II 

Calendar No. 438 

112TH CONGRESS 

2D SESSION S. 3342 

To improve information security, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JUNE 27, 2012 

Mr. MCCAIN (for himself, Mrs. HUTCHISON, Mr. CHAMBLISS, Mr. GRASSLEY, 

Ms. MURKOWSKI, Mr. COATS, Mr. BURR, and Mr. JOHNSON of Wisconsin) introduced the following bill; which was read the first time 

JUNE 28, 2012 

Read the second time and placed on the calendar 

A BILL 

To improve information security, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 

4 (a) SHORT TITLE.—This Act may be cited as the 

5 ‘‘Strengthening and Enhancing Cybersecurity by Using 

6 Research, Education, Information, and Technology Act of 

7 2012’’ or ‘‘SECURE IT’’. 

mstockstill on DSK4VPTVN1PROD with BILLS

2 

•S 3342 PCS

1 (b) TABLE OF CONTENTS.—The table of contents of 

2 this Act is as follows: 

Sec. 1. Short title; table of contents. 

TITLE I—FACILITATING SHARING OF CYBER THREAT 

INFORMATION 

Sec. 101. Definitions. 

Sec. 102. Authorization to share cyber threat information. 

Sec. 103. Information sharing by the Federal government. 

Sec. 104. Construction. 

Sec. 105. Report on implementation. 

Sec. 106. Inspector General review. 

Sec. 107. Technical amendments. 

Sec. 108. Access to classified information. 

TITLE II—COORDINATION OF FEDERAL INFORMATION SECURITY 

POLICY 

Sec. 201. Coordination of Federal information security policy. 

Sec. 202. Management of information technology. 

Sec. 203. No new funding. 

Sec. 204. Technical and conforming amendments. 

Sec. 205. Clarification of authorities. 

TITLE III—CRIMINAL PENALTIES 

Sec. 301. Penalties for fraud and related activity in connection with computers. 

Sec. 302. Trafficking in passwords. 

Sec. 303. Conspiracy and attempted computer fraud offenses. 

Sec. 304. Criminal and civil forfeiture for fraud and related activity in connection with computers. 

Sec. 305. Damage to critical infrastructure computers. 

Sec. 306. Limitation on actions involving unauthorized use. 

Sec. 307. No new funding. 

TITLE IV—CYBERSECURITY RESEARCH AND DEVELOPMENT 

Sec. 401. National High-Performance Computing Program planning and coordination. 

Sec. 402. Research in areas of national importance. 

Sec. 403. Program improvements. 

Sec. 404. Improving education of networking and information technology, including high performance computing. 

Sec. 405. Conforming and technical amendments to the High-Performance 

Computing Act of 1991. 

Sec. 406. Federal cyber scholarship-for-service program. 

Sec. 407. Study and analysis of certification and training of information infrastructure professionals. 

Sec. 408. International cybersecurity technical standards. 

Sec. 409. Identity management research and development. 

Sec. 410. Federal cybersecurity research and development. 

mstockstill on DSK4VPTVN1PROD with BILLS

3 

•S 3342 PCS

1 TITLE I—FACILITATING SHAR2 ING OF CYBER THREAT IN3 FORMATION 

4 SEC. 101. DEFINITIONS. 

5 In this title: 

6 (1) AGENCY.—The term ‘‘agency’’ has the 

7 meaning given the term in section 3502 of title 44, 

8 United States Code. 

9 (2) ANTITRUST LAWS.—The term ‘‘antitrust 

10 laws’’— 

11 (A) has the meaning given the term in sec12 tion 1(a) of the Clayton Act (15 U.S.C. 12(a)); 

13 (B) includes section 5 of the Federal 

14 Trade Commission Act (15 U.S.C. 45) to the 

15 extent that section 5 of that Act applies to un16 fair methods of competition; and 

17 (C) includes any State law that has the 

18 same intent and effect as the laws under sub19 paragraphs (A) and (B). 

20 (3) COUNTERMEASURE.—The term ‘‘counter21 measure’’ means an automated or a manual action 

22 with defensive intent to mitigate cyber threats. 

23 (4) CYBER THREAT INFORMATION.—The term 

24 ‘‘cyber threat information’’ means information that 

25 indicates or describes— 

mstockstill on DSK4VPTVN1PROD with BILLS

4 

•S 3342 PCS

1 (A) a technical or operation vulnerability 

2 or a cyber threat mitigation measure; 

3 (B) an action or operation to mitigate a 

4 cyber threat; 

5 (C) malicious reconnaissance, including 

6 anomalous patterns of network activity that ap7 pear to be transmitted for the purpose of gath8 ering technical information related to a cyberse9 curity threat; 

10 (D) a method of defeating a technical con11 trol; 

12 (E) a method of defeating an operational 

13 control; 

14 (F) network activity or protocols known to 

15 be associated with a malicious cyber actor or 

16 that signify malicious cyber intent; 

17 (G) a method of causing a user with legiti18 mate access to an information system or infor19 mation that is stored on, processed by, or 

20 transiting an information system to inadvert21 ently enable the defeat of a technical or oper22 ational control; 

23 (H) any other attribute of a cybersecurity 

24 threat or cyber defense information that would 

25 foster situational awareness of the United 

mstockstill on DSK4VPTVN1PROD with BILLS

5 

•S 3342 PCS

1 States cybersecurity posture, if disclosure of 

2 such attribute or information is not otherwise 

3 prohibited by law; 

4 (I) the actual or potential harm caused by 

5 a cyber incident, including information 

6 exfiltrated when it is necessary in order to iden7 tify or describe a cybersecurity threat; or 

8 (J) any combination of subparagraphs (A) 

9 through (I). 

10 (5) CYBERSECURITY CENTER.—The term ‘‘cy11 bersecurity center’’ means the Department of De12 fense Cyber Crime Center, the Intelligence Commu13 nity Incident Response Center, the United States 

14 Cyber Command Joint Operations Center, the Na15 tional Cyber Investigative Joint Task Force, the Na16 tional Security Agency/Central Security Service 

17 Threat Operations Center, the National Cybersecu18 rity and Communications Integration Center, and 

19 any successor center. 

20 (6) CYBERSECURITY SYSTEM.—The term ‘‘cy21 bersecurity system’’ means a system designed or em22 ployed to ensure the integrity, confidentiality, or 

23 availability of, or to safeguard, a system or network, 

24 including measures intended to protect a system or 

25 network from— 

mstockstill on DSK4VPTVN1PROD with BILLS

6 

•S 3342 PCS

1 (A) efforts to degrade, disrupt, or destroy 

2 such system or network; or 

3 (B) theft or misappropriations of private 

4 or government information, intellectual prop5 erty, or personally identifiable information. 

6 (7) ENTITY.— 

7 (A) IN GENERAL.—The term ‘‘entity’’ 

8 means any private entity, non-Federal govern9 ment agency or department, or State, tribal, or 

10 local government agency or department (includ11 ing an officer, employee, or agent thereof). 

12 (B) INCLUSIONS.—The term ‘‘entity’’ in13 cludes a government agency or department (in14 cluding an officer, employeee, or agent thereof) 

15 of the District of Columbia, the Commonwealth 

16 of Puerto Rico, the Virgin Islands, Guam, 

17 American Samoa, the Northern Mariana Is18 lands, and any other territory or possession of 

19 the United States. 

20 (8) FEDERAL INFORMATION SYSTEM.—The 

21 term ‘‘Federal information system’’ means an infor22 mation system of a Federal department or agency 

23 used or operated by an executive agency, by a con24 tractor of an executive agency, or by another organi25 zation on behalf of an executive agency. 

mstockstill on DSK4VPTVN1PROD with BILLS

7 

•S 3342 PCS

1 (9) INFORMATION SECURITY.—The term ‘‘infor2 mation security’’ means protecting information and 

3 information systems from disruption or unauthorized 

4 access, use, disclosure, modification, or destruction 

5 in order to provide— 

6 (A) integrity, by guarding against im7 proper information modification or destruction, 

8 including by ensuring information nonrepudi9 ation and authenticity; 

10 (B) confidentiality, by preserving author11 ized restrictions on access and disclosure, in12 cluding means for protecting personal privacy 

13 and proprietary information; or 

14 (C) availability, by ensuring timely and re15 liable access to and use of information. 

16 (10) INFORMATION SYSTEM.—The term ‘‘infor17 mation system’’ has the meaning given the term in 

18 section 3502 of title 44, United States Code. 

19 (11) LOCAL GOVERNMENT.—The term ‘‘local 

20 government’’ means any borough, city, county, par21 ish, town, township, village, or other general purpose 

22 political subdivision of a State. 

23 (12) MALICIOUS RECONNAISSANCE.—The term 

24 ‘‘malicious reconnaissance’’ means a method for ac25 tively probing or passively monitoring an information 

mstockstill on DSK4VPTVN1PROD with BILLS

8 

•S 3342 PCS

1 system for the purpose of discerning technical 

2 vulnerabilities of the information system, if such 

3 method is associated with a known or suspected cy4 bersecurity threat. 

5 (13) OPERATIONAL CONTROL.—The term 

6 ‘‘operational control’’ means a security control for 

7 an information system that primarily is implemented 

8 and executed by people. 

9 (14) OPERATIONAL VULNERABILITY.—The 

10 term ‘‘operational vulnerability’’ means any attribute 

11 of policy, process, or procedure that could enable or 

12 facilitate the defeat of an operational control. 

13 (15) PRIVATE ENTITY.—The term ‘‘private en14 tity’’ means any individual or any private group, or15 ganization, or corporation, including an officer, em16 ployee, or agent thereof. 

17 (16) SIGNIFICANT CYBER INCIDENT.—The term 

18 ‘‘significant cyber incident’’ means a cyber incident 

19 resulting in, or an attempted cyber incident that, if 

20 successful, would have resulted in— 

21 (A) the exfiltration from a Federal infor22 mation system of data that is essential to the 

23 operation of the Federal information system; or 

24 (B) an incident in which an operational or 

25 technical control essential to the security or opmstockstill on DSK4VPTVN1PROD with BILLS

9 

•S 3342 PCS

1 eration of a Federal information system was de2 feated. 

3 (17) TECHNICAL CONTROL.—The term ‘‘tech4 nical control’’ means a hardware or software restric5 tion on, or audit of, access or use of an information 

6 system or information that is stored on, processed 

7 by, or transiting an information system that is in8 tended to ensure the confidentiality, integrity, or 

9 availability of that system. 

10 (18) TECHNICAL VULNERABILITY.—The term 

11 ‘‘technical vulnerability’’ means any attribute of 

12 hardware or software that could enable or facilitate 

13 the defeat of a technical control. 

14 (19) TRIBAL.—The term ‘‘tribal’’ has the 

15 meaning given the term ‘‘Indian tribe’’ in section 4 

16 of the Indian Self-Determination and Education As17 sistance Act (25 U.S.C. 450b). 

18 SEC. 102. AUTHORIZATION TO SHARE CYBER THREAT IN19 FORMATION. 

20 (a) VOLUNTARY DISCLOSURE.— 

21 (1) PRIVATE ENTITIES.—Notwithstanding any 

22 other provision of law, a private entity may, for the 

23 purpose of preventing, investigating, or otherwise 

24 mitigating threats to information security, on its 

25 own networks, or as authorized by another entity, on 

mstockstill on DSK4VPTVN1PROD with BILLS

10 

•S 3342 PCS

1 such entity’s networks, employ countermeasures and 

2 use cybersecurity systems in order to obtain, iden3 tify, or otherwise possess cyber threat information. 

4 (2) ENTITIES.—Notwithstanding any other pro5 vision of law, an entity may disclose cyber threat in6 formation to— 

7 (A) a cybersecurity center; or 

8 (B) any other entity in order to assist with 

9 preventing, investigating, or otherwise miti10 gating threats to information security. 

11 (3) INFORMATION SECURITY PROVIDERS.—If 

12 the cyber threat information described in paragraph 

13 (1) is obtained, identified, or otherwise possessed in 

14 the course of providing information security prod15 ucts or services under contract to another entity, 

16 that entity shall be given, at any time prior to dis17 closure of such information, a reasonable oppor18 tunity to authorize or prevent such disclosure, to re19 quest anonymization of such information, or to re20 quest that reasonable efforts be made to safeguard 

21 such information that identifies specific persons 

22 from unauthorized access or disclosure. 

23 (b) SIGNIFICANT CYBER INCIDENTS INVOLVING

24 FEDERAL INFORMATION SYSTEMS.— 

mstockstill on DSK4VPTVN1PROD with BILLS

11 

•S 3342 PCS

1 (1) IN GENERAL.—An entity providing elec2 tronic communication services, remote computing 

3 services, or information security services to a Fed4 eral department or agency shall inform the Federal 

5 department or agency of a significant cyber incident 

6 involving the Federal information system of that 

7 Federal department or agency that— 

8 (A) is directly known to the entity as a re9 sult of providing such services; 

10 (B) is directly related to the provision of 

11 such services by the entity; and 

12 (C) as determined by the entity, has im13 peded or will impede the performance of a crit14 ical mission of the Federal department or agen15 cy. 

16 (2) ADVANCE COORDINATION.—A Federal de17 partment or agency receiving the services described 

18 in paragraph (1) shall coordinate in advance with an 

19 entity described in paragraph (1) to develop the pa20 rameters of any information that may be provided 

21 under paragraph (1), including clarification of the 

22 type of significant cyber incident that will impede 

23 the performance of a critical mission of the Federal 

24 department or agency. 

mstockstill on DSK4VPTVN1PROD with BILLS

12 

•S 3342 PCS

1 (3) REPORT.—A Federal department or agency 

2 shall report information provided under this sub3 section to a cybersecurity center. 

4 (4) CONSTRUCTION.—Any information provided 

5 to a cybersecurity center under paragraph (3) shall 

6 be treated in the same manner as information pro7 vided to a cybersecurity center under subsection (a). 

8 (c) INFORMATION SHARED WITH OR PROVIDED TO

9 A CYBERSECURITY CENTER.—Cyber threat information 

10 provided to a cybersecurity center under this section— 

11 (1) may be disclosed to, retained by, and used 

12 by, consistent with otherwise applicable Federal law, 

13 any Federal agency or department, component, offi14 cer, employee, or agent of the Federal government 

15 for a cybersecurity purpose, a national security pur16 pose, or in order to prevent, investigate, or prosecute 

17 any of the offenses listed in section 2516 of title 18, 

18 United States Code, and such information shall not 

19 be disclosed to, retained by, or used by any Federal 

20 agency or department for any use not permitted 

21 under this paragraph; 

22 (2) may, with the prior written consent of the 

23 entity submitting such information, be disclosed to 

24 and used by a State, tribal, or local government or 

25 government agency for the purpose of protecting inmstockstill on DSK4VPTVN1PROD with BILLS

13 

•S 3342 PCS

1 formation systems, or in furtherance of preventing, 

2 investigating, or prosecuting a criminal act, except 

3 that if the need for immediate disclosure prevents 

4 obtaining written consent, such consent may be pro5 vided orally with subsequent documentation of such 

6 consent; 

7 (3) shall be considered the commercial, finan8 cial, or proprietary information of the entity pro9 viding such information to the Federal government 

10 and any disclosure outside the Federal government 

11 may only be made upon the prior written consent by 

12 such entity and shall not constitute a waiver of any 

13 applicable privilege or protection provided by law, 

14 except that if the need for immediate disclosure pre15 vents obtaining written consent, such consent may 

16 be provided orally with subsequent documentation of 

17 such consent; 

18 (4) shall be deemed voluntarily shared informa19 tion and exempt from disclosure under section 552 

20 of title 5, United States Code, and any State, tribal, 

21 or local law requiring disclosure of information or 

22 records; 

23 (5) shall be, without discretion, withheld from 

24 the public under section 552(b)(3)(B) of title 5, 

mstockstill on DSK4VPTVN1PROD with BILLS

14 

•S 3342 PCS

1 United States Code, and any State, tribal, or local 

2 law requiring disclosure of information or records; 

3 (6) shall not be subject to the rules of any Fed4 eral agency or department or any judicial doctrine 

5 regarding ex parte communications with a decision6 making official; 

7 (7) shall not, if subsequently provided to a 

8 State, tribal, or local government or government 

9 agency, otherwise be disclosed or distributed to any 

10 entity by such State, tribal, or local government or 

11 government agency without the prior written consent 

12 of the entity submitting such information, notwith13 standing any State, tribal, or local law requiring dis14 closure of information or records, except that if the 

15 need for immediate disclosure prevents obtaining 

16 written consent, such consent may be provided orally 

17 with subsequent documentation of such consent; and 

18 (8) shall not be directly used by any Federal, 

19 State, tribal, or local department or agency to regu20 late the lawful activities of an entity, including ac21 tivities relating to obtaining, identifying, or other22 wise possessing cyber threat information, except that 

23 the procedures required to be developed and imple24 mented under this title shall not be considered regu25 lations within the meaning of this paragraph. 

mstockstill on DSK4VPTVN1PROD with BILLS

15 

•S 3342 PCS

1 (d) PROCEDURES RELATING TO INFORMATION SHAR2 ING WITH A CYBERSECURITY CENTER.—Not later than 

3 60 days after the date of enactment of this Act, the heads 

4 of each department or agency containing a cybersecurity 

5 center shall jointly develop, promulgate, and submit to 

6 Congress procedures to ensure that cyber threat informa7 tion shared with or provided to— 

8 (1) a cybersecurity center under this section— 

9 (A) may be submitted to a cybersecurity 

10 center by an entity, to the greatest extent pos11 sible, through a uniform, publicly available 

12 process or format that is easily accessible on 

13 the website of such cybersecurity center, and 

14 that includes the ability to provide relevant de15 tails about the cyber threat information and 

16 written consent to any subsequent disclosures 

17 authorized by this paragraph; 

18 (B) shall immediately be further shared 

19 with each cybersecurity center in order to pre20 vent, investigate, or otherwise mitigate threats 

21 to information security across the Federal gov22 ernment; 

23 (C) is handled by the Federal government 

24 in a reasonable manner, including consideration 

25 of the need to protect the privacy and civil libmstockstill on DSK4VPTVN1PROD with BILLS

16 

•S 3342 PCS

1 erties of individuals through anonymization or 

2 other appropriate methods, while fully accom3 plishing the objectives of this title, and the Fed4 eral government may undertake efforts con5 sistent with this subparagraph to limit the im6 pact on privacy and civil liberties of the sharing 

7 of cyber threat information with the Federal 

8 government; and 

9 (D) except as provided in this section, shall 

10 only be used, disclosed, or handled in accord11 ance with the provisions of subsection (c); and 

12 (2) a Federal agency or department under sub13 section (b) is provided immediately to a cybersecu14 rity center in order to prevent, investigate, or other15 wise mitigate threats to information security across 

16 the Federal government. 

