‘‘(15) 
OPERATIONAL
CONTROL.—The 
term 
‘operational control’ means a security control for an 
information system that primarily is implemented 
and executed by people. 
‘‘(16) PERSON.—The term ‘person’ has the 
meaning given the term in section 3502 of title 44. 
‘‘(17) 
SECRETARY.—The 
term 
‘Secretary’ 
means the Secretary of Commerce unless otherwise 
specified. 
‘‘(18) SECURITY CONTROL.—The term ‘security 
control’ means the management, operational, and 
technical controls, including safeguards or counter-
measures, prescribed for an information system to 
protect the confidentiality, integrity, and availability 
of the system and its information. 
‘‘(19) SIGNIFICANT
CYBER
INCIDENT.—The 
term ‘significant cyber incident’ means a cyber inci-
dent resulting in, or an attempted cyber incident 
that, if successful, would have resulted in— 
‘‘(A) the exfiltration from a Federal infor-
mation system of data that is essential to the 
operation of the Federal information system; or 
‘‘(B) an incident in which an operational 
or technical control essential to the security or 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00039
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
operation of a Federal information system was 
defeated. 
‘‘(20) TECHNICAL CONTROL.—The term ‘tech-
nical control’ means a hardware or software restric-
tion on, or audit of, access or use of an information 
system or information that is stored on, processed 
by, or transiting an information system that is in-
tended to ensure the confidentiality, integrity, or 
availability of that system. 
‘‘§ 3553. Federal information security authority and 
coordination 
‘‘(a) IN GENERAL.—The Secretary, in consultation 
with the Secretary of Homeland Security, shall— 
‘‘(1) issue compulsory and binding policies and 
directives governing agency information security op-
erations, and require implementation of such policies 
and directives, including— 
‘‘(A) policies and directives consistent with 
the standards and guidelines promulgated 
under section 11331 of title 40 to identify and 
provide 
information 
security 
protections 
prioritized and commensurate with the risk and 
impact resulting from the unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00040
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(i) information collected or main-
tained by or on behalf of an agency; or 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
an agency or other organization on behalf 
of an agency; 
‘‘(B) minimum operational requirements 
for the Federal Government to protect agency 
information systems and provide common situa-
tional awareness across all agency information 
systems; 
‘‘(C) reporting requirements, consistent 
with relevant law, regarding information secu-
rity incidents and cyber threat information; 
‘‘(D) requirements for agencywide informa-
tion security programs; 
‘‘(E) 
performance 
requirements 
and 
metrics for the security of agency information 
systems; 
‘‘(F) training requirements to ensure that 
agencies are able to fully and timely comply 
with the policies and directives issued by the 
Secretary under this subchapter; 
‘‘(G) training requirements regarding pri-
vacy, civil rights, and civil liberties, and infor-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00041
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
mation oversight for agency information secu-
rity personnel; 
‘‘(H) requirements for the annual reports 
to the Secretary under section 3554(d); 
‘‘(I) any other information security oper-
ations or information security requirements as 
determined by the Secretary in coordination 
with relevant agency heads; and 
‘‘(J) coordinating the development of 
standards and guidelines under section 20 of 
the National Institute of Standards and Tech-
nology Act (15 U.S.C. 278g–3) with agencies 
and offices operating or exercising control of 
national security systems (including the Na-
tional Security Agency) to assure, to the max-
imum extent feasible, that such standards and 
guidelines are complementary with standards 
and guidelines developed for national security 
systems; 
‘‘(2) review the agencywide information security 
programs under section 3554; and 
‘‘(3) designate an individual or an entity at 
each cybersecurity center, among other responsibil-
ities— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00042
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(A) to receive reports and information 
about information security incidents, cyber 
threat information, and deterioration of security 
control affecting agency information systems; 
and 
‘‘(B) to act on or share the information 
under subparagraph (A) in accordance with this 
subchapter. 
