I 
111TH CONGRESS 
1ST SESSION H. R. 4061 
To advance cybersecurity research, development, and technical standards, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 7, 2009 
Mr. LIPINSKI (for himself, Mr. MCCAUL, Mr. WU, Mr. EHLERS, Ms. EDDIE 
BERNICE JOHNSON of Texas, Mr. SMITH of Nebraska, Mr. GORDON of 
Tennessee, Mr. HALL of Texas, Mr. LUJA´N, and Mr. ROTHMAN of New 
Jersey) introduced the following bill; which was referred to the Committee 
on Science and Technology 
A BILL 
To advance cybersecurity research, development, and 
technical standards, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity En-
hancement Act of 2009’’. 
TITLE I—RESEARCH AND 
DEVELOPMENT 
SEC. 101. DEFINITIONS. 
In this title: 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
(1) NATIONAL
COORDINATION
OFFICE.—The 
term National Coordination Office means the Na-
tional Coordination Office for the Networking and 
Information Technology Research and Development 
program. 
(2) PROGRAM.—The term Program means the 
Networking and Information Technology Research 
and Development program which has been estab-
lished under section 101 of the High-Performance 
Computing Act of 1991 (15 U.S.C. 5511). 
SEC. 102. FINDINGS. 
Section 2 of the Cyber Security Research and Devel-
opment Act (15 U.S.C. 7401) is amended— 
(1) by amending paragraph (1) to read as fol-
lows: 
‘‘(1) Advancements in information and commu-
nications technology have resulted in a globally 
interconnected network of government, commercial, 
scientific, and education infrastructures, including 
critical infrastructures for electric power, natural 
gas and petroleum production and distribution, tele-
communications, transportation, water supply, bank-
ing and finance, and emergency and government 
services.’’; 
VerDate Nov 24 2008 
05:45 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
(2) in paragraph (2), by striking ‘‘Exponential 
increases in interconnectivity have facilitated en-
hanced communications, economic growth,’’ and in-
serting ‘‘These advancements have significantly con-
tributed to the growth of the United States econ-
omy’’; 
(3) by amending paragraph (3) to read as fol-
lows: 
‘‘(3) The Cyberspace Policy Review published 
by the President in May, 2009, concluded that our 
information technology and communications infra-
structure is vulnerable and has ‘suffered intrusions 
that have allowed criminals to steal hundreds of mil-
lions of dollars and nation-states and other entities 
to steal intellectual property and sensitive military 
information’.’’; 
(4) by redesignating paragraphs (4) through 
(6) as paragraphs (5) through (7), respectively; 
(5) by inserting after paragraph (3) the fol-
lowing new paragraph: 
‘‘(4) In a series of hearings held before Con-
gress in 2009, experts testified that the Federal cy-
bersecurity research and development portfolio was 
too focused on short-term, incremental research and 
that it lacked the prioritization and coordination 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
necessary to address the long-term challenge of en-
suring a secure and reliable information technology 
and communications infrastructure.’’; and 
(6) by amending paragraph (7), as so redesig-
nated by paragraph (4) of this section, to read as 
follows: 
‘‘(7) While African-Americans, Hispanics, and 
Native Americans constitute 33 percent of the col-
lege-age population, members of these minorities 
comprise less than 20 percent of bachelor degree re-
cipients in the field of computer sciences.’’. 
SEC. 103. CYBERSECURITY STRATEGIC RESEARCH AND DE-
VELOPMENT PLAN. 
(a) IN GENERAL.—Not later than 12 months after 
the date of enactment of this Act, the agencies identified 
in subsection 101(a)(3)(B) (i) through (x) of the High- 
Performance Computing Act of 1991 (15 U.S.C. 
5511(a)(3)(B) (i) through (x)) or designated under section 
101(a)(3)(B)(xi) of such Act, working through the Na-
tional Science and Technology Council and with the assist-
ance of the National Coordination Office, shall transmit 
to Congress a strategic plan based on an assessment of 
cybersecurity risk to guide the overall direction of Federal 
cybersecurity and information assurance research and de-
velopment for information technology and networking sys-
VerDate Nov 24 2008 
05:49 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
tems. Once every 3 years after the initial strategic plan 
is transmitted to Congress under this section, such agen-
cies shall prepare and transmit to Congress an update of 
such plan. 
