183 
tion to the extent such statistics are 
available; and 
(C) includes rates of pay set in accordance 
with subsection (c). 
TITLE V—OTHER PROVISIONS 
SEC. 501. CONSULTATION ON CYBERSECURITY MATTERS. 
The Chairman of the Federal Trade Commission, the 
Chairman of the Federal Communications Commission, 
and the head of any other Federal agency determined ap-
propriate by the President shall consult with the Director 
of the National Center for Cybersecurity and Communica-
tions regarding any regulation, rule, or requirement to be 
issued or other action to be required by the Federal agency 
relating to the security and resiliency of the national infor-
mation infrastructure. 
SEC. 502. CYBERSECURITY RESEARCH AND DEVELOPMENT. 
Subtitle D of title II of the Homeland Security Act 
of 2002 (6 U.S.C. 161 et seq.) is amended by adding at 
the end the following: 
‘‘SEC. 238. CYBERSECURITY RESEARCH AND DEVELOP-
MENT. 
‘‘(a) ESTABLISHMENT OF RESEARCH AND DEVELOP-
MENT PROGRAM.—The Under Secretary for Science and 
Technology, in coordination with the Director of the Na-
tional Center for Cybersecurity and Communications, shall 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00183
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
184 
carry out a research and development program for the 
purpose of improving the security of information infra-
structure. 
‘‘(b) ELIGIBLE PROJECTS.—The research and devel-
opment program carried out under subsection (a) may in-
clude projects to— 
‘‘(1) advance the development and accelerate 
the deployment of more secure versions of funda-
mental Internet protocols and architectures, includ-
ing for the secure domain name addressing system 
and routing security; 
‘‘(2) improve and create technologies for detect-
ing and analyzing attacks or intrusions, including 
analysis of malicious software; 
‘‘(3) improve and create mitigation and recov-
ery methodologies, including techniques for contain-
ment of attacks and development of resilient net-
works and systems; 
‘‘(4) develop and support infrastructure and 
tools to support cybersecurity research and develop-
ment efforts, including modeling, testbeds, and data 
sets for assessment of new cybersecurity tech-
nologies; 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00184
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
185 
‘‘(5) assist the development and support of 
technologies to reduce vulnerabilities in process con-
trol systems; 
‘‘(6) understand human behavioral factors that 
can affect cybersecurity technology and practices; 
‘‘(7) test, evaluate, and facilitate, with appro-
priate protections for any proprietary information 
concerning the technologies, the transfer of tech-
nologies associated with the engineering of less vul-
nerable software and securing the information tech-
nology software development lifecycle; 
‘‘(8) assist the development of identity manage-
ment and attribution technologies; 
‘‘(9) assist the development of technologies de-
signed to increase the security and resiliency of tele-
communications networks; 
‘‘(10) advance the protection of privacy and 
civil liberties in cybersecurity technology and prac-
tices; and 
‘‘(11) address other risks identified by the Di-
rector of the National Center for Cybersecurity and 
Communications. 
‘‘(c) COORDINATION WITH OTHER RESEARCH INI-
TIATIVES.—The Under Secretary— 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00185
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
186 
‘‘(1) shall ensure that the research and develop-
ment program carried out under subsection (a) is 
consistent with the national strategy to increase the 
security and resilience of cyberspace developed by 
the Director of Cyberspace Policy under section 101 
of the Protecting Cyberspace as a National Asset 
Act of 2010, or any succeeding strategy; 
‘‘(2) shall, to the extent practicable, coordinate 
the research and development activities of the De-
partment with other ongoing research and develop-
ment security-related initiatives, including research 
being conducted by— 
‘‘(A) the National Institute of Standards 
and Technology; 
‘‘(B) the National Academy of Sciences; 
‘‘(C) other Federal agencies, as defined 
under section 241; 
‘‘(D) other Federal and private research 
laboratories, research entities, and universities 
and institutions of higher education, and rel-
evant nonprofit organizations; and 
‘‘(E) international partners of the United 
States; 
‘‘(3) shall carry out any research and develop-
ment project under subsection (a) through a reim-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00186
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
187 
bursable agreement with an appropriate Federal 
agency, as defined under section 241, if the Federal 
agency— 
‘‘(A) is sponsoring a research and develop-
ment project in a similar area; or 
‘‘(B) has a unique facility or capability 
that would be useful in carrying out the project; 
‘‘(4) may make grants to, or enter into coopera-
tive agreements, contracts, other transactions, or re-
imbursable agreements with, the entities described in 
paragraph (2); and 
‘‘(5) shall submit a report to the appropriate 
committees of Congress on a review of the cyberse-
curity activities, and the capacity, of the national 
laboratories and other research entities available to 
the Department to determine if the establishment of 
a national laboratory dedicated to cybersecurity re-
search and development is necessary. 
