I 
112TH CONGRESS 
2D SESSION 
H. R. 4263 
To improve information security, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 27, 2012 
Mrs. BONO MACK (for herself and Mrs. BLACKBURN) introduced the following 
bill; which was referred to the Committee on Science, Space, and Tech-
nology, and in addition to the Committees on Oversight and Government 
Reform, the Judiciary, Armed Services, and Select Intelligence (Perma-
nent Select), for a period to be subsequently determined by the Speaker, 
in each case for consideration of such provisions as fall within the juris-
diction of the committee concerned 
A BILL 
To improve information security, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Strengthening and Enhancing Cybersecurity by Using 
Research, Education, Information, and Technology Act of 
2012’’ or the ‘‘SECURE IT Act of 2012’’. 
(b) TABLE OF CONTENTS.—The table of contents of 
this Act is as follows: 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
Sec. 1. Short title; table of contents. 
TITLE I—FACILITATING SHARING OF CYBER THREAT 
INFORMATION 
Sec. 101. Definitions. 
Sec. 102. Authorization to share cyber threat information. 
Sec. 103. Information sharing by the Federal Government. 
Sec. 104. Report on implementation. 
Sec. 105. Inspector General review. 
Sec. 106. Technical amendments. 
Sec. 107. Access to classified information. 
TITLE II—COORDINATION OF FEDERAL INFORMATION SECURITY 
POLICY 
Sec. 201. Coordination of Federal information security policy. 
Sec. 202. Management of information technology. 
Sec. 203. No new funding. 
Sec. 204. Technical and conforming amendments. 
TITLE III—CRIMINAL PENALTIES 
Sec. 301. Penalties for fraud and related activity in connection with computers. 
Sec. 302. Trafficking in passwords. 
Sec. 303. Conspiracy and attempted computer fraud offenses. 
Sec. 304. Criminal and civil forfeiture for fraud and related activity in connec-
tion with computers. 
Sec. 305. Damage to critical infrastructure computers. 
Sec. 306. Limitation on actions involving unauthorized use. 
TITLE IV—CYBERSECURITY RESEARCH AND DEVELOPMENT 
Sec. 401. National High-Performance Computing Program planning and co-
ordination. 
Sec. 402. Research in areas of national importance. 
Sec. 403. Program improvements. 
Sec. 404. Cloud computing services for research. 
Sec. 405. Cybersecurity university-industry task force. 
Sec. 406. Improving education of networking and information technology, in-
cluding high-performance computing. 
Sec. 407. Conforming and technical amendments to the High-Performance 
Computing Act of 1991. 
Sec. 408. Federal Cyber Scholarship-for-Service program. 
Sec. 409. Study and analysis of certification and training of information infra-
structure professionals. 
Sec. 410. Cybersecurity strategic research and development plan. 
Sec. 411. International cybersecurity technical standards. 
Sec. 412. Identity management research and development. 
Sec. 413. Federal cybersecurity research and development programs. 
Sec. 414. Cybersecurity automation and checklists for Government systems. 
Sec. 415. National Institute of Standards and Technology cybersecurity re-
search and development. 
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6211
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
TITLE 
I—FACILITATING 
SHAR-
ING OF CYBER THREAT IN-
FORMATION 
SEC. 101. DEFINITIONS. 
In this title: 
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given the term in section 3502 of title 44, 
United States Code. 
(2) ANTITRUST
LAWS.—The term ‘‘antitrust 
laws’’— 
(A) has the meaning given the term in sec-
tion 1(a) of the Clayton Act (15 U.S.C. 12(a)); 
(B) includes section 5 of the Federal 
Trade Commission Act (15 U.S.C. 45) to the 
extent that section 5 of that Act applies to un-
fair methods of competition; and 
(C) includes any State law that has the 
same intent and effect as the laws under sub-
paragraphs (A) and (B). 
(3) COUNTERMEASURE.—The term ‘‘counter-
measure’’ means an automated or a manual action 
with defensive intent to mitigate cyber threats. 
(4) CYBER THREAT INFORMATION.—The term 
‘‘cyber threat information’’ means information that 
may be indicative of or describes— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(A) a technical or operation vulnerability 
or a cyber threat mitigation measure; 
(B) an action or operation to mitigate a 
cyber threat; 
(C) malicious reconnaissance, including 
anomalous patterns of network activity that ap-
pear to be transmitted for the purpose of gath-
ering technical information related to a cyberse-
curity threat; 
(D) a method of defeating a technical con-
trol; 
(E) a method of defeating an operational 
control; 
(F) network activity or protocols known to 
be associated with a malicious cyber actor or 
that signify malicious cyber intent; 
(G) a method of causing a user with legiti-
mate access to an information system or infor-
mation that is stored on, processed by, or 
transiting an information system to inadvert-
ently enable the defeat of a technical or oper-
ational control; 
(H) any other attribute of a cybersecurity 
threat or cyber defense information that would 
foster situational awareness of the United 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
States cybersecurity posture, if disclosure of 
such attribute or information is not otherwise 
prohibited by law; 
(I) the actual or potential harm caused by 
a 
cyber 
incident, 
including 
information 
exfiltrated when it is necessary in order to iden-
tify or describe a cybersecurity threat; or 
(J) any combination thereof. 
(5) CYBERSECURITY CENTER.—The term ‘‘cy-
bersecurity center’’ means the Department of De-
fense Cyber Crime Center, the Intelligence Commu-
nity Incident Response Center, the United States 
Cyber Command Joint Operations Center, the Na-
tional Cyber Investigative Joint Task Force, the Na-
tional Security Agency/Central Security Service 
Threat Operations Center, the National Cybersecu-
rity and Communications Integration Center, and 
any successor center. 
(6) CYBERSECURITY SYSTEM.—The term ‘‘cy-
bersecurity system’’ means a system designed or em-
ployed to ensure the integrity, confidentiality, or 
availability of, or to safeguard, a system or network, 
including measures intended to protect a system or 
network from— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(A) efforts to degrade, disrupt, or destroy 
such system or network; or 
(B) theft or misappropriations of private 
or government information, intellectual prop-
erty, or personally identifiable information. 
(7) ENTITY.—The term ‘‘entity’’ means any 
private entity, non-Federal Government agency or 
department, or State, tribal, or local government 
agency or department (including an officer, em-
ployee, or agent thereof). 
(8) INFORMATION SECURITY.—The term ‘‘infor-
mation security’’ means protecting information and 
information systems from disruption or unauthorized 
access, use, disclosure, modification, or destruction 
in order to provide— 
(A) integrity, by guarding against im-
proper information modification or destruction, 
including by ensuring information nonrepudi-
ation and authenticity; 
(B) confidentiality, by preserving author-
ized restrictions on access and disclosure, in-
cluding means for protecting personal privacy 
and proprietary information; or 
(C) availability, by ensuring timely and re-
liable access to and use of information. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(9) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’ has the meaning given the term in 
section 3502 of title 44, United States Code. 
(10) MALICIOUS RECONNAISSANCE.—The term 
‘‘malicious reconnaissance’’ means a method for ac-
tively probing or passively monitoring an information 
system for the purpose of discerning technical 
vulnerabilities of the information system, if such 
method is associated with a known or suspected cy-
bersecurity threat. 
(11) 
OPERATIONAL
CONTROL.—The 
term 
‘‘operational control’’ means a security control for 
an information system that primarily is implemented 
and executed by people. 
(12) 
OPERATIONAL
VULNERABILITY.—The 
term ‘‘operational vulnerability’’ means any attribute 
of policy, process, or procedure that could enable or 
facilitate the defeat of an operational control. 
(13) PRIVATE ENTITY.—The term ‘‘private en-
tity’’ means any individual or any private group, or-
ganization, or corporation, including an officer, em-
ployee, or agent thereof. 
(14) TECHNICAL CONTROL.—The term ‘‘tech-
nical control’’ means a hardware or software restric-
tion on, or audit of, access or use of an information 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
system or information that is stored on, processed 
by, or transiting an information system that is in-
tended to ensure the confidentiality, integrity, or 
availability of that system. 
(15) TECHNICAL
VULNERABILITY.—The term 
‘‘technical vulnerability’’ means any attribute of 
hardware or software that could enable or facilitate 
the defeat of a technical control. 
SEC. 102. AUTHORIZATION TO SHARE CYBER THREAT IN-
FORMATION. 
(a) VOLUNTARY DISCLOSURE.— 
(1) PRIVATE ENTITIES.—Notwithstanding any 
other provision of law, a private entity may, for the 
purpose of preventing, investigating, or otherwise 
mitigating threats to information security, on its 
own networks, or as authorized by another entity, on 
such entity’s networks, employ countermeasures and 
use cybersecurity systems in order to obtain, iden-
tify, or otherwise possess cyber threat information. 
(2) ENTITIES.—Notwithstanding any other pro-
vision of law, an entity may disclose cyber threat in-
formation to— 
(A) a cybersecurity center; or 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(B) any other entity in order to assist with 
preventing, investigating, or otherwise miti-
gating threats to information security. 
(3) INFORMATION
SECURITY
PROVIDERS.—If 
the cyber threat information described in paragraph 
(1) is obtained, identified, or otherwise possessed in 
the course of providing information security prod-
ucts or services under contract to another entity, 
that entity shall, at any time prior to disclosure of 
such information, be given a reasonable opportunity 
to authorize or prevent such disclosure or to request 
anonymization of such information. 
(b) REQUIRED DISCLOSURE.— 
(1) IN
GENERAL.—An entity providing elec-
tronic communication services, remote computing 
services, or cybersecurity services under contract to 
a Federal agency or department shall immediately 
provide to such agency or department, and may pro-
vide to a cybersecurity center, any cyber threat in-
formation directly related to such contract that is 
obtained, identified, or otherwise possessed by such 
entity. 
(2) DISCLOSURE
TO
CYBERSECURITY
CEN-
TERS.—A Federal agency or department receiving 
cyber threat information under paragraph (1) shall 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
immediately disclose such information to a cyberse-
curity center. 
(3) LIMITATION ON APPLICATION.—This sub-
section shall not apply with respect to services pro-
vided under a contract in effect on the date of the 
enactment of this Act. 
(c) INFORMATION SHARED WITH OR PROVIDED TO 
A CYBERSECURITY CENTER.—Cyber threat information 
provided to a cybersecurity center under this section— 
(1) may be disclosed to and used by, consistent 
with otherwise applicable law, any Federal agency or 
department, component, officer, employee, or agent 
of the Federal Government for a cybersecurity pur-
pose, a national security purpose, or in order to pre-
vent, investigate, or prosecute any of the offenses 
listed in section 2516 of title 18, United States 
Code; 
(2) may, with the prior written consent of the 
entity submitting such information, be disclosed to 
and used by a State, tribal, or local government or 
government agency for the purpose of protecting in-
formation systems, or in furtherance of preventing, 
investigating, or prosecuting a criminal act, except 
that if the need for immediate disclosure prevents 
obtaining written consent, such consent may be pro-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
vided orally with subsequent documentation of such 
consent; 
(3) shall be considered the commercial, finan-
cial, or proprietary information of the entity pro-
viding such information to the Federal Government 
and any disclosure outside the Federal Government 
may only be made upon the prior written consent by 
such entity and shall not constitute a waiver of any 
applicable privilege or protection provided by law, 
except that if the need for immediate disclosure pre-
vents obtaining written consent, such consent may 
be provided orally with subsequent documentation of 
such consent; 
(4) shall be deemed voluntarily shared informa-
tion and exempt from disclosure under section 552 
of title 5, United States Code, and any State, tribal, 
or local law requiring disclosure of information or 
records; 
(5) shall be, without discretion, withheld from 
the public under section 552(b)(3)(B) of title 5, 
United States Code, and any State, tribal, or local 
law requiring disclosure of information or records; 
(6) shall not be subject to the rules of any Fed-
eral agency or department or any judicial doctrine 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
regarding ex parte communications with a decision-
making official; 
(7) shall not, if subsequently provided to a 
State, tribal, or local government or government 
agency, otherwise be disclosed or distributed to any 
entity by such State, tribal, or local government or 
government agency without the prior written consent 
of the entity submitting such information, notwith-
standing any State, tribal, or local law requiring dis-
closure of information or records, except that if the 
need for immediate disclosure prevents obtaining 
written consent, such consent may be provided orally 
with subsequent documentation of such consent; and 
(8) shall not be directly used by any Federal, 
State, tribal, or local department or agency to regu-
late the lawful activities of an entity, including ac-
tivities relating to obtaining, identifying, or other-
wise possessing cyber threat information, except that 
the procedures required to be developed and imple-
mented under this title shall not be considered regu-
lations within the meaning of this paragraph. 
(d) PROCEDURES RELATING TO INFORMATION SHAR-
ING WITH A CYBERSECURITY CENTER.—Not later than 
60 days after the date of enactment of this Act, the heads 
of each department or agency containing a cybersecurity 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
center shall jointly develop, promulgate, and submit to 
Congress procedures to ensure that cyber threat informa-
tion shared with or provided to— 
(1) a cybersecurity center under this section— 
(A) may be submitted to a cybersecurity 
center by an entity, to the greatest extent pos-
sible, through a uniform, publicly available 
process or format that is easily accessible on 
the Web site of such cybersecurity center, and 
that includes the ability to provide relevant de-
tails about the cyber threat information and 
written consent to any subsequent disclosures 
authorized by this paragraph; 
(B) shall immediately be further shared 
with each cybersecurity center in order to pre-
vent, investigate, or otherwise mitigate threats 
to information security across the Federal Gov-
ernment; 
(C) is handled by the Federal Government 
in a reasonable manner, including consideration 
of the need to protect the privacy and civil lib-
erties of individuals through anonymization or 
other appropriate methods, while fully accom-
plishing the objectives of this title; and 
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(D) except as provided in this section, shall 
only be used, disclosed, or handled in accord-
ance with the provisions of subsection (c); and 
(2) a Federal agency or department under sub-
section (b) is provided immediately to a cybersecu-
rity center in order to prevent, investigate, or other-
wise mitigate threats to information security across 
the Federal Government. 
(e) INFORMATION SHARED BETWEEN PRIVATE EN-
TITIES.— 
(1) IN
GENERAL.—A private entity sharing 
cyber threat information with another private entity 
under this title may restrict the use or sharing of 
such information by such other private entity. 
(2) FURTHER SHARING.—Cyber threat informa-
tion shared by any private entity with another pri-
vate entity under this title— 
(A) shall only be further shared in accord-
ance with any restrictions placed on the sharing 
of such information by the private entity au-
thorizing such sharing, such as appropriate 
anonymization of such information; and 
(B) may not be used by any private entity 
to gain an unfair competitive advantage to the 
detriment of the private entity authorizing the 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
sharing of such information, except that the 
conduct described in paragraph (3) shall not 
constitute unfair competitive conduct. 
