IB 

Union Calendar No. 19 

113TH CONGRESS 

1ST SESSION H. R. 756 

[Report No. 113–33] 

To advance cybersecurity research, development, and technical standards, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

FEBRUARY 15, 2013 

Mr. MCCAUL (for himself, Mr. LIPINSKI, Mr. SMITH of Texas, Mr. LANGEVIN, 

Mr. MEEHAN, Ms. MATSUI, Mr. HALL, and Mr. BEN RAY LUJA ́N of New 

Mexico) introduced the following bill; which was referred to the Committee on Science, Space, and Technology 

APRIL 11, 2013 

Additional sponsors: Mr. ROGERS of Michigan, Mrs. MILLER of Michigan, Mr. 

GARRETT, Mr. THORNBERRY, Mr. STEWART, and Ms. ESTY

APRIL 11, 2013 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on February 15, 2013] 

mstockstill on DSK4VPTVN1PROD with BILLS

2 

•HR 756 RH

A BILL 

To advance cybersecurity research, development, and 

technical standards, and for other purposes. 

mstockstill on DSK4VPTVN1PROD with BILLS

3 

•HR 756 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Cybersecurity Enhance5 ment Act of 2013’’. 

6 TITLE I—RESEARCH AND 

7 DEVELOPMENT 

8 SEC. 101. DEFINITIONS. 

9 In this title: 

10 (1) NATIONAL COORDINATION OFFICE.—The term 

11 National Coordination Office means the National Co12 ordination Office for the Networking and Information 

13 Technology Research and Development program. 

14 (2) PROGRAM.—The term Program means the 

15 Networking and Information Technology Research 

16 and Development program which has been established 

17 under section 101 of the High-Performance Com18 puting Act of 1991 (15 U.S.C. 5511). 

19 SEC. 102. FINDINGS. 

20 Section 2 of the Cyber Security Research and Develop21 ment Act (15 U.S.C. 7401) is amended— 

22 (1) by amending paragraph (1) to read as fol23 lows: 

24 ‘‘(1) Advancements in information and commu25 nications technology have resulted in a globally intermstockstill on DSK4VPTVN1PROD with BILLS

4 

•HR 756 RH

1 connected network of government, commercial, sci2 entific, and education infrastructures, including crit3 ical infrastructures for electric power, natural gas 

4 and petroleum production and distribution, tele5 communications, transportation, water supply, bank6 ing and finance, and emergency and government serv7 ices.’’; 

8 (2) in paragraph (2), by striking ‘‘Exponential 

9 increases in interconnectivity have facilitated en10 hanced communications, economic growth,’’ and in11 serting ‘‘These advancements have significantly con12 tributed to the growth of the United States economy,’’; 

13 (3) by amending paragraph (3) to read as fol14 lows: 

15 ‘‘(3) The Cyberspace Policy Review published by 

16 the President in May, 2009, concluded that our infor17 mation technology and communications infrastruc18 ture is vulnerable and has ‘suffered intrusions that 

19 have allowed criminals to steal hundreds of millions 

20 of dollars and nation-states and other entities to steal 

21 intellectual property and sensitive military informa22 tion’.’’; and 

23 (4) by amending paragraph (6) to read as fol24 lows: 

mstockstill on DSK4VPTVN1PROD with BILLS

5 

•HR 756 RH

1 ‘‘(6) While African-Americans, Hispanics, and 

2 Native Americans constitute 33 percent of the college3 age population, members of these minorities comprise 

4 less than 20 percent of bachelor degree recipients in 

5 the field of computer sciences.’’. 

6 SEC. 103. CYBERSECURITY STRATEGIC RESEARCH AND DE7 VELOPMENT PLAN. 

8 (a) IN GENERAL.—Not later than 12 months after the 

9 date of enactment of this Act, the agencies identified in sub10 section 101(a)(3)(B)(i) through (x) of the High-Performance 

11 Computing Act of 1991 (15 U.S.C. 5511(a)(3)(B)(i) 

12 through (x)) or designated under section 101(a)(3)(B)(xi) 

13 of such Act, working through the National Science and 

14 Technology Council and with the assistance of the National 

15 Coordination Office, shall transmit to Congress a strategic 

16 plan based on an assessment of cybersecurity risk to guide 

17 the overall direction of Federal cybersecurity and informa18 tion assurance research and development for information 

19 technology and networking systems. Once every 3 years 

20 after the initial strategic plan is transmitted to Congress 

21 under this section, such agencies shall prepare and transmit 

22 to Congress an update of such plan. 

