HR 2096 RFS
of Science and Technology Policy shall transmit to the 
Congress a report describing the findings and rec-
ommendations of the task force. 
(e) TERMINATION.—The task force shall terminate 
upon transmittal of the report required under subsection 
(d). 
(f) COMPENSATION
AND EXPENSES.—Members of 
the task force shall serve without compensation. 
SEC. 109. CYBERSECURITY AUTOMATION AND CHECKLISTS 
FOR GOVERNMENT SYSTEMS. 
Section 8(c) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7406(c)) is amended to read 
as follows: 
‘‘(c) SECURITY AUTOMATION AND CHECKLISTS FOR 
GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the Na-
tional Institute of Standards and Technology shall 
develop, and revise as necessary, security automation 
standards, associated reference materials (including 
protocols), and checklists providing settings and op-
tion selections that minimize the security risks asso-
ciated with each information technology hardware or 
software system and security tool that is, or is likely 
to become, widely used within the Federal Govern-
ment in order to enable standardized and interoper-
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS
HR 2096 RFS
able technologies, architectures, and frameworks for 
continuous monitoring of information security within 
the Federal Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
ment of standards, reference materials, and check-
lists under this subsection on the basis of— 
‘‘(A) the security risks associated with the 
use of the system; 
‘‘(B) the number of agencies that use a 
particular system or security tool; 
‘‘(C) the usefulness of the standards, ref-
erence materials, or checklists to Federal agen-
cies that are users or potential users of the sys-
tem; 
‘‘(D) the effectiveness of the associated 
standard, reference material, or checklist in cre-
ating or enabling continuous monitoring of in-
formation security; or 
‘‘(E) such other factors as the Director of 
the National Institute of Standards and Tech-
nology determines to be appropriate. 
‘‘(3) EXCLUDED
SYSTEMS.—The Director of 
the National Institute of Standards and Technology 
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS
HR 2096 RFS
may exclude from the application of paragraph (1) 
any information technology hardware or software 
system or security tool for which such Director de-
termines that the development of a standard, ref-
erence material, or checklist is inappropriate because 
of the infrequency of use of the system, the obsoles-
cence of the system, or the inutility or imprac-
ticability of developing a standard, reference mate-
rial, or checklist for the system. 
‘‘(4) DISSEMINATION OF STANDARDS AND RE-
LATED MATERIALS.—The Director of the National 
Institute of Standards and Technology shall ensure 
that Federal agencies are informed of the avail-
ability of any standard, reference material, checklist, 
or other item developed under this subsection. 
‘‘(5) AGENCY USE REQUIREMENTS.—The devel-
opment of standards, reference materials, and check-
lists under paragraph (1) for an information tech-
nology hardware or software system or tool does 
not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the standard, reference material, or checklist 
for the system; 
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS
HR 2096 RFS
‘‘(B) establish conditions or prerequisites 
for Federal agency procurement or deployment 
of any such system; 
‘‘(C) imply an endorsement of any such 
system by the Director of the National Institute 
of Standards and Technology; or 
‘‘(D) preclude any Federal agency from 
procuring or deploying other information tech-
nology hardware or software systems for which 
no such standard, reference material, or check-
list has been developed or identified under para-
graph (1).’’. 
SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND 
DEVELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redes-
ignating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following: 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execu-
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS
HR 2096 RFS
tion of a wide variety of resource protection policies 
and that is amenable to implementation within a 
wide variety of existing and emerging computing en-
vironments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and net-
works; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; and 
‘‘(4) carry out research associated with improv-
ing security of industrial control systems.’’. 
TITLE II—ADVANCEMENT OF CY-
BERSECURITY 
TECHNICAL 
STANDARDS 
SEC. 201. DEFINITIONS. 
In this title: 
(1) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the National Institute of Standards 
and Technology. 
(2) INSTITUTE.—The term ‘‘Institute’’ means 
the National Institute of Standards and Technology. 
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS
HR 2096 RFS
SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
(a) IN GENERAL.—The Director, in coordination with 
appropriate Federal authorities, shall— 
(1) as appropriate, ensure coordination of Fed-
eral agencies engaged in the development of inter-
national technical standards related to information 
system security; and 
(2) not later than 1 year after the date of en-
actment of this Act, develop and transmit to the 
Congress a plan for ensuring such Federal agency 
coordination. 
(b) CONSULTATION WITH THE PRIVATE SECTOR.— 
In carrying out the activities specified in subsection (a)(1), 
the Director shall ensure consultation with appropriate 
private sector stakeholders. 
SEC. 203. CLOUD COMPUTING STRATEGY. 
(a) IN GENERAL.—The Director, in collaboration 
with the Federal CIO Council, and in consultation with 
other relevant Federal agencies and stakeholders from the 
private sector, shall continue to develop and encourage the 
implementation of a comprehensive strategy for the use 
and adoption of cloud computing services by the Federal 
Government. 
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS
HR 2096 RFS
tute of Standards and Technology Act (15 
U.S.C. 278g-3); and 
(D) to support the development of the au-
tomation of continuous monitoring systems. 
SEC. 204. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, National Laboratories, the National Coordination 
Office of the Networking and Information Technology Re-
search and Development program, and other organiza-
tions, shall continue to coordinate a cybersecurity aware-
ness and education program to increase knowledge, skills, 
and awareness of cybersecurity risks, consequences, and 
best practices through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; 
(2) efforts to make cybersecurity best practices 
usable by individuals, small to medium-sized busi-
nesses, State, local, and tribal governments, and 
educational institutions; and 
(3) efforts to attract, recruit, and retain quali-
fied professionals to the Federal cybersecurity work-
force. 
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS
HR 2096 RFS
(b) STRATEGIC PLAN.—The Director shall, in co-
operation with relevant Federal agencies and other stake-
holders, develop and implement a strategic plan to guide 
Federal programs and activities in support of a com-
prehensive cybersecurity awareness and education pro-
gram as described under subsection (a). 
(c) REPORT TO CONGRESS.—Not later than 1 year 
after the date of enactment of this Act and every 5 years 
thereafter, the Director shall transmit the strategic plan 
required under subsection (b) to the Committee on 
Science, Space, and Technology of the House of Rep-
resentatives and the Committee on Commerce, Science, 
and Transportation of the Senate. 
SEC. 205. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director shall continue a program to support the 
development of technical standards, metrology, testbeds, 
and conformance criteria, taking into account appropriate 
user concerns, to— 
(1) improve interoperability among identity 
management technologies; 
(2) strengthen authentication methods of iden-
tity management systems; 
(3) improve privacy protection in identity man-
agement systems, including health information tech-
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS
HR 2096 RFS
nology systems, through authentication and security 
protocols; and 
(4) improve the usability of identity manage-
ment systems. 
SEC. 206. AUTHORIZATIONS. 
No additional funds are authorized to carry out this 
title and the amendments made by this title or to carry 
out the amendments made by sections 109 and 110 of this 
Act. This title and the amendments made by this title and 
the amendments made by sections 109 and 110 of this 
Act shall be carried out using amounts otherwise author-
ized or appropriated. 
Passed the House of Representatives April 27, 2012. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Mar 15 2010 
01:19 May 08, 2012
Jkt 019200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H2096.RFS
H2096
tjames on DSK6SPTVN1PROD with BILLS