HR 756 RFS 
(d) REPORT.—Not later than 12 months after the 
date of enactment of this Act, the Director of the Office 
of Science and Technology Policy shall transmit to the 
Congress a report describing the findings and rec-
ommendations of the task force. 
(e) TERMINATION.—The task force shall terminate 
upon transmittal of the report required under subsection 
(d). 
(f) COMPENSATION
AND EXPENSES.—Members of 
the task force shall serve without compensation. 
SEC. 109. CYBERSECURITY AUTOMATION AND CHECKLISTS 
FOR GOVERNMENT SYSTEMS. 
Section 8(c) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7406(c)) is amended to read 
as follows: 
‘‘(c) SECURITY AUTOMATION AND CHECKLISTS FOR 
GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the Na-
tional Institute of Standards and Technology shall 
develop, and revise as necessary, security automation 
standards, associated reference materials (including 
protocols), and checklists providing settings and op-
tion selections that minimize the security risks asso-
ciated with each information technology hardware or 
software system and security tool that is, or is likely 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
to become, widely used within the Federal Govern-
ment in order to enable standardized and interoper-
able technologies, architectures, and frameworks for 
continuous monitoring of information security within 
the Federal Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
ment of standards, reference materials, and check-
lists under this subsection on the basis of— 
‘‘(A) the security risks associated with the 
use of the system; 
‘‘(B) the number of agencies that use a 
particular system or security tool; 
‘‘(C) the usefulness of the standards, ref-
erence materials, or checklists to Federal agen-
cies that are users or potential users of the sys-
tem; 
‘‘(D) the effectiveness of the associated 
standard, reference material, or checklist in cre-
ating or enabling continuous monitoring of in-
formation security; or 
‘‘(E) such other factors as the Director of 
the National Institute of Standards and Tech-
nology determines to be appropriate. 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
‘‘(3) EXCLUDED
SYSTEMS.—The Director of 
the National Institute of Standards and Technology 
may exclude from the application of paragraph (1) 
any information technology hardware or software 
system or security tool for which such Director de-
termines that the development of a standard, ref-
erence material, or checklist is inappropriate because 
of the infrequency of use of the system, the obsoles-
cence of the system, or the inutility or imprac-
ticability of developing a standard, reference mate-
rial, or checklist for the system. 
‘‘(4) DISSEMINATION OF STANDARDS AND RE-
LATED MATERIALS.—The Director of the National 
Institute of Standards and Technology shall ensure 
that Federal agencies are informed of the avail-
ability of any standard, reference material, checklist, 
or other item developed under this subsection. 
‘‘(5) AGENCY USE REQUIREMENTS.—The devel-
opment of standards, reference materials, and check-
lists under paragraph (1) for an information tech-
nology hardware or software system or tool does 
not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
the standard, reference material, or checklist 
for the system; 
‘‘(B) establish conditions or prerequisites 
for Federal agency procurement or deployment 
of any such system; 
‘‘(C) imply an endorsement of any such 
system by the Director of the National Institute 
of Standards and Technology; or 
‘‘(D) preclude any Federal agency from 
procuring or deploying other information tech-
nology hardware or software systems for which 
no such standard, reference material, or check-
list has been developed or identified under para-
graph (1).’’. 
SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND 
DEVELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redes-
ignating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following: 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execu-
tion of a wide variety of resource protection policies 
and that is amenable to implementation within a 
wide variety of existing and emerging computing en-
vironments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and net-
works; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; 
‘‘(4) carry out research associated with improv-
ing security of industrial control systems; and 
‘‘(5) carry out research associated with improv-
ing the security and integrity of the information 
technology supply chain.’’. 
SEC. 111. RESEARCH ON THE SCIENCE OF CYBERSECURITY. 
The Director of the National Science Foundation and 
the Director of the National Institute of Standards and 
Technology shall, through existing programs and activi-
ties, support research that will lead to the development 
of a scientific foundation for the field of cybersecurity, in-
cluding research that increases understanding of the un-
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
derlying principles of securing complex networked sys-
tems, enables repeatable experimentation, and creates 
quantifiable security metrics. 
TITLE II—ADVANCEMENT OF CY-
BERSECURITY 
TECHNICAL 
STANDARDS 
SEC. 201. DEFINITIONS. 
In this title: 
(1) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the National Institute of Standards 
and Technology. 