23 (b) CONTENTS OF PLAN.—The strategic plan required 

24 under subsection (a) shall— 

mstockstill on DSK4VPTVN1PROD with BILLS

6 

•HR 756 RH

1 (1) specify and prioritize near-term, mid-term 

2 and long-term research objectives, including objectives 

3 associated with the research areas identified in sec4 tion 4(a)(1) of the Cyber Security Research and De5 velopment Act (15 U.S.C. 7403(a)(1)) and how the 

6 near-term objectives complement research and develop7 ment areas in which the private sector is actively en8 gaged; 

9 (2) describe how the Program will focus on inno10 vative, transformational technologies with the poten11 tial to enhance the security, reliability, resilience, and 

12 trustworthiness of the digital infrastructure, and to 

13 protect consumer privacy; 

14 (3) describe how the Program will foster the 

15 rapid transfer of research and development results 

16 into new cybersecurity technologies and applications 

17 for the timely benefit of society and the national in18 terest, including through the dissemination of best 

19 practices and other outreach activities; 

20 (4) describe how the Program will establish and 

21 maintain a national research infrastructure for cre22 ating, testing, and evaluating the next generation of 

23 secure networking and information technology sys24 tems; 

mstockstill on DSK4VPTVN1PROD with BILLS

7 

•HR 756 RH

1 (5) describe how the Program will facilitate ac2 cess by academic researchers to the infrastructure de3 scribed in paragraph (4), as well as to relevant data, 

4 including event data; 

5 (6) describe how the Program will engage females 

6 and individuals identified in section 33 or 34 of the 

7 Science and Engineering Equal Opportunities Act 

8 (42 U.S.C. 1885a or 1885b) to foster a more diverse 

9 workforce in this area; and 

10 (7) describe how the Program will help to recruit 

11 and prepare veterans for the Federal cybersecurity 

12 workforce. 

13 (c) DEVELOPMENT OF ROADMAP.—The agencies de14 scribed in subsection (a) shall develop and annually update 

15 an implementation roadmap for the strategic plan required 

16 in this section. Such roadmap shall— 

17 (1) specify the role of each Federal agency in 

18 carrying out or sponsoring research and development 

19 to meet the research objectives of the strategic plan, 

20 including a description of how progress toward the re21 search objectives will be evaluated; 

22 (2) specify the funding allocated to each major 

23 research objective of the strategic plan and the source 

24 of funding by agency for the current fiscal year; and 

mstockstill on DSK4VPTVN1PROD with BILLS

8 

•HR 756 RH

1 (3) estimate the funding required for each major 

2 research objective of the strategic plan for the fol3 lowing 3 fiscal years. 

4 (d) RECOMMENDATIONS.—In developing and updating 

5 the strategic plan under subsection (a), the agencies in6 volved shall solicit recommendations and advice from— 

7 (1) the advisory committee established under sec8 tion 101(b)(1) of the High-Performance Computing 

9 Act of 1991 (15 U.S.C. 5511(b)(1)); and 

10 (2) a wide range of stakeholders, including in11 dustry, academia, including representatives of minor12 ity serving institutions and community colleges, Na13 tional Laboratories, and other relevant organizations 

14 and institutions. 

15 (e) APPENDING TO REPORT.—The implementation 

16 roadmap required under subsection (c), and its annual up17 dates, shall be appended to the report required under section 

18 101(a)(2)(D) of the High-Performance Computing Act of 

19 1991 (15 U.S.C. 5511(a)(2)(D)). 

20 (f) CYBERSECURITY RESEARCH DATABASE.—The 

21 agencies involved in developing and updating the strategic 

22 plan under subsection (a) shall establish, in coordination 

23 with the Office of Management and Budget, a mechanism 

24 to track ongoing and completed Federal cybersecurity remstockstill on DSK4VPTVN1PROD with BILLS

9 

•HR 756 RH

1 search and development projects and associated funding, 

2 and shall make such information publically available. 

3 SEC. 104. SOCIAL AND BEHAVIORAL RESEARCH IN CYBER4 SECURITY. 

5 Section 4(a)(1) of the Cyber Security Research and 

6 Development Act (15 U.S.C. 7403(a)(1)) is amended— 

7 (1) by inserting ‘‘and usability’’ after ‘‘to the 

8 structure’’; 

9 (2) in subparagraph (H), by striking ‘‘and’’ 

10 after the semicolon; 

11 (3) in subparagraph (I), by striking the period 

12 at the end and inserting ‘‘; and’’; and 

13 (4) by adding at the end the following new sub14 paragraph: 

15 ‘‘(J) social and behavioral factors, including 

16 human-computer interactions, usability, and 

17 user motivations.’’. 

18 SEC. 105. NATIONAL SCIENCE FOUNDATION CYBERSECU19 RITY RESEARCH AND DEVELOPMENT PRO20 GRAMS. 

21 (a) COMPUTER AND NETWORK SECURITY RESEARCH

22 AREAS.—Section 4(a)(1) of the Cyber Security Research 

23 and Development Act (15 U.S.C. 7403(a)(1)) is amended— 

24 (1) in subparagraph (A) by inserting ‘‘identity 

25 management,’’ after ‘‘cryptography,’’; and 

mstockstill on DSK4VPTVN1PROD with BILLS

10 

•HR 756 RH

1 (2) in subparagraph (I), by inserting ‘‘, crimes 

2 against children, and organized crime’’ after ‘‘intel3 lectual property’’. 