‘‘(b) CONSIDERATIONS.—When issuing policies and 
directives under subsection (a), the Secretary shall con-
sider any applicable standards or guidelines developed by 
the National Institute of Standards and Technology under 
section 11331 of title 40. 
‘‘(c) LIMITATION OF AUTHORITY.—The authorities 
of the Secretary under this section shall not apply to na-
tional security systems. Information security policies, di-
rectives, standards and guidelines for national security 
systems shall be overseen as directed by the President and, 
in accordance with that direction, carried out under the 
authority of the heads of agencies that operate or exercise 
authority over such national security systems. 
‘‘(d) STATUTORY CONSTRUCTION.—Nothing in this 
subchapter shall be construed to alter or amend any law 
regarding the authority of any head of an agency over 
such agency. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00043
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘§ 3554. Agency responsibilities 
‘‘(a) IN GENERAL.—The head of each agency shall— 
‘‘(1) be responsible for— 
‘‘(A) complying with the policies and direc-
tives issued under section 3553; 
‘‘(B) providing information security protec-
tions commensurate with the risk resulting 
from unauthorized access, use, disclosure, dis-
ruption, modification, or destruction of— 
‘‘(i) information collected or main-
tained by the agency or by a contractor of 
an agency or other organization on behalf 
of an agency; and 
‘‘(ii) information systems used or op-
erated by an agency or by a contractor of 
an agency or other organization on behalf 
of an agency; 
‘‘(C) complying with the requirements of 
this subchapter, including— 
‘‘(i) information security standards 
and guidelines promulgated under section 
11331 of title 40; 
‘‘(ii) for any national security systems 
operated or controlled by that agency, in-
formation 
security 
policies, 
directives, 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00044
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
mation, and deterioration of security controls to 
the individual or entity designated at each cy-
bersecurity center and to other appropriate en-
tities consistent with policies and directives for 
non-national security systems as prescribed 
under section 3553(a), including information to 
assist the entity designated under section 
3555(a) with the ongoing security analysis 
under section 3555; 
‘‘(2) ensure that each senior agency official pro-
vides information security for the information and 
information systems that support the operations and 
assets under the senior agency official’s control, in-
cluding by— 
‘‘(A) assessing the risk and impact that 
could result from the unauthorized access, use, 
disclosure, disruption, modification, or destruc-
tion of such information or information sys-
tems; 
‘‘(B) determining the level of information 
security appropriate to protect such information 
and information systems in accordance with 
policies and directives issued under section 
3553(a), and standards and guidelines promul-
gated under section 11331 of title 40 for infor-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00046
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
mation security classifications and related re-
quirements; 
‘‘(C) implementing policies, procedures, 
and capabilities to reduce risks to an acceptable 
level in a cost-effective manner; 
‘‘(D) actively monitoring the effective im-
plementation of information security controls 
and techniques; and 
‘‘(E) reporting information about informa-
tion security incidents, cyber threat informa-
tion, and deterioration of security controls in a 
timely and adequate manner to the entity des-
ignated under section 3553(a)(3) in accordance 
with paragraph (1); 
‘‘(3) assess and maintain the resiliency of infor-
mation technology systems critical to agency mission 
and operations; 
‘‘(4) designate the agency Inspector General (or 
an independent entity selected in consultation with 
the Director and the Council of Inspectors General 
on Integrity and Efficiency if the agency does not 
have an Inspector General) to conduct the annual 
independent evaluation required under section 3556, 
and allow the agency Inspector General to contract 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00047
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
with an independent entity to perform such evalua-
tion; 
‘‘(5) delegate to the Chief Information Officer 
or equivalent (or to a senior agency official who re-
ports to the Chief Information Officer or equiva-
lent)— 
‘‘(A) the authority and primary responsi-
bility to implement an agencywide information 
security program; and 
‘‘(B) the authority to provide information 
security for the information collected and main-
tained by the agency (or by a contractor, other 
agency, or other source on behalf of the agency) 
and for the information systems that support 