(3) ANTITRUST EXEMPTION.—The exchange or 
provision of cyber threat information or assistance 
between 2 or more private entities under this title 
shall not be considered a violation of any provision 
of antitrust laws if exchanged or provided in order 
to assist with— 
(A) facilitating the prevention, investiga-
tion, or mitigation of threats to information se-
curity; or 
(B) communicating or disclosing of cyber 
threat information to help prevent, investigate 
or otherwise mitigate the effects of a threat to 
information security. 
(f) FEDERAL PREEMPTION.— 
(1) IN GENERAL.—This section supersedes any 
statute or other law of a State or political subdivi-
sion of a State that restricts or otherwise expressly 
regulates an activity authorized under this section. 
(2) STATE
LAW
ENFORCEMENT.—Nothing in 
this section shall be construed to supercede any stat-
ute or other law of a State or political subdivision 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(B) ENTITIES.—No cause of action shall 
lie or be maintained in any court against any 
entity for— 
(i) the use, receipt, or disclosure of 
any cyber threat information as authorized 
by this title; or 
(ii) the subsequent actions or inac-
tions of any lawful recipient of cyber threat 
information provided by such entity. 
(2) CONSTRUCTION.—Nothing in this sub-
section shall be construed as creating any immunity 
against, or otherwise affecting, any action brought 
by the Federal Government, or any agency or de-
partment thereof, to enforce any law, executive 
order, or procedure governing the appropriate han-
dling, disclosure, and use of classified information. 
(h) OTHERWISE LAWFUL DISCLOSURES.—Nothing 
in this section shall be construed to limit or prohibit other-
wise lawful disclosures of communications, records, or 
other information by a private entity to any other govern-
mental or private entity not covered under this section. 
(i) WHISTLEBLOWER PROTECTION.—Nothing in this 
Act shall be construed to preempt or preclude any em-
ployee from exercising rights currently provided under any 
whistleblower law, rule, or regulation. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
SEC. 103. INFORMATION SHARING BY THE FEDERAL GOV-
ERNMENT. 
(a) CLASSIFIED INFORMATION.— 
(1) PROCEDURES.—Consistent with the protec-
tion of intelligence sources and methods, and as oth-
erwise determined appropriate, the Director of Na-
tional Intelligence and the Secretary of Defense 
shall, in consultation with the heads of the appro-
priate Federal departments or agencies, develop and 
promulgate procedures to facilitate and promote— 
(A) the immediate sharing, through the cy-
bersecurity centers, of classified cyber threat in-
formation in the possession of the Federal Gov-
ernment with appropriately cleared representa-
tives of any appropriate entity; and 
(B) the declassification and immediate 
sharing, through the cybersecurity centers, with 
any entity or, if appropriate, public availability 
of cyber threat information in the possession of 
the Federal Government. 
(2) HANDLING OF CLASSIFIED INFORMATION.— 
The procedures developed under paragraph (1) shall 
ensure that each entity receiving classified cyber 
threat information pursuant to this section has ac-
knowledged in writing the ongoing obligation to com-
ply with all laws, executive orders, and procedures 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
concerning the appropriate handling, disclosure, or 
use of classified information. 
(b) UNCLASSIFIED CYBER THREAT INFORMATION.— 
The head of each department or agency containing a cy-
bersecurity center shall jointly develop and promulgate 
procedures that ensure that, consistent with the provisions 
of this section, unclassified cyber threat information, in-
cluding sensitive but unclassified cyber information, in the 
possession of the Federal Government— 
(1) is shared in an immediate and adequate 
manner with appropriate entities; and 
(2) if appropriate, is made publicly available. 
(c) DEVELOPMENT OF PROCEDURES.— 
(1) EXISTING PROCESSES.—The procedures de-
veloped under this section shall, to the greatest ex-
tent possible, incorporate existing processes utilized 
by sector-specific information sharing and analysis 
centers. 
(2) COORDINATION WITH ENTITIES.—In devel-
oping the procedures required under this section, the 
Director of National Intelligence and the head of 
each department or agency containing a cybersecu-
rity center shall coordinate with appropriate entities 
to ensure that protocols are implemented that will 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
facilitate and promote the sharing of cyber threat in-
formation by the Federal Government. 
(d) SUBMISSION TO CONGRESS.—Not later than 60 
days after the date of enactment of this Act, the Director 
of National Intelligence, in coordination with the appro-
priate head of a department or an agency containing a 
cybersecurity center, shall submit the procedures required 
by this section to Congress. 
SEC. 104. REPORT ON IMPLEMENTATION. 
(a) CONTENT OF REPORT.—Not later than 1 year 
after the date of enactment of this Act, and biennially 
thereafter, the heads of each department or agency con-
taining a cybersecurity center shall jointly submit, in co-
ordination with the privacy and civil liberties officials of 
such departments or agencies and the Privacy and Civil 
Liberties Oversight Board, a detailed report to Congress 
concerning the implementation of this title, including— 
(1) an assessment of the sufficiency of the pro-
cedures developed under section 103 of this Act in 
ensuring that cyber threat information in the posses-
sion of the Federal Government is provided in an 
immediate and adequate manner to appropriate enti-
ties or, if appropriate, is made publicly available; 
(2) an assessment of whether information has 
been appropriately classified and an accounting of 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
the number of security clearances authorized by the 
Federal Government for purposes of this title; 
(3) a review of the type of cyber threat infor-
mation shared with a cybersecurity center under sec-
tion 102 of this Act, including whether such infor-
mation meets the definition of cyber threat informa-
tion under section 101, the degree to which such in-
formation may impact the privacy and civil liberties 
of individuals, and the adequacy of any steps taken 
to reduce such impact; 
(4) a review of actions taken by the Federal 
Government based on information provided to a cy-
bersecurity center under section 102 of this Act, in-
cluding the appropriateness of any subsequent use 
under section 102(c)(1)(A) of this Act; 
(5) a description of any violations of the re-
quirements of this title by the Federal Government; 
(6) with respect to an entity providing elec-
tronic communication services, remote computing 
service, or cybersecurity services to a Federal agency 
or department, a description of any violations of the 
requirements of subsection (b) or (c) of section 102 
of this Act related to the performance of such serv-
ices; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(7) a classified list of entities that received clas-
sified information from the Federal Government 
under section 103 of this Act and a description of 
any indication that such information may not have 
been appropriately handled; 
(8) a summary of any breach of information se-
curity, if known, attributable to a specific failure by 
the Federal Government to act on cyber threat infor-
mation in the possession of the Federal Government 
that resulted in substantial economic harm or injury 
to a specific entity or the Federal Government; and 
(9) any recommendation for improvements or 
modifications to the authorities under this title. 
(b) FORM OF REPORT.—The report under subsection 
(a) shall be submitted in unclassified form, but shall in-
clude a classified annex. 
SEC. 105. INSPECTOR GENERAL REVIEW. 
(a) IN GENERAL.—The Council of the Inspectors 
General on Integrity and Efficiency may review compli-
ance by the cybersecurity centers, and by any Federal de-
partment or agency receiving cyber threat information 
from such cybersecurity centers, with the procedures re-
quired under section 102. 
(b) CONSIDERATIONS.—Each review described in 
subsection (a) shall consider whether the Federal Govern-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
ment has handled such cyber threat information in a rea-
sonable manner, including consideration of the need to 
protect the privacy and civil liberties of individuals 
through anonymization or other appropriate methods, 
while fully accomplishing the objectives of this title. 
(c) SUBMISSION TO CONGRESS.—The Council shall 
provide the results of any review conducted under this sec-
tion to Congress no later than 30 days after the date of 
completion of the review. 
SEC. 106. TECHNICAL AMENDMENTS. 
Section 552(b) of title 5, United States Code, is 
amended— 
(1) in paragraph (8), by striking ‘‘or’’; 
(2) in paragraph (9), by striking ‘‘wells.’’ and 
inserting ‘‘wells; or’’; and 
(3) by adding at the end the following: 
‘‘(10) information shared with or provided to a 
cybersecurity center under section 102 of title I of 
the Strengthening and Enhancing Cybersecurity by 
Using Research, Education, Information, and Tech-
nology Act of 2012.’’. 
SEC. 107. ACCESS TO CLASSIFIED INFORMATION. 
(a) AUTHORIZATION REQUIRED.—No person shall be 
provided with access to classified information (as defined 
in section 6.1 of Executive Order 13526 (50 U.S.C. 435 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
note; relating to classified national security information)) 
relating to cyber security threats or cyber security 
vulnerabilities under this title without the appropriate se-
curity clearances. 
(b) SECURITY CLEARANCES.—The appropriate Fed-
eral agencies or departments shall, consistent with appli-
cable procedures and requirements, and if otherwise 
deemed appropriate, assist an individual in timely obtain-
ing an appropriate security clearance where such indi-
vidual has been determined to be eligible for such clear-
ance and has a need-to-know (as defined in section 6.1 
of that Executive Order) classified information to carry 
out this title. 
TITLE 
II—COORDINATION 
OF 
FEDERAL INFORMATION SE-
CURITY POLICY 
SEC. 201. COORDINATION OF FEDERAL INFORMATION SE-
CURITY POLICY. 
(a) IN GENERAL.—Chapter 35 of title 44, United 
States Code, is amended by striking subchapters II and 
III and inserting the following: 
‘‘SUBCHAPTER II—INFORMATION SECURITY 
‘‘§ 3551. Purposes 
‘‘The purposes of this subchapter are— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(1) to provide a comprehensive framework for 
ensuring the effectiveness of information security 
controls over information resources that support 
Federal operations and assets; 
‘‘(2) to recognize the highly networked nature 
of the current Federal computing environment and 
provide effective government-wide management of 
policies, directives, standards, and guidelines, as well 
as effective and nimble oversight of and response to 
information security risks, including coordination of 
information security efforts throughout the Federal 
civilian, national security, and law enforcement com-
munities; 
‘‘(3) to provide for development and mainte-
nance of controls required to protect agency infor-
mation and information systems and contribute to 
the overall improvement of agency information secu-
rity posture; 
‘‘(4) to provide for the development of tools and 
methods to assess and respond to real-time situa-
tional risk for Federal information system operations 
and assets; and 
‘‘(5) to provide a mechanism for improving 
agency information security programs through con-
tinuous monitoring of agency information systems 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
and streamlined reporting requirements rather than 
overly prescriptive manual reporting. 
‘‘§ 3552. Definitions 
‘‘In this subchapter: 
‘‘(1) ADEQUATE
SECURITY.—The term ‘ade-
quate security’ means security commensurate with 
the risk and magnitude of the harm resulting from 
the unauthorized access to or loss, misuse, destruc-
tion, or modification of information. 
‘‘(2) AGENCY.—The term ‘agency’ has the 
meaning given the term in section 3502 of title 44. 
‘‘(3) CYBERSECURITY CENTER.—The term ‘cy-
bersecurity center’ means the Department of De-
fense Cyber Crime Center, the Intelligence Commu-
nity Incident Response Center, the United States 
Cyber Command Joint Operations Center, the Na-
tional Cyber Investigative Joint Task Force, the Na-
tional Security Agency/Central Security Service 
Threat Operations Center, the National Cybersecu-
rity and Communications Integration Center, and 
any successor center. 
‘‘(4) CYBER THREAT INFORMATION.—The term 
‘cyber threat information’ means information that 
may be indicative of or describes— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(A) a technical or operation vulnerability 
or a cyber threat mitigation measure; 
‘‘(B) an action or operation to mitigate a 
cyber threat; 
‘‘(C) malicious reconnaissance, including 
anomalous patterns of network activity that ap-
pear to be transmitted for the purpose of gath-
ering technical information related to a cyberse-
curity threat; 
‘‘(D) a method of defeating a technical 
control; 
‘‘(E) a method of defeating an operational 
control; 
‘‘(F) network activity or protocols known 
to be associated with a malicious cyber actor or 
that may signify malicious intent; 
‘‘(G) a method of causing a user with le-
gitimate access to an information system or in-
formation that is stored on, processed by, or 
transiting an information system to inadvert-
ently enable the defeat of a technical or oper-
ational control; 
‘‘(H) any other attribute of a cybersecurity 
threat or information that would foster situa-
tional awareness of the United States security 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
posture, if disclosure of such attribute or infor-
mation is not otherwise prohibited by law; 
‘‘(I) the actual or potential harm caused by 
a 
cyber 
incident, 
including 
information 
exfiltrated when it is necessary in order to iden-
tify or describe a cybersecurity threat; or 
‘‘(J) any combination thereof. 
‘‘(5) DIRECTOR.—The term ‘Director’ means 
the Director of the Office of Management and Budg-
et unless otherwise specified. 
‘‘(6) ENVIRONMENT OF OPERATION.—The term 
‘environment of operation’ means the information 
system and environment in which those systems op-
erate, including changing threats, vulnerabilities, 
technologies, and missions and business practices. 
‘‘(7) FEDERAL
INFORMATION
SYSTEM.—The 
term ‘Federal information system’ means an infor-
mation system used or operated by an executive 
agency, by a contractor of an executive agency, or by 
another organization on behalf of an executive agen-
cy. 
‘‘(8) INCIDENT.—The term ‘incident’ means an 
occurrence that— 
‘‘(A) actually or imminently jeopardizes 
the integrity, confidentiality, or availability of 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
an information system or the information that 
system controls, processes, stores, or transmits; 
or 
‘‘(B) constitutes a violation of law or an 
imminent threat of violation of a law, a security 
policy, a security procedure, or an acceptable 
use policy. 
‘‘(9) INFORMATION RESOURCES.—The term ‘in-
formation resources’ has the meaning given the term 
in section 3502 of title 44. 
‘‘(10) INFORMATION SECURITY.—The term ‘in-
formation security’ means protecting information 
and information systems from disruption or unau-
thorized access, use, disclosure, modification, or de-
struction in order to provide— 
‘‘(A) integrity, by guarding against im-
proper information modification or destruction, 
including by ensuring information nonrepudi-
ation and authenticity; 
‘‘(B) confidentiality, by preserving author-
ized restrictions on access and disclosure, in-
cluding means for protecting personal privacy 
and proprietary information; or 
‘‘(C) availability, by ensuring timely and 
reliable access to and use of information. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(11) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given the term in 
section 3502 of title 44. 
‘‘(12) INFORMATION TECHNOLOGY.—The term 
‘information technology’ has the meaning given the 
term in section 11101 of title 40. 
