tion of a wide variety of resource protection policies 
and that is amenable to implementation within a 
wide variety of existing and emerging computing en-
vironments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and net-
works; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; and 
‘‘(4) carry out research associated with improv-
ing security of industrial control systems.’’. 
TITLE II—ADVANCEMENT OF CY-
BERSECURITY 
TECHNICAL 
STANDARDS 
SEC. 201. DEFINITIONS. 
In this title: 
(1) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the National Institute of Standards 
and Technology. 
(2) INSTITUTE.—The term ‘‘Institute’’ means 
the National Institute of Standards and Technology.
SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
(a) IN GENERAL.—The Director, in coordination with 
appropriate Federal authorities, shall— 
(1) as appropriate, ensure coordination of Fed-
eral agencies engaged in the development of inter-
national technical standards related to information 
system security; and 
(2) not later than 1 year after the date of en-
actment of this Act, develop and transmit to the 
Congress a plan for ensuring such Federal agency 
coordination. 
(b) CONSULTATION WITH THE PRIVATE SECTOR.— 
In carrying out the activities specified in subsection (a)(1), 
the Director shall ensure consultation with appropriate 
private sector stakeholders. 
SEC. 203. CLOUD COMPUTING STRATEGY. 
(a) IN GENERAL.—The Director, in collaboration 
with the Federal CIO Council, and in consultation with 
other relevant Federal agencies and stakeholders from the 
private sector, shall continue to develop and encourage the 
implementation of a comprehensive strategy for the use 
and adoption of cloud computing services by the Federal 
Government.
(b) ACTIVITIES.—In carrying out the strategy devel-
oped under subsection (a), the Director shall give consid-
eration to activities that— 
(1) accelerate the development, in collaboration 
with the private sector, of standards that address 
interoperability and portability of cloud computing 
services; 
(2) advance the development of conformance 
testing performed by the private sector in support of 
cloud computing standardization; and 
(3) support, in consultation with the private 
sector, the development of appropriate security 
frameworks and reference materials, and the identi-
fication of best practices, for use by Federal agen-
cies to address security and privacy requirements to 
enable the use and adoption of cloud computing 
services, including activities— 
(A) to ensure the physical security of cloud 
computing data centers and the data stored in 
such centers; 
(B) to ensure secure access to the data 
stored in cloud computing data centers; 
(C) to develop security standards as re-
quired under section 20 of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g-3); and 
(D) to support the development of the au-
tomation of continuous monitoring systems. 
SEC. 204. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, National Laboratories, the National Coordination 
Office of the Networking and Information Technology Re-
search and Development program, and other organiza-
tions, shall continue to coordinate a cybersecurity aware-
ness and education program to increase knowledge, skills, 
and awareness of cybersecurity risks, consequences, and 
best practices through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; 
(2) efforts to make cybersecurity best practices 
usable by individuals, small to medium-sized busi-
nesses, State, local, and tribal governments, and 
educational institutions; and 
(3) efforts to attract, recruit, and retain quali-
fied professionals to the Federal cybersecurity work-
force.
(b) STRATEGIC PLAN.—The Director shall, in co-
operation with relevant Federal agencies and other stake-
holders, develop and implement a strategic plan to guide 
Federal programs and activities in support of a com-
prehensive cybersecurity awareness and education pro-
gram as described under subsection (a). 
(c) REPORT TO CONGRESS.—Not later than 1 year 
after the date of enactment of this Act and every 5 years 
thereafter, the Director shall transmit the strategic plan 
required under subsection (b) to the Committee on 
Science, Space, and Technology of the House of Rep-
resentatives and the Committee on Commerce, Science, 
and Transportation of the Senate. 
SEC. 205. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director shall continue a program to support the 
development of technical standards, metrology, testbeds, 
and conformance criteria, taking into account appropriate 
user concerns, to— 
(1) improve interoperability among identity 
management technologies; 
(2) strengthen authentication methods of iden-
tity management systems; 
(3) improve privacy protection in identity man-
agement systems, including health information tech-
nology systems, through authentication and security 
protocols; and 
(4) improve the usability of identity manage-
ment systems. 
SEC. 206. AUTHORIZATIONS. 
No additional funds are authorized to carry out this 
title and the amendments made by this title or to carry 
out the amendments made by sections 109 and 110 of this 
Act. This title and the amendments made by this title and 
the amendments made by sections 109 and 110 of this 
Act shall be carried out using amounts otherwise author-
ized or appropriated. 
Passed the House of Representatives April 27, 2012. 
Attest: 
Clerk.
112TH CONGRESS 
2D SESSION 
H. R. 2096 
AN ACT 
To advance cybersecurity research, development, 
and technical standards, and for other purposes.