H. R. 3394
One Hundred Seventh Congress
of the
United States of America
AT THE SECOND SESSION
Begun and held at the City of Washington on Wednesday,
the twenty-third day of January, two thousand and two
An Act
To authorize funding for computer and network security research and development
and research fellowship programs, and for other purposes.
Be it enacted by the Senate and House of Representatives of
the United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ‘‘Cyber Security Research and
Development Act’’.
SEC. 2. FINDINGS.
The Congress finds the following:
(1) Revolutionary advancements in computing and commu-
nications technology have interconnected government, commer-
cial, scientific, and educational infrastructures—including crit-
ical infrastructures for electric power, natural gas and petro-
leum 
production 
and 
distribution, 
telecommunications,
transportation, water supply, banking and finance, and emer-
gency and government services—in a vast, interdependent phys-
ical and electronic network.
(2) Exponential increases in interconnectivity have facili-
tated enhanced communications, economic growth, and the
delivery of services critical to the public welfare, but have
also increased the consequences of temporary or prolonged
failure.
(3) A Department of Defense Joint Task Force concluded
after a 1997 United States information warfare exercise that
the results ‘‘clearly demonstrated our lack of preparation for
a coordinated cyber and physical attack on our critical military
and civilian infrastructure’’.
(4) Computer security technology and systems implementa-
tion lack—
(A) sufficient long term research funding;
(B) adequate coordination across Federal and State
government agencies and among government, academia,
and industry; and
(C) sufficient numbers of outstanding researchers in
the field.
(5) Accordingly, Federal investment in computer and net-
work security research and development must be significantly
increased to—
(A) improve vulnerability assessment and technological
and systems solutions;
H. R. 3394—2
(B) expand and improve the pool of information secu-
rity professionals, including researchers, in the United
States workforce; and
(C) 
better 
coordinate 
information 
sharing 
and
collaboration among industry, government, and academic
research projects.
(6) While African-Americans, Hispanics, and Native Ameri-
cans constitute 25 percent of the total United States workforce
and 30 percent of the college-age population, members of these
minorities comprise less than 7 percent of the United States
computer and information science workforce.
SEC. 3. DEFINITIONS.
In this Act:
(1) DIRECTOR.—The term ‘‘Director’’ means the Director
of the National Science Foundation.
(2) INSTITUTION OF HIGHER EDUCATION.—The term ‘‘institu-
tion of higher education’’ has the meaning given that term
in section 101(a) of the Higher Education Act of 1965 (20
U.S.C. 1001(a)).
SEC. 4. NATIONAL SCIENCE FOUNDATION RESEARCH.
(a) COMPUTER AND NETWORK SECURITY RESEARCH GRANTS.—
(1) IN GENERAL.—The Director shall award grants for basic
research on innovative approaches to the structure of computer
and network hardware and software that are aimed at
enhancing computer security. Research areas may include—
(A) authentication, cryptography, and other secure data
communications technology;
(B) computer forensics and intrusion detection;
(C) reliability of computer and network applications,
middleware, operating systems, control systems, and
communications infrastructure;
(D) privacy and confidentiality;
(E) network security architecture, including tools for
security administration and analysis;
(F) emerging threats;
(G) vulnerability assessments and techniques for quan-
tifying risk;
(H) remote access and wireless security; and
(I) enhancement of law enforcement ability to detect,
investigate, and prosecute cyber-crimes, including those
that involve piracy of intellectual property.
(2) MERIT REVIEW; COMPETITION.—Grants shall be awarded
under this section on a merit-reviewed competitive basis.
(3) AUTHORIZATION OF APPROPRIATIONS.—There are author-
ized to be appropriated to the National Science Foundation
to carry out this subsection—
(A) $35,000,000 for fiscal year 2003;
(B) $40,000,000 for fiscal year 2004;
(C) $46,000,000 for fiscal year 2005;
(D) $52,000,000 for fiscal year 2006; and
(E) $60,000,000 for fiscal year 2007.