‘‘(13) MALICIOUS RECONNAISSANCE.—The term 
‘malicious reconnaissance’ means a method for ac-
tively probing or passively monitoring an information 
system for the purpose of discerning technical 
vulnerabilities of the information system, if such 
method is associated with a known or suspected cy-
bersecurity threat. 
‘‘(14) NATIONAL SECURITY SYSTEM.— 
‘‘(A) IN GENERAL.—The term ‘national se-
curity system’ means any information system 
(including any telecommunications system) used 
or operated by an agency or by a contractor of 
an agency, or other organization on behalf of an 
agency— 
‘‘(i) the function, operation, or use of 
which— 
‘‘(I) involves intelligence activi-
ties; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(II) involves cryptologic activi-
ties related to national security; 
‘‘(III) involves command and 
control of military forces; 
‘‘(IV) involves equipment that is 
an integral part of a weapon or weap-
ons system; or 
‘‘(V) subject to subparagraph 
(B), is critical to the direct fulfillment 
of military or intelligence missions; or 
‘‘(ii) is protected at all times by proce-
dures established for information that have 
been specifically authorized under criteria 
established by an Executive Order or an 
Act of Congress to be kept classified in the 
interest of national defense or foreign pol-
icy. 
‘‘(B) 
LIMITATION.—Subparagraph 
(A)(i)(V) does not include a system that is to 
be used for routine administrative and business 
applications (including payroll, finance, logis-
tics, and personnel management applications). 
‘‘(15) 
OPERATIONAL
CONTROL.—The 
term 
‘operational control’ means a security control for an 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
information system that primarily is implemented 
and executed by people. 
‘‘(16) PERSON.—The term ‘person’ has the 
meaning given the term in section 3502 of title 44. 
‘‘(17) 
SECRETARY.—The 
term 
‘Secretary’ 
means the Secretary of Commerce unless otherwise 
specified. 
‘‘(18) SECURITY CONTROL.—The term ‘security 
control’ means the management, operational, and 
technical controls, including safeguards or counter-
measures, prescribed for an information system to 
protect the confidentiality, integrity, and availability 
of the system and its information. 
‘‘(19) TECHNICAL CONTROL.—The term ‘tech-
nical control’ means a hardware or software restric-
tion on, or audit of, access or use of an information 
system or information that is stored on, processed 
by, or transiting an information system that is in-
tended to ensure the confidentiality, integrity, or 
availability of that system. 
‘‘§ 3553. Federal information security authority and 
coordination 
‘‘(a) IN GENERAL.—The Secretary, in consultation 
with the Secretary of Homeland Security, shall— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(1) issue compulsory and binding policies and 
directives governing agency information security op-
erations, and require implementation of such policies 
and directives, including— 
‘‘(A) policies and directives consistent with 
the standards and guidelines promulgated 
under section 11331 of title 40 to identify and 
provide 
information 
security 
protections 
prioritized and commensurate with the risk and 
impact resulting from the unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of— 
‘‘(i) information collected or main-
tained by or on behalf of an agency; or 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
an agency or other organization on behalf 
of an agency; 
‘‘(B) minimum operational requirements 
for Federal Government to protect agency in-
formation systems and provide common situa-
tional awareness across all agency information 
systems; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(C) reporting requirements, consistent 
with relevant law, regarding information secu-
rity incidents and cyber threat information; 
‘‘(D) requirements for agencywide informa-
tion security programs; 
‘‘(E) 
performance 
requirements 
and 
metrics for the security of agency information 
systems; 
‘‘(F) training requirements to ensure that 
agencies are able to fully and timely comply 
with the policies and directives issued by the 
Secretary under this subchapter; 
‘‘(G) training requirements regarding pri-
vacy, civil rights, and civil liberties, and infor-
mation oversight for agency information secu-
rity personnel; 
‘‘(H) requirements for the annual reports 
to the Secretary under section 3554(d); 
‘‘(I) any other information security oper-
ations or information security requirements as 
determined by the Secretary in coordination 
with relevant agency heads; and 
‘‘(J) coordinating the development of 
standards and guidelines under section 20 of 
the National Institute of Standards and Tech-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
nology Act (15 U.S.C. 278g–3) with agencies 
and offices operating or exercising control of 
national security systems (including the Na-
tional Security Agency) to assure, to the max-
imum extent feasible, that such standards and 
guidelines are complementary with standards 
and guidelines developed for national security 
systems; 
‘‘(2) review the agencywide information security 
programs under section 3554; and 
‘‘(3) designate an individual or an entity at 
each cybersecurity center, among other responsibil-
ities— 
‘‘(A) to receive reports and information 
about information security incidents, cyber 
threat information, and deterioration of security 
control affecting agency information systems; 
and 
‘‘(B) to act on or share the information 
under subparagraph (A) in accordance with this 
subchapter. 
‘‘(b) CONSIDERATIONS.—When issuing policies and 
directives under subsection (a), the Secretary shall con-
sider any applicable standards or guidelines developed by 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
the National Institute of Standards and Technology under 
section 11331 of title 40. 
‘‘(c) LIMITATION OF AUTHORITY.—The authorities 
of the Secretary under this section shall not apply to na-
tional security systems. Information security policies, di-
rectives, standards and guidelines for national security 
systems shall be overseen as directed by the President and, 
in accordance with that direction, carried out under the 
authority of the heads of agencies that operate or exercise 
authority over such national security systems. 
‘‘(d) STATUTORY CONSTRUCTION.—Nothing in this 
subchapter shall be construed to alter or amend any law 
regarding the authority of any head of an agency over 
such agency. 
‘‘§ 3554. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) complying with the policies and direc-
tives issued under section 3553; 
‘‘(B) providing information security protec-
tions commensurate with the risk resulting 
from unauthorized access, use, disclosure, dis-
ruption, modification, or destruction of— 
‘‘(i) information collected or main-
tained by the agency or by a contractor of 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
an agency or other organization on behalf 
of an agency; and 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
an agency or other organization on behalf 
of an agency; 
‘‘(C) complying with the requirements of 
this subchapter, including— 
‘‘(i) information security standards 
and guidelines promulgated under section 
11331 of title 40; 
‘‘(ii) for any national security systems 
operated or controlled by that agency, in-
formation 
security 
policies, 
directives, 
standards and guidelines issued as directed 
by the President; and 
‘‘(iii) for any non-national security 
systems operated or controlled by that 
agency, information security policies, direc-
tives, standards and guidelines issued 
under section 3553; 
‘‘(D) ensuring that information security 
management processes are integrated with 
agency strategic and operational planning proc-
esses; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00037
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(E) reporting and sharing, for an agency 
operating or exercising control of a national se-
curity system, information about information 
security incidents, cyber threat information, 
and deterioration of security controls to the in-
dividual or entity designated at each cybersecu-
rity center and to other appropriate entities 
consistent with policies and directives for na-
tional security systems issued as directed by the 
President; and 
‘‘(F) reporting and sharing, for those 
agencies operating or exercising control of non- 
national security systems, information about in-
formation security incidents, cyber threat infor-
mation, and deterioration of security controls to 
the individual or entity designated at each cy-
bersecurity center and to other appropriate en-
tities consistent with policies and directives for 
non-national security systems as prescribed 
under section 3553(a); including information to 
assist the Secretary of Homeland Security with 
carrying out the ongoing security analysis 
under section 3555; 
‘‘(2) ensure that each senior agency official pro-
vides information security for the information and 
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00038
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
information systems that support the operations and 
assets under the senior agency official’s control, in-
cluding by— 
‘‘(A) assessing the risk and impact that 
could result from the unauthorized access, use, 
disclosure, disruption, modification, or destruc-
tion of such information or information sys-
tems; 
‘‘(B) determining the level of information 
security appropriate to protect such information 
and information systems in accordance with 
policies and directives issued under section 
3553(a), and standards and guidelines promul-
gated under section 11331 of title 40 for infor-
mation security classifications and related re-
quirements; 
‘‘(C) implementing policies, procedures, 
and capabilities to reduce risks to an acceptable 
level in a cost-effective manner; 
‘‘(D) actively monitoring the effective im-
plementation of information security controls 
and techniques; and 
‘‘(E) reporting information about informa-
tion security incidents, cyber threat informa-
tion, and deterioration of security controls in a 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
timely and adequate manner to the entity des-
ignated under section 3553(a)(3) in accordance 
with paragraph (1); 
‘‘(3) assess and maintain the resiliency of infor-
mation technology systems critical to agency mission 
and operations; 
‘‘(4) designate the agency Inspector General (or 
an independent entity selected in consultation with 
the Director and the Council of Inspectors General 
on Integrity and Efficiency if the agency does not 
have an Inspector General) to conduct the annual 
independent evaluation required under section 3556, 
and allow the agency Inspector General to contract 
with an independent entity to perform such evalua-
tion; 
‘‘(5) delegate to the Chief Information Officer 
or equivalent (or to a senior agency official who re-
ports to the Chief Information Officer or equiva-
lent)— 
‘‘(A) the authority and primary responsi-
bility to implement an agencywide information 
security program; and 
‘‘(B) the authority to provide information 
security for the information collected and main-
tained by the agency (or by a contractor, other 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
agency, or other source on behalf of the agency) 
and for the information systems that support 
the operations, assets, and mission of the agen-
cy (including any information system provided 
or managed by a contractor, other agency, or 
other source on behalf of the agency); 
‘‘(6) delegate to the appropriate agency official 
(who is responsible for a particular agency system or 
subsystem) the responsibility to ensure and enforce 
compliance with all requirements of the agency’s 
agencywide information security program in coordi-
nation with the Chief Information Officer or equiva-
lent (or the senior agency official who reports to the 
Chief Information Officer or equivalent) under para-
graph (5); 
‘‘(7) ensure that an agency has trained per-
sonnel who have obtained any necessary security 
clearances to permit them to assist the agency in 
complying with this subchapter; 
‘‘(8) ensure that the Chief Information Officer 
or equivalent (or the senior agency official who re-
ports to the Chief Information Officer or equivalent) 
under paragraph (5), in coordination with other sen-
ior agency officials, reports to the agency head on 
the effectiveness of the agencywide information secu-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
rity program, including the progress of any remedial 
actions; and 
‘‘(9) ensure that the Chief Information Officer 
or equivalent (or the senior agency official who re-
ports to the Chief Information Officer or equivalent) 
under paragraph (5) has the necessary qualifications 
to administer the functions described in this sub-
chapter and has information security duties as a pri-
mary duty of that official. 
‘‘(b) CHIEF INFORMATION OFFICERS.—Each Chief 
Information Officer or equivalent (or the senior agency of-
ficial who reports to the Chief Information Officer or 
equivalent) under subsection (a)(5) shall— 
‘‘(1) establish and maintain an enterprise secu-
rity operations capability that on a continuous 
basis— 
‘‘(A) detects, reports, contains, mitigates, 
and responds to information security incidents 
that impair adequate security of the agency’s 
information or information system in a timely 
manner and in accordance with the policies and 
directives under section 3553; and 
‘‘(B) reports any information security inci-
dent under subparagraph (A) to the entity des-
ignated under section 3555; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(2) develop, maintain, and oversee an agency-
wide information security program; 
‘‘(3) develop, maintain, and oversee information 
security policies, procedures, and control techniques 
to address applicable requirements, including re-
quirements under section 3553 of this title and sec-
tion 11331 of title 40; and 
‘‘(4) train and oversee the agency personnel 
who have significant responsibility for information 
security with respect to that responsibility. 
‘‘(c) AGENCYWIDE INFORMATION SECURITY PRO-
GRAMS.— 
‘‘(1) IN GENERAL.—Each agencywide informa-
tion security program under subsection (b)(2) shall 
include— 
‘‘(A) security engineering throughout the 
development and acquisition lifecycle; 
‘‘(B) security testing commensurate with 
risk and impact; 
‘‘(C) mitigation of deterioration of security 
controls commensurate with risk and impact; 
‘‘(D) risk-based continuous monitoring of 
the operational status and security of agency 
information systems to enable evaluation of the 
effectiveness of and compliance with informa-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
information security policies, procedures, and 
practices of the agency; and 
‘‘(G) a plan and procedures to ensure the 
continuity of operations for information systems 
that support the operations and assets of the 
agency. 
‘‘(2) RISK
MANAGEMENT
STRATEGIES.—Each 
agencywide information security program under sub-
section (b)(2) shall include the development and 
maintenance of a risk management strategy for in-
formation security. The risk management strategy 
shall include— 
‘‘(A) consideration of information security 
incidents, cyber threat information, and deterio-
ration of security controls; and 
‘‘(B) consideration of the consequences 
that could result from the unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of information and information sys-
tems that support the operations and assets of 
the agency, including any information system 
provided or managed by a contractor, other 
agency, or other source on behalf of the agency. 
‘‘(3) POLICIES AND PROCEDURES.—Each agen-
cywide information security program under sub-
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00045
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
section (b)(2) shall include policies and procedures 
that— 
‘‘(A) are based on the risk management 
strategy under paragraph (2); 
‘‘(B) reduce information security risks to 
an acceptable level in a cost-effective manner; 
‘‘(C) ensure that cost-effective and ade-
quate 
information 
security 
is 
addressed 
throughout the life cycle of each agency infor-
mation system; and 
‘‘(D) ensure compliance with— 
‘‘(i) this subchapter; and 
‘‘(ii) any other applicable require-
ments. 
‘‘(4) TRAINING REQUIREMENTS.—Each agency-
wide information security program under subsection 
(b)(2) shall include information security, privacy, 
civil rights, civil liberties, and information oversight 
training that meets any applicable requirements 
under section 3553. The training shall inform each 
information security personnel that has access to 
agency information systems (including contractors 
and other users of information systems that support 
the operations and assets of the agency) of— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(A) the information security risks associ-
ated with the information security personnel’s 
activities; and 
‘‘(B) the individual’s responsibility to com-
ply with the agency policies and procedures that 
reduce the risks under subparagraph (A). 
‘‘(d) ANNUAL REPORT.—Each agency shall submit a 
report annually to the Secretary of Homeland Security on 
its agencywide information security program and informa-
tion systems. 
‘‘§ 3555. Multiagency ongoing threat assessment 
‘‘(a) PURPOSE.—The purpose of this section is to 
provide a framework for each agency to provide to the des-
ignee of the Secretary of Homeland Security under sub-
section (b)— 
‘‘(1) timely and actionable cyber threat infor-
mation; and 
‘‘(2) information on the environment of oper-
ation of an agency information system. 