the operations, assets, and mission of the agen-
cy (including any information system provided 
or managed by a contractor, other agency, or 
other source on behalf of the agency); 
‘‘(6) delegate to the appropriate agency official 
(who is responsible for a particular agency system or 
subsystem) the responsibility to ensure and enforce 
compliance with all requirements of the agency’s 
agencywide information security program in coordi-
nation with the Chief Information Officer or equiva-
lent (or the senior agency official who reports to the 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00048
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
Chief Information Officer or equivalent) under para-
graph (5); 
‘‘(7) ensure that an agency has trained per-
sonnel who have obtained any necessary security 
clearances to permit them to assist the agency in 
complying with this subchapter; 
‘‘(8) ensure that the Chief Information Officer 
or equivalent (or the senior agency official who re-
ports to the Chief Information Officer or equivalent) 
under paragraph (5), in coordination with other sen-
ior agency officials, reports to the agency head on 
the effectiveness of the agencywide information secu-
rity program, including the progress of any remedial 
actions; and 
‘‘(9) ensure that the Chief Information Officer 
or equivalent (or the senior agency official who re-
ports to the Chief Information Officer or equivalent) 
under paragraph (5) has the necessary qualifications 
to administer the functions described in this sub-
chapter and has information security duties as a pri-
mary duty of that official. 
‘‘(b) CHIEF INFORMATION OFFICERS.—Each Chief 
Information Officer or equivalent (or the senior agency of-
ficial who reports to the Chief Information Officer or 
equivalent) under subsection (a)(5) shall— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00049
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(1) establish and maintain an enterprise secu-
rity operations capability that on a continuous 
basis— 
‘‘(A) detects, reports, contains, mitigates, 
and responds to information security incidents 
that impair adequate security of the agency’s 
information or information system in a timely 
manner and in accordance with the policies and 
directives under section 3553; and 
‘‘(B) reports any information security inci-
dent under subparagraph (A) to the entity des-
ignated under section 3555; 
‘‘(2) develop, maintain, and oversee an agency-
wide information security program; 
‘‘(3) develop, maintain, and oversee information 
security policies, procedures, and control techniques 
to address applicable requirements, including re-
quirements under section 3553 of this title and sec-
tion 11331 of title 40; and 
‘‘(4) train and oversee the agency personnel 
who have significant responsibility for information 
security with respect to that responsibility. 
‘‘(c) AGENCYWIDE INFORMATION SECURITY PRO-
GRAMS.— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00050
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(1) IN GENERAL.—Each agencywide informa-
tion security program under subsection (b)(2) shall 
include— 
‘‘(A) relevant security risk assessments, in-
cluding technical assessments and others re-
lated to the acquisition process; 
‘‘(B) security testing commensurate with 
risk and impact; 
‘‘(C) mitigation of deterioration of security 
controls commensurate with risk and impact; 
‘‘(D) risk-based continuous monitoring and 
threat assessment of the operational status and 
security of agency information systems to en-
able evaluation of the effectiveness of and com-
pliance with information security policies, proce-
dures, and practices, including a relevant and 
appropriate selection of security controls of in-
formation systems identified in the inventory 
under section 3505(c); 
‘‘(E) operation of appropriate technical ca-
pabilities in order to detect, mitigate, report, 
and respond to information security incidents, 
cyber threat information, and deterioration of 
security controls in a manner that is consistent 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00051
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
with the policies and directives under section 
3553, including— 
‘‘(i) mitigating risks associated with 
such information security incidents; 
‘‘(ii) notifying and consulting with the 
entity designated under section 3555; and 
‘‘(iii) notifying and consulting with, as 
appropriate— 
‘‘(I) law enforcement and the rel-
evant Office of the Inspector General; 
and 
‘‘(II) any other entity, in accord-
ance with law and as directed by the 
President; 
‘‘(F) a process to ensure that remedial ac-
tion is taken to address any deficiencies in the 
information security policies, procedures, and 
practices of the agency; and 
‘‘(G) a plan and procedures to ensure the 
continuity of operations for information systems 
that support the operations and assets of the 
agency. 