4 (b) COMPUTER AND NETWORK SECURITY RESEARCH

5 GRANTS.—Section 4(a)(3) of such Act (15 U.S.C. 

6 7403(a)(3)) is amended by striking subparagraphs (A) 

7 through (E) and inserting the following new subpara8 graphs: 

9 ‘‘(A) $119,000,000 for fiscal year 2014; 

10 ‘‘(B) $119,000,000 for fiscal year 2015; and 

11 ‘‘(C) $119,000,000 for fiscal year 2016.’’. 

12 (c) COMPUTER AND NETWORK SECURITY RESEARCH

13 CENTERS.—Section 4(b) of such Act (15 U.S.C. 7403(b)) 

14 is amended— 

15 (1) in paragraph (4)— 

16 (A) in subparagraph (C), by striking ‘‘and’’ 

17 after the semicolon; 

18 (B) in subparagraph (D), by striking the 

19 period and inserting ‘‘; and’’; and 

20 (C) by adding at the end the following new 

21 subparagraph: 

22 ‘‘(E) how the center will partner with gov23 ernment laboratories, for-profit entities, other in24 stitutions of higher education, or nonprofit re25 search institutions.’’; and 

mstockstill on DSK4VPTVN1PROD with BILLS

11 

•HR 756 RH

1 (2) in paragraph (7) by striking subparagraphs 

2 (A) through (E) and inserting the following new sub3 paragraphs: 

4 ‘‘(A) $5,000,000 for fiscal year 2014; 

5 ‘‘(B) $5,000,000 for fiscal year 2015; and 

6 ‘‘(C) $5,000,000 for fiscal year 2016.’’. 

7 (d) COMPUTER AND NETWORK SECURITY CAPACITY

8 BUILDING GRANTS.—Section 5(a)(6) of such Act (15 U.S.C. 

9 7404(a)(6)) is amended by striking subparagraphs (A) 

10 through (E) and inserting the following new subpara11 graphs: 

12 ‘‘(A) $25,000,000 for fiscal year 2014; 

13 ‘‘(B) $25,000,000 for fiscal year 2015; and 

14 ‘‘(C) $25,000,000 for fiscal year 2016.’’. 

15 (e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT

16 GRANTS.—Section 5(b)(2) of such Act (15 U.S.C. 

17 7404(b)(2)) is amended by striking subparagraphs (A) 

18 through (E) and inserting the following new subpara19 graphs: 

20 ‘‘(A) $4,000,000 for fiscal year 2014; 

21 ‘‘(B) $4,000,000 for fiscal year 2015; and 

22 ‘‘(C) $4,000,000 for fiscal year 2016.’’. 

23 (f) GRADUATE TRAINEESHIPS IN COMPUTER AND NET24 WORK SECURITY.—Section 5(c)(7) of such Act (15 U.S.C. 

25 7404(c)(7)) is amended by striking subparagraphs (A) 

mstockstill on DSK4VPTVN1PROD with BILLS

12 

•HR 756 RH

1 through (E) and inserting the following new subpara2 graphs: 

3 ‘‘(A) $32,000,000 for fiscal year 2014; 

4 ‘‘(B) $32,000,000 for fiscal year 2015; and 

5 ‘‘(C) $32,000,000 for fiscal year 2016.’’. 

6 (g) CYBER SECURITY FACULTY DEVELOPMENT

7 TRAINEESHIP PROGRAM.—Section 5(e) of such Act (15 

8 U.S.C. 7404(e)) is repealed. 

9 SEC. 106. FEDERAL CYBER SCHOLARSHIP FOR SERVICE 

10 PROGRAM. 

11 (a) IN GENERAL.—The Director of the National 

12 Science Foundation shall continue a Scholarship for Serv13 ice program under section 5(a) of the Cyber Security Re14 search and Development Act (15 U.S.C. 7404(a)) to recruit 

15 and train the next generation of Federal cybersecurity pro16 fessionals and to increase the capacity of the higher edu17 cation system to produce an information technology work18 force with the skills necessary to enhance the security of the 

19 Nation’s communications and information infrastructure. 

20 (b) CHARACTERISTICS OF PROGRAM.—The program 

21 under this section shall— 

22 (1) provide, through qualified institutions of 

23 higher education, including community colleges, schol24 arships that provide tuition, fees, and a competitive 

25 stipend for up to 2 years to students pursing a bachmstockstill on DSK4VPTVN1PROD with BILLS

13 

•HR 756 RH

1 elor’s or master’s degree and up to 3 years to students 

2 pursuing a doctoral degree in a cybersecurity field; 

3 (2) provide the scholarship recipients with sum4 mer internship opportunities or other meaningful 

5 temporary appointments in the Federal information 

6 technology workforce; and 

7 (3) increase the capacity of institutions of higher 

8 education throughout all regions of the United States 

9 to produce highly qualified cybersecurity profes10 sionals, through the award of competitive, merit-re11 viewed grants that support such activities as— 

12 (A) faculty professional development, in13 cluding technical, hands-on experiences in the 