17 (e) INFORMATION SHARED BETWEEN ENTITIES.— 

18 (1) IN GENERAL.—An entity sharing cyber 

19 threat information with another entity under this 

20 title may restrict the use or sharing of such informa21 tion by such other entity. 

22 (2) FURTHER SHARING.—Cyber threat informa23 tion shared by any entity with another entity under 

24 this title— 

mstockstill on DSK4VPTVN1PROD with BILLS

17 

•S 3342 PCS

1 (A) shall only be further shared in accord2 ance with any restrictions placed on the sharing 

3 of such information by the entity authorizing 

4 such sharing, such as appropriate 

5 anonymization of such information; and 

6 (B) may not be used by any entity to gain 

7 an unfair competitive advantage to the det8 riment of the entity authorizing the sharing of 

9 such information, except that the conduct de10 scribed in paragraph (3) shall not constitute 

11 unfair competitive conduct. 

12 (3) INFORMATION SHARED WITH STATE, TRIB13 AL, OR LOCAL GOVERNMENT OR GOVERNMENT

14 AGENCY.—Cyber threat information shared with a 

15 State, tribal, or local government or government 

16 agency under this title— 

17 (A) may, with the prior written consent of 

18 the entity sharing such information, be dis19 closed to and used by a State, tribal, or local 

20 government or government agency for the pur21 pose of protecting information systems, or in 

22 furtherance of preventing, investigating, or 

23 prosecuting a criminal act, except if the need 

24 for immediate disclosure prevents obtaining 

mstockstill on DSK4VPTVN1PROD with BILLS

18 

•S 3342 PCS

1 written consent, consent may be provided orally 

2 with subsequent documentation of the consent; 

3 (B) shall be deemed voluntarily shared in4 formation and exempt from disclosure under 

5 any State, tribal, or local law requiring disclo6 sure of information or records; 

7 (C) shall not be disclosed or distributed to 

8 any entity by the State, tribal, or local govern9 ment or government agency without the prior 

10 written consent of the entity submitting such 

11 information, notwithstanding any State, tribal, 

12 or local law requiring disclosure of information 

13 or records, except if the need for immediate dis14 closure prevents obtaining written consent, con15 sent may be provided orally with subsequent 

16 documentation of the consent; and 

17 (D) shall not be directly used by any State, 

18 tribal, or local department or agency to regulate 

19 the lawful activities of an entity, including ac20 tivities relating to obtaining, identifying, or oth21 erwise possessing cyber threat information, ex22 cept that the procedures required to be devel23 oped and implemented under this title shall not 

24 be considered regulations within the meaning of 

25 this subparagraph. 

mstockstill on DSK4VPTVN1PROD with BILLS

19 

•S 3342 PCS

1 (4) ANTITRUST EXEMPTION.—The exchange or 

2 provision of cyber threat information or assistance 

3 between 2 or more private entities under this title 

4 shall not be considered a violation of any provision 

5 of antitrust laws if exchanged or provided in order 

6 to assist with— 

7 (A) facilitating the prevention, investiga8 tion, or mitigation of threats to information se9 curity; or 

10 (B) communicating or disclosing of cyber 

11 threat information to help prevent, investigate 

12 or otherwise mitigate the effects of a threat to 

13 information security. 

14 (5) NO RIGHT OR BENEFIT.—The provision of 

15 cyber threat information to an entity under this sec16 tion shall not create a right or a benefit to similar 

17 information by such entity or any other entity. 

18 (f) FEDERAL PREEMPTION.— 

19 (1) IN GENERAL.—This section supersedes any 

20 statute or other law of a State or political subdivi21 sion of a State that restricts or otherwise expressly 

22 regulates an activity authorized under this section. 

23 (2) STATE LAW ENFORCEMENT.—Nothing in 

24 this section shall be construed to supersede any stat25 ute or other law of a State or political subdivision 

mstockstill on DSK4VPTVN1PROD with BILLS

20 

•S 3342 PCS

1 of a State concerning the use of authorized law en2 forcement techniques. 

3 (3) PUBLIC DISCLOSURE.—No information 

4 shared with or provided to a State, tribal, or local 

5 government or government agency pursuant to this 

6 section shall be made publicly available pursuant to 

7 any State, tribal, or local law requiring disclosure of 

8 information or records. 

9 (g) CIVIL AND CRIMINAL LIABILITY.— 

10 (1) GENERAL PROTECTIONS.— 

11 (A) PRIVATE ENTITIES.—No cause of ac12 tion shall lie or be maintained in any court 

13 against any private entity for— 

14 (i) the use of countermeasures and cy15 bersecurity systems as authorized by this 

16 title; 

17 (ii) the use, receipt, or disclosure of 

18 any cyber threat information as authorized 

19 by this title; or 

20 (iii) the subsequent actions or inac21 tions of any lawful recipient of cyber threat 

22 information provided by such private enti23 ty. 

mstockstill on DSK4VPTVN1PROD with BILLS

21 

•S 3342 PCS

1 (B) ENTITIES.—No cause of action shall 

2 lie or be maintained in any court against any 

3 entity for— 

4 (i) the use, receipt, or disclosure of 

5 any cyber threat information as authorized 

6 by this title; or 

7 (ii) the subsequent actions or inac8 tions of any lawful recipient of cyber threat 

9 information provided by such entity. 

10 (2) CONSTRUCTION.—Nothing in this sub11 section shall be construed as creating any immunity 

12 against, or otherwise affecting, any action brought 

13 by the Federal government, or any agency or depart14 ment thereof, to enforce any law, executive order, or 

15 procedure governing the appropriate handling, dis16 closure, and use of classified information. 

17 (h) OTHERWISE LAWFUL DISCLOSURES.—Nothing 

18 in this section shall be construed to limit or prohibit other19 wise lawful disclosures of communications, records, or 

20 other information by a private entity to any other govern21 mental or private entity not covered under this section. 

22 (i) WHISTLEBLOWER PROTECTION.—Nothing in this 

23 Act shall be construed to preempt or preclude any em24 ployee from exercising rights currently provided under any 

25 whistleblower law, rule, or regulation. 

mstockstill on DSK4VPTVN1PROD with BILLS

22 

•S 3342 PCS

1 (j) RELATIONSHIP TO OTHER LAWS.—The submis2 sion of cyber threat information under this section to a 

3 cybersecurity center shall not affect any requirement 

4 under any other provision of law for an entity to provide 

5 information to the Federal government. 

6 SEC. 103. INFORMATION SHARING BY THE FEDERAL GOV7 ERNMENT. 

8 (a) CLASSIFIED INFORMATION.— 

9 (1) PROCEDURES.—Consistent with the protec10 tion of intelligence sources and methods, and as oth11 erwise determined appropriate, the Director of Na12 tional Intelligence and the Secretary of Defense, in 

13 consultation with the heads of the appropriate Fed14 eral departments or agencies, shall develop and pro15 mulgate procedures to facilitate and promote— 

16 (A) the immediate sharing, through the cy17 bersecurity centers, of classified cyber threat in18 formation in the possession of the Federal gov19 ernment with appropriately cleared representa20 tives of any appropriate entity; and 

21 (B) the declassification and immediate 

22 sharing, through the cybersecurity centers, with 

23 any entity or, if appropriate, public availability 

24 of cyber threat information in the possession of 

25 the Federal government; 

mstockstill on DSK4VPTVN1PROD with BILLS

23 

•S 3342 PCS

1 (2) HANDLING OF CLASSIFIED INFORMATION.— 

2 The procedures developed under paragraph (1) shall 

3 ensure that each entity receiving classified cyber 

4 threat information pursuant to this section has ac5 knowledged in writing the ongoing obligation to com6 ply with all laws, executive orders, and procedures 

7 concerning the appropriate handling, disclosure, or 

8 use of classified information. 

9 (b) UNCLASSIFIED CYBER THREAT INFORMATION.— 

10 The heads of each department or agency containing a cy11 bersecurity center shall jointly develop and promulgate 

12 procedures that ensure that, consistent with the provisions 

13 of this section, unclassified, including controlled unclassi14 fied, cyber threat information in the possession of the Fed15 eral government— 

16 (1) is shared, through the cybersecurity centers, 

17 in an immediate and adequate manner with appro18 priate entities; and 

19 (2) if appropriate, is made publicly available. 

20 (c) DEVELOPMENT OF PROCEDURES.— 

21 (1) IN GENERAL.—The procedures developed 

22 under this section shall incorporate, to the greatest 

23 extent possible, existing processes utilized by sector 

24 specific information sharing and analysis centers. 

mstockstill on DSK4VPTVN1PROD with BILLS

24 

•S 3342 PCS

1 (2) COORDINATION WITH ENTITIES.—In devel2 oping the procedures required under this section, the 

3 Director of National Intelligence and the heads of 

4 each department or agency containing a cybersecu5 rity center shall coordinate with appropriate entities 

6 to ensure that protocols are implemented that will 

7 facilitate and promote the sharing of cyber threat in8 formation by the Federal government. 

9 (d) ADDITIONAL RESPONSIBILITIES OF CYBERSECU10 RITY CENTERS.—Consistent with section 102, a cyberse11 curity center shall— 

12 (1) facilitate information sharing, interaction, 

13 and collaboration among and between cybersecurity 

14 centers and— 

15 (A) other Federal entities; 

16 (B) any entity; and 

17 (C) international partners, in consultation 

18 with the Secretary of State; 

19 (2) disseminate timely and actionable cyberse20 curity threat, vulnerability, mitigation, and warning 

21 information, including alerts, advisories, indicators, 

22 signatures, and mitigation and response measures, 

23 to improve the security and protection of informa24 tion systems; and 

mstockstill on DSK4VPTVN1PROD with BILLS

25 

•S 3342 PCS

1 (3) coordinate with other Federal entities, as 

2 appropriate, to integrate information from across 

3 the Federal government to provide situational 

4 awareness of the cybersecurity posture of the United 

5 States. 

6 (e) SHARING WITHIN THE FEDERAL GOVERN7 MENT.—The heads of appropriate Federal departments 

8 and agencies shall ensure that cyber threat information 

9 in the possession of such Federal departments or agencies 

10 that relates to the prevention, investigation, or mitigation 

11 of threats to information security across the Federal gov12 ernment is shared effectively with the cybersecurity cen13 ters. 

14 (f) SUBMISSION TO CONGRESS.—Not later than 60 

15 days after the date of enactment of this Act, the Director 

16 of National Intelligence, in coordination with the appro17 priate head of a department or an agency containing a 

18 cybersecurity center, shall submit the procedures required 

19 by this section to Congress. 

20 SEC. 104. CONSTRUCTION. 

21 (a) INFORMATION SHARING RELATIONSHIPS.—Noth22 ing in this title shall be construed— 

23 (1) to limit or modify an existing information 

24 sharing relationship; 

mstockstill on DSK4VPTVN1PROD with BILLS

26 

•S 3342 PCS

1 (2) to prohibit a new information sharing rela2 tionship; 

3 (3) to require a new information sharing rela4 tionship between any entity and the Federal govern5 ment, except as specified under section 102(b); or 

6 (4) to modify the authority of a department or 

7 agency of the Federal government to protect sources 

8 and methods and the national security of the United 

9 States. 

10 (b) ANTI-TASKING RESTRICTION.—Nothing in this 

11 title shall be construed to permit the Federal govern12 ment— 

13 (1) to require an entity to share information 

14 with the Federal government, except as expressly 

15 provided under section 102(b); or 

16 (2) to condition the sharing of cyber threat in17 formation with an entity on such entity’s provision 

18 of cyber threat information to the Federal govern19 ment. 

20 (c) NO LIABILITY FOR NON-PARTICIPATION.—Noth21 ing in this title shall be construed to subject any entity 

22 to liability for choosing not to engage in the voluntary ac23 tivities authorized under this title. 

24 (d) USE AND RETENTION OF INFORMATION.—Noth25 ing in this title shall be construed to authorize, or to modmstockstill on DSK4VPTVN1PROD with BILLS

27 

•S 3342 PCS

1 ify any existing authority of, a department or agency of 

2 the Federal government to retain or use any information 

3 shared under section 102 for any use other than a use 

4 permitted under subsection 102(c)(1). 

5 (e) NO NEW FUNDING.—An applicable Federal agen6 cy shall carry out the provisions of this title with existing 

7 facilities and funds otherwise available, through such 

8 means as the head of the agency considers appropriate. 

9 SEC. 105. REPORT ON IMPLEMENTATION. 

10 (a) CONTENT OF REPORT.—Not later than 1 year 

11 after the date of enactment of this Act, and biennially 

12 thereafter, the heads of each department or agency con13 taining a cybersecurity center shall jointly submit, in co14 ordination with the privacy and civil liberties officials of 

15 such departments or agencies and the Privacy and Civil 

16 Liberties Oversight Board, a detailed report to Congress 

17 concerning the implementation of this title, including— 

18 (1) an assessment of the sufficiency of the pro19 cedures developed under section 103 of this Act in 

20 ensuring that cyber threat information in the posses21 sion of the Federal government is provided in an im22 mediate and adequate manner to appropriate entities 

23 or, if appropriate, is made publicly available; 

24 (2) an assessment of whether information has 

25 been appropriately classified and an accounting of 

mstockstill on DSK4VPTVN1PROD with BILLS

28 

•S 3342 PCS

1 the number of security clearances authorized by the 

2 Federal government for purposes of this title; 

3 (3) a review of the type of cyber threat infor4 mation shared with a cybersecurity center under sec5 tion 102 of this Act, including whether such infor6 mation meets the definition of cyber threat informa7 tion under section 101, the degree to which such in8 formation may impact the privacy and civil liberties 

9 of individuals, any appropriate metrics to determine 

10 any impact of the sharing of such information with 

11 the Federal government on privacy and civil lib12 erties, and the adequacy of any steps taken to re13 duce such impact; 

14 (4) a review of actions taken by the Federal 

15 government based on information provided to a cy16 bersecurity center under section 102 of this Act, in17 cluding the appropriateness of any subsequent use 

18 under section 102(c)(1) of this Act and whether 

19 there was inappropriate stovepiping within the Fed20 eral government of any such information; 

21 (5) a description of any violations of the re22 quirements of this title by the Federal government; 

23 (6) a classified list of entities that received clas24 sified information from the Federal government 

25 under section 103 of this Act and a description of 

mstockstill on DSK4VPTVN1PROD with BILLS

29 

•S 3342 PCS

1 any indication that such information may not have 

2 been appropriately handled; 

3 (7) a summary of any breach of information se4 curity, if known, attributable to a specific failure by 

5 any entity or the Federal government to act on 

6 cyber threat information in the possession of such 

7 entity or the Federal government that resulted in 

8 substantial economic harm or injury to a specific en9 tity or the Federal government; and 

10 (8) any recommendation for improvements or 

11 modifications to the authorities under this title. 

12 (b) FORM OF REPORT.—The report under subsection 

13 (a) shall be submitted in unclassified form, but shall in14 clude a classified annex. 

15 SEC. 106. INSPECTOR GENERAL REVIEW. 

16 (a) IN GENERAL.—The Council of the Inspectors 

17 General on Integrity and Efficiency are authorized to re18 view compliance by the cybersecurity centers, and by any 

19 Federal department or agency receiving cyber threat infor20 mation from such cybersecurity centers, with the proce21 dures required under section 102 of this Act. 

22 (b) SCOPE OF REVIEW.—The review under sub23 section (a) shall consider whether the Federal government 

24 has handled such cyber threat information in a reasonable 

25 manner, including consideration of the need to protect the 

mstockstill on DSK4VPTVN1PROD with BILLS

30 

•S 3342 PCS

1 privacy and civil liberties of individuals through 

2 anonymization or other appropriate methods, while fully 

3 accomplishing the objectives of this title. 

