IB 
Union Calendar No. 177 
112TH CONGRESS 
1ST SESSION H. R. 2096 
[Report No. 112–264] 
To advance cybersecurity research, development, and technical standards, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 2, 2011 
Mr. MCCAUL (for himself and Mr. LIPINSKI) introduced the following bill; 
which was referred to the Committee on Science, Space, and Technology 
OCTOBER 31, 2011 
Additional sponsors: Mr. WU, Mr. HALL, Mr. SCHOCK, Mr. LUJA´N, Mr. 
SMITH of Texas, and Mr. BROOKS 
OCTOBER 31, 2011 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on June 2, 2011] 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
A BILL 
To advance cybersecurity research, development, and 
technical standards, and for other purposes. 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Enhance-
ment Act of 2011’’. 
TITLE I—RESEARCH AND 
DEVELOPMENT 
SEC. 101. DEFINITIONS. 
In this title: 
(1) NATIONAL COORDINATION OFFICE.—The term 
National Coordination Office means the National Co-
ordination Office for the Networking and Information 
Technology Research and Development program. 
(2) PROGRAM.—The term Program means the 
Networking and Information Technology Research 
and Development program which has been established 
under section 101 of the High-Performance Com-
puting Act of 1991 (15 U.S.C. 5511). 
SEC. 102. FINDINGS. 
Section 2 of the Cyber Security Research and Develop-
ment Act (15 U.S.C. 7401) is amended— 
(1) by amending paragraph (1) to read as fol-
lows: 
‘‘(1) Advancements in information and commu-
nications technology have resulted in a globally inter-
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
connected network of government, commercial, sci-
entific, and education infrastructures, including crit-
ical infrastructures for electric power, natural gas 
and petroleum production and distribution, tele-
communications, transportation, water supply, bank-
ing and finance, and emergency and government serv-
ices.’’; 
(2) in paragraph (2), by striking ‘‘Exponential 
increases in interconnectivity have facilitated en-
hanced communications, economic growth,’’ and in-
serting ‘‘These advancements have significantly con-
tributed to the growth of the United States economy’’; 
(3) by amending paragraph (3) to read as fol-
lows: 
‘‘(3) The Cyberspace Policy Review published by 
the President in May, 2009, concluded that our infor-
mation technology and communications infrastruc-
ture is vulnerable and has ‘suffered intrusions that 
have allowed criminals to steal hundreds of millions 
of dollars and nation-states and other entities to steal 
intellectual property and sensitive military informa-
tion’.’’; and 
(4) by amending paragraph (6) to read as fol-
lows: 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(6) While African-Americans, Hispanics, and 
Native Americans constitute 33 percent of the college- 
age population, members of these minorities comprise 
less than 20 percent of bachelor degree recipients in 
the field of computer sciences.’’. 
SEC. 103. CYBERSECURITY STRATEGIC RESEARCH AND DE-
VELOPMENT PLAN. 
(a) IN GENERAL.—Not later than 12 months after the 
date of enactment of this Act, the agencies identified in sub-
section 101(a)(3)(B)(i) through (x) of the High-Performance 
Computing Act of 1991 (15 U.S.C. 5511(a)(3)(B)(i) 
through (x)) or designated under section 101(a)(3)(B)(xi) 
of such Act, working through the National Science and 
Technology Council and with the assistance of the National 
Coordination Office, shall transmit to Congress a strategic 
plan based on an assessment of cybersecurity risk to guide 
the overall direction of Federal cybersecurity and informa-
tion assurance research and development for information 
technology and networking systems. Once every 3 years 
after the initial strategic plan is transmitted to Congress 
under this section, such agencies shall prepare and transmit 
to Congress an update of such plan. 
(b) CONTENTS OF PLAN.—The strategic plan required 
under subsection (a) shall— 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(1) specify and prioritize near-term, mid-term 
and long-term research objectives, including objectives 
associated with the research areas identified in sec-
tion 4(a)(1) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7403(a)(1)) and how the 
near-term objectives complement research and develop-
ment areas in which the private sector is actively en-
gaged; 
(2) describe how the Program will focus on inno-
vative, transformational technologies with the poten-
tial to enhance the security, reliability, resilience, and 
trustworthiness of the digital infrastructure, and to 
protect consumer privacy; 
(3) describe how the Program will foster the 
rapid transfer of research and development results 
into new cybersecurity technologies and applications 
for the timely benefit of society and the national in-
terest, including through the dissemination of best 
practices and other outreach activities; 
(4) describe how the Program will establish and 
maintain a national research infrastructure for cre-
ating, testing, and evaluating the next generation of 
secure networking and information technology sys-
tems; 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(5) describe how the Program will facilitate ac-
cess by academic researchers to the infrastructure de-
scribed in paragraph (4), as well as to relevant data, 
including event data; and 
(6) describe how the Program will engage females 
and individuals identified in section 33 or 34 of the 
Science and Engineering Equal Opportunities Act 
(42 U.S.C. 1885a or 1885b) to foster a more diverse 
workforce in this area. 