14 private sector or government, workshops, semi15 nars, conferences, and other professional develop16 ment opportunities that will result in improved 

17 instructional capabilities; 

18 (B) institutional partnerships, including 

19 minority serving institutions and community 

20 colleges; 

21 (C) development and evaluation of cyberse22 curity-related courses and curricula; and 

23 (D) public-private partnerships that will 

24 integrate research experiences and hands-on 

25 learning into cybersecurity degree programs. 

mstockstill on DSK4VPTVN1PROD with BILLS

14 

•HR 756 RH

1 (c) SCHOLARSHIP REQUIREMENTS.— 

2 (1) ELIGIBILITY.—Scholarships under this sec3 tion shall be available only to students who— 

4 (A) are citizens or permanent residents of 

5 the United States; 

6 (B) are full-time students in an eligible de7 gree program, as determined by the Director, 

8 that is focused on computer security or informa9 tion assurance at an awardee institution; and 

10 (C) accept the terms of a scholarship pursu11 ant to this section. 

12 (2) SELECTION.—Individuals shall be selected to 

13 receive scholarships primarily on the basis of aca14 demic merit, with consideration given to financial 

15 need, to the goal of promoting the participation of fe16 males and individuals identified in section 33 or 34 

17 of the Science and Engineering Equal Opportunities 

18 Act (42 U.S.C. 1885a or 1885b), and to veterans. For 

19 purposes of this paragraph, the term ‘‘veteran’’ means 

20 a person who— 

21 (A) served on active duty (other than active 

22 duty for training) in the Armed Forces of the 

23 United States for a period of more than 180 con24 secutive days, and who was discharged or remstockstill on DSK4VPTVN1PROD with BILLS

15 

•HR 756 RH

1 leased therefrom under conditions other than dis2 honorable; or 

3 (B) served on active duty (other than active 

4 duty for training) in the Armed Forces of the 

5 United States and was discharged or released 

6 from such service for a service-connected dis7 ability before serving 180 consecutive days. 

8 For purposes of subparagraph (B), the term ‘‘service9 connected’’ has the meaning given such term under 

10 section 101 of title 38, United States Code. 

11 (3) SERVICE OBLIGATION.—If an individual re12 ceives a scholarship under this section, as a condition 

13 of receiving such scholarship, the individual upon 

14 completion of their degree must serve as a cybersecu15 rity professional within the Federal workforce for a 

16 period of time as provided in paragraph (5). If a 

17 scholarship recipient is not offered employment by a 

18 Federal agency or a federally funded research and de19 velopment center, the service requirement can be satis20 fied at the Director’s discretion by— 

21 (A) serving as a cybersecurity professional 

22 in a State, local, or tribal government agency; or 

23 (B) teaching cybersecurity courses at an in24 stitution of higher education. 

mstockstill on DSK4VPTVN1PROD with BILLS

16 

•HR 756 RH

1 (4) CONDITIONS OF SUPPORT.—As a condition of 

2 acceptance of a scholarship under this section, a re3 cipient shall agree to provide the awardee institution 

4 with annual verifiable documentation of employment 

5 and up-to-date contact information. 

6 (5) LENGTH OF SERVICE.—The length of service 

7 required in exchange for a scholarship under this sub8 section shall be 1 year more than the number of years 

9 for which the scholarship was received. 

10 (d) FAILURE TO COMPLETE SERVICE OBLIGATION.— 

11 (1) GENERAL RULE.—If an individual who has 

12 received a scholarship under this section— 

13 (A) fails to maintain an acceptable level of 

14 academic standing in the educational institution 

15 in which the individual is enrolled, as deter16 mined by the Director; 

17 (B) is dismissed from such educational in18 stitution for disciplinary reasons; 

19 (C) withdraws from the program for which 

20 the award was made before the completion of 

21 such program; 

22 (D) declares that the individual does not in23 tend to fulfill the service obligation under this 

24 section; or 

mstockstill on DSK4VPTVN1PROD with BILLS

17 

•HR 756 RH

1 (E) fails to fulfill the service obligation of 

2 the individual under this section, 

3 such individual shall be liable to the United States as 

4 provided in paragraph (3). 

5 (2) MONITORING COMPLIANCE.—As a condition 

6 of participating in the program, a qualified institu7 tion of higher education receiving a grant under this 

8 section shall— 

9 (A) enter into an agreement with the Direc10 tor of the National Science Foundation to mon11 itor the compliance of scholarship recipients with 

12 respect to their service obligation; and 

13 (B) provide to the Director, on an annual 

14 basis, post-award employment information re15 quired under subsection (c)(4) for scholarship re16 cipients through the completion of their service 

17 obligation. 

18 (3) AMOUNT OF REPAYMENT.— 

19 (A) LESS THAN ONE YEAR OF SERVICE.—If 

20 a circumstance described in paragraph (1) oc21 curs before the completion of 1 year of a service 

22 obligation under this section, the total amount of 

23 awards received by the individual under this sec24 tion shall be repaid or such amount shall be 

mstockstill on DSK4VPTVN1PROD with BILLS

18 

•HR 756 RH

1 treated as a loan to be repaid in accordance with 

2 subparagraph (C). 