4 (c) REPORT TO CONGRESS.—Each review conducted 

5 under this section shall be provided to Congress not later 

6 than 30 days after the date of completion of the review. 

7 SEC. 107. TECHNICAL AMENDMENTS. 

8 Section 552(b) of title 5, United States Code, is 

9 amended— 

10 (1) in paragraph (8), by striking ‘‘or’’; 

11 (2) in paragraph (9), by striking ‘‘wells.’’ and 

12 inserting ‘‘wells; or’’; and 

13 (3) by adding at the end the following: 

14 ‘‘(10) information shared with or provided to a 

15 cybersecurity center under section 102 of title I of 

16 the Strengthening and Enhancing Cybersecurity by 

17 Using Research, Education, Information, and Tech18 nology Act of 2012.’’. 

19 SEC. 108. ACCESS TO CLASSIFIED INFORMATION. 

20 (a) AUTHORIZATION REQUIRED.—No person shall be 

21 provided with access to classified information (as defined 

22 in section 6.1 of Executive Order 13526 (50 U.S.C. 435 

23 note; relating to classified national security information)) 

24 relating to cyber security threats or cyber security 

mstockstill on DSK4VPTVN1PROD with BILLS

31 

•S 3342 PCS

1 vulnerabilities under this title without the appropriate se2 curity clearances. 

3 (b) SECURITY CLEARANCES.—The appropriate Fed4 eral agencies or departments shall, consistent with appli5 cable procedures and requirements, and if otherwise 

6 deemed appropriate, assist an individual in timely obtain7 ing an appropriate security clearance where such indi8 vidual has been determined to be eligible for such clear9 ance and has a need-to-know (as defined in section 6.1 

10 of that Executive Order) classified information to carry 

11 out this title. 

12 TITLE II—COORDINATION OF 

13 FEDERAL INFORMATION SE14 CURITY POLICY 

15 SEC. 201. COORDINATION OF FEDERAL INFORMATION SE16 CURITY POLICY. 

17 (a) IN GENERAL.—Chapter 35 of title 44, United 

18 States Code, is amended by striking subchapters II and 

19 III and inserting the following: 

20 ‘‘SUBCHAPTER II—INFORMATION SECURITY 

21 ‘‘§ 3551. Purposes 

22 ‘‘The purposes of this subchapter are— 

23 ‘‘(1) to provide a comprehensive framework for 

24 ensuring the effectiveness of information security 

mstockstill on DSK4VPTVN1PROD with BILLS

32 

•S 3342 PCS

1 controls over information resources that support 

2 Federal operations and assets; 

3 ‘‘(2) to recognize the highly networked nature 

4 of the current Federal computing environment and 

5 provide effective government-wide management of 

6 policies, directives, standards, and guidelines, as well 

7 as effective and nimble oversight of and response to 

8 information security risks, including coordination of 

9 information security efforts throughout the Federal 

10 civilian, national security, and law enforcement com11 munities; 

12 ‘‘(3) to provide for development and mainte13 nance of controls required to protect agency infor14 mation and information systems and contribute to 

15 the overall improvement of agency information secu16 rity posture; 

17 ‘‘(4) to provide for the development of tools and 

18 methods to assess and respond to real-time situa19 tional risk for Federal information system operations 

20 and assets; and 

21 ‘‘(5) to provide a mechanism for improving 

22 agency information security programs through con23 tinuous monitoring of agency information systems 

24 and streamlined reporting requirements rather than 

25 overly prescriptive manual reporting. 

mstockstill on DSK4VPTVN1PROD with BILLS

33 

•S 3342 PCS

1 ‘‘§ 3552. Definitions 

2 ‘‘In this subchapter: 

3 ‘‘(1) ADEQUATE SECURITY.—The term ‘ade4 quate security’ means security commensurate with 

5 the risk and magnitude of the harm resulting from 

6 the unauthorized access to or loss, misuse, destruc7 tion, or modification of information. 

8 ‘‘(2) AGENCY.—The term ‘agency’ has the 

9 meaning given the term in section 3502 of title 44. 

10 ‘‘(3) CYBERSECURITY CENTER.—The term ‘cy11 bersecurity center’ means the Department of De12 fense Cyber Crime Center, the Intelligence Commu13 nity Incident Response Center, the United States 

14 Cyber Command Joint Operations Center, the Na15 tional Cyber Investigative Joint Task Force, the Na16 tional Security Agency/Central Security Service 

17 Threat Operations Center, the National Cybersecu18 rity and Communications Integration Center, and 

19 any successor center. 

20 ‘‘(4) CYBER THREAT INFORMATION.—The term 

21 ‘cyber threat information’ means information that 

22 indicates or describes— 

23 ‘‘(A) a technical or operation vulnerability 

24 or a cyber threat mitigation measure; 

25 ‘‘(B) an action or operation to mitigate a 

26 cyber threat; 

mstockstill on DSK4VPTVN1PROD with BILLS

34 

•S 3342 PCS

1 ‘‘(C) malicious reconnaissance, including 

2 anomalous patterns of network activity that ap3 pear to be transmitted for the purpose of gath4 ering technical information related to a cyberse5 curity threat; 

6 ‘‘(D) a method of defeating a technical 

7 control; 

8 ‘‘(E) a method of defeating an operational 

9 control; 

10 ‘‘(F) network activity or protocols known 

11 to be associated with a malicious cyber actor or 

12 that signify malicious cyber intent; 

13 ‘‘(G) a method of causing a user with le14 gitimate access to an information system or in15 formation that is stored on, processed by, or 

16 transiting an information system to inadvert17 ently enable the defeat of a technical or oper18 ational control; 

19 ‘‘(H) any other attribute of a cybersecurity 

20 threat or cyber defense information that would 

21 foster situational awareness of the United 

22 States cybersecurity posture, if disclosure of 

23 such attribute or information is not otherwise 

24 prohibited by law; 

mstockstill on DSK4VPTVN1PROD with BILLS

35 

•S 3342 PCS

1 ‘‘(I) the actual or potential harm caused by 

2 a cyber incident, including information 

3 exfiltrated when it is necessary in order to iden4 tify or describe a cybersecurity threat; or 

5 ‘‘(J) any combination of subparagraphs 

6 (A) through (I). 

7 ‘‘(5) DIRECTOR.—The term ‘Director’ means 

8 the Director of the Office of Management and Budg9 et unless otherwise specified. 

10 ‘‘(6) ENVIRONMENT OF OPERATION.—The term 

11 ‘environment of operation’ means the information 

12 system and environment in which those systems op13 erate, including changing threats, vulnerabilities, 

14 technologies, and missions and business practices. 

15 ‘‘(7) FEDERAL INFORMATION SYSTEM.—The 

16 term ‘Federal information system’ means an infor17 mation system used or operated by an executive 

18 agency, by a contractor of an executive agency, or by 

19 another organization on behalf of an executive agen20 cy. 

21 ‘‘(8) INCIDENT.—The term ‘incident’ means an 

22 occurrence that— 

23 ‘‘(A) actually or imminently jeopardizes 

24 the integrity, confidentiality, or availability of 

25 an information system or the information that 

mstockstill on DSK4VPTVN1PROD with BILLS

36 

•S 3342 PCS

1 system controls, processes, stores, or transmits; 

2 or 

3 ‘‘(B) constitutes a violation of law or an 

4 imminent threat of violation of a law, a security 

5 policy, a security procedure, or an acceptable 

6 use policy. 

7 ‘‘(9) INFORMATION RESOURCES.—The term ‘in8 formation resources’ has the meaning given the term 

9 in section 3502 of title 44. 

10 ‘‘(10) INFORMATION SECURITY.—The term ‘in11 formation security’ means protecting information 

12 and information systems from disruption or unau13 thorized access, use, disclosure, modification, or de14 struction in order to provide— 

15 ‘‘(A) integrity, by guarding against im16 proper information modification or destruction, 

17 including by ensuring information nonrepudi18 ation and authenticity; 

19 ‘‘(B) confidentiality, by preserving author20 ized restrictions on access and disclosure, in21 cluding means for protecting personal privacy 

22 and proprietary information; or 

23 ‘‘(C) availability, by ensuring timely and 

24 reliable access to and use of information. 

mstockstill on DSK4VPTVN1PROD with BILLS

37 

•S 3342 PCS

1 ‘‘(11) INFORMATION SYSTEM.—The term ‘infor2 mation system’ has the meaning given the term in 

3 section 3502 of title 44. 

4 ‘‘(12) INFORMATION TECHNOLOGY.—The term 

5 ‘information technology’ has the meaning given the 

6 term in section 11101 of title 40. 

7 ‘‘(13) MALICIOUS RECONNAISSANCE.—The term 

8 ‘malicious reconnaissance’ means a method for ac9 tively probing or passively monitoring an information 

10 system for the purpose of discerning technical 

11 vulnerabilities of the information system, if such 

12 method is associated with a known or suspected cy13 bersecurity threat. 

14 ‘‘(14) NATIONAL SECURITY SYSTEM.— 

15 ‘‘(A) IN GENERAL.—The term ‘national se16 curity system’ means any information system 

17 (including any telecommunications system) used 

18 or operated by an agency or by a contractor of 

19 an agency, or other organization on behalf of an 

20 agency— 

21 ‘‘(i) the function, operation, or use of 

22 which— 

23 ‘‘(I) involves intelligence activi24 ties; 

mstockstill on DSK4VPTVN1PROD with BILLS

38 

•S 3342 PCS

1 ‘‘(II) involves cryptologic activi2 ties related to national security; 

3 ‘‘(III) involves command and 

4 control of military forces; 

5 ‘‘(IV) involves equipment that is 

6 an integral part of a weapon or weap7 ons system; or 

8 ‘‘(V) subject to subparagraph 

9 (B), is critical to the direct fulfillment 

10 of military or intelligence missions; or 

11 ‘‘(ii) is protected at all times by proce12 dures established for information that have 

13 been specifically authorized under criteria 

14 established by an Executive Order or an 

15 Act of Congress to be kept classified in the 

16 interest of national defense or foreign pol17 icy. 

18 ‘‘(B) LIMITATION.—Subparagraph 

19 (A)(i)(V) does not include a system that is to 

20 be used for routine administrative and business 

21 applications (including payroll, finance, logis22 tics, and personnel management applications). 

23 ‘‘(15) OPERATIONAL CONTROL.—The term 

24 ‘operational control’ means a security control for an 

mstockstill on DSK4VPTVN1PROD with BILLS

39 

•S 3342 PCS

1 information system that primarily is implemented 

2 and executed by people. 

3 ‘‘(16) PERSON.—The term ‘person’ has the 

4 meaning given the term in section 3502 of title 44. 

5 ‘‘(17) SECRETARY.—The term ‘Secretary’ 

6 means the Secretary of Commerce unless otherwise 

7 specified. 

8 ‘‘(18) SECURITY CONTROL.—The term ‘security 

9 control’ means the management, operational, and 

10 technical controls, including safeguards or counter11 measures, prescribed for an information system to 

12 protect the confidentiality, integrity, and availability 

13 of the system and its information. 

14 ‘‘(19) SIGNIFICANT CYBER INCIDENT.—The 

15 term ‘significant cyber incident’ means a cyber inci16 dent resulting in, or an attempted cyber incident 

17 that, if successful, would have resulted in— 

18 ‘‘(A) the exfiltration from a Federal infor19 mation system of data that is essential to the 

20 operation of the Federal information system; or 

21 ‘‘(B) an incident in which an operational 

22 or technical control essential to the security or 

23 operation of a Federal information system was 

24 defeated. 

mstockstill on DSK4VPTVN1PROD with BILLS

40 

•S 3342 PCS

1 ‘‘(20) TECHNICAL CONTROL.—The term ‘tech2 nical control’ means a hardware or software restric3 tion on, or audit of, access or use of an information 

4 system or information that is stored on, processed 

5 by, or transiting an information system that is in6 tended to ensure the confidentiality, integrity, or 

7 availability of that system. 

8 ‘‘§ 3553. Federal information security authority and 

9 coordination 

10 ‘‘(a) IN GENERAL.—The Secretary, in consultation 

11 with the Secretary of Homeland Security, shall— 

12 ‘‘(1) issue compulsory and binding policies and 

13 directives governing agency information security op14 erations, and require implementation of such policies 

15 and directives, including— 

16 ‘‘(A) policies and directives consistent with 

17 the standards and guidelines promulgated 

18 under section 11331 of title 40 to identify and 

19 provide information security protections 

20 prioritized and commensurate with the risk and 

21 impact resulting from the unauthorized access, 

22 use, disclosure, disruption, modification, or de23 struction of— 

24 ‘‘(i) information collected or main25 tained by or on behalf of an agency; or 

mstockstill on DSK4VPTVN1PROD with BILLS

41 

•S 3342 PCS

1 ‘‘(ii) information systems used or op2 erated by an agency or by a contractor of 

3 an agency or other organization on behalf 

4 of an agency; 

5 ‘‘(B) minimum operational requirements 

6 for Federal Government to protect agency in7 formation systems and provide common situa8 tional awareness across all agency information 

9 systems; 

10 ‘‘(C) reporting requirements, consistent 

11 with relevant law, regarding information secu12 rity incidents and cyber threat information; 

13 ‘‘(D) requirements for agencywide informa14 tion security programs; 

15 ‘‘(E) performance requirements and 

16 metrics for the security of agency information 

17 systems; 

18 ‘‘(F) training requirements to ensure that 

19 agencies are able to fully and timely comply 

20 with the policies and directives issued by the 

21 Secretary under this subchapter; 

22 ‘‘(G) training requirements regarding pri23 vacy, civil rights, and civil liberties, and infor24 mation oversight for agency information secu25 rity personnel; 

mstockstill on DSK4VPTVN1PROD with BILLS

42 

•S 3342 PCS

1 ‘‘(H) requirements for the annual reports 

2 to the Secretary under section 3554(d); 

3 ‘‘(I) any other information security oper4 ations or information security requirements as 

5 determined by the Secretary in coordination 

6 with relevant agency heads; and 

7 ‘‘(J) coordinating the development of 

8 standards and guidelines under section 20 of 

9 the National Institute of Standards and Tech10 nology Act (15 U.S.C. 278g–3) with agencies 

11 and offices operating or exercising control of 

12 national security systems (including the Na13 tional Security Agency) to assure, to the max14 imum extent feasible, that such standards and 

15 guidelines are complementary with standards 

16 and guidelines developed for national security 

17 systems; 

18 ‘‘(2) review the agencywide information security 

19 programs under section 3554; and 

20 ‘‘(3) designate an individual or an entity at 

21 each cybersecurity center, among other responsibil22 ities— 

23 ‘‘(A) to receive reports and information 

24 about information security incidents, cyber 

25 threat information, and deterioration of security 

mstockstill on DSK4VPTVN1PROD with BILLS

43 

•S 3342 PCS

1 control affecting agency information systems; 

2 and 

3 ‘‘(B) to act on or share the information 

4 under subparagraph (A) in accordance with this 

5 subchapter. 

6 ‘‘(b) CONSIDERATIONS.—When issuing policies and 

7 directives under subsection (a), the Secretary shall con8 sider any applicable standards or guidelines developed by 

9 the National Institute of Standards and Technology under 

10 section 11331 of title 40. 

11 ‘‘(c) LIMITATION OF AUTHORITY.—The authorities 

12 of the Secretary under this section shall not apply to na13 tional security systems. Information security policies, di14 rectives, standards and guidelines for national security 

15 systems shall be overseen as directed by the President and, 

16 in accordance with that direction, carried out under the 

17 authority of the heads of agencies that operate or exercise 

18 authority over such national security systems. 

19 ‘‘(d) STATUTORY CONSTRUCTION.—Nothing in this 

20 subchapter shall be construed to alter or amend any law 

21 regarding the authority of any head of an agency over 

22 such agency. 