‘‘(d) PRIVACY AND CIVIL RIGHTS AND CIVIL LIB-
ERTIES ISSUES.— 
‘‘(1) CONSULTATION.—In carrying out research 
and development projects under subsection (a), the 
Under Secretary shall consult with the Privacy Offi-
cer appointed under section 222 and the Officer for 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00187
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
188 
Civil Rights and Civil Liberties of the Department 
appointed under section 705. 
‘‘(2) PRIVACY
IMPACT
ASSESSMENTS.—In ac-
cordance with sections 222 and 705, the Privacy Of-
ficer shall conduct privacy impact assessments and 
the Officer for Civil Rights and Civil Liberties shall 
conduct reviews, as appropriate, for research and de-
velopment projects carried out under subsection (a) 
that the Under Secretary determines could have an 
impact on privacy, civil rights, or civil liberties. 
‘‘SEC. 239. NATIONAL CYBERSECURITY ADVISORY COUNCIL. 
‘‘(a) ESTABLISHMENT.—Not later than 90 days after 
the date of enactment of this section, the Secretary shall 
establish an advisory committee under section 871 on pri-
vate sector cybersecurity, to be known as the National Cy-
bersecurity Advisory Council (in this section referred to 
as the ‘Council’). 
‘‘(b) RESPONSIBILITIES.— 
‘‘(1) IN GENERAL.—The Council shall advise 
the Director of the National Center for Cybersecu-
rity and Communications on the implementation of 
the cybersecurity provisions affecting the private sec-
tor under this subtitle and subtitle E. 
‘‘(2) INCENTIVES
AND
REGULATIONS.—The 
Council shall advise the Director of the National 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00188
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
189 
Center for Cybersecurity and Communications and 
appropriate committees of Congress (as defined in 
section 241) and any other congressional committee 
with jurisdiction over the particular matter regard-
ing how market incentives and regulations may be 
implemented to enhance the cybersecurity and eco-
nomic security of the Nation. 
‘‘(c) MEMBERSHIP.— 
‘‘(1) IN GENERAL.—The members of the Coun-
cil shall be appointed the Director of the National 
Center for Cybersecurity and Communications and 
shall, to the extent practicable, represent a geo-
graphic and substantive cross-section of owners and 
operators of critical infrastructure and others with 
expertise in cybersecurity, including, as appro-
priate— 
‘‘(A) representatives of covered critical in-
frastructure (as defined under section 241); 
‘‘(B) academic institutions with expertise 
in cybersecurity; 
‘‘(C) Federal, State, and local government 
agencies with expertise in cybersecurity; 
‘‘(D) a representative of the National Se-
curity Telecommunications Advisory Council, as 
established by Executive Order 12382 (47 Fed. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00189
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
190 
Reg. 40531; relating to the establishment of the 
advisory council), as amended by Executive 
Order 13286 (68 Fed. Reg. 10619), as in effect 
on August 3, 2009, or any successor entity; 
‘‘(E) a representative of the Communica-
tions Sector Coordinating Council, or any suc-
cessor entity; 
‘‘(F) a representative of the Information 
Technology Sector Coordinating Council, or any 
successor entity; 
‘‘(G) individuals, acting in their personal 
capacity, with demonstrated technical expertise 
in cybersecurity; and 
‘‘(H) such other individuals as the Director 
determines to be appropriate, including owners 
of small business concerns (as defined under 
section 3 of the Small Business Act (15 U.S.C. 
632)). 
‘‘(2) TERM.—The members of the Council shall 
be appointed for 2-year terms and may be appointed 
to consecutive terms. 
