act, the Director of the Office of Science and 

6 Technology Policy shall convene a task force to explore 

7 mechanisms for carrying out collaborative research and de8 velopment activities for cybersecurity through a consortium 

9 or other appropriate entity with participants from institu10 tions of higher education and industry. 

11 (b) FUNCTIONS.—The task force shall— 

12 (1) develop options for a collaborative model and 

13 an organizational structure for such entity under 

14 which the joint research and development activities 

15 could be planned, managed, and conducted effectively, 

16 including mechanisms for the allocation of resources 

17 among the participants in such entity for support of 

18 such activities; 

19 (2) propose a process for developing a research 

20 and development agenda for such entity, including 

21 guidelines to ensure an appropriate scope of work fo22 cused on nationally significant challenges and requir23 ing collaboration; 

24 (3) define the roles and responsibilities for the 

25 participants from institutions of higher education 

26 and industry in such entity; 


jlentini on DSKJ8SOYB1PROD with BILLS
23 

•HR 4061 RH

1 (4) propose guidelines for assigning intellectual 

2 property rights and for the transfer of research and 

3 development results to the private sector; and 

4 (5) make recommendations for how such entity 

5 could be funded from Federal, State, and nongovern6 mental sources. 

7 (c) COMPOSITION.—In establishing the task force 

8 under subsection (a), the Director of the Office of Science 

9 and Technology Policy shall appoint an equal number of 

10 individuals from institutions of higher education and from 

11 industry with knowledge and expertise in cybersecurity. 

12 (d) REPORT.—Not later than 12 months after the date 

13 of enactment of this Act, the Director of the Office of Science 

14 and Technology Policy shall transmit to the Congress a re15 port describing the findings and recommendations of the 

16 task force. 

17 SEC. 109. CYBERSECURITY CHECKLIST DEVELOPMENT AND 

18 DISSEMINATION. 

19 Section 8(c) of the Cyber Security Research and Devel20 opment Act (15 U.S.C. 7406(c)) is amended to read as fol21 lows: 

22 ‘‘(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— 

23 ‘‘(1) IN GENERAL.—The Director of the National 

24 Institute of Standards and Technology shall develop 

25 or identify and revise or adapt as necessary, checkVerDate Nov 24 2008 21:05 Jan 27, 2010 Jkt 089200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6203 E:\BILLS\H4061.RH H4061

jlentini on DSKJ8SOYB1PROD with BILLS
24 

•HR 4061 RH

1 lists, configuration profiles, and deployment rec2 ommendations for products and protocols that mini3 mize the security risks associated with each computer 

4 hardware or software system that is, or is likely to be5 come, widely used within the Federal Government. 

6 ‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di7 rector of the National Institute of Standards and 

8 Technology shall establish priorities for the develop9 ment of checklists under this subsection. Such prior10 ities may be based on the security risks associated 

11 with the use of each system, the number of agencies 

12 that use a particular system, the usefulness of the 

13 checklist to Federal agencies that are users or poten14 tial users of the system, or such other factors as the 

15 Director determines to be appropriate. 

16 ‘‘(3) EXCLUDED SYSTEMS.—The Director of the 

17 National Institute of Standards and Technology may 

18 exclude from the requirements of paragraph (1) any 

19 computer hardware or software system for which the 

20 Director determines that the development of a check21 list is inappropriate because of the infrequency of use 

22 of the system, the obsolescence of the system, or the 

23 inutility or impracticability of developing a checklist 

24 for the system. 


jlentini on DSKJ8SOYB1PROD with BILLS
25 

•HR 4061 RH

1 ‘‘(4) AUTOMATION SPECIFICATIONS.—The Direc2 tor of the National Institute of Standards and Tech3 nology shall develop automated security specifications 

4 (such as the Security Content Automation Protocol) 

5 with respect to checklist content and associated secu6 rity related data. 

7 ‘‘(5) DISSEMINATION OF CHECKLISTS.—The Di8 rector of the National Institute of Standards and 

9 Technology shall ensure that Federal agencies are in10 formed of the availability of any product developed or 

11 identified under the National Checklist Program for 

12 any information system, including the Security Con13 tent Automation Protocol and other automated secu14 rity specifications. 

15 ‘‘(6) AGENCY USE REQUIREMENTS.—The develop16 ment of a checklist under paragraph (1) for a com17 puter hardware or software system does not— 

18 ‘‘(A) require any Federal agency to select 

19 the specific settings or options recommended by 

20 the checklist for the system; 

21 ‘‘(B) establish conditions or prerequisites for 

22 Federal agency procurement or deployment of 

23 any such system; 


jlentini on DSKJ8SOYB1PROD with BILLS
26 

•HR 4061 RH

1 ‘‘(C) imply an endorsement of any such sys2 tem by the Director of the National Institute of 

3 Standards and Technology; or 

4 ‘‘(D) preclude any Federal agency from pro5 curing or deploying other computer hardware or 

6 software systems for which no such checklist has 

7 been developed or identified under paragraph 

8 (1).’’. 