3 (B) MORE THAN ONE YEAR OF SERVICE.— 

4 If a circumstance described in subparagraph (D) 

5 or (E) of paragraph (1) occurs after the comple6 tion of 1 year of a service obligation under this 

7 section, the total amount of scholarship awards 

8 received by the individual under this section, re9 duced by the ratio of the number of years of serv10 ice completed divided by the number of years of 

11 service required, shall be repaid or such amount 

12 shall be treated as a loan to be repaid in accord13 ance with subparagraph (C). 

14 (C) REPAYMENTS.—A loan described in 

15 subparagraph (A) or (B) shall be treated as a 

16 Federal Direct Unsubsidized Stafford Loan 

17 under part D of title IV of the Higher Education 

18 Act of 1965 (20 U.S.C. 1087a and following), 

19 and shall be subject to repayment, together with 

20 interest thereon accruing from the date of the 

21 scholarship award, in accordance with terms and 

22 conditions specified by the Director (in consulta23 tion with the Secretary of Education) in regula24 tions promulgated to carry out this paragraph. 

25 (4) COLLECTION OF REPAYMENT.— 

mstockstill on DSK4VPTVN1PROD with BILLS

19 

•HR 756 RH

1 (A) IN GENERAL.—In the event that a schol2 arship recipient is required to repay the scholar3 ship under this subsection, the institution pro4 viding the scholarship shall— 

5 (i) be responsible for determining the 

6 repayment amounts and for notifying the 

7 recipient and the Director of the amount 

8 owed; and 

9 (ii) collect such repayment amount 

10 within a period of time as determined 

11 under the agreement described in paragraph 

12 (2), or the repayment amount shall be treat13 ed as a loan in accordance with paragraph 

14 (3)(C). 

15 (B) RETURNED TO TREASURY.—Except as 

16 provided in subparagraph (C) of this paragraph, 

17 any such repayment shall be returned to the 

18 Treasury of the United States. 

19 (C) RETAIN PERCENTAGE.—An institution 

20 of higher education may retain a percentage of 

21 any repayment the institution collects under this 

22 paragraph to defray administrative costs associ23 ated with the collection. The Director shall estab24 lish a single, fixed percentage that will apply to 

25 all eligible entities. 

mstockstill on DSK4VPTVN1PROD with BILLS

20 

•HR 756 RH

1 (5) EXCEPTIONS.—The Director may provide for 

2 the partial or total waiver or suspension of any serv3 ice or payment obligation by an individual under 

4 this section whenever compliance by the individual 

5 with the obligation is impossible or would involve ex6 treme hardship to the individual, or if enforcement of 

7 such obligation with respect to the individual would 

8 be unconscionable. 

9 (e) HIRING AUTHORITY.— 

10 (1) APPOINTMENT IN EXCEPTED SERVICE.—Not11 withstanding any provision of chapter 33 of title 5, 

12 United States Code, governing appointments in the 

13 competitive service, an agency shall appoint in the 

14 excepted service an individual who has completed the 

15 academic program for which a scholarship was 

16 awarded. 

17 (2) NONCOMPETITIVE CONVERSION.—Except as 

18 provided in paragraph (4), upon fulfillment of the 

19 service term, an employee appointed under paragraph 

20 (1) may be converted noncompetitively to term, ca21 reer-conditional or career appointment. 

22 (3) TIMING OF CONVERSION.—An agency may 

23 noncompetitively convert a term employee appointed 

24 under paragraph (2) to a career-conditional or career 

25 appointment before the term appointment expires. 

mstockstill on DSK4VPTVN1PROD with BILLS

21 

•HR 756 RH

1 (4) AUTHORITY TO DECLINE CONVERSION.—An 

2 agency may decline to make the noncompetitive con3 version or appointment under paragraph (2) for 

4 cause. 

5 SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT. 

6 Not later than 180 days after the date of enactment 

7 of this Act the President shall transmit to the Congress a 

8 report addressing the cybersecurity workforce needs of the 

9 Federal Government. The report shall include— 

10 (1) an examination of the current state of and 

11 the projected needs of the Federal cybersecurity work12 force, including a comparison of the different agencies 

13 and departments, and an analysis of the capacity of 

14 such agencies and departments to meet those needs; 

15 (2) an analysis of the sources and availability of 

16 cybersecurity talent, a comparison of the skills and 

17 expertise sought by the Federal Government and the 

18 private sector, an examination of the current and fu19 ture capacity of United States institutions of higher 

20 education, including community colleges, to provide 

21 current and future cybersecurity professionals, 

22 through education and training activities, with those 

23 skills sought by the Federal Government, State and 

24 local entities, and the private sector, and a descrip25 tion of how successful programs are engaging the talmstockstill on DSK4VPTVN1PROD with BILLS

22 

•HR 756 RH

1 ents of females and individuals identified in section 

2 33 or 34 of the Science and Engineering Equal Op3 portunities Act (42 U.S.C. 1885a or 1885b); 