(c) DEVELOPMENT OF ROADMAP.—The agencies de-
scribed in subsection (a) shall develop and annually update 
an implementation roadmap for the strategic plan required 
in this section. Such roadmap shall— 
(1) specify the role of each Federal agency in 
carrying out or sponsoring research and development 
to meet the research objectives of the strategic plan, 
including a description of how progress toward the re-
search objectives will be evaluated; 
(2) specify the funding allocated to each major 
research objective of the strategic plan and the source 
of funding by agency for the current fiscal year; and 
(3) estimate the funding required for each major 
research objective of the strategic plan for the fol-
lowing 3 fiscal years. 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(d) RECOMMENDATIONS.—In developing and updating 
the strategic plan under subsection (a), the agencies in-
volved shall solicit recommendations and advice from— 
(1) the advisory committee established under sec-
tion 101(b)(1) of the High-Performance Computing 
Act of 1991 (15 U.S.C. 5511(b)(1)); and 
(2) a wide range of stakeholders, including in-
dustry, academia, including representatives of minor-
ity serving institutions and community colleges, Na-
tional Laboratories, and other relevant organizations 
and institutions. 
(e) APPENDING
TO REPORT.—The implementation 
roadmap required under subsection (c), and its annual up-
dates, shall be appended to the report required under section 
101(a)(2)(D) of the High-Performance Computing Act of 
1991 (15 U.S.C. 5511(a)(2)(D)). 
SEC. 104. SOCIAL AND BEHAVIORAL RESEARCH IN CYBER-
SECURITY. 
Section 4(a)(1) of the Cyber Security Research and 
Development Act (15 U.S.C. 7403(a)(1)) is amended— 
(1) by inserting ‘‘and usability’’ after ‘‘to the 
structure’’; 
(2) in subparagraph (H), by striking ‘‘and’’ 
after the semicolon; 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 106. FEDERAL CYBER SCHOLARSHIP FOR SERVICE 
PROGRAM. 
(a) IN GENERAL.—The Director of the National 
Science Foundation shall continue a Scholarship for Serv-
ice program under section 5(a) of the Cyber Security Re-
search and Development Act (15 U.S.C. 7404(a)) to recruit 
and train the next generation of Federal cybersecurity pro-
fessionals and to increase the capacity of the higher edu-
cation system to produce an information technology work-
force with the skills necessary to enhance the security of the 
Nation’s communications and information infrastructure. 
(b) CHARACTERISTICS OF PROGRAM.—The program 
under this section shall— 
(1) provide, through qualified institutions of 
higher education, scholarships that provide tuition, 
fees, and a competitive stipend for up to 2 years to 
students pursing a bachelor’s or master’s degree and 
up to 3 years to students pursuing a doctoral degree 
in a cybersecurity field; 
(2) provide the scholarship recipients with sum-
mer internship opportunities or other meaningful 
temporary appointments in the Federal information 
technology workforce; and 
(3) increase the capacity of institutions of higher 
education throughout all regions of the United States 
to produce highly qualified cybersecurity profes-
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
sionals, through the award of competitive, merit-re-
viewed grants that support such activities as— 
(A) faculty professional development, in-
cluding technical, hands-on experiences in the 
private sector or government, workshops, semi-
nars, conferences, and other professional develop-
ment opportunities that will result in improved 
instructional capabilities; 
(B) institutional partnerships, including 
minority serving institutions and community 
colleges; and 
(C) development of cybersecurity-related 
courses and curricula. 
(c) SCHOLARSHIP REQUIREMENTS.— 
(1) ELIGIBILITY.—Scholarships under this sec-
tion shall be available only to students who— 
(A) are citizens or permanent residents of 
the United States; 
(B) are full-time students in an eligible de-
gree program, as determined by the Director, 
that is focused on computer security or informa-
tion assurance at an awardee institution; and 
(C) accept the terms of a scholarship pursu-
ant to this section. 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(2) SELECTION.—Individuals shall be selected to 
receive scholarships primarily on the basis of aca-
demic merit, with consideration given to financial 
need, to the goal of promoting the participation of in-
dividuals identified in section 33 or 34 of the Science 
and Engineering Equal Opportunities Act (42 U.S.C. 