9 SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH10 NOLOGY CYBERSECURITY RESEARCH AND DE11 VELOPMENT. 

12 Section 20 of the National Institute of Standards and 

13 Technology Act (15 U.S.C. 278g–3) is amended by redesig14 nating subsection (e) as subsection (f), and by inserting 

15 after subsection (d) the following: 

16 ‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 

17 the research activities conducted in accordance with sub18 section (d)(3), the Institute shall— 

19 ‘‘(1) conduct a research program to develop a 

20 unifying and standardized identity, privilege, and ac21 cess control management framework for the execution 

22 of a wide variety of resource protection policies and 

23 that is amenable to implementation within a wide 

24 variety of existing and emerging computing environ25 ments; 


jlentini on DSKJ8SOYB1PROD with BILLS
27 

•HR 4061 RH

1 ‘‘(2) carry out research associated with improv2 ing the security of information systems and networks; 

3 ‘‘(3) carry out research associated with improv4 ing the testing, measurement, usability, and assur5 ance of information systems and networks; and 

6 ‘‘(4) carry out research associated with improv7 ing security of industrial control systems.’’. 

8 TITLE II—ADVANCEMENT OF CY9 BERSECURITY TECHNICAL 

10 STANDARDS 

11 SEC. 201. DEFINITIONS. 

12 In this title: 

13 (1) DIRECTOR.—The term ‘‘Director’’ means the 

14 Director of the National Institute of Standards and 

15 Technology. 

16 (2) INSTITUTE.—The term ‘‘Institute’’ means the 

17 National Institute of Standards and Technology. 

18 SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 

19 STANDARDS. 

20 The Director, in coordination with appropriate Fed21 eral authorities, shall— 

22 (1) ensure coordination of United States Govern23 ment representation in the international development 

24 of technical standards related to cybersecurity; and 


jlentini on DSKJ8SOYB1PROD with BILLS
28 

•HR 4061 RH

1 (2) not later than 1 year after the date of enact2 ment of this Act, develop and transmit to the Con3 gress a proactive plan to engage international stand4 ards bodies with respect to the development of tech5 nical standards related to cybersecurity. 

6 SEC. 203. PROMOTING CYBERSECURITY AWARENESS AND 

7 EDUCATION. 

8 (a) PROGRAM.—The Director, in collaboration with 

9 relevant Federal agencies, industry, educational institu10 tions, and other organizations, shall develop and implement 

11 a cybersecurity awareness and education program to in12 crease public awareness of cybersecurity risks, consequences, 

13 and best practices through— 

14 (1) the widespread dissemination of cybersecu15 rity technical standards and best practices identified 

16 by the Institute; and 

17 (2) efforts to make cybersecurity technical stand18 ards and best practices usable by individuals, small 

19 to medium-sized businesses, State, local, and tribal 

20 governments, and educational institutions. 

21 (b) MANUFACTURING EXTENSION PARTNERSHIP.—The 

22 Director shall, to the extent appropriate, implement sub23 section (a) through the Manufacturing Extension Partner24 ship program under section 25 of the National Institute of 

25 Standards and Technology Act (15 U.S.C. 278k). 


jlentini on DSKJ8SOYB1PROD with BILLS
29 

•HR 4061 RH

1 (c) REPORT TO CONGRESS.—Not later than 90 days 

2 after the date of enactment of this Act, the Director shall 

3 transmit to the Congress a report containing a strategy for 

4 implementation of this section. 

5 SEC. 204. IDENTITY MANAGEMENT RESEARCH AND DEVEL6 OPMENT. 

7 The Director shall establish a program to support the 

8 development of technical standards, metrology, testbeds, and 

9 conformance criteria, taking into account appropriate user 

10 concerns, to— 

11 (1) improve interoperability among identity 

12 management technologies; 

13 (2) strengthen authentication methods of identity 

14 management systems; 

15 (3) improve privacy protection in identity man16 agement systems, including health information tech17 nology systems, through authentication and security 

18 protocols; and 

19 (4) improve the usability of identity manage20 ment systems. 


jlentini on DSKJ8SOYB1PROD with BILLS
Union Calendar No. 236 

111TH CONGRESS 

2D SESSION H. R. 4061 

[Report No. 111–405] 

A BILL 

and technical standards, and for other purposes. 

To advance cybersecurity research, development, 

JANUARY 27, 2010 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


jlentini on DSKJ8SOYB1PROD with BILLS