‘‘(2) RISK
MANAGEMENT
STRATEGIES.—Each 
agencywide information security program under sub-
section (b)(2) shall include the development and 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00052
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
maintenance of a risk management strategy for in-
formation security. The risk management strategy 
shall include— 
‘‘(A) consideration of information security 
incidents, cyber threat information, and deterio-
ration of security controls; and 
‘‘(B) consideration of the consequences 
that could result from the unauthorized access, 
use, disclosure, disruption, modification, or de-
struction of information and information sys-
tems that support the operations and assets of 
the agency, including any information system 
provided or managed by a contractor, other 
agency, or other source on behalf of the agency. 
‘‘(3) POLICIES AND PROCEDURES.—Each agen-
cywide information security program under sub-
section (b)(2) shall include policies and procedures 
that— 
‘‘(A) are based on the risk management 
strategy under paragraph (2); 
‘‘(B) reduce information security risks to 
an acceptable level in a cost-effective manner; 
‘‘(C) ensure that cost-effective and ade-
quate information security is addressed as part 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00053
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
of the acquisition and ongoing management of 
each agency information system; and 
‘‘(D) ensure compliance with— 
‘‘(i) this subchapter; and 
‘‘(ii) any other applicable require-
ments. 
‘‘(4) TRAINING REQUIREMENTS.—Each agency-
wide information security program under subsection 
(b)(2) shall include information security, privacy, 
civil rights, civil liberties, and information oversight 
training that meets any applicable requirements 
under section 3553. The training shall inform each 
information security personnel that has access to 
agency information systems (including contractors 
and other users of information systems that support 
the operations and assets of the agency) of— 
‘‘(A) the information security risks associ-
ated with the information security personnel’s 
activities; and 
‘‘(B) the individual’s responsibility to com-
ply with the agency policies and procedures that 
reduce the risks under subparagraph (A). 
‘‘(d) ANNUAL REPORT.—Each agency shall submit a 
report annually to the Secretary of Homeland Security on 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00054
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
its agencywide information security program and informa-
tion systems. 
‘‘§ 3555. Multiagency ongoing threat assessment 
‘‘(a) IMPLEMENTATION.—The Director of the Office 
of Management and Budget, in coordination with the Sec-
retary of Homeland Security, shall designate an entity to 
implement ongoing security analysis concerning agency in-
formation systems— 
‘‘(1) based on cyber threat information; 
‘‘(2) based on agency information system and 
environment of operation changes, including— 
‘‘(A) an ongoing evaluation of the informa-
tion system security controls; and 
‘‘(B) the security state, risk level, and en-
vironment of operation of an agency informa-
tion system, including— 
‘‘(i) a change in risk level due to a 
new cyber threat; 
‘‘(ii) a change resulting from a new 
technology; 
‘‘(iii) a change resulting from the 
agency’s mission; and 
‘‘(iv) a change resulting from the 
business practice; and 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00055
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(3) using automated processes to the max-
imum extent possible— 
‘‘(A) to increase information system secu-
rity; 
‘‘(B) to reduce paper-based reporting re-
quirements; and 
‘‘(C) to maintain timely and actionable 
knowledge of the state of the information sys-
tem security. 
‘‘(b) STANDARDS.—The National Institute of Stand-
ards and Technology may promulgate standards, in co-
ordination with the Secretary of Homeland Security, to 
assist an agency with its duties under this section. 