23 ‘‘§ 3554. Agency responsibilities 

24 ‘‘(a) IN GENERAL.—The head of each agency shall— 

25 ‘‘(1) be responsible for— 

mstockstill on DSK4VPTVN1PROD with BILLS

44 

•S 3342 PCS

1 ‘‘(A) complying with the policies and direc2 tives issued under section 3553; 

3 ‘‘(B) providing information security protec4 tions commensurate with the risk resulting 

5 from unauthorized access, use, disclosure, dis6 ruption, modification, or destruction of— 

7 ‘‘(i) information collected or main8 tained by the agency or by a contractor of 

9 an agency or other organization on behalf 

10 of an agency; and 

11 ‘‘(ii) information systems used or op12 erated by an agency or by a contractor of 

13 an agency or other organization on behalf 

14 of an agency; 

15 ‘‘(C) complying with the requirements of 

16 this subchapter, including— 

17 ‘‘(i) information security standards 

18 and guidelines promulgated under section 

19 11331 of title 40; 

20 ‘‘(ii) for any national security systems 

21 operated or controlled by that agency, in22 formation security policies, directives, 

23 standards and guidelines issued as directed 

24 by the President; and 

mstockstill on DSK4VPTVN1PROD with BILLS

45 

•S 3342 PCS

1 ‘‘(iii) for any non-national security 

2 systems operated or controlled by that 

3 agency, information security policies, direc4 tives, standards and guidelines issued 

5 under section 3553; 

6 ‘‘(D) ensuring that information security 

7 management processes are integrated with 

8 agency strategic and operational planning proc9 esses; 

10 ‘‘(E) reporting and sharing, for an agency 

11 operating or exercising control of a national se12 curity system, information about information 

13 security incidents, cyber threat information, 

14 and deterioration of security controls to the in15 dividual or entity designated at each cybersecu16 rity center and to other appropriate entities 

17 consistent with policies and directives for na18 tional security systems issued as directed by the 

19 President; and 

20 ‘‘(F) reporting and sharing, for those 

21 agencies operating or exercising control of non22 national security systems, information about in23 formation security incidents, cyber threat infor24 mation, and deterioration of security controls to 

25 the individual or entity designated at each cymstockstill on DSK4VPTVN1PROD with BILLS

46 

•S 3342 PCS

1 bersecurity center and to other appropriate en2 tities consistent with policies and directives for 

3 non-national security systems as prescribed 

4 under section 3553(a), including information to 

5 assist the entity designated under section 

6 3555(a) with the ongoing security analysis 

7 under section 3555; 

8 ‘‘(2) ensure that each senior agency official pro9 vides information security for the information and 

10 information systems that support the operations and 

11 assets under the senior agency official’s control, in12 cluding by— 

13 ‘‘(A) assessing the risk and impact that 

14 could result from the unauthorized access, use, 

15 disclosure, disruption, modification, or destruc16 tion of such information or information sys17 tems; 

18 ‘‘(B) determining the level of information 

19 security appropriate to protect such information 

20 and information systems in accordance with 

21 policies and directives issued under section 

22 3553(a), and standards and guidelines promul23 gated under section 11331 of title 40 for infor24 mation security classifications and related re25 quirements; 

mstockstill on DSK4VPTVN1PROD with BILLS

47 

•S 3342 PCS

1 ‘‘(C) implementing policies, procedures, 

2 and capabilities to reduce risks to an acceptable 

3 level in a cost-effective manner; 

4 ‘‘(D) actively monitoring the effective im5 plementation of information security controls 

6 and techniques; and 

7 ‘‘(E) reporting information about informa8 tion security incidents, cyber threat informa9 tion, and deterioration of security controls in a 

10 timely and adequate manner to the entity des11 ignated under section 3553(a)(3) in accordance 

12 with paragraph (1); 

13 ‘‘(3) assess and maintain the resiliency of infor14 mation technology systems critical to agency mission 

15 and operations; 

16 ‘‘(4) designate the agency Inspector General (or 

17 an independent entity selected in consultation with 

18 the Director and the Council of Inspectors General 

19 on Integrity and Efficiency if the agency does not 

20 have an Inspector General) to conduct the annual 

21 independent evaluation required under section 3556, 

22 and allow the agency Inspector General to contract 

23 with an independent entity to perform such evalua24 tion; 

mstockstill on DSK4VPTVN1PROD with BILLS

48 

•S 3342 PCS

1 ‘‘(5) delegate to the Chief Information Officer 

2 or equivalent (or to a senior agency official who re3 ports to the Chief Information Officer or equiva4 lent)— 

5 ‘‘(A) the authority and primary responsi6 bility to implement an agencywide information 

7 security program; and 

8 ‘‘(B) the authority to provide information 

9 security for the information collected and main10 tained by the agency (or by a contractor, other 

11 agency, or other source on behalf of the agency) 

12 and for the information systems that support 

13 the operations, assets, and mission of the agen14 cy (including any information system provided 

15 or managed by a contractor, other agency, or 

16 other source on behalf of the agency); 

17 ‘‘(6) delegate to the appropriate agency official 

18 (who is responsible for a particular agency system or 

19 subsystem) the responsibility to ensure and enforce 

20 compliance with all requirements of the agency’s 

21 agencywide information security program in coordi22 nation with the Chief Information Officer or equiva23 lent (or the senior agency official who reports to the 

24 Chief Information Officer or equivalent) under para25 graph (5); 

mstockstill on DSK4VPTVN1PROD with BILLS

49 

•S 3342 PCS

1 ‘‘(7) ensure that an agency has trained per2 sonnel who have obtained any necessary security 

3 clearances to permit them to assist the agency in 

4 complying with this subchapter; 

5 ‘‘(8) ensure that the Chief Information Officer 

6 or equivalent (or the senior agency official who re7 ports to the Chief Information Officer or equivalent) 

8 under paragraph (5), in coordination with other sen9 ior agency officials, reports to the agency head on 

10 the effectiveness of the agencywide information secu11 rity program, including the progress of any remedial 

12 actions; and 

13 ‘‘(9) ensure that the Chief Information Officer 

14 or equivalent (or the senior agency official who re15 ports to the Chief Information Officer or equivalent) 

16 under paragraph (5) has the necessary qualifications 

17 to administer the functions described in this sub18 chapter and has information security duties as a pri19 mary duty of that official. 

20 ‘‘(b) CHIEF INFORMATION OFFICERS.—Each Chief 

21 Information Officer or equivalent (or the senior agency of22 ficial who reports to the Chief Information Officer or 

23 equivalent) under subsection (a)(5) shall— 

mstockstill on DSK4VPTVN1PROD with BILLS

50 

•S 3342 PCS

1 ‘‘(1) establish and maintain an enterprise secu2 rity operations capability that on a continuous 

3 basis— 

4 ‘‘(A) detects, reports, contains, mitigates, 

5 and responds to information security incidents 

6 that impair adequate security of the agency’s 

7 information or information system in a timely 

8 manner and in accordance with the policies and 

9 directives under section 3553; and 

10 ‘‘(B) reports any information security inci11 dent under subparagraph (A) to the entity des12 ignated under section 3555; 

13 ‘‘(2) develop, maintain, and oversee an agency14 wide information security program; 

15 ‘‘(3) develop, maintain, and oversee information 

16 security policies, procedures, and control techniques 

17 to address applicable requirements, including re18 quirements under section 3553 of this title and sec19 tion 11331 of title 40; and 

20 ‘‘(4) train and oversee the agency personnel 

21 who have significant responsibility for information 

22 security with respect to that responsibility. 

23 ‘‘(c) AGENCYWIDE INFORMATION SECURITY PRO24 GRAMS.— 

mstockstill on DSK4VPTVN1PROD with BILLS

51 

•S 3342 PCS

1 ‘‘(1) IN GENERAL.—Each agencywide informa2 tion security program under subsection (b)(2) shall 

3 include— 

4 ‘‘(A) relevant security risk assessments, in5 cluding technical assessments and others re6 lated to the acquisition process; 

7 ‘‘(B) security testing commensurate with 

8 risk and impact; 

9 ‘‘(C) mitigation of deterioration of security 

10 controls commensurate with risk and impact; 

11 ‘‘(D) risk-based continuous monitoring and 

12 threat assessment of the operational status and 

13 security of agency information systems to en14 able evaluation of the effectiveness of and com15 pliance with information security policies, proce16 dures, and practices, including a relevant and 

17 appropriate selection of security controls of in18 formation systems identified in the inventory 

19 under section 3505(c); 

20 ‘‘(E) operation of appropriate technical ca21 pabilities in order to detect, mitigate, report, 

22 and respond to information security incidents, 

23 cyber threat information, and deterioration of 

24 security controls in a manner that is consistent 

mstockstill on DSK4VPTVN1PROD with BILLS

52 

•S 3342 PCS

1 with the policies and directives under section 

2 3553, including— 

3 ‘‘(i) mitigating risks associated with 

4 such information security incidents; 

5 ‘‘(ii) notifying and consulting with the 

6 entity designated under section 3555; and 

7 ‘‘(iii) notifying and consulting with, as 

8 appropriate— 

9 ‘‘(I) law enforcement and the rel10 evant Office of the Inspector General; 

11 and 

12 ‘‘(II) any other entity, in accord13 ance with law and as directed by the 

14 President; 

15 ‘‘(F) a process to ensure that remedial ac16 tion is taken to address any deficiencies in the 

17 information security policies, procedures, and 

18 practices of the agency; and 

19 ‘‘(G) a plan and procedures to ensure the 

20 continuity of operations for information systems 

21 that support the operations and assets of the 

22 agency. 

23 ‘‘(2) RISK MANAGEMENT STRATEGIES.—Each 

24 agencywide information security program under sub25 section (b)(2) shall include the development and 

mstockstill on DSK4VPTVN1PROD with BILLS

53 

•S 3342 PCS

1 maintenance of a risk management strategy for in2 formation security. The risk management strategy 

3 shall include— 

4 ‘‘(A) consideration of information security 

5 incidents, cyber threat information, and deterio6 ration of security controls; and 

7 ‘‘(B) consideration of the consequences 

8 that could result from the unauthorized access, 

9 use, disclosure, disruption, modification, or de10 struction of information and information sys11 tems that support the operations and assets of 

12 the agency, including any information system 

13 provided or managed by a contractor, other 

14 agency, or other source on behalf of the agency; 

15 ‘‘(3) POLICIES AND PROCEDURES.—Each agen16 cywide information security program under sub17 section (b)(2) shall include policies and procedures 

18 that— 

19 ‘‘(A) are based on the risk management 

20 strategy under paragraph (2); 

21 ‘‘(B) reduce information security risks to 

22 an acceptable level in a cost-effective manner; 

23 ‘‘(C) ensure that cost-effective and ade24 quate information security is addressed as part 

mstockstill on DSK4VPTVN1PROD with BILLS

54 

•S 3342 PCS

1 of the acquisition and ongoing management of 

2 each agency information system; and 

3 ‘‘(D) ensure compliance with— 

4 ‘‘(i) this subchapter; and 

5 ‘‘(ii) any other applicable require6 ments. 

7 ‘‘(4) TRAINING REQUIREMENTS.—Each agency8 wide information security program under subsection 

9 (b)(2) shall include information security, privacy, 

10 civil rights, civil liberties, and information oversight 

11 training that meets any applicable requirements 

12 under section 3553. The training shall inform each 

13 information security personnel that has access to 

14 agency information systems (including contractors 

15 and other users of information systems that support 

16 the operations and assets of the agency) of— 

17 ‘‘(A) the information security risks associ18 ated with the information security personnel’s 

19 activities; and 

20 ‘‘(B) the individual’s responsibility to com21 ply with the agency policies and procedures that 

22 reduce the risks under subparagraph (A). 

23 ‘‘(d) ANNUAL REPORT.—Each agency shall submit a 

24 report annually to the Secretary of Homeland Security on 

mstockstill on DSK4VPTVN1PROD with BILLS

55 

•S 3342 PCS

1 its agencywide information security program and informa2 tion systems. 

3 ‘‘§ 3555. Multiagency ongoing threat assessment 

4 ‘‘(a) IMPLEMENTATION.—The Director of the Office 

5 of Management and Budget, in coordination with the Sec6 retary of Homeland Security, shall designate an entity to 

7 implement ongoing security analysis concerning agency in8 formation systems— 

9 ‘‘(1) based on cyber threat information; 

10 ‘‘(2) based on agency information system and 

11 environment of operation changes, including— 

12 ‘‘(A) an ongoing evaluation of the informa13 tion system security controls; and 

14 ‘‘(B) the security state, risk level, and en15 vironment of operation of an agency informa16 tion system, including— 

17 ‘‘(i) a change in risk level due to a 

18 new cyber threat; 

19 ‘‘(ii) a change resulting from a new 

20 technology; 

21 ‘‘(iii) a change resulting from the 

22 agency’s mission; and 

23 ‘‘(iv) a change resulting from the 

24 business practice; and 

mstockstill on DSK4VPTVN1PROD with BILLS

56 

•S 3342 PCS

1 ‘‘(3) using automated processes to the max2 imum extent possible— 

3 ‘‘(A) to increase information system secu4 rity; 

5 ‘‘(B) to reduce paper-based reporting re6 quirements; and 

7 ‘‘(C) to maintain timely and actionable 

8 knowledge of the state of the information sys9 tem security. 

10 ‘‘(b) STANDARDS.—The National Institute of Stand11 ards and Technology may promulgate standards, in co12 ordination with the Secretary of Homeland Security, to 

13 assist an agency with its duties under this section. 

14 ‘‘(c) COMPLIANCE.—The head of each appropriate 

15 department and agency shall be responsible for ensuring 

16 compliance and implementing necessary procedures to 

17 comply with this section. The head of each appropriate 

18 department and agency, in consultation with the Director 

19 of the Office of Management and Budget and the Sec20 retary of Homeland Security, shall— 

21 ‘‘(1) monitor compliance under this section; 

22 ‘‘(2) develop a timeline and implement for the 

23 department or agency— 

24 ‘‘(A) adoption of any technology, system, 

25 or method that facilitates continuous monimstockstill on DSK4VPTVN1PROD with BILLS

57 

•S 3342 PCS

1 toring and threat assessments of an agency in2 formation system; 

3 ‘‘(B) adoption or updating of any tech4 nology, system, or method that prevents, de5 tects, or remediates a significant cyber incident 

6 to a Federal information system of the depart7 ment or agency that has impeded, or is reason8 ably likely to impede, the performance of a crit9 ical mission of the department or agency; and 

10 ‘‘(C) adoption of any technology, system, 

11 or method that satisfies a requirement under 

12 this section. 

13 ‘‘(d) LIMITATION OF AUTHORITY.—The authorities 

14 of the Director of the Office of Management and Budget 

15 and of the Secretary of Homeland Security under this sec16 tion shall not apply to national security systems. 

17 ‘‘(e) REPORT.—Not later than 6 months after the 

18 date of enactment of the Strengthening and Enhancing 

19 Cybersecurity by Using Research, Education, Information, 

20 and Technology Act of 2012, the Government Account21 ability Office shall issue a report evaluating each agency’s 

22 status toward implementing this section. 

23 ‘‘§ 3556. Independent evaluations 

24 ‘‘(a) IN GENERAL.—The Council of the Inspectors 

25 General on Integrity and Efficiency, in consultation with 

mstockstill on DSK4VPTVN1PROD with BILLS

58 

•S 3342 PCS

1 the Director and the Secretary of Homeland Security, the 

2 Secretary of Commerce, and the Secretary of Defense, 

3 shall issue and maintain criteria for the timely, cost-effec4 tive, risk-based, and independent evaluation of each agen5 cywide information security program (and practices) to de6 termine the effectiveness of the agencywide information 

7 security program (and practices). The criteria shall in8 clude measures to assess any conflicts of interest in the 

9 performance of the evaluation and whether the agencywide 

10 information security program includes appropriate safe11 guards against disclosure of information where such dis12 closure may adversely affect information security. 

13 ‘‘(b) ANNUAL INDEPENDENT EVALUATIONS.—Each 

14 agency shall perform an annual independent evaluation of 

15 its agencywide information security program (and prac16 tices) in accordance with the criteria under subsection (a). 

17 ‘‘(c) DISTRIBUTION OF REPORTS.—Not later than 30 

18 days after receiving an independent evaluation under sub19 section (b), each agency head shall transmit a copy of the 

20 independent evaluation to the Secretary of Homeland Se21 curity, the Secretary of Commerce, and the Secretary of 

22 Defense. 

23 ‘‘(d) NATIONAL SECURITY SYSTEMS.—Evaluations 

24 involving national security systems shall be conducted as 

25 directed by President. 

mstockstill on DSK4VPTVN1PROD with BILLS

59 

•S 3342 PCS

1 ‘‘§ 3557. National security systems. 

2 ‘‘The head of each agency operating or exercising 

3 control of a national security system shall be responsible 

4 for ensuring that the agency— 

5 ‘‘(1) provides information security protections 

6 commensurate with the risk and magnitude of the 

7 harm resulting from the unauthorized access, use, 

8 disclosure, disruption, modification, or destruction of 

9 the information contained in such system; and 

10 ‘‘(2) implements information security policies 

11 and practices as required by standards and guide12 lines for national security systems, issued in accord13 ance with law and as directed by the President.’’. 

14 (b) SAVINGS PROVISIONS.— 

15 (1) POLICY AND COMPLIANCE GUIDANCE.—Pol16 icy and compliance guidance issued by the Director 

17 before the date of enactment of this Act under sec18 tion 3543(a)(1) of title 44, United States Code (as 

19 in effect on the day before the date of enactment of 

20 this Act), shall continue in effect, according to its 

21 terms, until modified, terminated, superseded, or re22 pealed pursuant to section 3553(a)(1) of title 44, 

23 United States Code. 

24 (2) STANDARDS AND GUIDELINES.—Standards 

25 and guidelines issued by the Secretary of Commerce 

26 or by the Director before the date of enactment of 

mstockstill on DSK4VPTVN1PROD with BILLS

60 

•S 3342 PCS

1 this Act under section 11331(a)(1) of title 40, 

2 United States Code, (as in effect on the day before 

3 the date of enactment of this Act) shall continue in 

4 effect, according to their terms, until modified, ter5 minated, superseded, or repealed pursuant to section 

6 11331(a)(1) of title 40, United States Code, as 

7 amended by this Act. 

8 (c) TECHNICAL AND CONFORMING AMENDMENTS.— 

9 (1) CHAPTER ANALYSIS.—The chapter analysis 

10 for chapter 35 of title 44, United States Code, is 

11 amended— 

12 (A) by striking the items relating to sec13 tions 3531 through 3538; 

14 (B) by striking the items relating to sec15 tions 3541 through 3549; and 

16 (C) by inserting the following: 

‘‘3551. Purposes. 