(b) CONTENTS OF PLAN.—The strategic plan re-
quired under subsection (a) shall— 
(1) specify and prioritize near-term, mid-term 
and long-term research objectives, including objec-
tives associated with the research areas identified in 
section 4(a)(1) of the Cyber Security Research and 
Development Act (15 U.S.C. 7403(a)(1)) and how 
the near-term objectives complement research and 
development areas in which the private sector is ac-
tively engaged; 
(2) describe how the Program will focus on in-
novative, transformational technologies with the po-
tential to enhance the security, reliability, resilience, 
and trustworthiness of the digital infrastructure; 
(3) describe how the Program will foster the 
transfer of research and development results into 
new cybersecurity technologies and applications for 
the benefit of society and the national interest, in-
cluding through the dissemination of best practices 
and other outreach activities; 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
(4) describe how the Program will establish and 
maintain a national research infrastructure for cre-
ating, testing, and evaluating the next generation of 
secure networking and information technology sys-
tems; 
(5) describe how the Program will facilitate ac-
cess by academic researchers to the infrastructure 
described in paragraph (4), as well as to event data; 
and 
(6) describe how the Program will engage fe-
males and individuals identified in section 33 or 34 
of the Science and Engineering Equal Opportunities 
Act (42 U.S.C. 1885a or 1885b) to foster a more di-
verse workforce in this area. 
(c) DEVELOPMENT OF ROADMAP.—The agencies de-
scribed in subsection (a) shall develop and annually update 
an implementation roadmap for the strategic plan re-
quired in this section. Such roadmap shall— 
(1) specify the role of each Federal agency in 
carrying out or sponsoring research and development 
to meet the research objectives of the strategic plan, 
including a description of how progress toward the 
research objectives will be evaluated; 
(2) specify the funding allocated to each major 
research objective of the strategic plan and the 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
source of funding by agency for the current fiscal 
year; and 
(3) estimate the funding required for each 
major research objective of the strategic plan for the 
following 3 fiscal years. 
(d) RECOMMENDATIONS.—In developing and updat-
ing the strategic plan under subsection (a), the agencies 
involved shall solicit recommendations and advice from— 
(1) the advisory committee established under 
section 101(b)(1) of the High-Performance Com-
puting Act of 1991 (15 U.S.C. 5511(b)(1)); and 
(2) a wide range of stakeholders, including in-
dustry, academia, including representatives of mi-
nority serving institutions, and other relevant orga-
nizations and institutions. 
(e) APPENDING TO REPORT.—The implementation 
roadmap required under subsection (c), and its annual up-
dates, shall be appended to the report required under sec-
tion 101(a)(2)(D) of the High-Performance Computing 
Act of 1991 (15 U.S.C. 5511(a)(2)(D)). 
SEC. 104. SOCIAL AND BEHAVIORAL RESEARCH IN CYBER-
SECURITY. 
Section 4(a)(1) of the Cyber Security Research and 
Development Act (15 U.S.C. 7403(a)(1)) is amended— 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
(1) by inserting ‘‘and usability’’ after ‘‘to the 
structure’’; 
(2) in subparagraph (H), by striking ‘‘and’’ 
after the semicolon; 
(3) in subparagraph (I), by striking the period 
at the end and inserting ‘‘; and’’; and 
(4) by adding at the end the following new sub-
paragraph: 
‘‘(J) social and behavioral factors, includ-
ing human-computer interactions, usability, 
user motivations, and organizational cultures.’’. 
SEC. 105. NATIONAL SCIENCE FOUNDATION CYBERSECU-
RITY RESEARCH AND DEVELOPMENT PRO-
GRAMS. 
(a) COMPUTER AND NETWORK SECURITY RESEARCH 
AREAS.—Section 4(a) of the Cyber Security Research and 
Development Act (15 U.S.C. 7403(a)(1)) is amended in 
subparagraph (A) by inserting ‘‘identity management,’’ 
after ‘‘cryptography,’’. 
(b) COMPUTER AND NETWORK SECURITY RESEARCH 
GRANTS.—Section 4(a)(3) of such Act (15 U.S.C. 