‘‘(b) DESIGNEE.—The Secretary of Homeland Secu-
rity shall designate an entity within the Department of 
Homeland Security— 
‘‘(1) to conduct ongoing security analysis con-
cerning agency information systems— 
‘‘(A) based on cyber threat information; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) based on agency information system 
and environment of operation changes, includ-
ing— 
‘‘(i) an ongoing evaluation of the in-
formation system security controls; and 
‘‘(ii) the security state, risk level, and 
environment of operation of an agency in-
formation system, including— 
‘‘(I) a change in risk level due to 
a new cyber threat; 
‘‘(II) a change resulting from a 
new technology; 
‘‘(III) a change resulting from 
the agency’s mission; and 
‘‘(IV) a change resulting from 
the business practice; and 
‘‘(C) using automated processes to the 
maximum extent possible— 
‘‘(i) to increase information system se-
curity; 
‘‘(ii) to reduce paper-based reporting 
requirements; and 
‘‘(iii) to maintain timely and action-
able knowledge of the state of the informa-
tion system security. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(2) STANDARDS.—The National Institute of 
Standards and Technology may promulgate stand-
ards, in coordination with the Secretary of Home-
land Security, to assist an agency with its duties 
under this section. 
‘‘(3) COMPLIANCE.—The head of each appro-
priate agency shall be responsible for ensuring com-
pliance with this section. The Secretary of Home-
land Security, in consultation with the head of each 
appropriate agency, shall— 
‘‘(A) monitor compliance under this sec-
tion; 
‘‘(B) develop a timeline for each agency— 
‘‘(i) to adopt any technology, system, 
or method that facilitates continuous moni-
toring of an agency information system; 
and 
‘‘(ii) to adopt any technology, system, 
or method that satisfies a requirement 
under this section. 
‘‘(4) LIMITATION
OF
AUTHORITY.—The au-
thorities of the Secretary of Homeland Security 
under this section shall not apply to national secu-
rity systems. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(5) REPORT.—Not later than 6 months after 
the date of enactment of the Strengthening and En-
hancing Cybersecurity by Using Research, Edu-
cation, Information, and Technology Act of 2012, 
the Secretary of Homeland Security shall report to 
Congress each agency’s status toward implementing 
this section. 
‘‘§ 3556. Independent evaluations 
‘‘(a) IN GENERAL.—The Council of Inspectors Gen-
eral on Integrity and Efficiency, in consultation with the 
Director and the Secretary of Homeland Security, the Sec-
retary of Commerce, and the Secretary of Defense, shall 
issue and maintain criteria for the timely, cost-effective, 
risk-based, and independent evaluation of each agencywide 
information security program (and practices) to determine 
the effectiveness of the agencywide information security 
program (and practices). The criteria shall include meas-
ures to assess any conflicts of interest in the performance 
of the evaluation and whether the agencywide information 
security program includes appropriate safeguards against 
disclosure of information where such disclosure may ad-
versely affect information security. 
‘‘(b) ANNUAL INDEPENDENT EVALUATIONS.—Each 
agency shall perform an annual independent evaluation of 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
its agencywide information security program (and prac-
tices) in accordance with the criteria under subsection (a). 
‘‘(c) DISTRIBUTION OF REPORTS.—Not later than 30 
days after receiving an independent evaluation under sub-
section (b), each agency head shall transmit a copy of the 
independent evaluation to the Secretary of Homeland Se-
curity, the Secretary of Commerce, and the Secretary of 
Defense. 
‘‘(d) NATIONAL SECURITY SYSTEMS.—Evaluations 
involving national security systems shall be conducted as 
directed by President. 
‘‘§ 3557. National security systems. 
‘‘The head of each agency operating or exercising 
control of a national security system shall be responsible 
for ensuring that the agency— 
‘‘(1) provides information security protections 
commensurate with the risk and magnitude of the 
harm resulting from the unauthorized access, use, 
disclosure, disruption, modification, or destruction of 
the information contained in such system; and 
‘‘(2) implements information security policies 
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President.’’. 
(b) SAVINGS PROVISIONS.— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(1) POLICY AND COMPLIANCE GUIDANCE.—Pol-
icy and compliance guidance issued by the Director 
before the date of enactment of this Act under sec-
tion 3543(a)(1) of title 44, United States Code, (as 
in effect on the day before the date of enactment of 
this Act) shall continue in effect, according to its 
terms, until modified, terminated, superseded, or re-
pealed pursuant to section 3553(a)(1) of title 44, 
United States Code. 
(2) STANDARDS AND GUIDELINES.—Standards 
and guidelines issued by the Secretary of Commerce 
or by the Director before the date of enactment of 
this Act under section 11331(a)(1) of title 40, 
United States Code, (as in effect on the day before 
the date of enactment of this Act) shall continue in 
effect, according to their terms, until modified, ter-
minated, superseded, or repealed pursuant to section 
11331(a)(1) of title 40, United States Code, as 
amended by this Act. 
(c) TECHNICAL AND CONFORMING AMENDMENTS.— 
(1) CHAPTER ANALYSIS.—The chapter analysis 
for chapter 35 of title 44, United States Code, is 
amended— 
(A) by striking the items relating to sec-
tions 3531 through 3538; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(B) by striking the items relating to sec-
tions 3541 through 3549; and 
(C) by inserting the following: 
‘‘3551. Purposes. 
‘‘3552. Definitions. 
‘‘3553. Federal information security authority and coordination. 
‘‘3554. Agency responsibilities. 
‘‘3555. Multiagency ongoing threat assessment. 
‘‘3556. Independent evaluations. 
‘‘3557. National security systems.’’. 
(2) OTHER REFERENCES.— 
(A) Section 1001(c)(1)(A) of the Home-
land Security Act of 2002 (6 U.S.C. 511(1)(A)) 
is amended by striking ‘‘section 3532(3)’’ and 
inserting ‘‘section 3552’’. 
(B) Section 2222(j)(5) of title 10, United 
States Code, is amended by striking ‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552’’. 
(C) Section 2223(c)(3) of title 10, United 
States Code, is amended, by striking ‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552’’. 
(D) Section 2315 of title 10, United States 
Code, 
is 
amended 
by 
striking 
‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552’’. 
(E) Section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 
278g–3) is amended— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(i) in subsection (a)(2), by striking 
‘‘section 3532(b)(2)’’ and inserting ‘‘sec-
tion 3552’’; 
(ii) in subsection (c)(3), by striking 
‘‘Director of the Office of Management and 
Budget’’ and inserting ‘‘Secretary of Com-
merce’’; 
(iii) in subsection (d)(1), by striking 
‘‘Director of the Office of Management and 
Budget’’ and inserting ‘‘Secretary of Com-
merce’’; 
(iv) in subsection (d)(8) by striking 
‘‘Director of the Office of Management and 
Budget’’ and inserting ‘‘Secretary of Com-
merce’’; 
(v) in subsection (d)(8), by striking 
‘‘submitted to the Director’’ and inserting 
‘‘submitted to the Secretary’’; 
(vi) in subsection (e)(2), by striking 
‘‘section 3532(1) of such title’’ and insert-
ing ‘‘section 3552 of title 44’’; and 
(vii) in subsection (e)(5), by striking 
‘‘section 3532(b)(2) of such title’’ and in-
serting ‘‘section 3552 of title 44’’. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(F) Section 8(d)(1) of the Cyber Security 
Research and Development Act (15 U.S.C. 
7406(d)(1)) is amended by striking ‘‘section 
3534(b)’’ and inserting ‘‘section 3554(b)(2)’’. 
SEC. 202. MANAGEMENT OF INFORMATION TECHNOLOGY. 
(a) IN GENERAL.—Section 11331 of title 40, United 
States Code, is amended to read as follows: 
‘‘§ 11331. Responsibilities for Federal information sys-
tems standards 
‘‘(a) STANDARDS AND GUIDELINES.— 
‘‘(1) AUTHORITY
TO
PRESCRIBE.—Except as 
provided under paragraph (2), the Secretary of 
Commerce shall prescribe standards and guidelines 
pertaining to Federal information systems— 
‘‘(A) in consultation with the Secretary of 
Homeland Security; and 
‘‘(B) on the basis of standards and guide-
lines developed by the National Institute of 
Standards and Technology under paragraphs 
(2) and (3) of section 20(a) of the National In-
stitute of Standards and Technology Act (15 
U.S.C. 278g–3(a)(2) and (a)(3)). 
‘‘(2) NATIONAL
SECURITY
SYSTEMS.—Stand-
ards and guidelines for national security systems 
shall be developed, prescribed, enforced, and over-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
seen as otherwise authorized by law and as directed 
by the President. 
‘‘(b) MANDATORY STANDARDS AND GUIDELINES.— 
‘‘(1) AUTHORITY TO MAKE MANDATORY STAND-
ARDS
AND
GUIDELINES.—The Secretary of Com-
merce shall make standards and guidelines under 
subsection (a)(1) compulsory and binding to the ex-
tent determined necessary by the Secretary of Com-
merce to improve the efficiency of operation or secu-
rity of Federal information systems. 
‘‘(2) REQUIRED MANDATORY STANDARDS AND 
GUIDELINES.— 
‘‘(A) IN GENERAL.—Standards and guide-
lines under subsection (a)(1) shall include infor-
mation security standards that— 
‘‘(i) provide minimum information se-
curity requirements as determined under 
section 20(b) of the National Institute of 
Standards and Technology Act (15 U.S.C. 
278g–3(b)); and 
‘‘(ii) are otherwise necessary to im-
prove the security of Federal information 
and information systems. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) BINDING EFFECT.—Information se-
curity standards under subparagraph (A) shall 
be compulsory and binding. 
‘‘(c) EXERCISE OF AUTHORITY.—To ensure fiscal 
and policy consistency, the Secretary of Commerce shall 
exercise the authority conferred by this section subject to 
direction by the President and in coordination with the 
Director. 
‘‘(d) APPLICATION
OF MORE STRINGENT STAND-
ARDS AND GUIDELINES.—The head of an executive agen-
cy may employ standards for the cost-effective information 
security for information systems within or under the su-
pervision of that agency that are more stringent than the 
standards and guidelines the Secretary of Commerce pre-
scribes under this section if the more stringent standards 
and guidelines— 
‘‘(1) contain at least the applicable standards 
and guidelines made compulsory and binding by the 
Secretary of Commerce; and 
‘‘(2) are otherwise consistent with the policies, 
directives, and implementation memoranda issued 
under section 3553(a) of title 44. 
‘‘(e) DECISIONS ON PROMULGATION OF STANDARDS 
AND GUIDELINES.—The decision by the Secretary of 
Commerce regarding the promulgation of any standard or 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
guideline under this section shall occur not later than 6 
months after the date of submission of the proposed stand-
ard to the Secretary of Commerce by the National Insti-
tute of Standards and Technology under section 20 of the 
National Institute of Standards and Technology Act (15 
U.S.C. 278g–3). 
‘‘(f) NOTICE AND COMMENT.—A decision by the Sec-
retary of Commerce to significantly modify, or not promul-
gate, a proposed standard submitted to the Secretary by 
the National Institute of Standards and Technology under 
section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) shall be made after 
the public is given an opportunity to comment on the Sec-
retary’s proposed decision. 
‘‘(g) DEFINITIONS.—In this section: 
‘‘(1) FEDERAL
INFORMATION
SYSTEM.—The 
term ‘Federal information system’ has the meaning 
given the term in section 3552 of title 44. 
‘‘(2) INFORMATION SECURITY.—The term ‘in-
formation security’ has the meaning given the term 
in section 3552 of title 44. 
‘‘(3) NATIONAL SECURITY SYSTEM.—The term 
‘national security system’ has the meaning given the 
term in section 3552 of title 44.’’. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
SEC. 203. NO NEW FUNDING. 
An applicable Federal agency shall carry out the pro-
visions of this title with existing facilities and funds other-
wise available, through such means as the head of the 
agency considers appropriate. 
SEC. 204. TECHNICAL AND CONFORMING AMENDMENTS. 
Section 21(b) of the National Institute of Standards 
and Technology Act (15 U.S.C. 278g–4(b)) is amended— 
(1) in paragraph (2), by striking ‘‘and the Di-
rector of the Office of Management and Budget’’ 
and inserting ‘‘, the Secretary of Commerce, and the 
Secretary of Homeland Security’’; and 
(2) in paragraph (3), by inserting ‘‘, the Sec-
retary of Homeland Security,’’ after ‘‘the Secretary 
of Commerce’’. 
TITLE III—CRIMINAL PENALTIES 
SEC. 301. PENALTIES FOR FRAUD AND RELATED ACTIVITY 
IN CONNECTION WITH COMPUTERS. 
Section 1030(c) of title 18, United States Code, is 
amended to read as follows: 
‘‘(c) The punishment for an offense under subsection 
(a) or (b) of this section is— 
‘‘(1) a fine under this title or imprisonment for 
not more than 20 years, or both, in the case of an 
offense under subsection (a)(1) of this section; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(2)(A) except as provided in subparagraph 
(B), a fine under this title or imprisonment for not 
more than 3 years, or both, in the case of an offense 
under subsection (a)(2); or 
‘‘(B) a fine under this title or imprisonment for 
not more than ten years, or both, in the case of an 
offense under subsection (a)(2) of this section, if— 
‘‘(i) the offense was committed for pur-
poses of commercial advantage or private finan-
cial gain; 
‘‘(ii) the offense was committed in the fur-
therance of any criminal or tortuous act in vio-
lation of the Constitution or laws of the United 
States, or of any State; or 
‘‘(iii) the value of the information obtained, 
or that would have been obtained if the offense 
was completed, exceeds $5,000; 
‘‘(3) a fine under this title or imprisonment for 
not more than 10 years, or both, in the case of an 
offense under subsection (a)(3) of this section; 
‘‘(4) a fine under this title or imprisonment of 
not more than 20 years, or both, in the case of an 
offense under subsection (a)(4) of this section; 
‘‘(5)(A) except as provided in subparagraph 
(C), a fine under this title, imprisonment for not 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
more than 20 years, or both, in the case of an of-
fense under subsection (a)(5)(A) of this section, if 
the offense caused— 
‘‘(i) loss to 1 or more persons during any 
1-year period (and, for purposes of an inves-
tigation, 
prosecution, 
or 
other 
proceeding 
brought by the United States only, loss result-
ing from a related course of conduct affecting 
1 or more other protected computers) aggre-
gating at least $5,000 in value; 
‘‘(ii) the modification or impairment, or 
potential modification or impairment, of the 
medical examination, diagnosis, treatment, or 
care of 1 or more individuals; 
‘‘(iii) physical injury to any person; 
‘‘(iv) a threat to public health or safety; 
‘‘(v) damage affecting a computer used by, 
or on behalf of, an entity of the United States 
Government in furtherance of the administra-
tion of justice, national defense, or national se-
curity; or 
‘‘(vi) damage affecting 10 or more pro-
tected computers during any 1-year period; 
‘‘(B) a fine under this title, imprisonment for 
not more than 20 years, or both, in the case of an 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
offense under subsection (a)(5)(B), if the offense 
caused a harm provided in clause (i) through (vi) of 
subparagraph (A) of this subsection; 
‘‘(C) if the offender attempts to cause or know-
ingly or recklessly causes death from conduct in vio-
lation of subsection (a)(5)(A), a fine under this title, 
imprisonment for any term of years or for life, or 
both; 
‘‘(D) a fine under this title, imprisonment for 
not more than 10 years, or both, for any other of-
fense under subsection (a)(5); 
‘‘(E) a fine under this title or imprisonment for 
not more than 10 years, or both, in the case of an 
offense under subsection (a)(6) of this section; or 
‘‘(F) a fine under this title or imprisonment for 
not more than 10 years, or both, in the case of an 
offense under subsection (a)(7) of this section.’’. 
