thentication infrastructures to be made available to
Federal agencies so that such agencies may effec-
tively select and utilize electronic authentication
technologies in a manner that is—
(A) adequately secure to meet the needs of
those agencies and their transaction partners;
and
(B) interoperable, to the maximum extent
possible.
(2) ELEMENTS.—The guidelines and standards
developed under paragraph (1) shall include—
(A) protection profiles for cryptographic
and noncryptographic methods of authen-
ticating identity for electronic authentication
products and services;
(B) a core set of interoperability specifica-
tions for the use of electronic authentication
products and services in electronic transactions
between Federal agencies and their transaction
partners; and
(C) validation criteria to enable Federal
agencies to select cryptographic electronic au-
thentication products and services appropriate
to their needs.
(3) REVISIONS.—The Director shall periodically
review the guidelines and standards developed under
paragraph (1) and revise them as appropriate.
(b) LISTING
OF PRODUCTS.—Not later than 30
months after the date of the enactment of this Act, and
thereafter, the Director shall maintain and make available
to Federal agencies a nonmandatory list of commercially
available electronic authentication products, and other
such products used by Federal agencies, evaluated as con-
forming with the guidelines and standards developed
under subsection (a).
(c) SPECIFICATIONS
FOR
ELECTRONIC
CERTIFI-
CATION AND MANAGEMENT TECHNOLOGIES.—
(1) SPECIFICATIONS.—The Director shall, as
appropriate, establish core specifications for par-
ticular electronic certification and management tech-
nologies, or their components, for use by Federal
agencies.
(2) EVALUATION.—The Director shall advise
Federal agencies on how to evaluate the conform-
ance with the specifications established under para-
graph (1) of electronic certification and management
technologies, developed for use by Federal agencies
or available for such use.
(3) MAINTENANCE
OF
LIST.—The Director
shall maintain and make available to Federal agen-
cies a list of electronic certification and management
technologies evaluated as conforming to the speci-
fications established under paragraph (1).
(d) REPORTS.—Not later than 18 months after the
date of the enactment of this Act, and annually thereafter,
the Director shall transmit to the Congress a report that
includes—
(1) a description and analysis of the utilization
by Federal agencies of electronic authentication
technologies; and
(2) a description and analysis regarding the
problems Federal agencies are having, and the
progress such agencies are making, in implementing
electronic authentication infrastructures.
(e) DEFINITIONS.—For purposes of this section—
(1) the term ‘‘electronic authentication’’ means
cryptographic or noncryptographic methods of au-
thenticating identity in an electronic communication;
(2) the term ‘‘electronic authentication infra-
structure’’ means the software, hardware, and per-
sonnel resources, and the procedures, required to ef-
fectively 
utilize 
electronic 
authentication 
tech-
nologies;
(3) the term ‘‘electronic certification and man-
agement technologies’’ means computer systems, in-
cluding associated personnel and procedures, that
enable individuals to apply electronic authentication
to electronic information; and
(4) the term ‘‘protection profile’’ means a list of
security functions and associated assurance levels
used to describe a product.
SEC. 13. SOURCE OF AUTHORIZATIONS.
There are authorized to be appropriated to the Sec-
retary of Commerce $7,000,000 for fiscal year 2002 and
$8,000,000 for fiscal year 2003, for the National Institute
of Standards and Technology to carry out activities au-
thorized by this Act for which funds are not otherwise spe-
cifically authorized to be appropriated by this Act.
Passed the House of Representatives November 27,
2001.
Attest:
Clerk.