(2) INSTITUTE.—The term ‘‘Institute’’ means 
the National Institute of Standards and Technology. 
SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
(a) IN GENERAL.—The Director, in coordination with 
appropriate Federal authorities, shall— 
(1) as appropriate, ensure coordination of Fed-
eral agencies engaged in the development of inter-
national technical standards related to information 
system security; and 
(2) not later than 1 year after the date of en-
actment of this Act, develop and transmit to the 
Congress a plan for ensuring such Federal agency 
coordination. 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
(b) CONSULTATION WITH THE PRIVATE SECTOR.— 
In carrying out the activities specified in subsection (a)(1), 
the Director shall ensure consultation with appropriate 
private sector stakeholders. 
SEC. 203. CLOUD COMPUTING STRATEGY. 
(a) IN GENERAL.—The Director, in collaboration 
with the Federal CIO Council, and in consultation with 
other relevant Federal agencies and stakeholders from the 
private sector, shall continue to develop and encourage the 
implementation of a comprehensive strategy for the use 
and adoption of cloud computing services by the Federal 
Government. 
(b) ACTIVITIES.—In carrying out the strategy devel-
oped under subsection (a), the Director shall give consid-
eration to activities that— 
(1) accelerate the development, in collaboration 
with the private sector, of standards that address 
interoperability and portability of cloud computing 
services; 
(2) advance the development of conformance 
testing performed by the private sector in support of 
cloud computing standardization; and 
(3) support, in consultation with the private 
sector, the development of appropriate security 
frameworks and reference materials, and the identi-
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
fication of best practices, for use by Federal agen-
cies to address security and privacy requirements to 
enable the use and adoption of cloud computing 
services, including activities— 
(A) to ensure the physical security of cloud 
computing data centers and the data stored in 
such centers; 
(B) to ensure secure access to the data 
stored in cloud computing data centers; 
(C) to develop security standards as re-
quired under section 20 of the National Insti-
tute of Standards and Technology Act (15 
U.S.C. 278g–3); and 
(D) to support the development of the au-
tomation of continuous monitoring systems. 
SEC. 204. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, National Laboratories, the National Coordination 
Office of the Networking and Information Technology Re-
search and Development program, and other organiza-
tions, shall continue to coordinate a cybersecurity aware-
ness and education program to increase knowledge, skills, 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
and awareness of cybersecurity risks, consequences, and 
best practices through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; 
(2) efforts to make cybersecurity best practices 
usable by individuals, small to medium-sized busi-
nesses, State, local, and tribal governments, and 
educational institutions; 
(3) improving the state of cybersecurity edu-
cation at all educational levels; 
(4) efforts to attract, recruit, and retain quali-
fied professionals to the Federal cybersecurity work-
force; and 
(5) improving the skills, training, and profes-
sional development of the Federal cybersecurity 
workforce. 
(b) STRATEGIC PLAN.—The Director shall, in co-
operation with relevant Federal agencies and other stake-
holders, develop and implement a strategic plan to guide 
Federal programs and activities in support of a com-
prehensive cybersecurity awareness and education pro-
gram as described under subsection (a). 
(c) REPORT TO CONGRESS.—Not later than 1 year 
after the date of enactment of this Act and every 5 years 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
thereafter, the Director shall transmit the strategic plan 
required under subsection (b) to the Committee on 
Science, Space, and Technology of the House of Rep-
resentatives and the Committee on Commerce, Science, 
and Transportation of the Senate. 
SEC. 205. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director shall continue a program to support the 
development of technical standards, metrology, testbeds, 
and conformance criteria, taking into account appropriate 
user concerns, to— 
(1) improve interoperability among identity 
management technologies; 
(2) strengthen authentication methods of iden-
tity management systems; 
(3) improve privacy protection in identity man-
agement systems, including health information tech-
nology systems, through authentication and security 
protocols; and 
(4) improve the usability of identity manage-
ment systems. 
SEC. 206. AUTHORIZATIONS. 
No additional funds are authorized to carry out this 
Act, and the amendments made by this Act. This Act, and 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS
HR 756 RFS 
the amendments made by this Act, shall be carried out 
using amounts otherwise authorized or appropriated. 
Passed the House of Representatives April 16, 2013. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Mar 15 2010 
00:23 Apr 18, 2013
Jkt 029200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H756.RFS
H756
smartinez on DSK6TPTVN1PROD with BILLS