‘‘3552. Definitions. 

‘‘3553. Federal information security authority and coordination. 

‘‘3554. Agency responsibilities. 

‘‘3555. Multiagency ongoing threat assessment. 

‘‘3556. Independent evaluations. 

‘‘3557. National security systems.’’. 

17 (2) OTHER REFERENCES.— 

18 (A) Section 1001(c)(1)(A) of the Home19 land Security Act of 2002 (6 U.S.C. 511(1)(A)) 

20 is amended by striking ‘‘section 3532(3)’’ and 

21 inserting ‘‘section 3552’’. 

mstockstill on DSK4VPTVN1PROD with BILLS

61 

•S 3342 PCS

1 (B) Section 2222(j)(5) of title 10, United 

2 States Code, is amended by striking ‘‘section 

3 3542(b)(2)’’ and inserting ‘‘section 3552’’. 

4 (C) Section 2223(c)(3) of title 10, United 

5 States Code, is amended, by striking ‘‘section 

6 3542(b)(2)’’ and inserting ‘‘section 3552’’. 

7 (D) Section 2315 of title 10, United States 

8 Code, is amended by striking ‘‘section 

9 3542(b)(2)’’ and inserting ‘‘section 3552’’. 

10 (E) Section 20 of the National Institute of 

11 Standards and Technology Act (15 U.S.C. 

12 278g–3) is amended— 

13 (i) in subsection (a)(2), by striking 

14 ‘‘section 3532(b)(2)’’ and inserting ‘‘sec15 tion 3552’’; 

16 (ii) in subsection (c)(3), by striking 

17 ‘‘Director of the Office of Management and 

18 Budget’’ and inserting ‘‘Secretary of Com19 merce’’; 

20 (iii) in subsection (d)(1), by striking 

21 ‘‘Director of the Office of Management and 

22 Budget’’ and inserting ‘‘Secretary of Com23 merce’’; 

24 (iv) in subsection (d)(8) by striking 

25 ‘‘Director of the Office of Management and 

mstockstill on DSK4VPTVN1PROD with BILLS

62 

•S 3342 PCS

1 Budget’’ and inserting ‘‘Secretary of Com2 merce’’; 

3 (v) in subsection (d)(8), by striking 

4 ‘‘submitted to the Director’’ and inserting 

5 ‘‘submitted to the Secretary’’; 

6 (vi) in subsection (e)(2), by striking 

7 ‘‘section 3532(1) of such title’’ and insert8 ing ‘‘section 3552 of title 44’’; and 

9 (vii) in subsection (e)(5), by striking 

10 ‘‘section 3532(b)(2) of such title’’ and in11 serting ‘‘section 3552 of title 44’’. 

12 (F) Section 8(d)(1) of the Cyber Security 

13 Research and Development Act (15 U.S.C. 

14 7406(d)(1)) is amended by striking ‘‘section 

15 3534(b)’’ and inserting ‘‘section 3554(b)(2)’’. 

16 SEC. 202. MANAGEMENT OF INFORMATION TECHNOLOGY. 

17 (a) IN GENERAL.—Section 11331 of title 40, United 

18 States Code, is amended to read as follows: 

19 ‘‘§ 11331. Responsibilities for Federal information sys20 tems standards 

21 ‘‘(a) STANDARDS AND GUIDELINES.— 

22 ‘‘(1) AUTHORITY TO PRESCRIBE.—Except as 

23 provided under paragraph (2), the Secretary of 

24 Commerce shall prescribe standards and guidelines 

25 pertaining to Federal information systems— 

mstockstill on DSK4VPTVN1PROD with BILLS

63 

•S 3342 PCS

1 ‘‘(A) in consultation with the Secretary of 

2 Homeland Security; and 

3 ‘‘(B) on the basis of standards and guide4 lines developed by the National Institute of 

5 Standards and Technology under paragraphs 

6 (2) and (3) of section 20(a) of the National In7 stitute of Standards and Technology Act (15 

8 U.S.C. 278g–3(a)(2) and (a)(3)). 

9 ‘‘(2) NATIONAL SECURITY SYSTEMS.—Stand10 ards and guidelines for national security systems 

11 shall be developed, prescribed, enforced, and over12 seen as otherwise authorized by law and as directed 

13 by the President. 

14 ‘‘(b) MANDATORY STANDARDS AND GUIDELINES.— 

15 ‘‘(1) AUTHORITY TO MAKE MANDATORY STAND16 ARDS AND GUIDELINES.—The Secretary of Com17 merce shall make standards and guidelines under 

18 subsection (a)(1) compulsory and binding to the ex19 tent determined necessary by the Secretary of Com20 merce to improve the efficiency of operation or secu21 rity of Federal information systems. 

22 ‘‘(2) REQUIRED MANDATORY STANDARDS AND

23 GUIDELINES.— 

mstockstill on DSK4VPTVN1PROD with BILLS

64 

•S 3342 PCS

1 ‘‘(A) IN GENERAL.—Standards and guide2 lines under subsection (a)(1) shall include infor3 mation security standards that— 

4 ‘‘(i) provide minimum information se5 curity requirements as determined under 

6 section 20(b) of the National Institute of 

7 Standards and Technology Act (15 U.S.C. 

8 278g–3(b)); and 

9 ‘‘(ii) are otherwise necessary to im10 prove the security of Federal information 

11 and information systems. 

12 ‘‘(B) BINDING EFFECT.—Information se13 curity standards under subparagraph (A) shall 

14 be compulsory and binding. 

15 ‘‘(c) EXERCISE OF AUTHORITY.—To ensure fiscal 

16 and policy consistency, the Secretary of Commerce shall 

17 exercise the authority conferred by this section subject to 

18 direction by the President and in coordination with the 

19 Director. 

20 ‘‘(d) APPLICATION OF MORE STRINGENT STAND21 ARDS AND GUIDELINES.—The head of an executive agen22 cy may employ standards for the cost-effective information 

23 security for information systems within or under the su24 pervision of that agency that are more stringent than the 

25 standards and guidelines the Secretary of Commerce premstockstill on DSK4VPTVN1PROD with BILLS

65 

•S 3342 PCS

1 scribes under this section if the more stringent standards 

2 and guidelines— 

3 ‘‘(1) contain at least the applicable standards 

4 and guidelines made compulsory and binding by the 

5 Secretary of Commerce; and 

6 ‘‘(2) are otherwise consistent with the policies, 

7 directives, and implementation memoranda issued 

8 under section 3553(a) of title 44. 

9 ‘‘(e) DECISIONS ON PROMULGATION OF STANDARDS

10 AND GUIDELINES.—The decision by the Secretary of 

11 Commerce regarding the promulgation of any standard or 

12 guideline under this section shall occur not later than 6 

13 months after the date of submission of the proposed stand14 ard to the Secretary of Commerce by the National Insti15 tute of Standards and Technology under section 20 of the 

16 National Institute of Standards and Technology Act (15 

17 U.S.C. 278g–3). 

18 ‘‘(f) NOTICE AND COMMENT.—A decision by the Sec19 retary of Commerce to significantly modify, or not promul20 gate, a proposed standard submitted to the Secretary by 

21 the National Institute of Standards and Technology under 

22 section 20 of the National Institute of Standards and 

23 Technology Act (15 U.S.C. 278g–3) shall be made after 

24 the public is given an opportunity to comment on the Sec25 retary’s proposed decision. 

mstockstill on DSK4VPTVN1PROD with BILLS

66 

•S 3342 PCS

1 ‘‘(g) DEFINITIONS.—In this section: 

2 ‘‘(1) FEDERAL INFORMATION SYSTEM.—The 

3 term ‘Federal information system’ has the meaning 

4 given the term in section 3552 of title 44. 

5 ‘‘(2) INFORMATION SECURITY.—The term ‘in6 formation security’ has the meaning given the term 

7 in section 3552 of title 44. 

8 ‘‘(3) NATIONAL SECURITY SYSTEM.—The term 

9 ‘national security system’ has the meaning given the 

10 term in section 3552 of title 44.’’. 

11 SEC. 203. NO NEW FUNDING. 

12 An applicable Federal agency shall carry out the pro13 visions of this title with existing facilities and funds other14 wise available, through such means as the head of the 

15 agency considers appropriate. 

16 SEC. 204. TECHNICAL AND CONFORMING AMENDMENTS. 

17 Section 21(b) of the National Institute of Standards 

18 and Technology Act (15 U.S.C. 278g–4(b)) is amended— 

19 (1) in paragraph (2), by striking ‘‘and the Di20 rector of the Office of Management and Budget’’ 

21 and inserting ‘‘, the Secretary of Commerce, and the 

22 Secretary of Homeland Security’’; and 

23 (2) in paragraph (3), by inserting ‘‘, the Sec24 retary of Homeland Security,’’ after ‘‘the Secretary 

25 of Commerce’’. 

mstockstill on DSK4VPTVN1PROD with BILLS

67 

•S 3342 PCS

1 SEC. 205. CLARIFICATION OF AUTHORITIES. 

2 Nothing in this title shall be construed to convey any 

3 new regulatory authority to any government entity imple4 menting or complying with any provision of this title. 

5 TITLE III—CRIMINAL PENALTIES 

6 SEC. 301. PENALTIES FOR FRAUD AND RELATED ACTIVITY 

7 IN CONNECTION WITH COMPUTERS. 

8 Section 1030(c) of title 18, United States Code, is 

9 amended to read as follows: 

10 ‘‘(c) The punishment for an offense under subsection 

11 (a) or (b) of this section is— 

12 ‘‘(1) a fine under this title or imprisonment for 

13 not more than 20 years, or both, in the case of an 

14 offense under subsection (a)(1) of this section; 

15 ‘‘(2)(A) except as provided in subparagraph 

16 (B), a fine under this title or imprisonment for not 

17 more than 3 years, or both, in the case of an offense 

18 under subsection (a)(2); or 

19 ‘‘(B) a fine under this title or imprison20 ment for not more than ten years, or both, in 

21 the case of an offense under subsection (a)(2) 

22 of this section, if— 

23 ‘‘(i) the offense was committed for 

24 purposes of commercial advantage or pri25 vate financial gain; 

mstockstill on DSK4VPTVN1PROD with BILLS

68 

•S 3342 PCS

1 ‘‘(ii) the offense was committed in the 

2 furtherance of any criminal or tortious act 

3 in violation of the Constitution or laws of 

4 the United States, or of any State; or 

5 ‘‘(iii) the value of the information ob6 tained, or that would have been obtained if 

7 the offense was completed, exceeds $5,000; 

8 ‘‘(3) a fine under this title or imprisonment for 

9 not more than 10 years, or both, in the case of an 

10 offense under subsection (a)(3) of this section; 

11 ‘‘(4) a fine under this title or imprisonment of 

12 not more than 20 years, or both, in the case of an 

13 offense under subsection (a)(4) of this section; 

14 ‘‘(5)(A) except as provided in subparagraph 

15 (C), a fine under this title, imprisonment for not 

16 more than 20 years, or both, in the case of an of17 fense under subsection (a)(5)(A) of this section, if 

18 the offense caused— 

19 ‘‘(i) loss to 1 or more persons during 

20 any 1-year period (and, for purposes of an 

21 investigation, prosecution, or other pro22 ceeding brought by the United States only, 

23 loss resulting from a related course of con24 duct affecting 1 or more other protected 

mstockstill on DSK4VPTVN1PROD with BILLS

69 

•S 3342 PCS

1 computers) aggregating at least $5,000 in 

2 value; 

3 ‘‘(ii) the modification or impairment, 

4 or potential modification or impairment, of 

5 the medical examination, diagnosis, treat6 ment, or care of 1 or more individuals; 

7 ‘‘(iii) physical injury to any person; 

8 ‘‘(iv) a threat to public health or safe9 ty; 

10 ‘‘(v) damage affecting a computer 

11 used by, or on behalf of, an entity of the 

12 United States Government in furtherance 

13 of the administration of justice, national 

14 defense, or national security; or 

15 ‘‘(vi) damage affecting 10 or more 

16 protected computers during any 1-year pe17 riod; 

18 ‘‘(B) a fine under this title, imprisonment 

19 for not more than 20 years, or both, in the case 

20 of an offense under subsection (a)(5)(B), if the 

21 offense caused a harm provided in clause (i) 

22 through (vi) of subparagraph (A) of this sub23 section; 

24 ‘‘(C) if the offender attempts to cause or 

25 knowingly or recklessly causes death from conmstockstill on DSK4VPTVN1PROD with BILLS

70 

•S 3342 PCS

1 duct in violation of subsection (a)(5)(A), a fine 

2 under this title, imprisonment for any term of 

3 years or for life, or both; 

4 ‘‘(D) a fine under this title, imprisonment 

5 for not more than 10 years, or both, for any 

6 other offense under subsection (a)(5); 

7 ‘‘(E) a fine under this title or imprison8 ment for not more than 10 years, or both, in 

9 the case of an offense under subsection (a)(6) 

10 of this section; or 

11 ‘‘(F) a fine under this title or imprison12 ment for not more than 10 years, or both, in 

13 the case of an offense under subsection (a)(7) 

14 of this section.’’. 

15 SEC. 302. TRAFFICKING IN PASSWORDS. 

16 Section 1030(a)(6) of title 18, United States Code, 

17 is amended to read as follows: 

18 ‘‘(6) knowingly and with intent to defraud traf19 fics (as defined in section 1029) in any password or 

20 similar information or means of access through 

21 which a protected computer (as defined in subpara22 graphs (A) and (B) of subsection (e)(2)) may be 

23 accessed without authorization.’’. 

mstockstill on DSK4VPTVN1PROD with BILLS

71 

•S 3342 PCS

1 SEC. 303. CONSPIRACY AND ATTEMPTED COMPUTER 

2 FRAUD OFFENSES. 

3 Section 1030(b) of title 18, United States Code, is 

4 amended by inserting ‘‘as if for the completed offense’’ 

5 after ‘‘punished as provided’’. 

6 SEC. 304. CRIMINAL AND CIVIL FORFEITURE FOR FRAUD 

7 AND RELATED ACTIVITY IN CONNECTION 

8 WITH COMPUTERS. 

9 Section 1030 of title 18, United States Code, is 

10 amended by striking subsections (i) and (j) and inserting 

11 the following: 

12 ‘‘(i) CRIMINAL FORFEITURE.— 

13 ‘‘(1) The court, in imposing sentence on any 

14 person convicted of a violation of this section, or 

15 convicted of conspiracy to violate this section, shall 

16 order, in addition to any other sentence imposed and 

17 irrespective of any provision of State law, that such 

18 person forfeit to the United States— 

19 ‘‘(A) such persons interest in any property, 

20 real or personal, that was used, or intended to 

21 be used, to commit or facilitate the commission 

22 of such violation; and 

23 ‘‘(B) any property, real or personal, consti24 tuting or derived from any gross proceeds, or 

25 any property traceable to such property, that 

mstockstill on DSK4VPTVN1PROD with BILLS

72 

•S 3342 PCS

1 such person obtained, directly or indirectly, as 

2 a result of such violation. 

3 ‘‘(2) The criminal forfeiture of property under 

4 this subsection, including any seizure and disposition 

5 of the property, and any related judicial or adminis6 trative proceeding, shall be governed by the provi7 sions of section 413 of the Comprehensive Drug 

8 Abuse Prevention and Control Act of 1970 (21 

9 U.S.C. 853), except subsection (d) of that section. 

10 ‘‘(j) CIVIL FORFEITURE.— 

11 ‘‘(1) The following shall be subject to forfeiture 

12 to the United States and no property right, real or 

13 personal, shall exist in them: 

14 ‘‘(A) Any property, real or personal, that 

15 was used, or intended to be used, to commit or 

16 facilitate the commission of any violation of this 

17 section, or a conspiracy to violate this section. 

18 ‘‘(B) Any property, real or personal, con19 stituting or derived from any gross proceeds ob20 tained directly or indirectly, or any property 

21 traceable to such property, as a result of the 

22 commission of any violation of this section, or 

23 a conspiracy to violate this section. 

24 ‘‘(2) Seizures and forfeitures under this sub25 section shall be governed by the provisions in chapmstockstill on DSK4VPTVN1PROD with BILLS

73 

•S 3342 PCS

1 ter 46 relating to civil forfeitures, except that such 

2 duties as are imposed on the Secretary of the Treas3 ury under the customs laws described in section 

4 981(d) shall be performed by such officers, agents 

5 and other persons as may be designated for that 

6 purpose by the Secretary of Homeland Security or 

7 the Attorney General.’’. 

8 SEC. 305. DAMAGE TO CRITICAL INFRASTRUCTURE COM9 PUTERS. 

10 (a) IN GENERAL.—Chapter 47 of title 18, United 

11 States Code, is amended by inserting after section 1030 

12 the following: 

13 ‘‘§ 1030A. Aggravated damage to a critical infrastruc14 ture computer 

15 ‘‘(a) DEFINITIONS.—In this section— 

16 ‘‘(1) the term ‘computer’ has the meaning given 

17 the term in section 1030; 

18 ‘‘(2) the term ‘critical infrastructure computer’ 

19 means a computer that manages or controls systems 

20 or assets vital to national defense, national security, 

21 national economic security, public health or safety, 

22 or any combination of those matters, whether pub23 licly or privately owned or operated, including— 

24 ‘‘(A) oil and gas production, storage, con25 version, and delivery systems; 

mstockstill on DSK4VPTVN1PROD with BILLS

74 

•S 3342 PCS

1 ‘‘(B) water supply systems; 

2 ‘‘(C) telecommunication networks; 

3 ‘‘(D) electrical power generation and deliv4 ery systems; 

5 ‘‘(E) finance and banking systems; 

6 ‘‘(F) emergency services; 

7 ‘‘(G) transportation systems and services; 

8 and 

9 ‘‘(H) government operations that provide 

10 essential services to the public; and 

11 ‘‘(3) the term ‘damage’ has the meaning given 

12 the term in section 1030. 