(b) COMPUTER AND NETWORK SECURITY RESEARCH CENTERS.—
(1) IN
GENERAL.—The Director shall award multiyear
grants, subject to the availability of appropriations, to institu-
tions of higher education, nonprofit research institutions, or
H. R. 3394—3
consortia thereof to establish multidisciplinary Centers for Com-
puter and Network Security Research. Institutions of higher
education, nonprofit research institutions, or consortia thereof
receiving such grants may partner with 1 or more government
laboratories or for-profit institutions, or other institutions of
higher education or nonprofit research institutions.
(2) MERIT REVIEW; COMPETITION.—Grants shall be awarded
under this subsection on a merit-reviewed competitive basis.
(3) PURPOSE.—The purpose of the Centers shall be to gen-
erate innovative approaches to computer and network security
by conducting cutting-edge, multidisciplinary research in com-
puter and network security, including the research areas
described in subsection (a)(1).
(4) APPLICATIONS.—An institution of higher education, non-
profit research institution, or consortia thereof seeking funding
under this subsection shall submit an application to the
Director at such time, in such manner, and containing such
information as the Director may require. The application shall
include, at a minimum, a description of—
(A) the research projects that will be undertaken by
the Center and the contributions of each of the partici-
pating entities;
(B) how the Center will promote active collaboration
among scientists and engineers from different disciplines,
such as computer scientists, engineers, mathematicians,
and social science researchers;
(C) how the Center will contribute to increasing the
number and quality of computer and network security
researchers and other professionals, including individuals
from groups historically underrepresented in these fields;
and
(D) how the center will disseminate research results
quickly and widely to improve cyber security in information
technology networks, products, and services.
(5) CRITERIA.—In evaluating the applications submitted
under paragraph (4), the Director shall consider, at a
minimum—
(A) the ability of the applicant to generate innovative
approaches to computer and network security and effec-
tively carry out the research program;
(B) the experience of the applicant in conducting
research on computer and network security and the
capacity of the applicant to foster new multidisciplinary
collaborations;
(C) the capacity of the applicant to attract and provide
adequate support for a diverse group of undergraduate
and graduate students and postdoctoral fellows to pursue
computer and network security research; and
(D) the extent to which the applicant will partner
with government laboratories, for-profit entities, other
institutions of higher education, or nonprofit research
institutions, and the role the partners will play in the
research undertaken by the Center.
(6) ANNUAL
MEETING.—The Director shall convene an
annual meeting of the Centers in order to foster collaboration
and communication between Center participants.
H. R. 3394—4
(7) AUTHORIZATION OF APPROPRIATIONS.—There are author-
ized to be appropriated for the National Science Foundation
to carry out this subsection—
(A) $12,000,000 for fiscal year 2003;
(B) $24,000,000 for fiscal year 2004;
(C) $36,000,000 for fiscal year 2005;
(D) $36,000,000 for fiscal year 2006; and
(E) $36,000,000 for fiscal year 2007.
SEC. 5. NATIONAL SCIENCE FOUNDATION COMPUTER AND NETWORK
SECURITY PROGRAMS.
(a) COMPUTER
AND NETWORK SECURITY CAPACITY BUILDING
GRANTS.—
(1) IN GENERAL.—The Director shall establish a program
to award grants to institutions of higher education (or consortia
thereof) to establish or improve undergraduate and master’s
degree programs in computer and network security, to increase
the number of students, including the number of students from
groups historically underrepresented in these fields, who pursue
undergraduate or master’s degrees in fields related to computer
and network security, and to provide students with experience
in government or industry related to their computer and net-
work security studies.
(2) MERIT REVIEW.—Grants shall be awarded under this
subsection on a merit-reviewed competitive basis.