‘‘(3) LEADERSHIP.—The Chairperson and Vice- 
Chairperson of the Council shall be selected by mem-
bers of the Council from among the members of the 
Council and shall serve 2-year terms. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00190
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
191 
‘‘(d) APPLICABILITY OF FEDERAL ADVISORY COM-
MITTEE ACT.—The Federal Advisory Committee Act (5 
U.S.C. App.) shall not apply to the Council.’’. 
SEC. 503. PRIORITIZED CRITICAL INFORMATION INFRA-
STRUCTURE. 
Section 210E(a)(2) of the Homeland Security Act of 
2002 (6 U.S.C. 124l(a)(2)) is amended— 
(1) by striking ‘‘In accordance’’ and inserting 
the following: 
‘‘(A) IN GENERAL.—In accordance’’; and 
(2) by adding at the end the following: 
‘‘(B) CONSIDERATIONS.—In establishing 
and maintaining a list under subparagraph (A), 
the Secretary, in coordination with the Director 
of the National Center for Cybersecurity and 
Communications and in consultation with the 
National 
Cybersecurity 
Advisory 
Council, 
shall— 
‘‘(i) consider cyber vulnerabilities and 
consequences by sector, including— 
‘‘(I) the factors listed in section 
248(a)(2); 
‘‘(II) interdependencies between 
components of covered critical infra-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00191
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
192 
structure (as defined under section 
241); and 
‘‘(III) any other security related 
factor determined appropriate by the 
Secretary; and 
‘‘(ii) add covered critical infrastruc-
ture to or delete covered critical infrastruc-
ture from the list based on the factors list-
ed in clause (i) for purposes of sections 
248 and 249. 
‘‘(C) NOTIFICATION.—The Secretary— 
‘‘(i) shall notify the owner or operator 
of any system or asset added under sub-
paragraph (B)(ii) to the list established 
and maintained under subparagraph (A) as 
soon as is practicable; 
‘‘(ii) shall develop a mechanism for an 
owner or operator notified under clause (i) 
to provide relevant information to the Sec-
retary and the Director of the National 
Center for Cybersecurity and Communica-
tions relating to the inclusion of the sys-
tem or asset on the list, including any in-
formation that the owner or operator be-
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00192
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
193 
lieves may have led to the improper inclu-
sion of the system or asset on the list; and 
‘‘(iii) at the sole and unreviewable dis-
cretion of the Secretary, may revise the list 
based on information provided in clause 
(ii).’’. 
SEC. 504. NATIONAL CENTER FOR CYBERSECURITY AND 
COMMUNICATIONS ACQUISITION AUTHORI-
TIES. 
(a) IN GENERAL.—The National Center for Cyberse-
curity and Communications is authorized to use the au-
thorities under subsections (c)(1) and (d)(1)(B) of section 
2304 of title 10, United States Code, instead of the au-
thorities under subsections (c)(1) and (d)(1)(B) of section 
303 of the Federal Property and Administrative Services 
Act of 1949 (41 U.S.C. 253), subject to all other require-
ments of section 303 of the Federal Property and Admin-
istrative Services Act of 1949. 
(b) GUIDELINES.—Not later than 90 days after the 
date of enactment of this Act, the chief procurement offi-
cer of the Department of Homeland Security shall issue 
guidelines for use of the authority under subsection (a). 
(c) TERMINATION.—The National Center for Cyber-
security and Communications may not use the authority 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00193
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
194 
under subsection (a) on and after the date that is 3 years 
after the date of enactment of this Act. 
(d) REPORTING.— 
(1) IN GENERAL.—On a semiannual basis, the 
Director of the National Center for Cybersecurity 
and Communications shall submit a report on use of 
the authority granted by subsection (a) to— 
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; and 
(B) the Committee on Homeland Security 
of the House of Representatives. 
(2) CONTENTS.—Each report submitted under 
paragraph (1) shall include, at a minimum— 
(A) the number of contract actions taken 
under the authority under subsection (a) during 
the period covered by the report; and 
(B) for each contract action described in 
subparagraph (A)— 
(i) the total dollar value of the con-
tract action; 
(ii) a summary of the market research 
conducted by the National Center for Cy-
bersecurity and Communications, including 
a list of all offerors who were considered 
and those who actually submitted bids, in 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00194
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
195 
order to determine that use of the author-
ity was appropriate; and 
(iii) a copy of the justification and ap-
proval documents required by section 
303(f) of the Federal Property and Admin-
istrative Services Act of 1949 (41 U.S.C. 