SEC. 302. TRAFFICKING IN PASSWORDS. 
Section 1030(a)(6) of title 18, United States Code, 
is amended to read as follows: 
‘‘(6) knowingly and with intent to defraud traf-
fics (as defined in section 1029) in any password or 
similar information or means of access through 
which a protected computer (as defined in subpara-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
graphs (A) and (B) of subsection (e)(2)) may be 
accessed without authorization.’’. 
SEC. 
303. 
CONSPIRACY 
AND 
ATTEMPTED 
COMPUTER 
FRAUD OFFENSES. 
Section 1030(b) of title 18, United States Code, is 
amended by inserting ‘‘as if for the completed offense’’ 
after ‘‘punished as provided’’. 
SEC. 304. CRIMINAL AND CIVIL FORFEITURE FOR FRAUD 
AND RELATED ACTIVITY IN CONNECTION 
WITH COMPUTERS. 
Section 1030 of title 18, United States Code, is 
amended by striking subsections (i) and (j) and inserting 
the following: 
‘‘(i) CRIMINAL FORFEITURE.— 
‘‘(1) The court, in imposing sentence on any 
person convicted of a violation of this section, or 
convicted of conspiracy to violate this section, shall 
order, in addition to any other sentence imposed and 
irrespective of any provision of State law, that such 
person forfeit to the United States— 
‘‘(A) such person’s interest in any prop-
erty, real or personal, that was used, or in-
tended to be used, to commit or facilitate the 
commission of such violation; and 
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) any property, real or personal, consti-
tuting or derived from any gross proceeds, or 
any property traceable to such property, that 
such person obtained, directly or indirectly, as 
a result of such violation. 
‘‘(2) The criminal forfeiture of property under 
this subsection, including any seizure and disposition 
of the property, and any related judicial or adminis-
trative proceeding, shall be governed by the provi-
sions of section 413 of the Comprehensive Drug 
Abuse Prevention and Control Act of 1970 (21 
U.S.C. 853), except subsection (d) of that section. 
‘‘(j) CIVIL FORFEITURE.— 
‘‘(1) The following shall be subject to forfeiture 
to the United States and no property right, real or 
personal, shall exist in them: 
‘‘(A) Any property, real or personal, that 
was used, or intended to be used, to commit or 
facilitate the commission of any violation of this 
section, or a conspiracy to violate this section. 
‘‘(B) Any property, real or personal, con-
stituting or derived from any gross proceeds ob-
tained directly or indirectly, or any property 
traceable to such property, as a result of the 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
commission of any violation of this section, or 
a conspiracy to violate this section. 
‘‘(2) Seizures and forfeitures under this sub-
section shall be governed by the provisions in chap-
ter 46 relating to civil forfeitures, except that such 
duties as are imposed on the Secretary of the Treas-
ury under the customs laws described in section 
981(d) shall be performed by such officers, agents 
and other persons as may be designated for that 
purpose by the Secretary of Homeland Security or 
the Attorney General.’’. 
SEC. 305. DAMAGE TO CRITICAL INFRASTRUCTURE COM-
PUTERS. 
(a) IN GENERAL.—Chapter 47 of title 18, United 
States Code, is amended by inserting after section 1030 
the following: 
‘‘§ 1030A. Aggravated damage to a critical infrastruc-
ture computer 
‘‘(a) DEFINITIONS.—In this section— 
‘‘(1) the term ‘computer’ has the meaning given 
the term in section 1030; 
‘‘(2) the term ‘critical infrastructure computer’ 
means a computer that manages or controls systems 
or assets vital to national defense, national security, 
national economic security, public health or safety, 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
or any combination of those matters, whether pub-
licly or privately owned or operated, including— 
‘‘(A) gas and oil production, storage, con-
version, and delivery systems; 
‘‘(B) water supply systems; 
‘‘(C) telecommunication networks; 
‘‘(D) electrical power generation and deliv-
ery systems; 
‘‘(E) finance and banking systems; 
‘‘(F) emergency services; 
‘‘(G) transportation systems and services; 
and 
‘‘(H) government operations that provide 
essential services to the public; and 
‘‘(3) the term ‘damage’ has the meaning given 
the term in section 1030. 
‘‘(b) OFFENSE.—It shall be unlawful, during and in 
relation to a felony violation of section 1030, to knowingly 
cause or attempt to cause damage to a critical infrastruc-
ture computer if the damage results in (or, in the case 
of an attempt, if completed, would have resulted in) the 
substantial impairment— 
‘‘(1) of the operation of the critical infrastruc-
ture computer; or 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(2) of the critical infrastructure associated 
with the computer. 
‘‘(c) PENALTY.—Any person who violates subsection 
(b) shall be— 
‘‘(1) fined under this title; 
‘‘(2) imprisoned for not less than 3 years but 
not more than 20 years; or 
‘‘(3) penalized under paragraphs (1) and (2). 
‘‘(d) CONSECUTIVE
SENTENCE.—Notwithstanding 
any other provision of law— 
‘‘(1) a court shall not place on probation any 
person convicted of a violation of this section; 
‘‘(2) except as provided in paragraph (4), no 
term of imprisonment imposed on a person under 
this section shall run concurrently with any other 
term of imprisonment, including any term of impris-
onment imposed on the person under any other pro-
vision of law, including any term of imprisonment 
imposed for a felony violation of section 1030; 
‘‘(3) in determining any term of imprisonment 
to be imposed for a felony violation of section 1030, 
a court shall not in any way reduce the term to be 
imposed for such crime so as to compensate for, or 
otherwise take into account, any separate term of 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
imprisonment imposed or to be imposed for a viola-
tion of this section; and 
‘‘(4) a term of imprisonment imposed on a per-
son for a violation of this section may, in the discre-
tion of the court, run concurrently, in whole or in 
part, only with another term of imprisonment that 
is imposed by the court at the same time on that 
person for an additional violation of this section, 
provided that such discretion shall be exercised in 
accordance with any applicable guidelines and policy 
statements issued by the United States Sentencing 
Commission pursuant to section 994 of title 28.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The chapter analysis for chapter 47 of title 18, United 
States Code, is amended by inserting after the item relat-
ing to section 1030 the following: 
‘‘1030A. Aggravated damage to a critical infrastructure computer.’’. 
SEC. 306. LIMITATION ON ACTIONS INVOLVING UNAUTHOR-
IZED USE. 
Section 1030(e)(6) of title 18, United States Code, 
is amended by striking ‘‘alter;’’ and inserting ‘‘alter, but 
does not include access in violation of a contractual obliga-
tion or agreement, such as an acceptable use policy or 
terms of service agreement, with an Internet service pro-
vider, Internet Web site, or non-government employer, if 
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
such violation constitutes the sole basis for determining 
that access to a protected computer is unauthorized;’’. 
TITLE IV—CYBERSECURITY 
RESEARCH AND DEVELOPMENT 
SEC. 401. NATIONAL HIGH-PERFORMANCE COMPUTING 
PROGRAM PLANNING AND COORDINATION. 
(a) GOALS AND PRIORITIES.—Section 101 of the 
High-Performance Computing Act of 1991 (15 U.S.C. 
5511) is amended by adding at the end the following: 
‘‘(d) GOALS AND PRIORITIES.—The goals and prior-
ities for Federal high-performance computing research, 
development, networking, and other activities under sub-
section (a)(2)(A) shall include— 
‘‘(1) encouraging and supporting mechanisms 
for interdisciplinary research and development in 
networking and information technology, including 
through collaborations— 
‘‘(A) across agencies; 
‘‘(B) across Program Component Areas; 
‘‘(C) with industry; 
‘‘(D) with institutions of higher education; 
‘‘(E) with Federal laboratories (as defined 
in section 4 of the Stevenson-Wydler Tech-
nology Innovation Act of 1980 (15 U.S.C. 
3703)); and 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(F) with international organizations; 
‘‘(2) addressing national, multi-agency, multi- 
faceted challenges of national importance; and 
‘‘(3) fostering the transfer of research and de-
velopment results into new technologies and applica-
tions for the benefit of society.’’. 
(b) DEVELOPMENT OF STRATEGIC PLAN.—Section 
101 of the High-Performance Computing Act of 1991 (15 
U.S.C. 5511) is further amended by adding at the end 
the following: 
‘‘(e) STRATEGIC PLAN.— 
‘‘(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of the Strengthening and En-
hancing Cybersecurity by Using Research, Edu-
cation, Information, and Technology Act of 2012, 
the agencies under subsection (a)(3)(B), working 
through the National Science and Technology Coun-
cil and with the assistance of the Office of Science 
and Technology Policy, shall develop a 5-year stra-
tegic plan to guide the activities under subsection 
(a)(1). 
‘‘(2) CONTENTS.—The strategic plan shall 
specify— 
‘‘(A) the near-term objectives for the Pro-
gram; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) the long-term objectives for the Pro-
gram; 
‘‘(C) the anticipated time frame for achiev-
ing the near-term objectives; 
‘‘(D) the metrics that will be used to as-
sess any progress made toward achieving the 
near-term objectives and the long-term objec-
tives; and 
‘‘(E) how the Program will achieve the 
goals and priorities under subsection (d). 
‘‘(3) RECOMMENDATIONS.—When developing 
the strategic plan under paragraph (1), such agen-
cies shall take into consideration the recommenda-
tions of— 
‘‘(A) the advisory committee under sub-
section (b); and 
‘‘(B) the stakeholders whose input was so-
licited by the National Coordination Office, as 
required under section 102(b)(3). 
‘‘(4) IMPLEMENTATION ROADMAP.—Such agen-
cies shall develop and annually update an implemen-
tation roadmap for the strategic plan, which shall— 
‘‘(A) specify the role of each Federal agen-
cy in carrying out or sponsoring research and 
development to meet the research objectives of 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
the strategic plan, including a description of 
how progress toward the research objectives will 
be evaluated, with consideration of any relevant 
recommendations of the advisory committee; 
‘‘(B) specify the funding allocated to each 
major research objective of the strategic plan 
and the source of funding by agency for the 
current fiscal year; and 
‘‘(C) estimate the funding required for 
each major research objective of the strategic 
plan for the next 3 fiscal years. 
‘‘(5) REPORT TO CONGRESS.—The Director of 
the National Coordination Office shall transmit the 
strategic plan under this subsection, including the 
implementation roadmap and any updates under 
paragraph (4), to— 
‘‘(A) the advisory committee under sub-
section (b); 
‘‘(B) 
the 
Committee 
on 
Commerce, 
Science, and Transportation of the Senate; and 
‘‘(C) the Committee on Science, Space, and 
Technology of the House of Representatives.’’. 
(c) PERIODIC REVIEWS.—Section 101 of the High- 
Performance Computing Act of 1991 (15 U.S.C. 5511) 
is further amended by adding at the end the following: 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(f) PERIODIC REVIEWS.—The agencies under sub-
section (a)(3)(B) shall— 
‘‘(1) periodically assess the contents and fund-
ing levels of the Program Component Areas and re-
structure the Program when warranted, taking into 
consideration any relevant recommendations of the 
advisory committee under subsection (b); and 
‘‘(2) ensure that the Program includes national, 
multi-agency, multi-faceted research and develop-
ment activities, including activities described in sec-
tion 104.’’. 
(d) ADDITIONAL RESPONSIBILITIES OF DIRECTOR.— 
Section 101(a)(2) of the High-Performance Computing 
Act of 1991 (15 U.S.C. 5511(a)(2)) is amended— 
(1) by redesignating subparagraphs (E) and 
(F) as subparagraphs (G) and (H), respectively; and 
(2) by inserting after subparagraph (D) the fol-
lowing: 
‘‘(E) encourage and monitor the efforts of the 
agencies participating in the Program to allocate the 
level of resources and management attention nec-
essary to ensure that— 
‘‘(i) the strategic plan under subsection (e) 
is developed and executed effectively; and 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(ii) the objectives of the Program are 
met; 
‘‘(F) working with the Office of Management 
and Budget, direct the Office of Science and Tech-
nology Policy and the agencies participating in the 
Program to establish a mechanism (consistent with 
existing law) to track all ongoing and completed re-
search and development projects and associated 
funding;’’. 
(e) ADVISORY COMMITTEE.—Section 101(b) of the 
High-Performance Computing Act of 1991 (15 U.S.C. 
5511(b)) is amended— 
(1) in paragraph (1)— 
(A) by inserting after the first sentence the 
following: ‘‘The co-chairs of the advisory com-
mittee shall meet the qualifications of com-
mittee members and may be members of the 
President’s Council of Advisors on Science and 
Technology.’’; and 
(B) by striking ‘‘high-performance’’ in sub-
paragraph (D) and inserting ‘‘high-end’’; and 
(2) by amending paragraph (2) to read as fol-
lows: 
‘‘(2) In addition to the duties under paragraph (1), 
the advisory committee shall conduct periodic evaluations 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
of the funding, management, coordination, implementa-
tion, and activities of the Program. The advisory com-
mittee shall report its findings and recommendations not 
less frequently than once every 3 fiscal years to the Com-
mittee on Commerce, Science, and Transportation of the 
Senate and the Committee on Science, Space, and Tech-
nology of the House of Representatives. The report shall 
be submitted in conjunction with the update of the stra-
tegic plan.’’. 
(f) REPORT.—Section 101(a)(3) of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5511(a)(3)) 
is amended— 
(1) in subparagraph (C)— 
(A) by striking ‘‘is submitted,’’ and insert-
ing ‘‘is submitted, the levels for the previous 
fiscal year,’’; and 
(B) by striking ‘‘each Program Component 
Area’’ and inserting ‘‘each Program Component 
Area and each research area supported in ac-
cordance with section 104’’; 
(2) in subparagraph (D)— 
(A) by striking ‘‘each Program Component 
Area,’’ and inserting ‘‘each Program Compo-
nent Area and each research area supported in 
accordance with section 104,’’; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(iii) the amount of funding provided for 
the Office of Science and Technology Policy for 
the current fiscal year by each agency partici-
pating in the Program; and’’. 