4 (3) an examination of the effectiveness of the Na5 tional Centers of Academic Excellence in Information 

6 Assurance Education, the Centers of Academic Excel7 lence in Research, and the Federal Cyber Scholarship 

8 for Service programs in promoting higher education 

9 and research in cybersecurity and information assur10 ance and in producing a growing number of profes11 sionals with the necessary cybersecurity and informa12 tion assurance expertise, including individuals from 

13 States or regions in which the unemployment rate ex14 ceeds the national average; 

15 (4) an analysis of any barriers to the Federal 

16 Government recruiting and hiring cybersecurity tal17 ent, including barriers relating to compensation, the 

18 hiring process, job classification, and hiring flexibili19 ties; and 

20 (5) recommendations for Federal policies to en21 sure an adequate, well-trained Federal cybersecurity 

22 workforce. 

mstockstill on DSK4VPTVN1PROD with BILLS

23 

•HR 756 RH

1 SEC. 108. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 

2 FORCE. 

3 (a) ESTABLISHMENT OF UNIVERSITY-INDUSTRY TASK

4 FORCE.—Not later than 180 days after the date of enact5 ment of this Act, the Director of the Office of Science and 

6 Technology Policy shall convene a task force to explore 

7 mechanisms for carrying out collaborative research, devel8 opment, education, and training activities for cybersecurity 

9 through a consortium or other appropriate entity with par10 ticipants from institutions of higher education and indus11 try. 

12 (b) FUNCTIONS.—The task force shall— 

13 (1) develop options for a collaborative model and 

14 an organizational structure for such entity under 

15 which the joint research and development activities 

16 could be planned, managed, and conducted effectively, 

17 including mechanisms for the allocation of resources 

18 among the participants in such entity for support of 

19 such activities; 

20 (2) identify and prioritize at least three cyberse21 curity grand challenges, focused on nationally signifi22 cant problems requiring collaborative and inter23 disciplinary solutions; 

24 (3) propose a process for developing a research 

25 and development agenda for such entity to address the 

26 grand challenges identified under paragraph (2); 

mstockstill on DSK4VPTVN1PROD with BILLS

24 

•HR 756 RH

1 (4) define the roles and responsibilities for the 

2 participants from institutions of higher education 

3 and industry in such entity; 

4 (5) propose guidelines for assigning intellectual 

5 property rights and for the transfer of research and 

6 development results to the private sector; and 

7 (6) make recommendations for how such entity 

8 could be funded from Federal, State, and nongovern9 mental sources. 

10 (c) COMPOSITION.—In establishing the task force 

11 under subsection (a), the Director of the Office of Science 

12 and Technology Policy shall appoint an equal number of 

13 individuals from institutions of higher education, including 

14 minority-serving institutions and community colleges, and 

15 from industry with knowledge and expertise in cybersecu16 rity. 

17 (d) REPORT.—Not later than 12 months after the date 

18 of enactment of this Act, the Director of the Office of Science 

19 and Technology Policy shall transmit to the Congress a re20 port describing the findings and recommendations of the 

21 task force. 

22 (e) TERMINATION.—The task force shall terminate 

23 upon transmittal of the report required under subsection 

24 (d). 

mstockstill on DSK4VPTVN1PROD with BILLS

25 

•HR 756 RH

1 (f) COMPENSATION AND EXPENSES.—Members of the 

2 task force shall serve without compensation. 

3 SEC. 109. CYBERSECURITY AUTOMATION AND CHECKLISTS 

4 FOR GOVERNMENT SYSTEMS. 

5 Section 8(c) of the Cyber Security Research and Devel6 opment Act (15 U.S.C. 7406(c)) is amended to read as fol7 lows: 

8 ‘‘(c) SECURITY AUTOMATION AND CHECKLISTS FOR

9 GOVERNMENT SYSTEMS.— 

10 ‘‘(1) IN GENERAL.—The Director of the National 

11 Institute of Standards and Technology shall develop, 

12 and revise as necessary, security automation stand13 ards, associated reference materials (including proto14 cols), and checklists providing settings and option se15 lections that minimize the security risks associated 

16 with each information technology hardware or soft17 ware system and security tool that is, or is likely to 

18 become, widely used within the Federal Government 

19 in order to enable standardized and interoperable 

20 technologies, architectures, and frameworks for contin21 uous monitoring of information security within the 

22 Federal Government. 

23 ‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di24 rector of the National Institute of Standards and 

25 Technology shall establish priorities for the developmstockstill on DSK4VPTVN1PROD with BILLS

26 

•HR 756 RH

1 ment of standards, reference materials, and checklists 

2 under this subsection on the basis of— 

3 ‘‘(A) the security risks associated with the 

4 use of the system; 

5 ‘‘(B) the number of agencies that use a par6 ticular system or security tool; 

7 ‘‘(C) the usefulness of the standards, ref8 erence materials, or checklists to Federal agencies 

9 that are users or potential users of the system; 

10 ‘‘(D) the effectiveness of the associated 

11 standard, reference material, or checklist in cre12 ating or enabling continuous monitoring of in13 formation security; or 

14 ‘‘(E) such other factors as the Director of 

15 the National Institute of Standards and Tech16 nology determines to be appropriate. 