13 ‘‘(b) OFFENSE.—It shall be unlawful, during and in 

14 relation to a felony violation of section 1030, to knowingly 

15 cause or attempt to cause damage to a critical infrastruc16 ture computer if the damage results in (or, in the case 

17 of an attempt, if completed, would have resulted in) the 

18 substantial impairment— 

19 ‘‘(1) of the operation of the critical infrastruc20 ture computer; or 

21 ‘‘(2) of the critical infrastructure associated 

22 with the computer. 

23 ‘‘(c) PENALTY.—Any person who violates subsection 

24 (b) shall be— 

25 ‘‘(1) fined under this title; 

mstockstill on DSK4VPTVN1PROD with BILLS

75 

•S 3342 PCS

1 ‘‘(2) imprisoned for not less than 3 years but 

2 not more than 20 years; or 

3 ‘‘(3) penalized under paragraphs (1) and (2). 

4 ‘‘(d) CONSECUTIVE SENTENCE.—Notwithstanding 

5 any other provision of law— 

6 ‘‘(1) a court shall not place on probation any 

7 person convicted of a violation of this section; 

8 ‘‘(2) except as provided in paragraph (4), no 

9 term of imprisonment imposed on a person under 

10 this section shall run concurrently with any other 

11 term of imprisonment, including any term of impris12 onment imposed on the person under any other pro13 vision of law, including any term of imprisonment 

14 imposed for a felony violation of section 1030; 

15 ‘‘(3) in determining any term of imprisonment 

16 to be imposed for a felony violation of section 1030, 

17 a court shall not in any way reduce the term to be 

18 imposed for such crime so as to compensate for, or 

19 otherwise take into account, any separate term of 

20 imprisonment imposed or to be imposed for a viola21 tion of this section; and 

22 ‘‘(4) a term of imprisonment imposed on a per23 son for a violation of this section may, in the discre24 tion of the court, run concurrently, in whole or in 

25 part, only with another term of imprisonment that 

mstockstill on DSK4VPTVN1PROD with BILLS

76 

•S 3342 PCS

1 is imposed by the court at the same time on that 

2 person for an additional violation of this section, 

3 provided that such discretion shall be exercised in 

4 accordance with any applicable guidelines and policy 

5 statements issued by the United States Sentencing 

6 Commission pursuant to section 994 of title 28.’’. 

7 (b) TECHNICAL AND CONFORMING AMENDMENT.— 

8 The chapter analysis for chapter 47 of title 18, United 

9 States Code, is amended by inserting after the item relat10 ing to section 1030 the following: 

‘‘1030A. Aggravated damage to a critical infrastructure computer.’’. 

11 SEC. 306. LIMITATION ON ACTIONS INVOLVING UNAUTHOR12 IZED USE. 

13 Section 1030(e)(6) of title 18, United States Code, 

14 is amended by striking ‘‘alter;’’ and inserting ‘‘alter, but 

15 does not include access in violation of a contractual obliga16 tion or agreement, such as an acceptable use policy or 

17 terms of service agreement, with an Internet service pro18 vider, Internet website, or non-government employer, if 

19 such violation constitutes the sole basis for determining 

20 that access to a protected computer is unauthorized;’’. 

21 SEC. 307. NO NEW FUNDING. 

22 An applicable Federal agency shall carry out the pro23 visions of this title with existing facilities and funds other24 wise available, through such means as the head of the 

25 agency considers appropriate. 

mstockstill on DSK4VPTVN1PROD with BILLS

77 

•S 3342 PCS

1 TITLE IV—CYBERSECURITY 

2 RESEARCH AND DEVELOPMENT 

3 SEC. 401. NATIONAL HIGH-PERFORMANCE COMPUTING 

4 PROGRAM PLANNING AND COORDINATION. 

5 (a) GOALS AND PRIORITIES.—Section 101 of the 

6 High-Performance Computing Act of 1991 (15 U.S.C. 

7 5511) is amended by adding at the end the following: 

8 ‘‘(d) GOALS AND PRIORITIES.—The goals and prior9 ities for Federal high-performance computing research, 

10 development, networking, and other activities under sub11 section (a)(2)(A) shall include— 

12 ‘‘(1) encouraging and supporting mechanisms 

13 for interdisciplinary research and development in 

14 networking and information technology, including— 

15 ‘‘(A) through collaborations across agen16 cies; 

17 ‘‘(B) through collaborations across Pro18 gram Component Areas; 

19 ‘‘(C) through collaborations with industry; 

20 ‘‘(D) through collaborations with institu21 tions of higher education; 

22 ‘‘(E) through collaborations with Federal 

23 laboratories (as defined in section 4 of the Ste24 venson-Wydler Technology Innovation Act of 

25 1980 (15 U.S.C. 3703)); and 

mstockstill on DSK4VPTVN1PROD with BILLS

78 

•S 3342 PCS

1 ‘‘(F) through collaborations with inter2 national organizations; 

3 ‘‘(2) addressing national, multi-agency, multi4 faceted challenges of national importance; and 

5 ‘‘(3) fostering the transfer of research and de6 velopment results into new technologies and applica7 tions for the benefit of society.’’. 

8 (b) DEVELOPMENT OF STRATEGIC PLAN.—Section 

9 101 of the High-Performance Computing Act of 1991 (15 

10 U.S.C. 5511) is amended by adding at the end the fol11 lowing: 

12 ‘‘(e) STRATEGIC PLAN.— 

13 ‘‘(1) IN GENERAL.—Not later than 1 year after 

14 the date of enactment of the Strengthening and En15 hancing Cybersecurity by Using Research, Edu16 cation, Information, and Technology Act of 2012, 

17 the agencies under subsection (a)(3)(B), working 

18 through the National Science and Technology Coun19 cil and with the assistance of the Office of Science 

20 and Technology Policy shall develop a 5-year stra21 tegic plan to guide the activities under subsection 

22 (a)(1). 

23 ‘‘(2) CONTENTS.—The strategic plan shall 

24 specify— 

mstockstill on DSK4VPTVN1PROD with BILLS

79 

•S 3342 PCS

1 ‘‘(A) the near-term objectives for the Pro2 gram; 

3 ‘‘(B) the long-term objectives for the Pro4 gram; 

5 ‘‘(C) the anticipated time frame for achiev6 ing the near-term objectives; 

7 ‘‘(D) the metrics that will be used to as8 sess any progress made toward achieving the 

9 near-term objectives and the long-term objec10 tives; and 

11 ‘‘(E) how the Program will achieve the 

12 goals and priorities under subsection (d). 

13 ‘‘(3) IMPLEMENTATION ROADMAP.— 

14 ‘‘(A) IN GENERAL.—The agencies under 

15 subsection (a)(3)(B) shall develop and annually 

16 update an implementation roadmap for the 

17 strategic plan. 

18 ‘‘(B) REQUIREMENTS.—The information in 

19 the implementation roadmap shall be coordi20 nated with the database under section 102(c) 

21 and the annual report under section 101(a)(3). 

22 The implementation roadmap shall— 

23 ‘‘(i) specify the role of each Federal 

24 agency in carrying out or sponsoring re25 search and development to meet the remstockstill on DSK4VPTVN1PROD with BILLS

80 

•S 3342 PCS

1 search objectives of the strategic plan, in2 cluding a description of how progress to3 ward the research objectives will be evalu4 ated, with consideration of any relevant 

5 recommendations of the advisory com6 mittee; 

7 ‘‘(ii) specify the funding allocated to 

8 each major research objective of the stra9 tegic plan and the source of funding by 

10 agency for the current fiscal year; and 

11 ‘‘(iii) estimate the funding required 

12 for each major research objective of the 

13 strategic plan for the next 3 fiscal years. 

14 ‘‘(4) RECOMMENDATIONS.—The agencies under 

15 subsection (a)(3)(B) shall take into consideration 

16 when developing the strategic plan under paragraph 

17 (1) the recommendations of— 

18 ‘‘(A) the advisory committee under sub19 section (b); and 

20 ‘‘(B) the stakeholders under section 

21 102(a)(3). 

22 ‘‘(5) REPORT TO CONGRESS.—The Director of 

23 the Office of Science and Technology Policy shall 

24 transmit the strategic plan under this subsection, inmstockstill on DSK4VPTVN1PROD with BILLS

81 

•S 3342 PCS

1 cluding the implementation roadmap and any up2 dates under paragraph (3), to— 

3 ‘‘(A) the advisory committee under sub4 section (b); 

5 ‘‘(B) the Committee on Commerce, 

6 Science, and Transportation of the Senate; and 

7 ‘‘(C) the Committee on Science and Tech8 nology of the House of Representatives.’’. 

9 (c) PERIODIC REVIEWS.—Section 101 of the High10 Performance Computing Act of 1991 (15 U.S.C. 5511) 

11 is amended by adding at the end the following: 

12 ‘‘(f) PERIODIC REVIEWS.—The agencies under sub13 section (a)(3)(B) shall— 

14 ‘‘(1) periodically assess the contents and fund15 ing levels of the Program Component Areas and re16 structure the Program when warranted, taking into 

17 consideration any relevant recommendations of the 

18 advisory committee under subsection (b); and 

19 ‘‘(2) ensure that the Program includes national, 

20 multi-agency, multi-faceted research and develop21 ment activities, including activities described in sec22 tion 104.’’. 

23 (d) ADDITIONAL RESPONSIBILITIES OF DIRECTOR.— 

24 Section 101(a)(2) of the High-Performance Computing 

25 Act of 1991 (15 U.S.C. 5511(a)(2)) is amended— 

mstockstill on DSK4VPTVN1PROD with BILLS

82 

•S 3342 PCS

1 (1) by redesignating subparagraphs (E) and 

2 (F) as subparagraphs (G) and (H), respectively; and 

3 (2) by inserting after subparagraph (D) the fol4 lowing: 

5 ‘‘(E) encourage and monitor the efforts of 

6 the agencies participating in the Program to al7 locate the level of resources and management 

8 attention necessary— 

9 ‘‘(i) to ensure that the strategic plan 

10 under subsection (e) is developed and exe11 cuted effectively; and 

12 ‘‘(ii) to ensure that the objectives of 

13 the Program are met; 

14 ‘‘(F) working with the Office of Manage15 ment and Budget and in coordination with the 

16 creation of the database under section 102(c), 

17 direct the Office of Science and Technology Pol18 icy and the agencies participating in the Pro19 gram to establish a mechanism (consistent with 

20 existing law) to track all ongoing and completed 

21 research and development projects and associ22 ated funding;’’. 

23 (e) ADVISORY COMMITTEE.—Section 101(b) of the 

24 High-Performance Computing Act of 1991 (15 U.S.C. 

25 5511(b)) is amended— 

mstockstill on DSK4VPTVN1PROD with BILLS

83 

•S 3342 PCS

1 (1) in paragraph (1)— 

2 (A) by inserting after the first sentence the 

3 following: ‘‘The co-chairs of the advisory com4 mittee shall meet the qualifications of com5 mittee members and may be members of the 

6 Presidents Council of Advisors on Science and 

7 Technology.’’; and 

8 (B) by striking ‘‘high-performance’’ in sub9 paragraph (D) and inserting ‘‘high-end’’; and 

10 (2) by amending paragraph (2) to read as fol11 lows: 

12 ‘‘(2) In addition to the duties under paragraph 

13 (1), the advisory committee shall conduct periodic 

14 evaluations of the funding, management, coordina15 tion, implementation, and activities of the Program. 

16 The advisory committee shall report its findings and 

17 recommendations not less frequently than once every 

18 3 fiscal years to the Committee on Commerce, 

19 Science, and Transportation of the Senate and the 

20 Committee on Science and Technology of the House 

21 of Representatives. The report shall be submitted in 

22 conjunction with the update of the strategic plan.’’. 

23 (f) REPORT.—Section 101(a)(3) of the High-Per24 formance Computing Act of 1991 (15 U.S.C. 5511(a)(3)) 

25 is amended— 

mstockstill on DSK4VPTVN1PROD with BILLS

84 

•S 3342 PCS

1 (1) in subparagraph (C)— 

2 (A) by striking ‘‘is submitted,’’ and insert3 ing ‘‘is submitted, the levels for the previous 

4 fiscal year,’’; and 

5 (B) by striking ‘‘each Program Component 

6 Area’’ and inserting ‘‘each Program Component 

7 Area and each research area supported in ac8 cordance with section 104’’; 

9 (2) in subparagraph (D)— 

10 (A) by striking ‘‘each Program Component 

11 Area,’’ and inserting ‘‘each Program Compo12 nent Area and each research area supported in 

13 accordance with section 104,’’; 

14 (B) by striking ‘‘is submitted,’’ and insert15 ing ‘‘is submitted, the levels for the previous 

16 fiscal year,’’; and 

17 (C) by striking ‘‘and’’ after the semicolon; 

18 (3) by redesignating subparagraph (E) as sub19 paragraph (G); and 

20 (4) by inserting after subparagraph (D) the fol21 lowing: 

22 ‘‘(E) include a description of how the ob23 jectives for each Program Component Area, and 

24 the objectives for activities that involve multiple 

25 Program Component Areas, relate to the objecmstockstill on DSK4VPTVN1PROD with BILLS

85 

•S 3342 PCS

1 tives of the Program identified in the strategic 

2 plan under subsection (e); 

3 ‘‘(F) include— 

4 ‘‘(i) a description of the funding re5 quired by the Office of Science and Tech6 nology Policy to perform the functions 

7 under subsections (a) and (c) of section 

8 102 for the next fiscal year by category of 

9 activity; 

10 ‘‘(ii) a description of the funding re11 quired by the Office of Science and Tech12 nology Policy to perform the functions 

13 under subsections (a) and (c) of section 

14 102 for the current fiscal year by category 

15 of activity; and 

16 ‘‘(iii) the amount of funding provided 

17 for the Office of Science and Technology 

18 Policy for the current fiscal year by each 

19 agency participating in the Program; and’’. 

20 (g) DEFINITIONS.—Section 4 of the High-Perform21 ance Computing Act of 1991 (15 U.S.C. 5503) is amend22 ed— 

23 (1) by redesignating paragraphs (1) and (2) as 

24 paragraphs (2) and (3), respectively; 

mstockstill on DSK4VPTVN1PROD with BILLS

86 

•S 3342 PCS

1 (2) by redesignating paragraph (3) as para2 graph (6); 

3 (3) by redesignating paragraphs (6) and (7) as 

4 paragraphs (7) and (8), respectively; 

5 (4) by inserting before paragraph (2), as redes6 ignated, the following: 

7 ‘‘(1) ‘cyber-physical systems’ means physical or 

8 engineered systems whose networking and informa9 tion technology functions and physical elements are 

10 deeply integrated and are actively connected to the 

11 physical world through sensors, actuators, or other 

12 means to perform monitoring and control func13 tions;’’; 

14 (5) in paragraph (3), as redesignated, by strik15 ing ‘‘high-performance computing’’ and inserting 

16 ‘‘networking and information technology’’; 

17 (6) in paragraph (6), as redesignated— 

18 (A) by striking ‘‘high-performance com19 puting’’ and inserting ‘‘networking and infor20 mation technology’’; and 

21 (B) by striking ‘‘supercomputer’’ and in22 serting ‘‘high-end computing’’; 

23 (7) in paragraph (5), by striking ‘‘network re24 ferred to as’’ and all that follows through the semi25 colon and inserting ‘‘network, including advanced 

mstockstill on DSK4VPTVN1PROD with BILLS

87 

•S 3342 PCS

1 computer networks of Federal agencies and depart2 ments’’; and 

3 (8) in paragraph (7), as redesignated, by strik4 ing ‘‘National High-Performance Computing Pro5 gram’’ and inserting ‘‘networking and information 

6 technology research and development program’’. 

7 SEC. 402. RESEARCH IN AREAS OF NATIONAL IMPORTANCE. 

8 (a) RESEARCH IN AREAS OF NATIONAL IMPOR9 TANCE.—Title I of the High-Performance Computing Act 

10 of 1991 (15 U.S.C. 5511 et seq.) is amended by adding 

11 at the end the following: 

12 ‘‘SEC. 104. RESEARCH IN AREAS OF NATIONAL IMPOR13 TANCE. 

14 ‘‘(a) IN GENERAL.—The Program shall encourage 

15 agencies under section 101(a)(3)(B) to support, maintain, 

16 and improve national, multi-agency, multi-faceted, re17 search and development activities in networking and infor18 mation technology directed toward application areas that 

19 have the potential for significant contributions to national 

20 economic competitiveness and for other significant societal 

21 benefits. 