(g) DEFINITIONS.—Section 4 of the High-Perform-
ance Computing Act of 1991 (15 U.S.C. 5503) is amend-
ed— 
(1) by redesignating paragraphs (6) and (7) as 
paragraphs (7) and (8), respectively; 
(2) by redesignating paragraph (3) as para-
graph (6); 
(3) by redesignating paragraphs (1) and (2) as 
paragraphs (2) and (3), respectively; 
(4) by inserting before paragraph (2), as redes-
ignated, the following: 
‘‘(1) ‘cyber-physical systems’ means physical or 
engineered systems whose networking and informa-
tion technology functions and physical elements are 
deeply integrated and are actively connected to the 
physical world through sensors, actuators, or other 
means to perform monitoring and control func-
tions;’’; 
(5) in paragraph (3), as redesignated, by strik-
ing ‘‘high-performance computing’’ and inserting 
‘‘networking and information technology’’; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(6) in paragraph (6), as redesignated— 
(A) by striking ‘‘high-performance com-
puting’’ and inserting ‘‘networking and infor-
mation technology’’; and 
(B) by striking ‘‘supercomputer’’ and in-
serting ‘‘high-end computing’’; 
(7) in paragraph (5), by striking ‘‘network re-
ferred to as’’ and all that follows through ‘‘section 
102’’ and inserting ‘‘network, including advanced 
computer networks of Federal agencies and depart-
ments’’; and 
(8) in paragraph (7), as redesignated, by strik-
ing ‘‘National High-Performance Computing Pro-
gram’’ and inserting ‘‘networking and information 
technology research and development program’’. 
SEC. 402. RESEARCH IN AREAS OF NATIONAL IMPORTANCE. 
(a) RESEARCH
IN AREAS
OF NATIONAL IMPOR-
TANCE.—Title I of the High-Performance Computing Act 
of 1991 (15 U.S.C. 5511 et seq.) is amended by adding 
at the end the following: 
‘‘SEC. 104. RESEARCH IN AREAS OF NATIONAL IMPOR-
TANCE. 
‘‘(a) IN GENERAL.—The Program shall encourage 
agencies under section 101(a)(3)(B) to support, maintain, 
and improve national, multi-agency, multi-faceted, re-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
search and development activities in networking and infor-
mation technology directed toward application areas that 
have the potential for significant contributions to national 
economic competitiveness and for other significant societal 
benefits. 
‘‘(b) RECOMMENDATIONS.—The advisory committee 
under section 101(b) shall make recommendations to the 
Program for candidate research and development areas for 
support under this section. 
‘‘(c) CHARACTERISTICS.— 
‘‘(1) IN GENERAL.—Research and development 
activities under this section— 
‘‘(A) shall include projects selected on the 
basis of applications for support through a com-
petitive, merit-based process; 
‘‘(B) shall leverage, when possible, Federal 
investments through collaboration with related 
State initiatives; 
‘‘(C) shall include a plan for fostering the 
transfer of research discoveries and the results 
of technology demonstration activities, including 
from institutions of higher education and Fed-
eral laboratories, to industry for commercial de-
velopment; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(D) shall involve collaborations among re-
searchers in institutions of higher education 
and industry; and 
‘‘(E) may involve collaborations among 
nonprofit research institutions and Federal lab-
oratories, as appropriate. 
‘‘(2) COST-SHARING.—In selecting applications 
for support, the agencies under section 101(a)(3)(B) 
shall give special consideration to projects that in-
clude cost sharing from non-Federal sources. 
‘‘(3) AGENCY COLLABORATION.—If 2 or more 
agencies identified in section 101(a)(3)(B), or other 
appropriate agencies, are working on large-scale re-
search and development activities in the same area 
of national importance, then such agencies shall 
strive to collaborate through joint solicitation and se-
lection of applications for support and subsequent 
funding of projects. 
‘‘(4) 
MULTIDISCIPLINARY
RESEARCH
CEN-
TERS.—Research and development activities under 
this section shall be supported through multidisci-
plinary research centers, including Federal labora-
tories, that are organized to investigate basic re-
search questions and carry out technology dem-
onstration activities in areas described in subsection 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(a). Research may be carried out through existing 
multidisciplinary centers, including those authorized 
under section 7024(b)(2) of the America COM-
PETES Act (42 U.S.C. 1862o–10(2)).’’. 
(b) CYBER-PHYSICAL SYSTEMS.—Section 101(a)(1) 
of the High-Performance Computing Act of 1991 (15 
U.S.C. 5511(a)(1)) is amended— 
(1) in subparagraph (H), by striking ‘‘and’’ 
after the semicolon; 
(2) in subparagraph (I), by striking the period 
at the end and inserting a semicolon; and 
(3) by adding at the end the following: 
‘‘(J) provide for increased understanding of the 
scientific principles of cyber-physical systems and 
improve the methods available for the design, devel-
opment, and operation of cyber-physical systems 
that are characterized by high reliability, safety, and 
security; and 
‘‘(K) provide for research and development on 
human-computer interactions, visualization, and big 
data.’’. 
(c) TASK FORCE.—Title I of the High-Performance 
Computing Act of 1991 (15 U.S.C. 5511 et seq.) is further 
amended by adding at the end the following: 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘SEC. 105. CYBER-PHYSICAL SYSTEMS UNIVERSITY-INDUS-
TRY TASK FORCE. 
‘‘(a) ESTABLISHMENT.—Not later than 180 days 
after the date of enactment of the Strengthening and En-
hancing Cybersecurity by Using Research, Education, In-
formation, and Technology Act of 2012, the Director of 
the National Coordination Office under section 102 shall 
convene a task force to explore mechanisms for carrying 
out collaborative research and development activities for 
cyber-physical systems (including the related technologies 
required to enable these systems) through a consortium 
or other appropriate entity with participants from institu-
tions of higher education, Federal laboratories, and indus-
try. 
‘‘(b) FUNCTIONS.—The task force shall— 
‘‘(1) develop options for a collaborative model 
and an organizational structure for such entity 
under which the joint research and development ac-
tivities could be planned, managed, and conducted 
effectively, including mechanisms for the allocation 
of resources among the participants in such entity 
for support of such activities; 
‘‘(2) propose a process for developing a re-
search and development agenda for such entity, in-
cluding guidelines to ensure an appropriate scope of 
work focused on nationally significant challenges and 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
requiring collaboration and to ensure the develop-
ment of related scientific and technological mile-
stones; 
‘‘(3) define the roles and responsibilities for the 
participants from institutions of higher education, 
Federal laboratories, and industry in such entity; 
‘‘(4) propose guidelines for assigning intellec-
tual property rights and for transferring research re-
sults to the private sector; and 
‘‘(5) make recommendations for how such enti-
ty could be funded from Federal, State, and non- 
governmental sources. 
‘‘(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the National Coordi-
nation Office shall appoint an equal number of individuals 
from institutions of higher education and from industry 
with knowledge and expertise in cyber-physical systems, 
and may appoint not more than 2 individuals from Fed-
eral laboratories. 
‘‘(d) REPORT.—Not later than 1 year after the date 
of enactment of the Strengthening and Enhancing Cyber-
security by Using Research, Education, Information, and 
Technology Act of 2012, the Director of the National Co-
ordination Office shall transmit to the Committee on Com-
merce, Science, and Transportation of the Senate and the 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
Committee on Science, Space, and Technology of the 
House of Representatives a report describing the findings 
and recommendations of the task force. 
‘‘(e) TERMINATION.—The task force shall terminate 
upon transmittal of the report required under subsection 
(d). 
‘‘(f) COMPENSATION AND EXPENSES.—Members of 
the task force shall serve without compensation.’’. 
SEC. 403. PROGRAM IMPROVEMENTS. 
Section 102 of the High-Performance Computing Act 
of 1991 (15 U.S.C. 5512) is amended to read as follows: 
‘‘SEC. 102. NATIONAL COORDINATION OFFICE. 
‘‘(a) OFFICE.—The Director shall continue a Na-
tional Coordination Office with a Director and full-time 
staff. 
‘‘(b) FUNCTIONS.—The National Coordination Office 
shall— 
‘‘(1) provide technical and administrative sup-
port to— 
‘‘(A) the agencies participating in planning 
and implementing the Program, including such 
support as needed in the development of the 
strategic plan under section 101(e); and 
‘‘(B) the advisory committee established 
under section 101(b); 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(2) serve as the primary point of contact on 
Federal networking and information technology ac-
tivities for government organizations, academia, in-
dustry, professional societies, State computing and 
networking technology programs, interested citizen 
groups, and others to exchange technical and pro-
grammatic information; 
‘‘(3) solicit input and recommendations from a 
wide range of stakeholders during the development 
of each strategic plan required under section 101(e) 
through the convening of at least 1 workshop with 
invitees from academia, industry, Federal labora-
tories, and other relevant organizations and institu-
tions; 
‘‘(4) conduct public outreach, including the dis-
semination of findings and recommendations of the 
advisory committee, as appropriate; and 
‘‘(5) promote access to and early application of 
the technologies, innovations, and expertise derived 
from Program activities to agency missions and sys-
tems across the Federal Government and to United 
States industry. 
‘‘(c) SOURCE OF FUNDING.— 
‘‘(1) IN GENERAL.—The operation of the Na-
tional Coordination Office shall be supported by 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
funds from each agency participating in the Pro-
gram. 
‘‘(2) SPECIFICATIONS.—The portion of the total 
budget of such Office that is provided by each agen-
cy for each fiscal year shall be in the same propor-
tion as each such agency’s share of the total budget 
for the Program for the previous fiscal year, as spec-
ified 
in 
the 
report 
required 
under 
section 
101(a)(3).’’. 
SEC. 404. CLOUD COMPUTING SERVICES FOR RESEARCH. 
Title I of the High-Performance Computing Act of 
1991 (15 U.S.C. 5511) is further amended by adding at 
the end the following: 
‘‘SEC. 106. CLOUD COMPUTING SERVICES FOR RESEARCH. 
‘‘(a) INTERAGENCY WORKING GROUP.—Not later 
than 180 days after the date of enactment of the 
Strengthening and Enhancing Cybersecurity by Using Re-
search, Education, Information, and Technology Act of 
2012, the Director of the National Coordination Office, 
working through the National Science and Technology 
Council, shall convene an interagency working group to 
examine— 
‘‘(1) the research and development needed— 
‘‘(A) to enhance the effectiveness and effi-
ciency of cloud computing environments; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(B) to increase the trustworthiness of 
cloud applications and infrastructure; and 
‘‘(C) to enhance the foundations of cloud 
architectures, programming models, and inter-
operability; and 
‘‘(2) the potential use of cloud computing for 
federally funded science and engineering research, 
including issues around funding mechanisms and 
policies for the use of cloud computing services for 
such research. 
‘‘(b) CONSULTATION.—In carrying out the tasks in 
paragraphs (1) and (2) of subsection (a), the working 
group shall consult with academia, industry, Federal lab-
oratories, and other relevant organizations and institu-
tions, as appropriate. 
‘‘(c) REPORT.—Not later than 1 year after the date 
of enactment of the Strengthening and Enhancing Cyber-
security by Using Research, Education, Information, and 
Technology Act of 2012, the Director of the National Co-
ordination Office shall transmit to the Committee on 
Science, Space, and Technology of the House of Rep-
resentatives and the Committee on Commerce, Science, 
and Transportation of the Senate a report describing the 
findings and any recommendations of the working group. 
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
‘‘(d) TERMINATION.—The interagency working group 
shall terminate upon transmittal of the report required 
under subsection (c).’’. 
SEC. 405. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 
FORCE. 
(a) ESTABLISHMENT
OF
UNIVERSITY-INDUSTRY 
TASK FORCE.—Not later than 180 days after the date of 
enactment of this Act, the Director of the Office of Science 
and Technology Policy shall convene a task force to ex-
plore mechanisms for carrying out collaborative research, 
development, education, and training activities for cyber-
security through a consortium or other appropriate entity 
with participants from institutions of higher education and 
industry. 
(b) FUNCTIONS.—The task force shall— 
(1) develop options for a collaborative model 
and an organizational structure for such entity 
under which the joint research and development ac-
tivities could be planned, managed, and conducted 
effectively, including mechanisms for the allocation 
of resources among the participants in such entity 
for support of such activities; 
(2) propose a process for developing a research 
and development agenda for such entity, including 
guidelines to ensure an appropriate scope of work fo-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
cused on nationally significant challenges and requir-
ing collaboration; 
(3) define the roles and responsibilities for the 
participants from institutions of higher education 
and industry in such entity; 
(4) propose guidelines for assigning intellectual 
property rights, for the transfer of research and de-
velopment results to the private sector; and 
(5) make recommendations for how such entity 
could be funded from Federal, State, and nongovern-
mental sources. 
(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the Office of Science 
and Technology Policy shall appoint an equal number of 
individuals from institutions of higher education, including 
minority-serving institutions and community colleges, and 
from industry with knowledge and expertise in cybersecu-
rity. 
(d) REPORT.—Not later than 12 months after the 
date of enactment of this Act, the Director of the Office 
of Science and Technology Policy shall transmit to the 
Congress a report describing the findings and rec-
ommendations of the task force. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(e) TERMINATION.—The task force shall terminate 
upon transmittal of the report required under subsection 
(d). 
(f) COMPENSATION
AND EXPENSES.—Members of 
the task force shall serve without compensation. 
SEC. 406. IMPROVING EDUCATION OF NETWORKING AND 
INFORMATION 
TECHNOLOGY, 
INCLUDING 
HIGH-PERFORMANCE COMPUTING. 
Section 201(a) of the High-Performance Computing 
Act of 1991 (15 U.S.C. 5521(a)) is amended— 
(1) by redesignating paragraphs (2) through 
(4) as paragraphs (3) through (5), respectively; and 
(2) by inserting after paragraph (1) the fol-
lowing new paragraph: 
‘‘(2) the National Science Foundation shall use 
its existing programs, in collaboration with other 
agencies, as appropriate, to improve the teaching 
and learning of networking and information tech-
nology at all levels of education and to increase par-
ticipation in networking and information technology 
fields;’’. 
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
SEC. 407. CONFORMING AND TECHNICAL AMENDMENTS TO 
THE HIGH-PERFORMANCE COMPUTING ACT 
OF 1991. 