7403(a)(3)) is amended by striking subparagraphs (A) 
through (E) and inserting the following new subpara-
graphs: 
‘‘(A) $68,700,000 for fiscal year 2010; 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
‘‘(B) $73,500,000 for fiscal year 2011; 
‘‘(C) $78,600,000 for fiscal year 2012; 
‘‘(D) $84,200,000 for fiscal year 2013; 
and 
‘‘(E) $90,000,000 for fiscal year 2014.’’. 
(c) COMPUTER AND NETWORK SECURITY RESEARCH 
CENTERS.—Section 4(b) of such Act (15 U.S.C. 7403(b)) 
is amended— 
(1) in paragraph (4)— 
(A) in subparagraph (C), by inserting 
‘‘and’’ after the semicolon; 
(B) in subparagraph (D), by striking the 
period and inserting ‘‘; and’’; and 
(C) by striking subparagraph (D); 
(2) by adding at the end the following new sub-
paragraph: 
‘‘(E) how the center will partner with gov-
ernment laboratories, for-profit entities, other 
institutions of higher education, or nonprofit re-
search institutions.’’; and 
(3) by amending paragraph (7) to read as fol-
lows: 
‘‘(7) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’. 
(d) COMPUTER AND NETWORK SECURITY CAPACITY 
BUILDING GRANTS.—Section 5(a)(6) of such Act (15 
U.S.C. 7404(a)(6)) is amended to read as follows: 
‘‘(6) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’. 
(e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT 
GRANTS.—Section 5(b)(2) of such Act (15 U.S.C. 
7404(b)(2)) is amended to read as follows: 
‘‘(2) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’. 
(f) GRADUATE TRAINEESHIPS IN COMPUTER AND 
NETWORK SECURITY.—Section 5(c)(7) of such Act (15 
U.S.C. 7404(c)(7)) is amended to read as follows: 
‘‘(7) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’. 
(g) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CY-
BERSECURITY.—Section 5(e) of such Act (15 U.S.C. 
7404(e)) is amended to read as follows: 
‘‘(e) POSTDOCTORAL RESEARCH FELLOWSHIPS IN 
CYBERSECURITY.— 
‘‘(1) IN GENERAL.—The Director shall carry 
out a program to encourage young scientists and en-
gineers to conduct postdoctoral research in the fields 
of cybersecurity and information assurance, includ-
ing the research areas described in section 4(a)(1), 
through the award of competitive, merit-based fel-
lowships. 
‘‘(2) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’. 
SEC. 106. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 
FORCE. 
(a) ESTABLISHMENT
OF
UNIVERSITY-INDUSTRY 
TASK FORCE.—Not later than 180 days after the date of 
enactment of this Act, the Director of the Office of Science 
and Technology Policy shall convene a task force to ex-
VerDate Nov 24 2008 
05:49 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
plore mechanisms for carrying out collaborative research 
and development activities for cybersecurity through a 
consortium or other appropriate entity with participants 
from institutions of higher education and industry. 
(b) FUNCTIONS.—The task force shall— 
(1) develop options for a collaborative model 
and an organizational structure for such entity 
under which the joint research and development ac-
tivities could be planned, managed, and conducted 
effectively, including mechanisms for the allocation 
of resources among the participants in such entity 
for support of such activities; 
(2) propose a process for developing a research 
and development agenda for such entity, including 
guidelines to ensure an appropriate scope of work fo-
cused on nationally significant challenges and requir-
ing collaboration; 
(3) define the roles and responsibilities for the 
participants from institutions of higher education 
and industry in such entity; 
(4) propose guidelines for assigning intellectual 
property rights and for the transfer of research and 
development results to the private sector; and 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
(5) make recommendations for how such entity 
could be funded from Federal, State, and nongovern-
mental sources. 
(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the Office of Science 
and Technology Policy shall appoint an equal number of 
individuals from institutions of higher education and from 
industry with knowledge and expertise in cybersecurity. 
(d) REPORT.—Not later than 12 months after the 
date of enactment of this Act, the Director of the Office 
of Science and Technology Policy shall transmit to the 
Congress a report describing the findings and rec-
ommendations of the task force. 
SEC. 107. CYBERSECURITY CHECKLIST DEVELOPMENT AND 
DISSEMINATION. 