22 ‘‘(b) TECHNICAL SOLUTIONS.—An activity under 

23 subsection (a) shall be designed to advance the develop24 ment of research discoveries by demonstrating technical 

25 solutions to important problems in areas including— 

mstockstill on DSK4VPTVN1PROD with BILLS

88 

•S 3342 PCS

1 ‘‘(1) cybersecurity; 

2 ‘‘(2) health care; 

3 ‘‘(3) energy management and low-power sys4 tems and devices; 

5 ‘‘(4) transportation, including surface and air 

6 transportation; 

7 ‘‘(5) cyber-physical systems; 

8 ‘‘(6) large-scale data analysis and modeling of 

9 physical phenomena; 

10 ‘‘(7) large scale data analysis and modeling of 

11 behavioral phenomena; 

12 ‘‘(8) supply chain quality and security; and 

13 ‘‘(9) privacy protection and protected disclosure 

14 of confidential data. 

15 ‘‘(c) RECOMMENDATIONS.—The advisory committee 

16 under section 101(b) shall make recommendations to the 

17 Program for candidate research and development areas for 

18 support under this section. 

19 ‘‘(d) CHARACTERISTICS.— 

20 ‘‘(1) IN GENERAL.—Research and development 

21 activities under this section— 

22 ‘‘(A) shall include projects selected on the 

23 basis of applications for support through a com24 petitive, merit-based process; 

mstockstill on DSK4VPTVN1PROD with BILLS

89 

•S 3342 PCS

1 ‘‘(B) shall leverage, when possible, Federal 

2 investments through collaboration with related 

3 State initiatives; 

4 ‘‘(C) shall include a plan for fostering the 

5 transfer of research discoveries and the results 

6 of technology demonstration activities, including 

7 from institutions of higher education and Fed8 eral laboratories, to industry for commercial de9 velopment; 

10 ‘‘(D) shall involve collaborations among re11 searchers in institutions of higher education 

12 and industry; and 

13 ‘‘(E) may involve collaborations among 

14 nonprofit research institutions and Federal lab15 oratories, as appropriate. 

16 ‘‘(2) COST-SHARING.—In selecting applications 

17 for support, the agencies under section 101(a)(3)(B) 

18 shall give special consideration to projects that in19 clude cost sharing from non-Federal sources. 

20 ‘‘(3) MULTIDISCIPLINARY RESEARCH CEN21 TERS.—Research and development activities under 

22 this section shall be supported through multidisci23 plinary research centers, including Federal labora24 tories, that are organized to investigate basic re25 search questions and carry out technology demmstockstill on DSK4VPTVN1PROD with BILLS

90 

•S 3342 PCS

1 onstration activities in areas described in subsection 

2 (a). Research may be carried out through existing 

3 multidisciplinary centers, including those authorized 

4 under section 7024(b)(2) of the America COM5 PETES Act (42 U.S.C. 1862o–10(2)).’’. 

6 (b) CYBER-PHYSICAL SYSTEMS.—Section 101(a)(1) 

7 of the High-Performance Computing Act of 1991 (15 

8 U.S.C. 5511(a)(1)) is amended— 

9 (1) in subparagraph (H), by striking ‘‘and’’ 

10 after the semicolon; 

11 (2) in subparagraph (I), by striking the period 

12 at the end and inserting a semicolon; and 

13 (3) by adding at the end the following: 

14 ‘‘(J) provide for increased understanding 

15 of the scientific principles of cyber-physical sys16 tems and improve the methods available for the 

17 design, development, and operation of cyber18 physical systems that are characterized by high 

19 reliability, safety, and security; and 

20 ‘‘(K) provide for research and development 

21 on human-computer interactions, visualization, 

22 and big data.’’. 

23 (c) TASK FORCE.—Title I of the High-Performance 

24 Computing Act of 1991 (15 U.S.C. 5511 et seq.), as 

mstockstill on DSK4VPTVN1PROD with BILLS

91 

•S 3342 PCS

1 amended by section 402(a) of this Act, is amended by add2 ing at the end the following: 

3 ‘‘SEC. 105. TASK FORCE. 

4 ‘‘(a) ESTABLISHMENT.—Not later than 180 days 

5 after the date of enactment the Strengthening and En6 hancing Cybersecurity by Using Research, Education, In7 formation, and Technology Act of 2012, the Director of 

8 the Office of Science and Technology Policy under section 

9 102 shall convene a task force to explore mechanisms for 

10 carrying out collaborative research and development activi11 ties for cyber-physical systems (including the related tech12 nologies required to enable these systems) through a con13 sortium or other appropriate entity with participants from 

14 institutions of higher education, Federal laboratories, and 

15 industry. 

16 ‘‘(b) FUNCTIONS.—The task force shall— 

17 ‘‘(1) develop options for a collaborative model 

18 and an organizational structure for such entity 

19 under which the joint research and development ac20 tivities could be planned, managed, and conducted 

21 effectively, including mechanisms for the allocation 

22 of resources among the participants in such entity 

23 for support of such activities; 

24 ‘‘(2) propose a process for developing a re25 search and development agenda for such entity, inmstockstill on DSK4VPTVN1PROD with BILLS

92 

•S 3342 PCS

1 cluding guidelines to ensure an appropriate scope of 

2 work focused on nationally significant challenges and 

3 requiring collaboration and to ensure the develop4 ment of related scientific and technological mile5 stones; 

6 ‘‘(3) define the roles and responsibilities for the 

7 participants from institutions of higher education, 

8 Federal laboratories, and industry in such entity; 

9 ‘‘(4) propose guidelines for assigning intellec10 tual property rights and for transferring research re11 sults to the private sector; and 

12 ‘‘(5) make recommendations for how such enti13 ty could be funded from Federal, State, and non14 governmental sources. 

15 ‘‘(c) COMPOSITION.—In establishing the task force 

16 under subsection (a), the Director of the Office of Science 

17 and Technology Policy shall appoint an equal number of 

18 individuals from institutions of higher education and from 

19 industry with knowledge and expertise in cyber-physical 

20 systems, and may appoint not more than 2 individuals 

21 from Federal laboratories. 

22 ‘‘(d) REPORT.—Not later than 1 year after the date 

23 of enactment of the Strengthening and Enhancing Cyber24 security by Using Research, Education, Information, and 

25 Technology Act of 2012, the Director of the Office of 

mstockstill on DSK4VPTVN1PROD with BILLS

93 

•S 3342 PCS

1 Science and Technology Policy shall transmit to the Com2 mittee on Commerce, Science, and Transportation of the 

3 Senate and the Committee on Science and Technology of 

4 the House of Representatives a report describing the find5 ings and recommendations of the task force. 

6 ‘‘(e) TERMINATION.—The task force shall terminate 

7 upon transmittal of the report required under subsection 

8 (d). 

9 ‘‘(f) COMPENSATION AND EXPENSES.—Members of 

10 the task force shall serve without compensation.’’. 

11 SEC. 403. PROGRAM IMPROVEMENTS. 

12 Section 102 of the High-Performance Computing Act 

13 of 1991 (15 U.S.C. 5512) is amended to read as follows: 

14 ‘‘SEC. 102. PROGRAM IMPROVEMENTS. 

15 ‘‘(a) FUNCTIONS.—The Director of the Office of 

16 Science and Technology Policy shall continue— 

17 ‘‘(1) to provide technical and administrative 

18 support to— 

19 ‘‘(A) the agencies participating in planning 

20 and implementing the Program, including sup21 port needed to develop the strategic plan under 

22 section 101(e); and 

23 ‘‘(B) the advisory committee under section 

24 101(b); 

mstockstill on DSK4VPTVN1PROD with BILLS

94 

•S 3342 PCS

1 ‘‘(2) to serve as the primary point of contact on 

2 Federal networking and information technology ac3 tivities for government agencies, academia, industry, 

4 professional societies, State computing and net5 working technology programs, interested citizen 

6 groups, and others to exchange technical and pro7 grammatic information; 

8 ‘‘(3) to solicit input and recommendations from 

9 a wide range of stakeholders during the development 

10 of each strategic plan under section 101(e) by con11 vening at least 1 workshop with invitees from aca12 demia, industry, Federal laboratories, and other rel13 evant organizations and institutions; 

14 ‘‘(4) to conduct public outreach, including the 

15 dissemination of the advisory committee’s findings 

16 and recommendations, as appropriate; 

17 ‘‘(5) to promote access to and early application 

18 of the technologies, innovations, and expertise de19 rived from Program activities to agency missions 

20 and systems across the Federal Government and to 

21 United States industry; 

22 ‘‘(6) to ensure accurate and detailed budget re23 porting of networking and information technology 

24 research and development investment; and 

mstockstill on DSK4VPTVN1PROD with BILLS

95 

•S 3342 PCS

1 ‘‘(7) to encourage agencies participating in the 

2 Program to use existing programs and resources to 

3 strengthen networking and information technology 

4 education and training, and increase participation in 

5 such fields, including by women and underrep6 resented minorities. 

7 ‘‘(b) SOURCE OF FUNDING.— 

8 ‘‘(1) IN GENERAL.—The functions under this 

9 section shall be supported by funds from each agen10 cy participating in the Program. 

11 ‘‘(2) SPECIFICATIONS.—The portion of the total 

12 budget of the Office of Science and Technology Pol13 icy that is provided by each agency participating in 

14 the Program for each fiscal year shall be in the 

15 same proportion as each agency’s share of the total 

16 budget for the Program for the previous fiscal year, 

17 as specified in the database under section 102(c). 

18 ‘‘(c) DATABASE.— 

19 ‘‘(1) IN GENERAL.—The Director of the Office 

20 of Science and Technology Policy shall develop and 

21 maintain a database of projects funded by each 

22 agency for the fiscal year for each Program Compo23 nent Area. 

mstockstill on DSK4VPTVN1PROD with BILLS

96 

•S 3342 PCS

1 ‘‘(2) PUBLIC ACCESSIBILITY.—The Director of 

2 the Office of Science and Technology Policy shall 

3 make the database accessible to the public. 

4 ‘‘(3) DATABASE CONTENTS.—The database 

5 shall include, for each project in the database— 

6 ‘‘(A) a description of the project; 

7 ‘‘(B) each agency, industry, institution of 

8 higher education, Federal laboratory, or inter9 national institution involved in the project; 

10 ‘‘(C) the source funding of the project (set 

11 forth by agency); 

12 ‘‘(D) the funding history of the project; 

13 and 

14 ‘‘(E) whether the project has been com15 pleted.’’. 

16 SEC. 404. IMPROVING EDUCATION OF NETWORKING AND 

17 INFORMATION TECHNOLOGY, INCLUDING 

18 HIGH PERFORMANCE COMPUTING. 

19 Section 201(a) of the High-Performance Computing 

20 Act of 1991 (15 U.S.C. 5521(a)) is amended— 

21 (1) by redesignating paragraphs (2) through 

22 (4) as paragraphs (3) through (5), respectively; and 

23 (2) by inserting after paragraph (1) the fol24 lowing: 

mstockstill on DSK4VPTVN1PROD with BILLS

97 

•S 3342 PCS

1 ‘‘(2) the National Science Foundation shall use 

2 its existing programs, in collaboration with other 

3 agencies, as appropriate, to improve the teaching 

4 and learning of networking and information tech5 nology at all levels of education and to increase par6 ticipation in networking and information technology 

7 fields;’’. 

8 SEC. 405. CONFORMING AND TECHNICAL AMENDMENTS TO 

9 THE HIGH-PERFORMANCE COMPUTING ACT 

10 OF 1991. 

11 (a) SECTION 3.—Section 3 of the High-Performance 

12 Computing Act of 1991 (15 U.S.C. 5502) is amended— 

13 (1) in the matter preceding paragraph (1), by 

14 striking ‘‘high-performance computing’’ and insert15 ing ‘‘networking and information technology’’; 

16 (2) in paragraph (1)— 

17 (A) in the matter preceding subparagraph 

18 (A), by striking ‘‘high-performance computing’’ 

19 and inserting ‘‘networking and information 

20 technology’’; 

21 (B) in subparagraphs (A), (F), and (G), by 

22 striking ‘‘high-performance computing’’ each 

23 place it appears and inserting ‘‘networking and 

24 information technology’’; and 

mstockstill on DSK4VPTVN1PROD with BILLS

98 

•S 3342 PCS

1 (C) in subparagraph (H), by striking 

2 ‘‘high-performance’’ and inserting ‘‘high-end’’; 

3 and 

4 (3) in paragraph (2)— 

5 (A) by striking ‘‘high-performance com6 puting and’’ and inserting ‘‘networking and in7 formation technology, and’’; and 

8 (B) by striking ‘‘high-performance com9 puting network’’ and inserting ‘‘networking and 

10 information technology’’. 

11 (b) TITLE HEADING.—The heading of title I of the 

12 High-Performance Computing Act of 1991 (105 Stat. 

13 1595) is amended by striking ‘‘HIGH-PERFORM14 ANCE COMPUTING’’ and inserting ‘‘NET15 WORKING AND INFORMATION TECH16 NOLOGY’’. 

17 (c) SECTION 101.—Section 101 of the High-Perform18 ance Computing Act of 1991 (15 U.S.C. 5511) is amend19 ed— 

20 (1) in the section heading, by striking ‘‘HIGH21 PERFORMANCE COMPUTING’’ and inserting 

22 ‘‘NETWORKING AND INFORMATION TECH23 NOLOGY RESEARCH AND DEVELOPMENT’’; 

24 (2) in subsection (a)— 

mstockstill on DSK4VPTVN1PROD with BILLS

99 

•S 3342 PCS

1 (A) in the subsection heading, by striking 

2 ‘‘NATIONAL HIGH-PERFORMANCE COMPUTING’’ 

3 and inserting ‘‘NETWORKING AND INFORMA4 TION TECHNOLOGY RESEARCH AND DEVELOP5 MENT’’; 

6 (B) in paragraph (1)— 

7 (i) by striking ‘‘National High-Per8 formance Computing Program’’ and insert9 ing ‘‘networking and information tech10 nology research and development pro11 gram’’; 

12 (ii) in subparagraph (A), by striking 

13 ‘‘high-performance computing, including 

14 networking’’ and inserting ‘‘networking 

15 and information technology’’; 

16 (iii) in subparagraphs (B) and (G), by 

17 striking ‘‘high-performance’’ each place it 

18 appears and inserting ‘‘high-end’’; and 

19 (iv) in subparagraph (C), by striking 

20 ‘‘high-performance computing and net21 working’’ and inserting ‘‘high-end com22 puting, distributed, and networking’’; and 

23 (C) in paragraph (2)— 

24 (i) in subparagraphs (A) and (C)— 

mstockstill on DSK4VPTVN1PROD with BILLS

100 

•S 3342 PCS

1 (I) by striking ‘‘high-performance 

2 computing’’ each place it appears and 

3 inserting ‘‘networking and information 

4 technology’’; and 

5 (II) by striking ‘‘development, 

6 networking,’’ each place it appears 

7 and inserting ‘‘development,’’; and 

8 (ii) in subparagraphs (G) and (H), as 

9 redesignated by section 401(d) of this Act, 

10 by striking ‘‘high-performance’’ each place 

11 it appears and inserting ‘‘high-end’’; 

12 (3) in subsection (b)(1), in the matter pre13 ceding subparagraph (A), by striking ‘‘high-perform14 ance computing’’ each place it appears and inserting 

15 ‘‘networking and information technology’’; and 

16 (4) in subsection (c)(1)(A), by striking ‘‘high17 performance computing’’ and inserting ‘‘networking 

18 and information technology’’. 

19 (d) SECTION 201.—Section 201(a)(1) of the High20 Performance Computing Act of 1991 (15 U.S.C. 

21 5521(a)(1)) is amended by striking ‘‘high-performance 

22 computing and advanced high-speed computer net23 working’’ and inserting ‘‘networking and information tech24 nology research and development’’. 

mstockstill on DSK4VPTVN1PROD with BILLS

101 

•S 3342 PCS

1 (e) SECTION 202.—Section 202(a) of the High-Per2 formance Computing Act of 1991 (15 U.S.C. 5522(a)) is 

3 amended by striking ‘‘high-performance computing’’ and 

4 inserting ‘‘networking and information technology’’. 

5 (f) SECTION 203.—Section 203(a) of the High-Per6 formance Computing Act of 1991 (15 U.S.C. 5523(a)) is 

7 amended— 

8 (1) in paragraph (1), by striking ‘‘high-per9 formance computing and networking’’ and inserting 

10 ‘‘networking and information technology’’; and 

11 (2) in paragraph (2)(A), by striking ‘‘high-per12 formance’’ and inserting ‘‘high-end’’. 

13 (g) SECTION 204.—Section 204 of the High-Per14 formance Computing Act of 1991 (15 U.S.C. 5524) is 

15 amended— 

16 (1) in subsection (a)(1)— 

17 (A) in subparagraph (A), by striking 

18 ‘‘high-performance computing systems and net19 works’’ and inserting ‘‘networking and informa20 tion technology systems and capabilities’’; 

21 (B) in subparagraph (B), by striking 

22 ‘‘interoperability of high-performance com23 puting systems in networks and for common 

24 user interfaces to systems’’ and inserting 

mstockstill on DSK4VPTVN1PROD with BILLS

102 

•S 3342 PCS

1 ‘‘interoperability and usability of networking 

2 and information technology systems’’; and 

3 (C) in subparagraph (C), by striking 

4 ‘‘high-performance computing’’ and inserting 

5 ‘‘networking and information technology’’; and 

6 (2) in subsection (b)— 

7 (A) by striking ‘‘HIGH-PERFORMANCE

8 COMPUTING AND NETWORK’’ in the heading 

9 and inserting ‘‘NETWORKING AND INFORMA10 TION TECHNOLOGY’’; and 

11 (B) by striking ‘‘sensitive’’. 