‘‘(c) COMPLIANCE.—The head of each appropriate 
department and agency shall be responsible for ensuring 
compliance and implementing necessary procedures to 
comply with this section. The head of each appropriate 
department and agency, in consultation with the Director 
of the Office of Management and Budget and the Sec-
retary of Homeland Security, shall— 
‘‘(1) monitor compliance under this section; 
‘‘(2) develop a timeline and implement for the 
department or agency— 
‘‘(A) adoption of any technology, system, 
or method that facilitates continuous moni-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00056
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
toring and threat assessments of an agency in-
formation system; 
‘‘(B) adoption or updating of any tech-
nology, system, or method that prevents, de-
tects, or remediates a significant cyber incident 
to a Federal information system of the depart-
ment or agency that has impeded, or is reason-
ably likely to impede, the performance of a crit-
ical mission of the department or agency; and 
‘‘(C) adoption of any technology, system, 
or method that satisfies a requirement under 
this section. 
‘‘(d) LIMITATION OF AUTHORITY.—The authorities 
of the Director of the Office of Management and Budget 
and of the Secretary of Homeland Security under this sec-
tion shall not apply to national security systems. 
‘‘(e) REPORT.—Not later than 6 months after the 
date of enactment of the Strengthening and Enhancing 
Cybersecurity by Using Research, Education, Information, 
and Technology Act of 2013, the Government Account-
ability Office shall issue a report evaluating each agency’s 
status toward implementing this section. 
‘‘§ 3556. Independent evaluations 
‘‘(a) IN GENERAL.—The Council of the Inspectors 
General on Integrity and Efficiency, in consultation with 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00057
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
the Director and the Secretary of Homeland Security, the 
Secretary of Commerce, and the Secretary of Defense, 
shall issue and maintain criteria for the timely, cost-effec-
tive, risk-based, and independent evaluation of each agen-
cywide information security program (and practices) to de-
termine the effectiveness of the agencywide information 
security program (and practices). The criteria shall in-
clude measures to assess any conflicts of interest in the 
performance of the evaluation and whether the agencywide 
information security program includes appropriate safe-
guards against disclosure of information where such dis-
closure may adversely affect information security. 
‘‘(b) ANNUAL INDEPENDENT EVALUATIONS.—Each 
agency shall perform an annual independent evaluation of 
its agencywide information security program (and prac-
tices) in accordance with the criteria under subsection (a). 
‘‘(c) DISTRIBUTION OF REPORTS.—Not later than 30 
days after receiving an independent evaluation under sub-
section (b), each agency head shall transmit a copy of the 
independent evaluation to the Secretary of Homeland Se-
curity, the Secretary of Commerce, and the Secretary of 
Defense. 
‘‘(d) NATIONAL SECURITY SYSTEMS.—Evaluations 
involving national security systems shall be conducted as 
directed by President. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00058
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘§ 3557. National security systems. 
‘‘The head of each agency operating or exercising 
control of a national security system shall be responsible 
for ensuring that the agency— 
‘‘(1) provides information security protections 
commensurate with the risk and magnitude of the 
harm resulting from the unauthorized access, use, 
disclosure, disruption, modification, or destruction of 
the information contained in such system; and 
‘‘(2) implements information security policies 
and practices as required by standards and guide-
lines for national security systems, issued in accord-
ance with law and as directed by the President.’’. 
(b) SAVINGS PROVISIONS.— 
(1) POLICY AND COMPLIANCE GUIDANCE.—Pol-
icy and compliance guidance issued by the Director 
before the date of enactment of this Act under sec-
tion 3543(a)(1) of title 44, United States Code (as 
in effect on the day before the date of enactment of 
this Act), shall continue in effect, according to its 
terms, until modified, terminated, superseded, or re-
pealed pursuant to section 3553(a)(1) of title 44, 
United States Code. 
(2) STANDARDS AND GUIDELINES.—Standards 
and guidelines issued by the Secretary of Commerce 
or by the Director before the date of enactment of 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00059
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
this Act under section 11331(a)(1) of title 40, 
United States Code, (as in effect on the day before 
the date of enactment of this Act) shall continue in 
effect, according to their terms, until modified, ter-
minated, superseded, or repealed pursuant to section 
11331(a)(1) of title 40, United States Code, as 
amended by this Act. 
(c) TECHNICAL AND CONFORMING AMENDMENTS.— 
(1) CHAPTER ANALYSIS.—The chapter analysis 
for chapter 35 of title 44, United States Code, is 
amended— 
(A) by striking the items relating to sec-
tions 3531 through 3538; 
(B) by striking the items relating to sec-
tions 3541 through 3549; and 
(C) by inserting the following: 
‘‘3551. Purposes. 
‘‘3552. Definitions. 
‘‘3553. Federal information security authority and coordination. 
‘‘3554. Agency responsibilities. 
‘‘3555. Multiagency ongoing threat assessment. 
‘‘3556. Independent evaluations. 
‘‘3557. National security systems.’’. 
(2) OTHER REFERENCES.— 
(A) Section 1001(c)(1)(A) of the Home-
land Security Act of 2002 (6 U.S.C. 511(1)(A)) 
is amended by striking ‘‘section 3532(3)’’ and 
inserting ‘‘section 3552’’. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00060
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(B) Section 2222(j)(5) of title 10, United 
States Code, is amended by striking ‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552’’. 
(C) Section 2223(c)(3) of title 10, United 
States Code, is amended, by striking ‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552’’. 
(D) Section 2315 of title 10, United States 
Code, 
is 
amended 
by 
striking 
‘‘section 
3542(b)(2)’’ and inserting ‘‘section 3552’’. 
(E) Section 20 of the National Institute of 
Standards and Technology Act (15 U.S.C. 
278g–3) is amended— 
(i) in subsection (a)(2), by striking 
‘‘section 3532(b)(2)’’ and inserting ‘‘sec-
tion 3552’’; 
(ii) in subsection (c)(3), by striking 
‘‘Director of the Office of Management and 
Budget’’ and inserting ‘‘Secretary of Com-
merce’’; 
(iii) in subsection (d)(1), by striking 
‘‘Director of the Office of Management and 
Budget’’ and inserting ‘‘Secretary of Com-
merce’’; 
(iv) in subsection (d)(8) by striking 
‘‘Director of the Office of Management and 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00061
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
Budget’’ and inserting ‘‘Secretary of Com-
merce’’; 
(v) in subsection (d)(8), by striking 
‘‘submitted to the Director’’ and inserting 
‘‘submitted to the Secretary’’; 
(vi) in subsection (e)(2), by striking 
‘‘section 3532(1) of such title’’ and insert-
ing ‘‘section 3552 of title 44’’; and 
(vii) in subsection (e)(5), by striking 
‘‘section 3532(b)(2) of such title’’ and in-
serting ‘‘section 3552 of title 44’’. 
(F) Section 8(d)(1) of the Cyber Security 
Research and Development Act (15 U.S.C. 
7406(d)(1)) is amended by striking ‘‘section 
3534(b)’’ and inserting ‘‘section 3554(b)(2)’’. 
SEC. 202. MANAGEMENT OF INFORMATION TECHNOLOGY. 
(a) IN GENERAL.—Section 11331 of title 40, United 
States Code, is amended to read as follows: 
‘‘§ 11331. Responsibilities for Federal information sys-
tems standards 
‘‘(a) STANDARDS AND GUIDELINES.— 
‘‘(1) AUTHORITY
TO
PRESCRIBE.—Except as 
provided under paragraph (2), the Secretary of 
Commerce shall prescribe standards and guidelines 
pertaining to Federal information systems— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00062
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(A) in consultation with the Secretary of 
Homeland Security; and 
‘‘(B) on the basis of standards and guide-
lines developed by the National Institute of 
Standards and Technology under paragraphs 
(2) and (3) of section 20(a) of the National In-
stitute of Standards and Technology Act (15 
U.S.C. 278g–3(a)(2) and (a)(3)). 
‘‘(2) NATIONAL
SECURITY
SYSTEMS.—Stand-
ards and guidelines for national security systems 
shall be developed, prescribed, enforced, and over-
seen as otherwise authorized by law and as directed 
by the President. 
‘‘(b) MANDATORY STANDARDS AND GUIDELINES.— 
‘‘(1) AUTHORITY TO MAKE MANDATORY STAND-
ARDS
AND
GUIDELINES.—The Secretary of Com-
merce shall make standards and guidelines under 
subsection (a)(1) compulsory and binding to the ex-
tent determined necessary by the Secretary of Com-
merce to improve the efficiency of operation or secu-
rity of Federal information systems. 
‘‘(2) REQUIRED MANDATORY STANDARDS AND 
GUIDELINES.— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00063
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(A) IN GENERAL.—Standards and guide-
lines under subsection (a)(1) shall include infor-
mation security standards that— 
‘‘(i) provide minimum information se-
curity requirements as determined under 
section 20(b) of the National Institute of 
Standards and Technology Act (15 U.S.C. 
278g–3(b)); and 
‘‘(ii) are otherwise necessary to im-
prove the security of Federal information 
and information systems. 
‘‘(B) BINDING EFFECT.—Information se-
curity standards under subparagraph (A) shall 
be compulsory and binding. 
‘‘(c) EXERCISE OF AUTHORITY.—To ensure fiscal 
and policy consistency, the Secretary of Commerce shall 
exercise the authority conferred by this section subject to 
direction by the President and in coordination with the 
Director. 
‘‘(d) APPLICATION
OF MORE STRINGENT STAND-
ARDS AND GUIDELINES.—The head of an executive agen-
cy may employ standards for the cost-effective information 
security for information systems within or under the su-
pervision of that agency that are more stringent than the 
standards and guidelines the Secretary of Commerce pre-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00064
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
scribes under this section if the more stringent standards 
and guidelines— 
‘‘(1) contain at least the applicable standards 
and guidelines made compulsory and binding by the 
Secretary of Commerce; and 
‘‘(2) are otherwise consistent with the policies, 
directives, and implementation memoranda issued 
under section 3553(a) of title 44. 
‘‘(e) DECISIONS ON PROMULGATION OF STANDARDS 
AND GUIDELINES.—The decision by the Secretary of 
Commerce regarding the promulgation of any standard or 
guideline under this section shall occur not later than 6 
months after the date of submission of the proposed stand-
ard to the Secretary of Commerce by the National Insti-
tute of Standards and Technology under section 20 of the 
National Institute of Standards and Technology Act (15 
U.S.C. 278g–3). 
‘‘(f) NOTICE AND COMMENT.—A decision by the Sec-
retary of Commerce to significantly modify, or not promul-
gate, a proposed standard submitted to the Secretary by 
the National Institute of Standards and Technology under 
section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) shall be made after 
the public is given an opportunity to comment on the Sec-
retary’s proposed decision. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00065
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(g) DEFINITIONS.—In this section: 
‘‘(1) FEDERAL
INFORMATION
SYSTEM.—The 
term ‘Federal information system’ has the meaning 
given the term in section 3552 of title 44. 
‘‘(2) INFORMATION SECURITY.—The term ‘in-
formation security’ has the meaning given the term 
in section 3552 of title 44. 
‘‘(3) NATIONAL SECURITY SYSTEM.—The term 
‘national security system’ has the meaning given the 
term in section 3552 of title 44.’’. 
SEC. 203. NO NEW FUNDING. 
An applicable Federal agency shall carry out the pro-
visions of this title with existing facilities and funds other-
wise available, through such means as the head of the 
agency considers appropriate. 
SEC. 204. TECHNICAL AND CONFORMING AMENDMENTS. 