(3) USE OF FUNDS.—Grants awarded under this subsection
shall be used for activities that enhance the ability of an
institution of higher education (or consortium thereof) to pro-
vide high-quality undergraduate and master’s degree programs
in computer and network security and to recruit and retain
increased numbers of students to such programs. Activities
may include—
(A) revising curriculum to better prepare under-
graduate and master’s degree students for careers in com-
puter and network security;
(B) establishing degree and certificate programs in
computer and network security;
(C) creating opportunities for undergraduate students
to participate in computer and network security research
projects;
(D) acquiring equipment necessary for student instruc-
tion in computer and network security, including the
installation of testbed networks for student use;
(E) providing opportunities for faculty to work with
local or Federal Government agencies, private industry,
nonprofit research institutions, or other academic institu-
tions to develop new expertise or to formulate new research
directions in computer and network security;
(F) establishing collaborations with other academic
institutions or academic departments that seek to establish,
expand, or enhance programs in computer and network
security;
(G) establishing student internships in computer and
network security at government agencies or in private
industry;
(H) establishing collaborations with other academic
institutions to establish or enhance a web-based collection
H. R. 3394—5
of computer and network security courseware and labora-
tory exercises for sharing with other institutions of higher
education, including community colleges;
(I) establishing or enhancing bridge programs in com-
puter and network security between community colleges
and universities; and
(J) any other activities the Director determines will
accomplish the goals of this subsection.
(4) SELECTION PROCESS.—
(A) APPLICATION.—An institution of higher education
(or a consortium thereof) seeking funding under this sub-
section shall submit an application to the Director at such
time, in such manner, and containing such information
as the Director may require. The application shall include,
at a minimum—
(i) a description of the applicant’s computer and
network security research and instructional capacity,
and in the case of an application from a consortium
of institutions of higher education, a description of
the role that each member will play in implementing
the proposal;
(ii) a comprehensive plan by which the institution
or consortium will build instructional capacity in com-
puter and information security;
(iii) a description of relevant collaborations with
government agencies or private industry that inform
the instructional program in computer and network
security;
(iv) a survey of the applicant’s historic student
enrollment and placement data in fields related to
computer and network security and a study of potential
enrollment and placement for students enrolled in the
proposed computer and network security program; and
(v) a plan to evaluate the success of the proposed
computer and network security program, including
post-graduation assessment of graduate school and job
placement and retention rates as well as the relevance
of the instructional program to graduate study and
to the workplace.
(B) AWARDS.—(i) The Director shall ensure, to the
extent practicable, that grants are awarded under this
subsection in a wide range of geographic areas and cat-
egories of institutions of higher education, including
minority serving institutions.
(ii) The Director shall award grants under this sub-
section for a period not to exceed 5 years.
(5) ASSESSMENT REQUIRED.—The Director shall evaluate
the program established under this subsection no later than
6 years after the establishment of the program. At a minimum,
the Director shall evaluate the extent to which the program
achieved its objectives of increasing the quality and quantity
of students, including students from groups historically under-
represented in computer and network security related dis-
ciplines, pursuing undergraduate or master’s degrees in com-
puter and network security.
H. R. 3394—6
(6) AUTHORIZATION OF APPROPRIATIONS.—There are author-
ized to be appropriated to the National Science Foundation
to carry out this subsection—
(A) $15,000,000 for fiscal year 2003;
(B) $20,000,000 for fiscal year 2004;
(C) $20,000,000 for fiscal year 2005;
(D) $20,000,000 for fiscal year 2006; and
(E) $20,000,000 for fiscal year 2007.
(b) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT OF 1992.—
(1) GRANTS.—The Director shall provide grants under the
Scientific and Advanced Technology Act of 1992 (42 U.S.C.
1862i) for the purposes of section 3(a) and (b) of that Act,
except that the activities supported pursuant to this subsection
shall be limited to improving education in fields related to
computer and network security.
(2) AUTHORIZATION OF APPROPRIATIONS.—There are author-
ized to be appropriated to the National Science Foundation
to carry out this subsection—
(A) $1,000,000 for fiscal year 2003;
(B) $1,250,000 for fiscal year 2004;
(C) $1,250,000 for fiscal year 2005;
(D) $1,250,000 for fiscal year 2006; and
(E) $1,250,000 for fiscal year 2007.
(c) GRADUATE TRAINEESHIPS IN COMPUTER AND NETWORK SECU-
RITY RESEARCH.—
(1) IN GENERAL.—The Director shall establish a program
to award grants to institutions of higher education to establish
traineeship programs for graduate students who pursue com-
puter and network security research leading to a doctorate
degree by providing funding and other assistance, and by pro-
viding graduate students with research experience in govern-
ment or industry related to the students’ computer and network
security studies.
(2) MERIT REVIEW.—Grants shall be provided under this
subsection on a merit-reviewed competitive basis.
(3) USE OF FUNDS.—An institution of higher education shall
use grant funds for the purposes of—
(A) providing traineeships to students who are citizens,
nationals, or lawfully admitted permanent resident aliens
of the United States and are pursuing research in computer
or network security leading to a doctorate degree;
(B) paying tuition and fees for students receiving
traineeships under subparagraph (A);
(C) establishing scientific internship programs for stu-
dents receiving traineeships under subparagraph (A) in
computer and network security at for-profit institutions,
nonprofit research institutions, or government laboratories;
and
(D) other costs associated with the administration of
the program.
(4) TRAINEESHIP
AMOUNT.—Traineeships provided under
paragraph (3)(A) shall be in the amount of $25,000 per year,
or the level of the National Science Foundation Graduate
Research Fellowships, whichever is greater, for up to 3 years.
H. R. 3394—7
(5) SELECTION PROCESS.—An institution of higher education
seeking funding under this subsection shall submit an applica-
tion to the Director at such time, in such manner, and con-
taining such information as the Director may require. The
application shall include, at a minimum, a description of—
(A) the instructional program and research opportuni-
ties in computer and network security available to graduate
students at the applicant’s institution; and
(B) the internship program to be established, including
the opportunities that will be made available to students
for internships at for-profit institutions, nonprofit research
institutions, and government laboratories.
(6) REVIEW OF APPLICATIONS.—In evaluating the applica-
tions submitted under paragraph (5), the Director shall
consider—
(A) the ability of the applicant to effectively carry
out the proposed program;
(B) the quality of the applicant’s existing research and
education programs;
(C) the likelihood that the program will recruit
increased numbers of students, including students from
groups historically underrepresented in computer and net-
work security related disciplines, to pursue and earn doc-
torate degrees in computer and network security;
(D) the nature and quality of the internship program
established through collaborations with government labora-
tories, nonprofit research institutions, and for-profit institu-
tions;
(E) the integration of internship opportunities into
graduate students’ research; and
(F) the relevance of the proposed program to current
and future computer and network security needs.
(7) AUTHORIZATION OF APPROPRIATIONS.—There are author-
ized to be appropriated to the National Science Foundation
to carry out this subsection—
(A) $10,000,000 for fiscal year 2003;
(B) $20,000,000 for fiscal year 2004;
(C) $20,000,000 for fiscal year 2005;
(D) $20,000,000 for fiscal year 2006; and
(E) $20,000,000 for fiscal year 2007.
(d) GRADUATE RESEARCH FELLOWSHIPS PROGRAM SUPPORT.—
Computer and network security shall be included among the fields
of specialization supported by the National Science Foundation’s
Graduate Research Fellowships program under section 10 of the
National Science Foundation Act of 1950 (42 U.S.C. 1869).
(e) CYBER SECURITY FACULTY DEVELOPMENT TRAINEESHIP PRO-
GRAM.—
(1) IN GENERAL.—The Director shall establish a program
to award grants to institutions of higher education to establish
traineeship programs to enable graduate students to pursue
academic careers in cyber security upon completion of doctoral
degrees.
(2) MERIT REVIEW; COMPETITION.—Grants shall be awarded
under this section on a merit-reviewed competitive basis.
(3) APPLICATION.—Each institution of higher education
desiring to receive a grant under this subsection shall submit
H. R. 3394—8
an application to the Director at such time, in such manner,
and containing such information as the Director shall require.
(4) USE OF FUNDS.—Funds received by an institution of
higher education under this paragraph shall—
(A) be made available to individuals on a merit-
reviewed competitive basis and in accordance with the
requirements established in paragraph (7);
(B) be in an amount that is sufficient to cover annual
tuition and fees for doctoral study at an institution of
higher education for the duration of the graduate
traineeship, and shall include, in addition, an annual living
stipend of $25,000; and
(C) be provided to individuals for a duration of no
more than 5 years, the specific duration of each graduate
traineeship to be determined by the institution of higher
education, on a case-by-case basis.
(5) REPAYMENT.—Each graduate traineeship shall—
(A) subject to paragraph (5)(B), be subject to full repay-
ment upon completion of the doctoral degree according
to a repayment schedule established and administered by
the institution of higher education;
(B) be forgiven at the rate of 20 percent of the total
amount of the graduate traineeship assistance received
under this section for each academic year that a recipient
is employed as a full-time faculty member at an institution
of higher education for a period not to exceed 5 years;
and
(C) be monitored by the institution of higher education
receiving a grant under this subsection to ensure compli-
ance with this subsection.
(6) EXCEPTIONS.—The Director may provide for the partial
or total waiver or suspension of any service obligation or pay-
ment by an individual under this section whenever compliance
by the individual is impossible or would involve extreme hard-
ship to the individual, or if enforcement of such obligation
with respect to the individual would be unconscionable.
(7) ELIGIBILITY.—To be eligible to receive a graduate
traineeship under this section, an individual shall—
(A) be a citizen, national, or lawfully admitted perma-
nent resident alien of the United States; and
(B) demonstrate a commitment to a career in higher
education.
(8) CONSIDERATION.—In making selections for graduate
traineeships under this paragraph, an institution receiving a
grant under this subsection shall consider, to the extent pos-
sible, a diverse pool of applicants whose interests are of an
interdisciplinary nature, encompassing the social scientific as
well as the technical dimensions of cyber security.
(9) AUTHORIZATION OF APPROPRIATIONS.—There are author-
ized to be appropriated to the National Science Foundation
to carry out this paragraph $5,000,000 for each of fiscal years
2003 through 2007.
SEC. 6. CONSULTATION.
In carrying out sections 4 and 5, the Director shall consult
with other Federal agencies.
H. R. 3394—9
SEC. 7. FOSTERING RESEARCH AND EDUCATION IN COMPUTER AND
NETWORK SECURITY.
Section 3(a) of the National Science Foundation Act of 1950
(42 U.S.C. 1862(a)) is amended—
(1) by striking ‘‘and’’ at the end of paragraph (6);
(2) by striking ‘‘Congress.’’ in paragraph (7) and inserting
‘‘Congress ; and’’; and
(3) by adding at the end the following:
‘‘(8) to take a leading role in fostering and supporting
research and education activities to improve the security of
networked information systems.’’.
SEC. 8. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY PRO-
GRAMS.
(a) RESEARCH PROGRAM.—The National Institute of Standards
and Technology Act (15 U.S.C. 271 et seq.) is amended—
(1) by moving section 22 to the end of the Act and redesig-
nating it as section 32; and
(2) by inserting after section 21 the following new section:
‘‘SEC. 22. RESEARCH PROGRAM ON SECURITY OF COMPUTER SYSTEMS
‘‘(a) ESTABLISHMENT.—The Director shall establish a program
of assistance to institutions of higher education that enter into
partnerships with for-profit entities to support research to improve
the security of computer systems. The partnerships may also include
government laboratories and nonprofit research institutions. The
program shall—
‘‘(1) include multidisciplinary, long-term research;
‘‘(2) include research directed toward addressing needs
identified through the activities of the Computer System Secu-
rity and Privacy Advisory Board under section 20(f); and
‘‘(3) promote the development of a robust research commu-
nity working at the leading edge of knowledge in subject areas
relevant to the security of computer systems by providing sup-
port for graduate students, post-doctoral researchers, and senior
researchers.
‘‘(b) FELLOWSHIPS.—
‘‘(1) POST-DOCTORAL RESEARCH FELLOWSHIPS.—The Director
is authorized to establish a program to award post-doctoral
research fellowships to individuals who are citizens, nationals,
or lawfully admitted permanent resident aliens of the United
States and are seeking research positions at institutions,
including the Institute, engaged in research activities related
to the security of computer systems, including the research
areas described in section 4(a)(1) of the Cyber Security Research
and Development Act.
‘‘(2) SENIOR
RESEARCH
FELLOWSHIPS.—The Director is
authorized to establish a program to award senior research
fellowships to individuals seeking research positions at institu-
tions, including the Institute, engaged in research activities
related to the security of computer systems, including the
research areas described in section 4(a)(1) of the Cyber Security
Research and Development Act. Senior research fellowships
shall be made available for established researchers at institu-
tions of higher education who seek to change research fields
and pursue studies related to the security of computer systems.
‘‘(3) ELIGIBILITY.—
H. R. 3394—10
‘‘(A) IN GENERAL.—To be eligible for an award under
this subsection, an individual shall submit an application
to the Director at such time, in such manner, and con-
taining such information as the Director may require.
‘‘(B) STIPENDS.—Under this subsection, the Director
is authorized to provide stipends for post-doctoral research
fellowships at the level of the Institute’s Post Doctoral
Research Fellowship Program and senior research fellow-
ships at levels consistent with support for a faculty member
in a sabbatical position.
‘‘(c) AWARDS; APPLICATIONS.—
‘‘(1) IN
GENERAL.—The Director is authorized to award
grants or cooperative agreements to institutions of higher edu-
cation to carry out the program established under subsection
(a). No funds made available under this section shall be made
available directly to any for-profit partners.
‘‘(2) ELIGIBILITY.—To be eligible for an award under this
section, an institution of higher education shall submit an
application to the Director at such time, in such manner, and
containing such information as the Director may require. The
application shall include, at a minimum, a description of—
‘‘(A) the number of graduate students anticipated to
participate in the research project and the level of support
to be provided to each;
‘‘(B) the number of post-doctoral research positions
included under the research project and the level of support
to be provided to each;
‘‘(C) the number of individuals, if any, intending to
change research fields and pursue studies related to the
security of computer systems to be included under the
research project and the level of support to be provided
to each; and
‘‘(D) how the for-profit entities, nonprofit research
institutions, and any other partners will participate in
developing and carrying out the research and education
agenda of the partnership.
‘‘(d) PROGRAM OPERATION.—
‘‘(1) MANAGEMENT.—The program established under sub-
section (a) shall be managed by individuals who shall have
both expertise in research related to the security of computer
systems and knowledge of the vulnerabilities of existing com-
puter systems. The Director shall designate such individuals
as program managers.
‘‘(2) MANAGERS MAY BE EMPLOYEES.—Program managers
designated under paragraph (1) may be new or existing
employees of the Institute or individuals on assignment at
the Institute under the Intergovernmental Personnel Act of
1970, except that individuals on assignment at the Institute
under the Intergovernmental Personnel Act of 1970 shall not
directly manage such employees.
‘‘(3) MANAGER
RESPONSIBILITY.—Program managers des-
ignated under paragraph (1) shall be responsible for—
‘‘(A) establishing and publicizing the broad research
goals for the program;
‘‘(B) soliciting applications for specific research projects
to address the goals developed under subparagraph (A);
H. R. 3394—11
‘‘(C) selecting research projects for support under the
program from among applications submitted to the
Institute, following consideration of—
‘‘(i) the novelty and scientific and technical merit
of the proposed projects;
‘‘(ii) the demonstrated capabilities of the individual
or individuals submitting the applications to success-
fully carry out the proposed research;
‘‘(iii) the impact the proposed projects will have
on increasing the number of computer security
researchers;
‘‘(iv) the nature of the participation by for-profit
entities and the extent to which the proposed projects
address the concerns of industry; and
‘‘(v) other criteria determined by the Director,
based on information specified for inclusion in applica-
tions under subsection (c); and
‘‘(D) monitoring the progress of research projects sup-
ported under the program.
‘‘(4) REPORTS.—The Director shall report to the Senate
Committee on Commerce, Science, and Transportation and the
House of Representatives Committee on Science annually on
the use and responsibility of individuals on assignment at the
Institute under the Intergovernmental Personnel Act of 1970
who are performing duties under subsection (d).
‘‘(e) REVIEW OF PROGRAM.—
‘‘(1) PERIODIC
REVIEW.—The Director shall periodically
review the portfolio of research awards monitored by each
program manager designated in accordance with subsection
(d). In conducting those reviews, the Director shall seek the
advice of the Computer System Security and Privacy Advisory
Board, established under section 21, on the appropriateness
of the research goals and on the quality and utility of research
projects managed by program managers in accordance with
subsection (d).
‘‘(2) COMPREHENSIVE 5-YEAR REVIEW.—The Director shall
also contract with the National Research Council for a com-
prehensive review of the program established under subsection
(a) during the 5th year of the program. Such review shall
include an assessment of the scientific quality of the research
conducted, the relevance of the research results obtained to
the goals of the program established under subsection (d)(3)(A),
and the progress of the program in promoting the development
of a substantial academic research community working at the
leading edge of knowledge in the field. The Director shall
submit to Congress a report on the results of the review under
this paragraph no later than 6 years after the initiation of
the program.
‘‘(f) DEFINITIONS.—In this section:
‘‘(1) COMPUTER SYSTEM.—The term ‘computer system’ has
the meaning given that term in section 20(d)(1).
‘‘(2) INSTITUTION OF HIGHER EDUCATION.—The term ‘institu-
tion of higher education’ has the meaning given that term
in section 101(a) of the Higher Education Act of 1965 (20
U.S.C. 1001(a)).’’.
H. R. 3394—12
(b) AMENDMENT
OF COMPUTER
SYSTEM DEFINITION.—Section
20(d)(1)(B)(i) of National Institute of Standards and Technology
Act (15 U.S.C. 278g–3(d)(1)(B)(i)) is amended to read as follows:
‘‘(i) computers and computer networks;’’.
(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.—
(1) IN GENERAL.—The Director of the National Institute
of Standards and Technology shall develop, and revise as nec-
essary, a checklist setting forth settings and option selections
that minimize the security risks associated with each computer
hardware or software system that is, or is likely to become,
widely used within the Federal Government.
(2) PRIORITIES FOR DEVELOPMENT; EXCLUDED SYSTEMS.—
The Director of the National Institute of Standards and Tech-
nology may establish priorities for the development of checklists
under this paragraph on the basis of the security risks associ-
ated with the use of the system, the number of agencies that
use a particular system, the usefulness of the checklist to
Federal agencies that are users or potential users of the system,
or such other factors as the Director determines to be appro-
priate. The Director of the National Institute of Standards
and Technology may exclude from the application of paragraph
(1) any computer hardware or software system for which the
Director of the National Institute of Standards and Technology
determines that the development of a checklist is inappropriate
because of the infrequency of use of the system, the obsolescence
of the system, or the inutility or impracticability of developing
a checklist for the system.
(3) DISSEMINATION OF CHECKLISTS.—The Director of the
National Institute of Standards and Technology shall make
any checklist developed under this paragraph for any computer
hardware or software system available to each Federal agency
that is a user or potential user of the system.
(4) AGENCY
USE
REQUIREMENTS.—The development of a
checklist under paragraph (1) for a computer hardware or soft-
ware system does not—
(A) require any Federal agency to select the specific
settings or options recommended by the checklist for the
system;
(B) establish conditions or prerequisites for Federal
agency procurement or deployment of any such system;
(C) represent an endorsement of any such system by
the Director of the National Institute of Standards and
Technology; nor
(D) preclude any Federal agency from procuring or
deploying other computer hardware or software systems
for which no such checklist has been developed.
(d) FEDERAL AGENCY INFORMATION SECURITY PROGRAMS.—
(1) IN GENERAL.—In developing the agencywide information
security program required by section 3534(b) of title 44, United
States Code, an agency that deploys a computer hardware
or software system for which the Director of the National
Institute of Standards and Technology has developed a checklist
under subsection (c) of this section—
(A) shall include in that program an explanation of
how the agency has considered such checklist in deploying
that system; and