(a) SECTION 3.—Section 3 of the High-Performance 
Computing Act of 1991 (15 U.S.C. 5502) is amended— 
(1) in the matter preceding paragraph (1), by 
striking ‘‘high-performance computing’’ and insert-
ing ‘‘networking and information technology’’; 
(2) in paragraph (1)— 
(A) in the matter preceding subparagraph 
(A), by striking ‘‘high-performance computing’’ 
and inserting ‘‘networking and information 
technology’’; 
(B) in subparagraphs (A), (F), and (G), by 
striking ‘‘high-performance computing’’ each 
place it appears and inserting ‘‘networking and 
information technology’’; and 
(C) in subparagraph (H), by striking 
‘‘high-performance’’ and inserting ‘‘high-end’’; 
and 
(3) in paragraph (2)— 
(A) by striking ‘‘high-performance com-
puting and’’ and inserting ‘‘networking and in-
formation technology, and’’; and 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(B) by striking ‘‘high-performance com-
puting network’’ and inserting ‘‘networking and 
information technology’’. 
(b) TITLE HEADING.—The heading of title I of the 
High-Performance Computing Act of 1991 (105 Stat. 
1595) is amended by striking ‘‘HIGH-PERFORM-
ANCE 
COMPUTING’’ 
and 
inserting 
‘‘NET-
WORKING 
AND 
INFORMATION 
TECH-
NOLOGY’’. 
(c) SECTION 101.—Section 101 of the High-Perform-
ance Computing Act of 1991 (15 U.S.C. 5511) is amend-
ed— 
(1) in the section heading, by striking ‘‘HIGH- 
PERFORMANCE
COMPUTING’’ 
and 
inserting 
‘‘NETWORKING
AND
INFORMATION
TECH-
NOLOGY RESEARCH AND DEVELOPMENT’’; 
(2) in subsection (a)— 
(A) in the subsection heading, by striking 
‘‘NATIONAL HIGH-PERFORMANCE COMPUTING’’ 
and inserting ‘‘NETWORKING
AND INFORMA-
TION TECHNOLOGY RESEARCH AND DEVELOP-
MENT’’; 
(B) in paragraph (1)— 
(i) by striking ‘‘National High-Per-
formance Computing Program’’ and insert-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
ing ‘‘networking and information tech-
nology research and development pro-
gram’’; 
(ii) in subparagraph (A), by striking 
‘‘high-performance computing, including 
networking’’ and inserting ‘‘networking 
and information technology’’; 
(iii) in subparagraphs (B) and (G), by 
striking ‘‘high-performance’’ each place it 
appears and inserting ‘‘high-end’’; and 
(iv) in subparagraph (C), by striking 
‘‘high-performance computing and net-
working’’ and inserting ‘‘high-end com-
puting, distributed, and networking’’; and 
(C) in paragraph (2)— 
(i) in subparagraphs (A) and (C)— 
(I) by striking ‘‘high-performance 
computing’’ each place it appears and 
inserting ‘‘networking and information 
technology’’; and 
(II) by striking ‘‘development, 
networking,’’ each place it appears 
and inserting ‘‘development,’’; and 
(ii) in subparagraphs (G) and (H), as 
redesignated by section 401(d) of this Act, 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
by striking ‘‘high-performance’’ each place 
it appears and inserting ‘‘high-end’’; 
(3) in subsection (b)(1), in the matter pre-
ceding subparagraph (A), by striking ‘‘high-perform-
ance computing’’ each place it appears and inserting 
‘‘networking and information technology’’; and 
(4) in subsection (c)(1)(A), by striking ‘‘high- 
performance computing’’ and inserting ‘‘networking 
and information technology’’. 
(d) SECTION 201.—Section 201(a)(1) of the High- 
Performance Computing Act of 1991 (15 U.S.C. 
5521(a)(1)) is amended by striking ‘‘high-performance 
computing and advanced high-speed computer net-
working’’ and inserting ‘‘networking and information tech-
nology research and development’’. 
(e) SECTION 202.—Section 202(a) of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5522(a)) is 
amended by striking ‘‘high-performance computing’’ and 
inserting ‘‘networking and information technology’’. 
(f) SECTION 203.—Section 203(a) of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5523(a)) is 
amended— 
(1) in paragraph (1), by striking ‘‘high-per-
formance computing and networking’’ and inserting 
‘‘networking and information technology’’; and 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(2) in paragraph (2)(A), by striking ‘‘high-per-
formance’’ and inserting ‘‘high-end’’. 
(g) SECTION 204.—Section 204 of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5524) is 
amended— 
(1) in subsection (a)(1)— 
(A) in subparagraph (A), by striking 
‘‘high-performance computing systems and net-
works’’ and inserting ‘‘networking and informa-
tion technology systems and capabilities’’; 
(B) in subparagraph (B), by striking 
‘‘interoperability 
of 
high-performance 
com-
puting systems in networks and for common 
user interfaces to systems’’ and inserting 
‘‘interoperability and usability of networking 
and information technology systems’’; and 
(C) in subparagraph (C), by striking 
‘‘high-performance computing’’ and inserting 
‘‘networking and information technology’’; and 
(2) in subsection (b)— 
(A) 
by 
striking 
‘‘HIGH-PERFORMANCE 
COMPUTING
AND NETWORK’’ in the heading 
and inserting ‘‘NETWORKING
AND INFORMA-
TION TECHNOLOGY’’; and 
(B) by striking ‘‘sensitive’’. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(h) SECTION 205.—Section 205(a) of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5525(a)) is 
amended by striking ‘‘computational’’ and inserting ‘‘net-
working and information technology’’. 
(i) SECTION 206.—Section 206(a) of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5526(a)) is 
amended by striking ‘‘computational research’’ and insert-
ing ‘‘networking and information technology research’’. 
(j) SECTION 207.—Section 207 of the High-Perform-
ance Computing Act of 1991 (15 U.S.C. 5527) is amended 
by striking ‘‘high-performance computing’’ and inserting 
‘‘networking and information technology’’. 
(k) SECTION 208.—Section 208 of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5528) is 
amended— 
(1) in the section heading, by striking ‘‘HIGH- 
PERFORMANCE
COMPUTING’’ 
and 
inserting 
‘‘NETWORKING
AND
INFORMATION
TECH-
NOLOGY’’; and 
(2) in subsection (a)— 
(A) in paragraph (1), by striking ‘‘High- 
performance computing and associated’’ and in-
serting ‘‘Networking and information’’; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(B) in paragraph (2), by striking ‘‘high- 
performance computing’’ and inserting ‘‘net-
working and information technologies’’; 
(C) in paragraph (3), by striking ‘‘high- 
performance’’ and inserting ‘‘high-end’’; 
(D) in paragraph (4), by striking ‘‘high- 
performance computers and associated’’ and in-
serting ‘‘networking and information’’; and 
(E) in paragraph (5), by striking ‘‘high- 
performance computing and associated’’ and in-
serting ‘‘networking and information’’. 
SEC. 408. FEDERAL CYBER SCHOLARSHIP-FOR-SERVICE 
PROGRAM. 
(a) IN GENERAL.—The Director of the National 
Science Foundation shall continue a Federal Cyber Schol-
arship-for-Service program under section 5(a) of the 
Cyber Security Research and Development Act (15 U.S.C. 
7404(a)) to increase the capacity of the higher education 
system to produce an information technology workforce 
with the skills necessary to enhance the security of the 
Nation’s communications and information infrastructure 
and to recruit and train the next generation of information 
technology professionals and security managers to meet 
the needs of the cybersecurity mission for Federal, State, 
local, and tribal governments. 
VerDate Mar 15 2010 
22:49 Mar 28, 2012
Jkt 019200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(b) PROGRAM DESCRIPTION AND COMPONENTS.— 
The program shall— 
(1) provide, through qualified institutions of 
higher education, scholarships that provide tuition, 
fees, and a competitive stipend for up to 2 years to 
students pursuing a bachelor’s or master’s degree 
and up to 3 years to students pursuing a doctoral 
degree in a cybersecurity field; 
(2) provide the scholarship recipients with sum-
mer internship opportunities or other meaningful 
temporary appointments in the Federal information 
technology workforce; 
(3) increase the capacity of institutions of high-
er education throughout all regions of the United 
States to produce highly qualified cybersecurity pro-
fessionals, through the award of competitive, merit- 
reviewed grants that support such activities as— 
(A) faculty professional development, in-
cluding technical, hands-on experiences in the 
private sector or government, workshops, semi-
nars, conferences, and other professional devel-
opment opportunities that will result in im-
proved instructional capabilities; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
(B) institutional partnerships, including 
minority serving institutions and community 
colleges; and 
(C) development of cybersecurity-related 
courses and curricula; 
(4) provide a procedure for the hiring Federal 
agency, consistent with regulations of the Office of 
Personnel Management, to request and fund a secu-
rity clearance for a scholarship recipient, including 
providing for clearance during a summer internship 
and upon graduation; and 
(5) provide opportunities for students to receive 
temporary appointments for meaningful employment 
in the Federal information technology workforce 
during school vacation periods and for internships. 
(c) HIRING AUTHORITY.— 
(1) IN GENERAL.—For purposes of any law or 
regulation governing the appointment of an indi-
vidual in the Federal civil service, upon the success-
ful completion of the degree, a student receiving a 
scholarship under the program may— 
(A) be hired under section 213.3102(r) of 
title 5, Code of Federal Regulations; and 
(B) be exempt from competitive service. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
100 
(2) COMPETITIVE SERVICE.—Upon satisfactory 
fulfillment of the service term under paragraph (1), 
an individual may be converted to a competitive 
service position without competition if the individual 
meets the requirements for that position. 
(d) ELIGIBILITY.—A scholarship under this section 
shall be available only to a student who— 
(1) is a citizen or permanent resident of the 
United States; 
(2) is a full-time student in an eligible degree 
program, as determined by the Director, that is fo-
cused on computer security or information assurance 
at an awardee institution; 
(3) accepts the terms of a scholarship under 
this section; 
(4) maintains a GPA of 3.0 or above on a 4.0 
scale; and 
(5) has demonstrated a level of proficiency in 
math or computer sciences. 
(e) SERVICE OBLIGATION.— 
(1) IN GENERAL.—If an individual receives a 
scholarship under this section, as a condition of re-
ceiving such scholarship, the individual upon comple-
tion of the degree must serve as a cybersecurity pro-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
101 
fessional within the Federal workforce for a period 
of time as provided in subsection (g). 
(2) NOT OFFERED EMPLOYMENT.—If a scholar-
ship recipient is not offered employment by a Fed-
eral agency or a federally funded research and devel-
opment center, the service requirement can be satis-
fied at the Director’s discretion by— 
(A) serving as a cybersecurity professional 
in a State, local, or tribal government agency; 
or 
(B) teaching cybersecurity courses at an 
institution of higher education. 
(f) CONDITIONS OF SUPPORT.—As a condition of ac-
ceptance of a scholarship under this section, a scholarship 
recipient shall agree to provide the awardee institution 
with annual verifiable documentation of employment and 
up-to-date contact information. 
(g) LENGTH OF SERVICE.—The length of service re-
quired in exchange for a scholarship under this section 
shall be 1 year more than the number of years for which 
the scholarship was received. 
(h) FAILURE
TO
COMPLETE
SERVICE
OBLIGA-
TION.— 
(1) GENERAL
RULE.—A scholarship recipient 
under this section shall be liable to the United 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00101
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
102 
States under paragraph (3) if the scholarship recipi-
ent— 
(A) fails to maintain an acceptable level of 
academic standing in the educational institution 
in which the individual is enrolled, as deter-
mined by the Director; 
(B) is dismissed from such educational in-
stitution for disciplinary reasons; 
(C) withdraws from the program for which 
the award was made before the completion of 
such program; 
(D) declares that the individual does not 
intend to fulfill the service obligation under this 
section; or 
(E) fails to fulfill the service obligation of 
the individual under this section. 
(2) MONITORING COMPLIANCE.—As a condition 
of participating in the program, a qualified institu-
tion of higher education receiving a grant under this 
section shall— 
(A) enter into an agreement with the Di-
rector of the National Science Foundation to 
monitor the compliance of scholarship recipients 
with respect to their service obligations; and 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00102
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
103 
(B) provide to the Director, on an annual 
basis, post-award employment information for 
scholarship recipients through the completion of 
their service obligations. 
(3) REPAYMENT AMOUNTS.— 
(A) LESS THAN 1 YEAR OF SERVICE.—If a 
circumstance under paragraph (1) occurs before 
the completion of 1 year of a service obligation 
under this section, the total amount of awards 
received by the individual under this section 
shall be repaid or such amount shall be treated 
as a loan to be repaid in accordance with sub-
paragraph (C). 
(B) ONE OR MORE YEARS OF SERVICE.— 
If a circumstance described in subparagraph 
(D) or (E) of paragraph (1) occurs after the 
completion of 1 year of a service obligation 
under this section, the total amount of scholar-
ship awards received by the individual under 
this section, reduced by the ratio of the number 
of years of service completed divided by the 
number of years of service required, shall be re-
paid or such amount shall be treated as a loan 
to be repaid in accordance with subparagraph 
(C). 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
104 
(C) 
REPAYMENTS.—A 
loan 
described 
under subparagraph (A) or (B) shall be treated 
as a Federal Direct Unsubsidized Stafford 
Loan under part D of title IV of the Higher 
Education Act of 1965 (20 U.S.C. 1087a et 
seq.), and shall be subject to repayment, to-
gether with interest thereon accruing from the 
date of the scholarship award, in accordance 
with terms and conditions specified by the Di-
rector (in consultation with the Secretary of 
Education) in regulations promulgated to carry 
out this paragraph. 
(4) COLLECTION OF REPAYMENT.— 
(A) IN
GENERAL.—In the event that a 
scholarship recipient is required to repay the 
scholarship under this subsection, the institu-
tion providing the scholarship shall— 
(i) be responsible for determining the 
repayment amounts and for notifying the 
scholarship recipient and the Director of 
the amount owed; and 
(ii) collect such repayment amount 
within a period of time as determined 
under the agreement under paragraph (2) 
or the repayment amount shall be treated 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
105 
as a loan in accordance with paragraph 
(3)(C). 
(B) RETURNED TO TREASURY.—Except as 
provided in subparagraph (C), any such repay-
ment shall be returned to the Treasury of the 
United States. 
(C) RETAIN PERCENTAGE.—An institution 
of higher education may retain a percentage of 
any repayment the institution collects under 
this paragraph to defray administrative costs 
associated with the collection. The Director 
shall establish a single, fixed percentage that 
will apply to all eligible entities. 
(5) EXCEPTIONS.—The Director may provide 
for the partial or total waiver or suspension of any 
service or payment obligation by an individual under 
this section if— 
(A) compliance by the individual with the 
obligation is impossible; 
(B) compliance by the individual would in-
volve extreme hardship to the individual; or 
(C) enforcement of such obligation with re-
spect to the individual would be unconscionable. 