1885a or 1885b), and to veterans. For purposes of 
this paragraph, the term ‘‘veteran’’ means a person 
who— 
(A) served on active duty (other than active 
duty for training) in the Armed Forces of the 
United States for a period of more than 180 con-
secutive days, and who was discharged or re-
leased therefrom under conditions other than dis-
honorable; or 
(B) served on active duty (other than active 
duty for training) in the Armed Forces of the 
United States and was discharged or released 
from such service for a service-connected dis-
ability before serving 180 consecutive days. 
For purposes of subparagraph (B), the term ‘‘service- 
connected’’ has the meaning given such term under 
section 101 of title 38, United States Code. 
(3) SERVICE OBLIGATION.—If an individual re-
ceives a scholarship under this section, as a condition 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
of receiving such scholarship, the individual upon 
completion of their degree must serve as a cybersecu-
rity professional within the Federal workforce for a 
period of time as provided in paragraph (5). If a 
scholarship recipient is not offered employment by a 
Federal agency or a federally funded research and de-
velopment center, the service requirement can be satis-
fied at the Director’s discretion by— 
(A) serving as a cybersecurity professional 
in a State, local, or tribal government agency; or 
(B) teaching cybersecurity courses at an in-
stitution of higher education. 
(4) CONDITIONS OF SUPPORT.—As a condition of 
acceptance of a scholarship under this section, a re-
cipient shall agree to provide the awardee institution 
with annual verifiable documentation of employment 
and up-to-date contact information. 
(5) LENGTH OF SERVICE.—The length of service 
required in exchange for a scholarship under this sub-
section shall be 1 year more than the number of years 
for which the scholarship was received. 
(d) FAILURE TO COMPLETE SERVICE OBLIGATION.— 
(1) GENERAL RULE.—If an individual who has 
received a scholarship under this section— 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(A) fails to maintain an acceptable level of 
academic standing in the educational institution 
in which the individual is enrolled, as deter-
mined by the Director; 
(B) is dismissed from such educational in-
stitution for disciplinary reasons; 
(C) withdraws from the program for which 
the award was made before the completion of 
such program; 
(D) declares that the individual does not in-
tend to fulfill the service obligation under this 
section; or 
(E) fails to fulfill the service obligation of 
the individual under this section, 
such individual shall be liable to the United States as 
provided in paragraph (3). 
(2) MONITORING COMPLIANCE.—As a condition 
of participating in the program, a qualified institu-
tion of higher education receiving a grant under this 
section shall— 
(A) enter into an agreement with the Direc-
tor of the National Science Foundation to mon-
itor the compliance of scholarship recipients with 
respect to their service obligation; and 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(B) provide to the Director, on an annual 
basis, post-award employment information re-
quired under subsection (c)(4) for scholarship re-
cipients through the completion of their service 
obligation. 
(3) AMOUNT OF REPAYMENT.— 
(A) LESS THAN ONE YEAR OF SERVICE.—If 
a circumstance described in paragraph (1) oc-
curs before the completion of 1 year of a service 
obligation under this section, the total amount of 
awards received by the individual under this sec-
tion shall be repaid or such amount shall be 
treated as a loan to be repaid in accordance with 
subparagraph (C). 
(B) MORE THAN ONE YEAR OF SERVICE.— 
If a circumstance described in subparagraph (D) 
or (E) of paragraph (1) occurs after the comple-
tion of 1 year of a service obligation under this 
section, the total amount of scholarship awards 
received by the individual under this section, re-
duced by the ratio of the number of years of serv-
ice completed divided by the number of years of 
service required, shall be repaid or such amount 
shall be treated as a loan to be repaid in accord-
ance with subparagraph (C). 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(C) REPAYMENTS.—A loan described in 
subparagraph (A) or (B) shall be treated as a 
Federal Direct Unsubsidized Stafford Loan 
under part D of title IV of the Higher Education 
Act of 1965 (20 U.S.C. 1087a and following), 
and shall be subject to repayment, together with 
interest thereon accruing from the date of the 
scholarship award, in accordance with terms and 
conditions specified by the Director (in consulta-
tion with the Secretary of Education) in regula-
tions promulgated to carry out this paragraph. 