12 (h) SECTION 205.—Section 205(a) of the High-Per13 formance Computing Act of 1991 (15 U.S.C. 5525(a)) is 

14 amended by striking ‘‘computational’’ and inserting ‘‘net15 working and information technology’’. 

16 (i) SECTION 206.—Section 206(a) of the High-Per17 formance Computing Act of 1991 (15 U.S.C. 5526(a)) is 

18 amended by striking ‘‘computational research’’ and insert19 ing ‘‘networking and information technology research’’. 

20 (j) SECTION 207.—Section 207 of the High-Perform21 ance Computing Act of 1991 (15 U.S.C. 5527) is amended 

22 by striking ‘‘high-performance computing’’ and inserting 

23 ‘‘networking and information technology’’. 

mstockstill on DSK4VPTVN1PROD with BILLS

103 

•S 3342 PCS

1 (k) SECTION 208.—Section 208 of the High-Per2 formance Computing Act of 1991 (15 U.S.C. 5528) is 

3 amended— 

4 (1) in the section heading, by striking ‘‘HIGH5 PERFORMANCE COMPUTING’’ and inserting 

6 ‘‘NETWORKING AND INFORMATION TECH7 NOLOGY’’; and 

8 (2) in subsection (a)— 

9 (A) in paragraph (1), by striking ‘‘High10 performance computing and associated’’ and in11 serting ‘‘Networking and information’’; 

12 (B) in paragraph (2), by striking ‘‘high13 performance computing’’ and inserting ‘‘net14 working and information technologies’’; 

15 (C) in paragraph (3), by striking ‘‘high16 performance’’ and inserting ‘‘high-end’’; 

17 (D) in paragraph (4), by striking ‘‘high18 performance computers and associated’’ and in19 serting ‘‘networking and information’’; and 

20 (E) in paragraph (5), by striking ‘‘high21 performance computing and associated’’ and in22 serting ‘‘networking and information’’. 

mstockstill on DSK4VPTVN1PROD with BILLS

104 

•S 3342 PCS

1 SEC. 406. FEDERAL CYBER SCHOLARSHIP-FOR-SERVICE 

2 PROGRAM. 

3 (a) IN GENERAL.—The Director of the National 

4 Science Foundation, in coordination with the Secretary of 

5 Homeland Security, shall carry out a Federal cyber schol6 arship-for-service program to recruit and train the next 

7 generation of information technology professionals and se8 curity managers to meet the needs of the cybersecurity 

9 mission for the Federal government. 

10 (b) PROGRAM DESCRIPTION AND COMPONENTS.— 

11 The program shall— 

12 (1) annually assess the workforce needs of the 

13 Federal government for cybersecurity professionals, 

14 including network engineers, software engineers, and 

15 other experts in order to determine how many schol16 arships should be awarded annually to ensure that 

17 the workforce needs following graduation match the 

18 number of scholarships awarded; 

19 (2) provide scholarships for up to 1,000 stu20 dents per year in their pursuit of undergraduate or 

21 graduate degrees in the cybersecurity field, in an 

22 amount that may include coverage for full tuition, 

23 fees, and a stipend; 

24 (3) require each scholarship recipient, as a con25 dition of receiving a scholarship under the program, 

26 to serve in a Federal information technology workmstockstill on DSK4VPTVN1PROD with BILLS

105 

•S 3342 PCS

1 force for a period equal to one and one-half times 

2 each year, or partial year, of scholarship received, in 

3 addition to an internship in the cybersecurity field, 

4 if applicable, following graduation; 

5 (4) provide a procedure for the National 

6 Science Foundation or a Federal agency, consistent 

7 with regulations of the Office of Personnel Manage8 ment, to request and fund a security clearance for 

9 a scholarship recipient, including providing for clear10 ance during a summer internship and upon gradua11 tion; and 

12 (5) provide opportunities for students to receive 

13 temporary appointments for meaningful employment 

14 in the Federal information technology workforce 

15 during school vacation periods and for internships. 

16 (c) HIRING AUTHORITY.— 

17 (1) IN GENERAL.—For purposes of any law or 

18 regulation governing the appointment of an indi19 vidual in the Federal civil service, upon the success20 ful completion of the student’s studies, a student re21 ceiving a scholarship under the program may— 

22 (A) be hired under section 213.3102(r) of 

23 title 5, Code of Federal Regulations; and 

24 (B) be exempt from competitive service. 

mstockstill on DSK4VPTVN1PROD with BILLS

106 

•S 3342 PCS

1 (2) COMPETITIVE SERVICE.—Upon satisfactory 

2 fulfillment of the service term under paragraph (1), 

3 an individual may be converted to a competitive 

4 service position without competition if the individual 

5 meets the requirements for that position. 

6 (d) ELIGIBILITY.—The eligibility requirements for a 

7 scholarship under this section shall include that a scholar8 ship applicant— 

9 (1) be a citizen of the United States; 

10 (2) be eligible to be granted a security clear11 ance; 

12 (3) maintain a grade point average of 3.2 or 

13 above on a 4.0 scale for undergraduate study or a 

14 3.5 or above on a 4.0 scale for postgraduate study; 

15 (4) demonstrate a commitment to a career in 

16 improving the security of the information infrastruc17 ture; and 

18 (5) has demonstrated a level of proficiency in 

19 math or computer sciences. 

20 (e) FAILURE TO COMPLETE SERVICE OBLIGATION.— 

21 (1) IN GENERAL.—A scholarship recipient 

22 under this section shall be liable to the United 

23 States under paragraph (2) if the scholarship recipi24 ent— 

mstockstill on DSK4VPTVN1PROD with BILLS

107 

•S 3342 PCS

1 (A) fails to maintain an acceptable level of 

2 academic standing in the educational institution 

3 in which the individual is enrolled, as deter4 mined by the Director; 

5 (B) is dismissed from such educational in6 stitution for disciplinary reasons; 

7 (C) withdraws from the program for which 

8 the award was made before the completion of 

9 such program; 

10 (D) declares that the individual does not 

11 intend to fulfill the service obligation under this 

12 section; 

13 (E) fails to fulfill the service obligation of 

14 the individual under this section; or 

15 (F) loses a security clearance or becomes 

16 ineligible for a security clearance. 

17 (2) REPAYMENT AMOUNTS.— 

18 (A) LESS THAN 1 YEAR OF SERVICE.—If a 

19 circumstance under paragraph (1) occurs before 

20 the completion of 1 year of a service obligation 

21 under this section, the total amount of awards 

22 received by the individual under this section 

23 shall be repaid. 

24 (B) ONE OR MORE YEARS OF SERVICE.— 

25 If a circumstance described in subparagraph 

mstockstill on DSK4VPTVN1PROD with BILLS

108 

•S 3342 PCS

1 (D) or (E) of paragraph (1) occurs after the 

2 completion of 1 year of a service obligation 

3 under this section, the total amount of scholar4 ship awards received by the individual under 

5 this section, reduced by the ratio of the number 

6 of years of service completed divided by the 

7 number of years of service required, shall be re8 paid. 

9 (f) EVALUATION AND REPORT.—The Director of the 

10 National Science Foundation shall— 

11 (1) evaluate the success of recruiting individ12 uals for scholarships under this section and of hiring 

13 and retaining those individuals in the public sector 

14 workforce, including the annual cost and an assess15 ment of how the program actually improves the Fed16 eral workforce; and 

17 (2) periodically report the findings under para18 graph (1) to Congress. 

19 (g) AUTHORIZATION OF APPROPRIATIONS.—From 

20 amounts made available under section 503 of the America 

21 COMPETES Reauthorization Act of 2010 (124 Stat. 

22 4005), the Secretary may use funds to carry out the re23 quirements of this section for fiscal years 2012 through 

24 2013. 

mstockstill on DSK4VPTVN1PROD with BILLS

109 

•S 3342 PCS

1 SEC. 407. STUDY AND ANALYSIS OF CERTIFICATION AND 

2 TRAINING OF INFORMATION INFRASTRUC3 TURE PROFESSIONALS. 

4 (a) STUDY.—The President shall enter into an agree5 ment with the National Academies to conduct a com6 prehensive study of government, academic, and private7 sector accreditation, training, and certification programs 

8 for personnel working in information infrastructure. The 

9 agreement shall require the National Academies to consult 

10 with sector coordinating councils and relevant govern11 mental agencies, regulatory entities, and nongovernmental 

12 organizations in the course of the study. 

13 (b) SCOPE.—The study shall include— 

14 (1) an evaluation of the body of knowledge and 

15 various skills that specific categories of personnel 

16 working in information infrastructure should possess 

17 in order to secure information systems; 

18 (2) an assessment of whether existing govern19 ment, academic, and private-sector accreditation, 

20 training, and certification programs provide the body 

21 of knowledge and various skills described in para22 graph (1); 

23 (3) an analysis of any barriers to the Federal 

24 Government recruiting and hiring cybersecurity tal25 ent, including barriers relating to compensation, the 

mstockstill on DSK4VPTVN1PROD with BILLS

110 

•S 3342 PCS

1 hiring process, job classification, and hiring flexi2 bility; and 

3 (4) an analysis of the sources and availability of 

4 cybersecurity talent, a comparison of the skills and 

5 expertise sought by the Federal Government and the 

6 private sector, an examination of the current and fu7 ture capacity of United States institutions of higher 

8 education, including community colleges, to provide 

9 current and future cybersecurity professionals, 

10 through education and training activities, with those 

11 skills sought by the Federal Government, State and 

12 local entities, and the private sector. 

13 (c) REPORT.—Not later than 1 year after the date 

14 of enactment of this Act, the National Academies shall 

15 submit to the President and Congress a report on the re16 sults of the study. The report shall include— 

17 (1) findings regarding the state of information 

18 infrastructure accreditation, training, and certifi19 cation programs, including specific areas of defi20 ciency and demonstrable progress; and 

21 (2) recommendations for the improvement of in22 formation infrastructure accreditation, training, and 

23 certification programs. 

mstockstill on DSK4VPTVN1PROD with BILLS

111 

•S 3342 PCS

1 SEC. 408. INTERNATIONAL CYBERSECURITY TECHNICAL 

2 STANDARDS. 

3 (a) IN GENERAL.—The Director of the National In4 stitute of Standards and Technology, in coordination with 

5 appropriate Federal authorities, shall— 

6 (1) as appropriate, ensure coordination of Fed7 eral agencies engaged in the development of inter8 national technical standards related to information 

9 system security; and 

10 (2) not later than 1 year after the date of en11 actment of this Act, develop and transmit to Con12 gress a plan for ensuring such Federal agency co13 ordination. 

14 (b) CONSULTATION WITH THE PRIVATE SECTOR.— 

15 In carrying out the activities under subsection (a)(1), the 

16 Director shall ensure consultation with appropriate private 

17 sector stakeholders. 

18 SEC. 409. IDENTITY MANAGEMENT RESEARCH AND DEVEL19 OPMENT. 

20 The Director of the National Institute of Standards 

21 and Technology shall continue a program to support the 

22 development of technical standards, metrology, testbeds, 

23 and conformance criteria, taking into account appropriate 

24 user concerns— 

25 (1) to improve interoperability among identity 

26 management technologies; 

mstockstill on DSK4VPTVN1PROD with BILLS

112 

•S 3342 PCS

1 (2) to strengthen authentication methods of 

2 identity management systems; 

3 (3) to improve privacy protection in identity 

4 management systems, including health information 

5 technology systems, through authentication and se6 curity protocols; and 

7 (4) to improve the usability of identity manage8 ment systems. 

9 SEC. 410. FEDERAL CYBERSECURITY RESEARCH AND DE10 VELOPMENT. 

11 (a) NATIONAL SCIENCE FOUNDATION COMPUTER

12 AND NETWORK SECURITY RESEARCH GRANT AREAS.— 

13 Section 4(a)(1) of the Cyber Security Research and Devel14 opment Act (15 U.S.C. 7403(a)(1)) is amended— 

15 (1) in subparagraph (H), by striking ‘‘and’’ 

16 after the semicolon; 

17 (2) in subparagraph (I), by striking ‘‘property.’’ 

18 and inserting ‘‘property;’’; and 

19 (3) by adding at the end the following: 

20 ‘‘(J) secure fundamental protocols that are 

21 at the heart of inter-network communications 

22 and data exchange; 

23 ‘‘(K) system security that addresses the 

24 building of secure systems from trusted and 

25 untrusted components; 

mstockstill on DSK4VPTVN1PROD with BILLS

113 

•S 3342 PCS

1 ‘‘(L) monitoring and detection; and 

2 ‘‘(M) resiliency and rapid recovery meth3 ods.’’. 

4 (b) NATIONAL SCIENCE FOUNDATION COMPUTER

5 AND NETWORK SECURITY GRANTS.—Section 4(a)(3) of 

6 the Cyber Security Research and Development Act (15 

7 U.S.C. 7403(a)(3)) is amended— 

8 (1) in subparagraph (D), by striking ‘‘and’’; 

9 (2) in subparagraph (E), by striking ‘‘2007.’’ 

10 and inserting ‘‘2007;’’; and 

11 (3) by adding at the end the following: 

12 ‘‘(F) such funds from amounts made avail13 able under section 503 of the America COM14 PETES Reauthorization Act of 2010 (124 

15 Stat. 4005), as the Secretary finds necessary to 

16 carry out the requirements of this subsection 

17 for fiscal years 2012 through 2013.’’. 

18 (c) COMPUTER AND NETWORK SECURITY CEN19 TERS.—Section 4(b)(7) of the Cyber Security Research 

20 and Development Act (15 U.S.C. 7403(b)(7)) is amend21 ed— 

22 (1) in subparagraph (D), by striking ‘‘and’’; 

23 (2) in subparagraph (E), by striking ‘‘2007.’’ 

24 and inserting ‘‘2007;’’; and 

25 (3) by adding at the end the following: 

mstockstill on DSK4VPTVN1PROD with BILLS

114 

•S 3342 PCS

1 ‘‘(F) such funds from amounts made avail2 able under section 503 of the America COM3 PETES Reauthorization Act of 2010 (124 

4 Stat. 4005), as the Secretary finds necessary to 

5 carry out the requirements of this subsection 

6 for fiscal years 2012 through 2013.’’. 

7 (d) COMPUTER AND NETWORK SECURITY CAPACITY

8 BUILDING GRANTS.—Section 5(a)(6) of the Cyber Secu9 rity Research and Development Act (15 U.S.C. 

10 7404(a)(6)) is amended— 

11 (1) in subparagraph (D), by striking ‘‘and’’; 

12 (2) in subparagraph (E), by striking ‘‘2007.’’ 

13 and inserting ‘‘2007;’’; and 

14 (3) by adding at the end the following: 

15 ‘‘(F) such funds from amounts made avail16 able under section 503 of the America COM17 PETES Reauthorization Act of 2010 (124 

18 Stat. 4005), as the Secretary finds necessary to 

19 carry out the requirements of this subsection 

20 for fiscal years 2012 through 2013.’’. 

21 (e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT

22 GRANTS.—Section 5(b)(2) of the Cyber Security Research 

23 and Development Act (15 U.S.C. 7404(b)(2)) is amend24 ed— 

25 (1) in subparagraph (D), by striking ‘‘and’’; 

mstockstill on DSK4VPTVN1PROD with BILLS

115 

•S 3342 PCS

1 (2) in subparagraph (E), by striking ‘‘2007.’’ 

2 and inserting ‘‘2007;’’; and 

3 (3) by adding at the end the following: 

4 ‘‘(F) such funds from amounts made avail5 able under section 503 of the America COM6 PETES Reauthorization Act of 2010 (124 

7 Stat. 4005), as the Secretary finds necessary to 

8 carry out the requirements of this subsection 

9 for fiscal years 2012 through 2013.’’. 

10 (f) GRADUATE TRAINEESHIPS IN COMPUTER AND

11 NETWORK SECURITY RESEARCH.—Section 5(c)(7) of the 

12 Cyber Security Research and Development Act (15 U.S.C. 

13 7404(c)(7)) is amended— 

14 (1) in subparagraph (D), by striking ‘‘and’’; 

15 (2) in subparagraph (E), by striking ‘‘2007.’’ 

16 and inserting ‘‘2007;’’; and 

17 (3) by adding at the end the following: 

18 ‘‘(F) such funds from amounts made avail19 able under section 503 of the America COM20 PETES Reauthorization Act of 2010 (124 

21 Stat. 4005), as the Secretary finds necessary to 

22 carry out the requirements of this subsection 

23 for fiscal years 2012 through 2013.’’. 

mstockstill on DSK4VPTVN1PROD with BILLS

Calendar No. 438 

112TH CONGRESS 

2D SESSION S. 3342 

A BILL 

To improve information security, and for other 

purposes. 

JUNE 28, 2012 

Read the second time and placed on the calendar 

mstockstill on DSK4VPTVN1PROD with BILLS