(i) EVALUATION AND REPORT.—The Director of the 
National Science Foundation shall— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
106 
(1) evaluate the success of recruiting individ-
uals for scholarships under this section and of hiring 
and retaining those individuals in the public sector 
workforce, including the annual cost and an assess-
ment of how the program actually improves the Fed-
eral workforce; and 
(2) periodically report the findings under para-
graph (1) to Congress. 
(j) AUTHORIZATION
OF APPROPRIATIONS.—From 
amounts made available under section 503 of the America 
COMPETES Reauthorization Act of 2010 (124 Stat. 
4005), the Secretary may use funds to carry out the re-
quirements of this section for fiscal years 2012 through 
2013. 
SEC. 409. STUDY AND ANALYSIS OF CERTIFICATION AND 
TRAINING OF INFORMATION INFRASTRUC-
TURE PROFESSIONALS. 
(a) STUDY.—The President shall enter into an agree-
ment with the National Academies to conduct a com-
prehensive study of government, academic, and private- 
sector accreditation, training, and certification programs 
for personnel working in information infrastructure. The 
agreement shall require the National Academies to consult 
with sector coordinating councils and relevant govern-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
107 
mental agencies, regulatory entities, and nongovernmental 
organizations in the course of the study. 
(b) SCOPE.—The study shall include— 
(1) an evaluation of the body of knowledge and 
various skills that specific categories of personnel 
working in information infrastructure should possess 
in order to secure information systems; 
(2) an assessment of whether existing govern-
ment, academic, and private-sector accreditation, 
training, and certification programs provide the body 
of knowledge and various skills described in para-
graph (1); 
(3) an analysis of any barriers to the Federal 
Government recruiting and hiring cybersecurity tal-
ent, including barriers relating to compensation, the 
hiring process, job classification, and hiring flexi-
bility; and 
(4) an analysis of the sources and availability of 
cybersecurity talent, a comparison of the skills and 
expertise sought by the Federal Government and the 
private sector, and an examination of the current 
and future capacity of United States institutions of 
higher education, including community colleges, to 
provide current and future cybersecurity profes-
sionals, through education and training activities, 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
108 
with those skills sought by the Federal Government, 
State and local entities, and the private sector. 
(c) REPORT.—Not later than 1 year after the date 
of enactment of this Act, the National Academies shall 
submit to the President and Congress a report on the re-
sults of the study. The report shall include— 
(1) findings regarding the state of information 
infrastructure accreditation, training, and certifi-
cation programs, including specific areas of defi-
ciency and demonstrable progress; and 
(2) recommendations for the improvement of in-
formation infrastructure accreditation, training, and 
certification programs. 
SEC. 410. CYBERSECURITY STRATEGIC RESEARCH AND DE-
VELOPMENT PLAN. 
(a) IN GENERAL.—Not later than 12 months after 
the date of enactment of this Act, the agencies designated 
under section 101(a)(3)(B) (i) through (xi) of the High- 
Performance Computing Act of 1991 (15 U.S.C. 
5511(a)(3)(B) (i) through (xi)) (working through the Na-
tional Science and Technology Council) shall transmit to 
Congress a strategic plan based on an assessment of cy-
bersecurity risk to guide the overall direction of Federal 
cybersecurity and information assurance research and de-
velopment for information technology and networking sys-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
109 
tems. Once every 3 years after the initial strategic plan 
is transmitted to Congress under this section, the agencies 
shall prepare and transmit to Congress an update of the 
strategic plan. 
(b) CONTENTS OF PLAN.—The strategic plan under 
subsection (a) shall— 
(1) specify and prioritize— 
(A) near-term, mid-term, and long-term re-
search objectives, including objectives associated 
with the research areas identified in section 
4(a)(1) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7403(a)(1)); and 
(B) how the near-term objectives com-
plement research and development areas in 
which the private sector is actively engaged; 
(2) describe how the National Networking and 
Information Technology Research and Development 
Program will focus on innovative, transformational 
technologies with the potential to enhance the secu-
rity, reliability, resilience, and trustworthiness of the 
digital infrastructure, and to protect consumer pri-
vacy; 
(3) describe how the Program will foster the 
rapid transfer of research and development results 
into new cybersecurity technologies and applications 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
110 
for the timely benefit of society and the national in-
terest, including through the dissemination of best 
practices and other outreach activities; 
(4) describe how the Program will establish and 
maintain a national research infrastructure for cre-
ating, testing, and evaluating the next generation of 
secure networking and information technology sys-
tems; 
(5) describe how the Program will facilitate ac-
cess by academic researchers to the infrastructure 
described in paragraph (4), as well as to relevant 
data, including event data; and 
(6) describe how the Program will engage fe-
males and individuals identified in section 33 or 34 
of the Science and Engineering Equal Opportunities 
Act (42 U.S.C. 1885a and 1885b) to foster a more 
diverse workforce in this area. 
(c) DEVELOPMENT
OF
IMPLEMENTATION
ROAD-
MAP.—The agencies described in subsection (a) shall de-
velop and annually update an implementation roadmap for 
the strategic plan under this section. The implementation 
roadmap shall— 
(1) specify the role of each Federal agency in 
carrying out or sponsoring research and development 
to meet the research objectives of the strategic plan, 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
111 
including a description of how progress toward the 
research objectives will be evaluated; 
(2) specify the funding allocated to each major 
research objective of the strategic plan and the 
source of funding by agency for the current fiscal 
year; and 
(3) estimate the funding required for each 
major research objective of the strategic plan for the 
following 3 fiscal years. 
(d) RECOMMENDATIONS.—In developing and updat-
ing the strategic plan under subsection (a), the agencies 
involved shall solicit recommendations and advice from— 
(1) the advisory committee established under 
section 101(b)(1) of the High-Performance Com-
puting Act of 1991 (15 U.S.C. 5511(b)(1)); and 
(2) a wide range of stakeholders, including in-
dustry, academia (including representatives of mi-
nority serving institutions and community colleges), 
National Laboratories, and other relevant organiza-
tions and institutions. 
(e) REPORT APPENDIX.—The implementation road-
map under subsection (c), and its annual updates, shall 
be appended to the report under section 101(a)(2)(D) of 
the High-Performance Computing Act of 1991 (15 U.S.C. 
5511(a)(2)(D)). 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
112 
(f) AUTHORIZATION
OF APPROPRIATIONS.—From 
amounts made available under section 503 of the America 
COMPETES Reauthorization Act of 2010 (124 Stat. 
4005), the Secretary may use funds to carry out the re-
quirements of this section for fiscal years 2012 through 
2013. 
SEC. 411. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
(a) IN GENERAL.—The Director of the National In-
stitute of Standards and Technology, in coordination with 
appropriate Federal authorities, shall— 
(1) as appropriate, ensure coordination of Fed-
eral agencies engaged in the development of inter-
national technical standards related to information 
system security; and 
(2) not later than 1 year after the date of en-
actment of this Act, develop and transmit to Con-
gress a plan for ensuring such Federal agency co-
ordination. 
(b) CONSULTATION WITH THE PRIVATE SECTOR.— 
In carrying out the activities under subsection (a)(1), the 
Director shall ensure consultation with appropriate private 
sector stakeholders. 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
113 
SEC. 412. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director of the National Institute of Standards 
and Technology shall continue a program to support the 
development of technical standards, metrology, testbeds, 
and conformance criteria, taking into account appropriate 
user concerns— 
(1) to improve interoperability among identity 
management technologies; 
(2) to strengthen authentication methods of 
identity management systems; 
(3) to improve privacy protection in identity 
management systems, including health information 
technology systems, through authentication and se-
curity protocols; and 
(4) to improve the usability of identity manage-
ment systems. 
SEC. 413. FEDERAL CYBERSECURITY RESEARCH AND DE-
VELOPMENT PROGRAMS. 
(a) COMPUTER AND NETWORK SECURITY RESEARCH 
AREAS.—Section 4(a)(1) of the Cyber Security Research 
and Development Act (15 U.S.C. 7403(a)(1)) is amend-
ed— 
(1) in subparagraph (A) by inserting ‘‘identity 
management,’’ after ‘‘cryptography,’’; and 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
114 
(2) in subparagraph (I), by inserting ‘‘, crimes 
against children, and organized crime’’ after ‘‘intel-
lectual property’’. 
(b) COMPUTER AND NETWORK SECURITY RESEARCH 
GRANTS.—Section 4(a)(3) of such Act (15 U.S.C. 
7403(a)(3)) is amended by striking subparagraphs (A) 
through (E) and inserting the following new subpara-
graphs: 
‘‘(A) $90,000,000 for fiscal year 2012; 
‘‘(B) $90,000,000 for fiscal year 2013; and 
‘‘(C) $90,000,000 for fiscal year 2014.’’. 
(c) COMPUTER AND NETWORK SECURITY RESEARCH 
CENTERS.—Section 4(b) of such Act (15 U.S.C. 7403(b)) 
is amended— 
(1) in paragraph (4)— 
(A) in subparagraph (C), by striking 
‘‘and’’ after the semicolon; 
(B) in subparagraph (D), by striking the 
period and inserting ‘‘; and’’; and 
(C) by adding at the end the following new 
subparagraph: 
‘‘(E) how the center will partner with gov-
ernment laboratories, for-profit entities, other 
institutions of higher education, or nonprofit re-
search institutions.’’; and 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
115 
(2) in paragraph (7) by striking subparagraphs 
(A) through (E) and inserting the following new 
subparagraphs: 
‘‘(A) $4,500,000 for fiscal year 2012; 
‘‘(B) $4,500,000 for fiscal year 2013; and 
‘‘(C) $4,500,000 for fiscal year 2014.’’. 
(d) COMPUTER AND NETWORK SECURITY CAPACITY 
BUILDING GRANTS.—Section 5(a)(6) of such Act (15 
U.S.C. 7404(a)(6)) is amended by striking subparagraphs 
(A) through (E) and inserting the following new subpara-
graphs: 
‘‘(A) $19,000,000 for fiscal year 2012; 
‘‘(B) $19,000,000 for fiscal year 2013; and 
‘‘(C) $19,000,000 for fiscal year 2014.’’. 
(e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT 
GRANTS.—Section 5(b)(2) of such Act (15 U.S.C. 
7404(b)(2)) is amended by striking subparagraphs (A) 
through (E) and inserting the following new subpara-
graphs: 
‘‘(A) $2,500,000 for fiscal year 2012; 
‘‘(B) $2,500,000 for fiscal year 2013; and 
‘‘(C) $2,500,000 for fiscal year 2014.’’. 
(f) GRADUATE TRAINEESHIPS IN COMPUTER AND 
NETWORK SECURITY.—Section 5(c)(7) of such Act (15 
U.S.C. 7404(c)(7)) is amended by striking subparagraphs 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
116 
(A) through (E) and inserting the following new subpara-
graphs: 
‘‘(A) $24,000,000 for fiscal year 2012; 
‘‘(B) $24,000,000 for fiscal year 2013; and 
‘‘(C) $24,000,000 for fiscal year 2014.’’. 
(g) CYBER
SECURITY
FACULTY
DEVELOPMENT 
TRAINEESHIP PROGRAM.—Section 5(e) of such Act (15 
U.S.C. 7404(e)) is repealed. 
SEC. 414. CYBERSECURITY AUTOMATION AND CHECKLISTS 
FOR GOVERNMENT SYSTEMS. 
Section 8(c) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7406(c)) is amended to read 
as follows: 
‘‘(c) SECURITY AUTOMATION AND CHECKLISTS FOR 
GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the Na-
tional Institute of Standards and Technology shall 
develop, and revise as necessary, security automation 
standards, associated reference materials (including 
protocols), and checklists providing settings and op-
tion selections that minimize the security risks asso-
ciated with each information technology hardware or 
software system and security tool that is, or is likely 
to become, widely used within the Federal Govern-
ment in order to enable standardized and interoper-
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
117 
able technologies, architectures, and frameworks for 
continuous monitoring of information security within 
the Federal Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
ment of standards, reference materials, and check-
lists under this subsection on the basis of— 
‘‘(A) the security risks associated with the 
use of the system; 
‘‘(B) the number of agencies that use a 
particular system or security tool; 
‘‘(C) the usefulness of the standards, ref-
erence materials, or checklists to Federal agen-
cies that are users or potential users of the sys-
tem; 
‘‘(D) the effectiveness of the associated 
standard, reference material, or checklist in cre-
ating or enabling continuous monitoring of in-
formation security; or 
‘‘(E) such other factors as the Director of 
the National Institute of Standards and Tech-
nology determines to be appropriate. 
‘‘(3) EXCLUDED
SYSTEMS.—The Director of 
the National Institute of Standards and Technology 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
118 
may exclude from the application of paragraph (1) 
any information technology hardware or software 
system or security tool for which such Director de-
termines that the development of a standard, ref-
erence material, or checklist is inappropriate because 
of the infrequency of use of the system, the obsoles-
cence of the system, or the inutility or imprac-
ticability of developing a standard, reference mate-
rial, or checklist for the system. 
‘‘(4) DISSEMINATION OF STANDARDS AND RE-
LATED MATERIALS.—The Director of the National 
Institute of Standards and Technology shall ensure 
that Federal agencies are informed of the avail-
ability of any standard, reference material, checklist, 
or other item developed under this subsection. 
‘‘(5) AGENCY USE REQUIREMENTS.—The devel-
opment of standards, reference materials, and check-
lists under paragraph (1) for an information tech-
nology hardware or software system or tool does 
not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the standard, reference material, or checklist 
for the system; 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
119 
‘‘(B) establish conditions or prerequisites 
for Federal agency procurement or deployment 
of any such system; 
‘‘(C) imply an endorsement of any such 
system by the Director of the National Institute 
of Standards and Technology; or 
‘‘(D) preclude any Federal agency from 
procuring or deploying other information tech-
nology hardware or software systems for which 
no such standard, reference material, or check-
list has been developed or identified under para-
graph (1).’’. 
SEC. 415. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND 
DEVELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended— 
(1) by redesignating subsection (e) as sub-
section (f); and 
(2) by inserting after subsection (d) the fol-
lowing: 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6201
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS
120 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execu-
tion of a wide variety of resource protection policies 
and that is amenable to implementation within a 
wide variety of existing and emerging computing en-
vironments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and net-
works; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; and 
‘‘(4) carry out research associated with improv-
ing security of industrial control systems.’’. 
Æ 
VerDate Mar 15 2010 
03:20 Mar 28, 2012
Jkt 099200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6301
E:\BILLS\H4263.IH
H4263
jbell on DSK7SPTVN1PROD with BILLS