17 ‘‘(3) EXCLUDED SYSTEMS.—The Director of the 

18 National Institute of Standards and Technology may 

19 exclude from the application of paragraph (1) any in20 formation technology hardware or software system or 

21 security tool for which such Director determines that 

22 the development of a standard, reference material, or 

23 checklist is inappropriate because of the infrequency 

24 of use of the system, the obsolescence of the system, or 

25 the inutility or impracticability of developing a 

mstockstill on DSK4VPTVN1PROD with BILLS

27 

•HR 756 RH

1 standard, reference material, or checklist for the sys2 tem. 

3 ‘‘(4) DISSEMINATION OF STANDARDS AND RE4 LATED MATERIALS.—The Director of the National In5 stitute of Standards and Technology shall ensure that 

6 Federal agencies are informed of the availability of 

7 any standard, reference material, checklist, or other 

8 item developed under this subsection. 

9 ‘‘(5) AGENCY USE REQUIREMENTS.—The develop10 ment of standards, reference materials, and checklists 

11 under paragraph (1) for an information technology 

12 hardware or software system or tool does not— 

13 ‘‘(A) require any Federal agency to select 

14 the specific settings or options recommended by 

15 the standard, reference material, or checklist for 

16 the system; 

17 ‘‘(B) establish conditions or prerequisites for 

18 Federal agency procurement or deployment of 

19 any such system; 

20 ‘‘(C) imply an endorsement of any such sys21 tem by the Director of the National Institute of 

22 Standards and Technology; or 

23 ‘‘(D) preclude any Federal agency from pro24 curing or deploying other information technology 

25 hardware or software systems for which no such 

mstockstill on DSK4VPTVN1PROD with BILLS

28 

•HR 756 RH

1 standard, reference material, or checklist has 

2 been developed or identified under paragraph 

3 (1).’’. 

4 SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH5 NOLOGY CYBERSECURITY RESEARCH AND DE6 VELOPMENT. 

7 Section 20 of the National Institute of Standards and 

8 Technology Act (15 U.S.C. 278g–3) is amended by redesig9 nating subsection (e) as subsection (f), and by inserting 

10 after subsection (d) the following: 

11 ‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 

12 the research activities conducted in accordance with sub13 section (d)(3), the Institute shall— 

14 ‘‘(1) conduct a research program to develop a 

15 unifying and standardized identity, privilege, and ac16 cess control management framework for the execution 

17 of a wide variety of resource protection policies and 

18 that is amenable to implementation within a wide 

19 variety of existing and emerging computing environ20 ments; 

21 ‘‘(2) carry out research associated with improv22 ing the security of information systems and networks; 

23 ‘‘(3) carry out research associated with improv24 ing the testing, measurement, usability, and assur25 ance of information systems and networks; 

mstockstill on DSK4VPTVN1PROD with BILLS

29 

•HR 756 RH

1 ‘‘(4) carry out research associated with improv2 ing security of industrial control systems; and 

3 ‘‘(5) carry out research associated with improv4 ing the security and integrity of the information tech5 nology supply chain.’’. 

6 SEC. 111. RESEARCH ON THE SCIENCE OF CYBERSECURITY. 

7 The Director of the National Science Foundation and 

8 the Director of the National Institute of Standards and 

9 Technology shall, through existing programs and activities, 

10 support research that will lead to the development of a sci11 entific foundation for the field of cybersecurity, including 

12 research that increases understanding of the underlying 

13 principles of securing complex networked systems, enables 

14 repeatable experimentation, and creates quantifiable secu15 rity metrics. 

16 TITLE II—ADVANCEMENT OF CY17 BERSECURITY TECHNICAL 

18 STANDARDS 

19 SEC. 201. DEFINITIONS. 

20 In this title: 

21 (1) DIRECTOR.—The term ‘‘Director’’ means the 

22 Director of the National Institute of Standards and 

23 Technology. 

24 (2) INSTITUTE.—The term ‘‘Institute’’ means the 

25 National Institute of Standards and Technology. 

mstockstill on DSK4VPTVN1PROD with BILLS

30 

•HR 756 RH

1 SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 

2 STANDARDS. 

3 (a) IN GENERAL.—The Director, in coordination with 

4 appropriate Federal authorities, shall— 

5 (1) as appropriate, ensure coordination of Fed6 eral agencies engaged in the development of inter7 national technical standards related to information 

8 system security; and 

9 (2) not later than 1 year after the date of enact10 ment of this Act, develop and transmit to the Con11 gress a plan for ensuring such Federal agency coordi12 nation. 

13 (b) CONSULTATION WITH THE PRIVATE SECTOR.—In 

14 carrying out the activities specified in subsection (a)(1), the 

15 Director shall ensure consultation with appropriate private 

16 sector stakeholders. 

17 SEC. 203. CLOUD COMPUTING STRATEGY. 

18 (a) IN GENERAL.—The Director, in collaboration with 

19 the Federal CIO Council, and in consultation with other 

20 relevant Federal agencies and stakeholders from the private 

21 sector, shall continue to develop and encourage the imple22 mentation of a comprehensive strategy for the use and adop23 tion of cloud computing services by the Federal Govern24 ment. 

mstockstill on DSK4VPTVN1PROD with BILLS

31 

•HR 756 RH

1 (b) ACTIVITIES.—In carrying out the strategy devel2 oped under subsection (a), the Director shall give consider3 ation to activities that— 

4 (1) accelerate the development, in collaboration 

5 with the private sector, of standards that address 

6 interoperability and portability of cloud computing 

7 services; 

8 (2) advance the development of conformance test9 ing performed by the private sector in support of 

10 cloud computing standardization; and 

11 (3) support, in consultation with the private sec12 tor, the development of appropriate security frame13 works and reference materials, and the identification 

14 of best practices, for use by Federal agencies to ad15 dress security and privacy requirements to enable the 

16 use and adoption of cloud computing services, includ17 ing activities— 

18 (A) to ensure the physical security of cloud 

19 computing data centers and the data stored in 

20 such centers; 

21 (B) to ensure secure access to the data 

22 stored in cloud computing data centers; 

23 (C) to develop security standards as re24 quired under section 20 of the National Institute 

mstockstill on DSK4VPTVN1PROD with BILLS

32 

•HR 756 RH

1 of Standards and Technology Act (15 U.S.C. 

2 278g–3); and 

3 (D) to support the development of the auto4 mation of continuous monitoring systems. 

5 SEC. 204. PROMOTING CYBERSECURITY AWARENESS AND 

6 EDUCATION. 

7 (a) PROGRAM.—The Director, in collaboration with 

8 relevant Federal agencies, industry, educational institu9 tions, National Laboratories, the National Coordination Of10 fice of the Networking and Information Technology Re11 search and Development program, and other organizations, 

12 shall continue to coordinate a cybersecurity awareness and 

13 education program to increase knowledge, skills, and aware14 ness of cybersecurity risks, consequences, and best practices 

15 through— 

16 (1) the widespread dissemination of cybersecu17 rity technical standards and best practices identified 

18 by the Institute; 

19 (2) efforts to make cybersecurity best practices 

20 usable by individuals, small to medium-sized busi21 nesses, State, local, and tribal governments, and edu22 cational institutions; 

23 (3) improving the state of cybersecurity edu24 cation at all educational levels; 

mstockstill on DSK4VPTVN1PROD with BILLS

33 

•HR 756 RH

1 (4) efforts to attract, recruit, and retain quali2 fied professionals to the Federal cybersecurity work3 force; and 

4 (5) improving the skills, training, and profes5 sional development of the Federal cybersecurity work6 force. 

7 (b) STRATEGIC PLAN.—The Director shall, in coopera8 tion with relevant Federal agencies and other stakeholders, 

9 develop and implement a strategic plan to guide Federal 

10 programs and activities in support of a comprehensive cy11 bersecurity awareness and education program as described 

12 under subsection (a). 

13 (c) REPORT TO CONGRESS.—Not later than 1 year 

14 after the date of enactment of this Act and every 5 years 

15 thereafter, the Director shall transmit the strategic plan re16 quired under subsection (b) to the Committee on Science, 

17 Space, and Technology of the House of Representatives and 

18 the Committee on Commerce, Science, and Transportation 

19 of the Senate. 

20 SEC. 205. IDENTITY MANAGEMENT RESEARCH AND DEVEL21 OPMENT. 

22 The Director shall continue a program to support the 

23 development of technical standards, metrology, testbeds, and 

24 conformance criteria, taking into account appropriate user 

25 concerns, to— 

mstockstill on DSK4VPTVN1PROD with BILLS

34 

•HR 756 RH

1 (1) improve interoperability among identity 

2 management technologies; 

3 (2) strengthen authentication methods of identity 

4 management systems; 

5 (3) improve privacy protection in identity man6 agement systems, including health information tech7 nology systems, through authentication and security 

8 protocols; and 

9 (4) improve the usability of identity manage10 ment systems. 

11 SEC. 206. AUTHORIZATIONS. 

12 No additional funds are authorized to carry out this 

13 Act, and the amendments made by this Act. This Act, and 

14 the amendments made by this Act, shall be carried out using 

15 amounts otherwise authorized or appropriated. 

mstockstill on DSK4VPTVN1PROD with BILLS

mstockstill on DSK4VPTVN1PROD with BILLS

Union Calendar No. 19 

113TH CONGRESS 

1ST SESSION H. R. 756 

[Report No. 113–33] 

A BILL 

and technical standards, and for other purposes. 

To advance cybersecurity research, development, 

APRIL 11, 2013 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 

mstockstill on DSK4VPTVN1PROD with BILLS