253(f)). 
(3) CLASSIFIED
ANNEX.—A report submitted 
under this subsection shall be submitted in an un-
classified form, but may include a classified annex, 
if necessary. 
SEC. 505. TECHNICAL AND CONFORMING AMENDMENTS. 
(a) ELIMINATION OF ASSISTANT SECRETARY FOR 
CYBERSECURITY AND COMMUNICATIONS.—The Homeland 
Security Act of 2002 (6 U.S.C. 101 et seq.) is amended— 
(1) in section 103(a)(8) (6 U.S.C. 113(a)(8)), 
by striking ‘‘, cybersecurity,’’; 
(2) in section 514 (6 U.S.C. 321c)— 
(A) by striking subsection (b); and 
(B) by redesignating subsection (c) as sub-
section (b); and 
(3) in section 1801(b) (6 U.S.C. 571(b)), by 
striking ‘‘shall report to the Assistant Secretary for 
Cybersecurity and Communications’’ and inserting 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00195
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
196 
‘‘shall report to the Director of the National Center 
for Cybersecurity and Communications’’. 
(b) CIO COUNCIL.—Section 3603(b) of title 44, 
United States Code, is amended— 
(1) by redesignating paragraph (7) as para-
graph (8); and 
(2) by inserting after paragraph (6) the fol-
lowing: 
‘‘(7) The Director of the National Center for 
Cybersecurity and Communications.’’. 
(c) REPEAL.—The Homeland Security Act of 2002 
(6 U.S.C. 101 et seq) is amended— 
(1) by striking section 223 (6 U.S.C. 143); and 
(2) by redesignating sections 224 and 225 (6 
U.S.C. 144 and 145) as sections 223 and 224, re-
spectively. 
(d) TECHNICAL CORRECTION.—Section 1802(a) of 
the Homeland Security Act of 2002 (6 U.S.C. 572(a)) is 
amended in the matter preceding paragraph (1) by strik-
ing ‘‘Department of’’. 
(e) EXECUTIVE SCHEDULE POSITION.—Section 5313 
of title 5, United States Code, is amended by adding at 
the end the following: 
‘‘Director of the National Center for Cybersecurity 
and Communications.’’. 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00196
Fmt 6652
Sfmt 6201
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS
197 
(f) TABLE OF CONTENTS.—The table of contents in 
section 1(b) of the Homeland Security Act of 2002 (6 
U.S.C. 101 et seq.) is amended— 
(1) by striking the items relating to sections 
223, 224, and 225 and inserting the following: 
‘‘Sec. 223. NET guard. 
‘‘Sec. 224. Cyber Security Enhancements Act of 2002.’’; 
and 
(2) by inserting after the item relating to sec-
tion 237 the following: 
‘‘Sec. 238. Cybersecurity research and development. 
‘‘Sec. 239. National Cybersecurity Advisory Council. 
‘‘Subtitle E—Cybersecurity 
‘‘Sec. 241. Definitions. 
‘‘Sec. 242. National Center for Cybersecurity and Communications. 
‘‘Sec. 243. Physical and cyber infrastructure collaboration. 
‘‘Sec. 244. United States Computer Emergency Readiness Team. 
‘‘Sec. 245. Additional authorities of the Director of the National Center for Cy-
bersecurity and Communications. 
‘‘Sec. 246. Information sharing. 
‘‘Sec. 247. Private sector assistance. 
‘‘Sec. 248. Cyber vulnerabilities to covered critical infrastructure. 
‘‘Sec. 249. National cyber emergencies.. 
‘‘Sec. 250. Enforcement. 
‘‘Sec. 251. Protection of information. 
‘‘Sec. 252. Sector-specific agencies. 
‘‘Sec. 253. Strategy for Federal cybersecurity supply chain management.’’. 
Æ 
VerDate Mar 15 2010 
03:41 Jun 18, 2010
Jkt 089200
PO 00000
Frm 00197
Fmt 6652
Sfmt 6301
E:\BILLS\H5548.IH
H5548
tjames on DSKG8SOYB1PROD with BILLS