Section 8(c) of the Cybersecurity Research and De-
velopment Act (15 U.S.C. 7406(c)) is amended to read 
as follows: 
‘‘(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the Na-
tional Institute of Standards and Technology shall 
develop or identify and revise or adapt as necessary, 
checklists, configuration profiles, and deployment 
recommendations for products and protocols that 
minimize the security risks associated with each 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
computer hardware or software system that is, or is 
likely to become, widely used within the Federal 
Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
ment of checklists under this subsection. Such prior-
ities may be based on the security risks associated 
with the use of each system, the number of agencies 
that use a particular system, the usefulness of the 
checklist to Federal agencies that are users or po-
tential users of the system, or such other factors as 
the Director determines to be appropriate. 
‘‘(3) EXCLUDED
SYSTEMS.—The Director of 
the National Institute of Standards and Technology 
may exclude from the requirements of paragraph (1) 
any computer hardware or software system for 
which the Director determines that the development 
of a checklist is inappropriate because of the infre-
quency of use of the system, the obsolescence of the 
system, or the inutility or impracticability of devel-
oping a checklist for the system. 
‘‘(4) AUTOMATION SPECIFICATIONS.—The Di-
rector of the National Institute of Standards and 
Technology shall develop automated security speci-
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
fications (such as the Security Content Automation 
Protocol) with respect to checklist content and asso-
ciated security related data. 
‘‘(5) DISSEMINATION
OF
CHECKLISTS.—The 
Director of the National Institute of Standards and 
Technology shall ensure that any product developed 
under the National Checklist Program for any infor-
mation system, including the Security Content Auto-
mation Protocol and other automated security speci-
fications, is made available to Federal agencies. 
‘‘(6) AGENCY
USE
REQUIREMENTS.—Federal 
agencies shall use checklists developed or identified 
under paragraph (1) to secure computer hardware 
and software systems. This paragraph does not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the checklist for the system; 
‘‘(B) establish conditions or prerequisites 
for Federal agency procurement or deployment 
of any such system; 
‘‘(C) imply an endorsement of any such 
system by the Director of the National Institute 
of Standards and Technology; or 
‘‘(D) preclude any Federal agency from 
procuring or deploying other computer hard-
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
ware or software systems for which no such 
checklist has been developed or identified under 
paragraph (1).’’. 
SEC. 108. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND 
DEVELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redes-
ignating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following: 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execu-
tion of a wide variety of resource protection policies 
and that is amenable to implementation within a 
wide variety of existing and emerging computing en-
vironments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and net-
works; 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; and 
‘‘(4) carry out research associated with improv-
ing security of industrial control systems.’’. 
TITLE II—ADVANCEMENT OF CY-
BERSECURITY 
TECHNICAL 
STANDARDS 
SEC. 201. DEFINITIONS. 
In this title: 
(1) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the National Institute of Standards 
and Technology. 
(2) INSTITUTE.—The term ‘‘Institute’’ means 
the National Institute of Standards and Technology. 
SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
The Director, in coordination with appropriate Fed-
eral authorities, shall— 
(1) ensure coordination of United States Gov-
ernment representation in the international develop-
ment of technical standards related to cybersecurity; 
and 
(2) not later than 1 year after the date of en-
actment of this Act, develop and transmit to the 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS
Congress a proactive plan to engage international 
standards bodies with respect to the development of 
technical standards related to cybersecurity. 
SEC. 203. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, and other organizations, shall develop and imple-
ment a cybersecurity awareness and education program to 
increase public awareness of cybersecurity risks, con-
sequences, and best practices through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; and 
(2) efforts to make cybersecurity technical 
standards and best practices usable by individuals, 
small to medium-sized businesses, State and local 
governments, and educational institutions. 
(b) MANUFACTURING EXTENSION PARTNERSHIP.— 
The Director shall, to the extent appropriate, implement 
subsection (a) through the Manufacturing Extension Part-
nership program under section 25 of the National Insti-
tute of Standards and Technology Act (15 U.S.C. 278k). 
(c) REPORT TO CONGRESS.—Not later than 90 days 
after the date of enactment of this Act, the Director shall 
VerDate Nov 24 2008 
04:12 Nov 08, 2009
Jkt 089200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.IH
H4061
smartinez on DSKB9S0YB1PROD with BILLS