(4) COLLECTION OF REPAYMENT.— 
(A) IN GENERAL.—In the event that a schol-
arship recipient is required to repay the scholar-
ship under this subsection, the institution pro-
viding the scholarship shall— 
(i) be responsible for determining the 
repayment amounts and for notifying the 
recipient and the Director of the amount 
owed; and 
(ii) collect such repayment amount 
within a period of time as determined 
under the agreement described in paragraph 
(2), or the repayment amount shall be treat-
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
ed as a loan in accordance with paragraph 
(3)(C). 
(B) RETURNED TO TREASURY.—Except as 
provided in subparagraph (C) of this paragraph, 
any such repayment shall be returned to the 
Treasury of the United States. 
(C) RETAIN PERCENTAGE.—An institution 
of higher education may retain a percentage of 
any repayment the institution collects under this 
paragraph to defray administrative costs associ-
ated with the collection. The Director shall estab-
lish a single, fixed percentage that will apply to 
all eligible entities. 
(5) EXCEPTIONS.—The Director may provide for 
the partial or total waiver or suspension of any serv-
ice or payment obligation by an individual under 
this section whenever compliance by the individual 
with the obligation is impossible or would involve ex-
treme hardship to the individual, or if enforcement of 
such obligation with respect to the individual would 
be unconscionable. 
(e) HIRING AUTHORITY.—For purposes of any law or 
regulation governing the appointment of individuals in the 
Federal civil service, upon successful completion of their de-
gree, students receiving a scholarship under this section 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
shall be hired under the authority provided for in section 
213.3102(r) of title 5, Code of Federal Regulations, and be 
exempted from competitive service. Upon fulfillment of the 
service term, such individuals shall be converted to a com-
petitive service position without competition if the indi-
vidual meets the requirements for that position. 
SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT. 
Not later than 180 days after the date of enactment 
of this Act the President shall transmit to the Congress a 
report addressing the cybersecurity workforce needs of the 
Federal Government. The report shall include— 
(1) an examination of the current state of and 
the projected needs of the Federal cybersecurity work-
force, including a comparison of the different agencies 
and departments, and an analysis of the capacity of 
such agencies and departments to meet those needs; 
(2) an analysis of the sources and availability of 
cybersecurity talent, a comparison of the skills and 
expertise sought by the Federal Government and the 
private sector, an examination of the current and fu-
ture capacity of United States institutions of higher 
education, including community colleges, to provide 
current 
and 
future 
cybersecurity 
professionals, 
through education and training activities, with those 
skills sought by the Federal Government, State and 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
local entities, and the private sector, and a descrip-
tion of how successful programs are engaging the tal-
ents of females and individuals identified in section 
33 or 34 of the Science and Engineering Equal Op-
portunities Act (42 U.S.C. 1885a or 1885b); 
(3) an examination of the effectiveness of the Na-
tional Centers of Academic Excellence in Information 
Assurance Education, the Centers of Academic Excel-
lence in Research, and the Federal Cyber Scholarship 
for Service programs in promoting higher education 
and research in cybersecurity and information assur-
ance and in producing a growing number of profes-
sionals with the necessary cybersecurity and informa-
tion assurance expertise, including individuals from 
States or regions in which the unemployment rate ex-
ceeds the national average; 
(4) an analysis of any barriers to the Federal 
Government recruiting and hiring cybersecurity tal-
ent, including barriers relating to compensation, the 
hiring process, job classification, and hiring flexibili-
ties; and 
(5) recommendations for Federal policies to en-
sure an adequate, well-trained Federal cybersecurity 
workforce. 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 108. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 
FORCE. 
(a) ESTABLISHMENT OF UNIVERSITY-INDUSTRY TASK 
FORCE.—Not later than 180 days after the date of enact-
ment of this Act, the Director of the Office of Science and 
Technology Policy shall convene a task force to explore 
mechanisms for carrying out collaborative research, devel-
opment, education, and training activities for cybersecurity 
through a consortium or other appropriate entity with par-
ticipants from institutions of higher education and indus-
try. 
(b) FUNCTIONS.—The task force shall— 
(1) develop options for a collaborative model and 
an organizational structure for such entity under 
which the joint research and development activities 
could be planned, managed, and conducted effectively, 
including mechanisms for the allocation of resources 
among the participants in such entity for support of 
such activities; 
(2) propose a process for developing a research 
and development agenda for such entity, including 
guidelines to ensure an appropriate scope of work fo-
cused on nationally significant challenges and requir-
ing collaboration; 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS