(1) promote an increased use of security tech-
niques, such as risk assessment, and security tools,
such as cryptography, to enhance the protection of
the Nation’s information infrastructure;
(2) establish a central repository of information
for dissemination to the public to promote awareness
of information security vulnerabilities and risks; and
(3) in a manner consistent with section 12(d) of
the National Technology Transfer and Advancement
Act of 1995 (15 U.S.C. 272 nt), promote the devel-
opment of national standards-based infrastructures
needed to support government, commercial, and pri-
vate uses of encryption technologies for confiden-
tiality and authentication.
SEC. 12. ELECTRONIC AUTHENTICATION INFRASTRUC-
TURES.
(a) ELECTRONIC
AUTHENTICATION
INFRASTRUC-
TURES.—
(1) TECHNOLOGY-NEUTRAL
GUIDELINES
AND
STANDARDS.—Not later than 18 months after the
date of the enactment of this Act, the Director, in
consultation with industry and appropriate Federal
agencies, shall develop technology-neutral guidelines
and standards, or adopt existing technology-neutral
industry guidelines and standards, for electronic au-
thentication infrastructures to be made available to
Federal agencies so that such agencies may effec-
tively select and utilize electronic authentication
technologies in a manner that is—
(A) adequately secure to meet the needs of
those agencies and their transaction partners;
and
(B) interoperable, to the maximum extent
possible.
(2) ELEMENTS.—The guidelines and standards
developed under paragraph (1) shall include—
(A) protection profiles for cryptographic
and noncryptographic methods of authen-
ticating identity for electronic authentication
products and services;
(B) a core set of interoperability specifica-
tions for the use of electronic authentication
products and services in electronic transactions
between Federal agencies and their transaction
partners; and
(C) validation criteria to enable Federal
agencies to select cryptographic electronic au-
thentication products and services appropriate
to their needs.
(3) REVISIONS.—The Director shall periodically
review the guidelines and standards developed under
paragraph (1) and revise them as appropriate.
(b) LISTING
OF PRODUCTS.—Not later than 30
months after the date of the enactment of this Act, and
thereafter, the Director shall maintain and make available
to Federal agencies a nonmandatory list of commercially
available electronic authentication products, and other
such products used by Federal agencies, evaluated as con-
forming with the guidelines and standards developed
under subsection (a).
(c) SPECIFICATIONS
FOR
ELECTRONIC
CERTIFI-
CATION AND MANAGEMENT TECHNOLOGIES.—
(1) SPECIFICATIONS.—The Director shall, as
appropriate, establish core specifications for par-
ticular electronic certification and management tech-
nologies, or their components, for use by Federal
agencies.
(2) EVALUATION.—The Director shall advise
Federal agencies on how to evaluate the conform-
ance with the specifications established under para-
graph (1) of electronic certification and management
technologies, developed for use by Federal agencies
or available for such use.
(3) MAINTENANCE
OF
LIST.—The Director
shall maintain and make available to Federal agen-
cies a list of electronic certification and management
technologies evaluated as conforming to the speci-
fications established under paragraph (1).
(d) REPORTS.—Not later than 18 months after the
date of the enactment of this Act, and annually thereafter,
the Director shall transmit to the Congress a report that
includes—
(1) a description and analysis of the utilization
by Federal agencies of electronic authentication
technologies; and
(2) a description and analysis regarding the
problems Federal agencies are having, and the
progress such agencies are making, in implementing
electronic authentication infrastructures.
(e) DEFINITIONS.—For purposes of this section—
(1) the term ‘‘electronic authentication’’ means
cryptographic or noncryptographic methods of au-
thenticating identity in an electronic communication;
(2) the term ‘‘electronic authentication infra-
structure’’ means the software, hardware, and per-
sonnel resources, and the procedures, required to ef-
fectively 
utilize 
electronic 
authentication 
tech-
nologies;
(3) the term ‘‘electronic certification and man-
agement technologies’’ means computer systems, in-
cluding associated personnel and procedures, that
enable individuals to apply electronic authentication
to electronic information; and
(4) the term ‘‘protection profile’’ means a list of
security functions and associated assurance levels
used to describe a product.
SEC. 13. SOURCE OF AUTHORIZATIONS.
There are authorized to be appropriated to the Sec-
retary of Commerce $7,000,000 for fiscal year 2001 and
$8,000,000 for fiscal year 2002, for the National Institute
of Standards and Technology to carry out activities au-
thorized by this Act for which funds are not otherwise spe-
cifically authorized to be appropriated by this Act.
Passed the House of Representatives October 24,
2000.
Attest:
Clerk.
106TH CONGRESS
2D SESSION
H. R. 2413
AN ACT
To amend the National Institute of Standards and
Technology Act to enhance the ability of the Na-
tional Institute of Standards and Technology to
improve computer security, and for other pur-
poses.