Section 21(b) of the National Institute of Standards 
and Technology Act (15 U.S.C. 278g–4(b)) is amended— 
(1) in paragraph (2), by striking ‘‘and the Di-
rector of the Office of Management and Budget’’ 
and inserting ‘‘, the Secretary of Commerce, and the 
Secretary of Homeland Security’’; and 
(2) in paragraph (3), by inserting ‘‘, the Sec-
retary of Homeland Security,’’ after ‘‘the Secretary 
of Commerce’’. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00066
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
SEC. 205. CLARIFICATION OF AUTHORITIES. 
Nothing in this title shall be construed to convey any 
new regulatory authority to any government entity imple-
menting or complying with any provision of this title. 
TITLE III—CRIMINAL PENALTIES 
SEC. 301. PENALTIES FOR FRAUD AND RELATED ACTIVITY 
IN CONNECTION WITH COMPUTERS. 
Section 1030(c) of title 18, United States Code, is 
amended to read as follows: 
‘‘(c) The punishment for an offense under subsection 
(a) or (b) of this section is— 
‘‘(1) a fine under this title or imprisonment for 
not more than 20 years, or both, in the case of an 
offense under subsection (a)(1) of this section; 
‘‘(2)(A) except as provided in subparagraph 
(B), a fine under this title or imprisonment for not 
more than 3 years, or both, in the case of an offense 
under subsection (a)(2); or 
‘‘(B) a fine under this title or imprison-
ment for not more than ten years, or both, in 
the case of an offense under subsection (a)(2) 
of this section, if— 
‘‘(i) the offense was committed for 
purposes of commercial advantage or pri-
vate financial gain; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00067
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(ii) the offense was committed in the 
furtherance of any criminal or tortious act 
in violation of the Constitution or laws of 
the United States, or of any State; or 
‘‘(iii) the value of the information ob-
tained, or that would have been obtained if 
the offense was completed, exceeds $5,000; 
‘‘(3) a fine under this title or imprisonment for 
not more than 10 years, or both, in the case of an 
offense under subsection (a)(3) of this section; 
‘‘(4) a fine under this title or imprisonment of 
not more than 20 years, or both, in the case of an 
offense under subsection (a)(4) of this section; 
‘‘(5)(A) except as provided in subparagraph 
(C), a fine under this title, imprisonment for not 
more than 20 years, or both, in the case of an of-
fense under subsection (a)(5)(A) of this section, if 
the offense caused— 
‘‘(i) loss to 1 or more persons during 
any 1-year period (and, for purposes of an 
investigation, prosecution, or other pro-
ceeding brought by the United States only, 
loss resulting from a related course of con-
duct affecting 1 or more other protected 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00068
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
computers) aggregating at least $5,000 in 
value; 
‘‘(ii) the modification or impairment, 
or potential modification or impairment, of 
the medical examination, diagnosis, treat-
ment, or care of 1 or more individuals; 
‘‘(iii) physical injury to any person; 
‘‘(iv) a threat to public health or safe-
ty; 
‘‘(v) damage affecting a computer 
used by, or on behalf of, an entity of the 
United States Government in furtherance 
of the administration of justice, national 
defense, or national security; or 
‘‘(vi) damage affecting 10 or more 
protected computers during any 1-year pe-
riod; 
‘‘(B) a fine under this title, imprisonment 
for not more than 20 years, or both, in the case 
of an offense under subsection (a)(5)(B), if the 
offense caused a harm provided in clause (i) 
through (vi) of subparagraph (A) of this sub-
section; 
‘‘(C) if the offender attempts to cause or 
knowingly or recklessly causes death from con-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00069
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
duct in violation of subsection (a)(5)(A), a fine 
under this title, imprisonment for any term of 
years or for life, or both; 
‘‘(D) a fine under this title, imprisonment 
for not more than 10 years, or both, for any 
other offense under subsection (a)(5); 
‘‘(E) a fine under this title or imprison-
ment for not more than 10 years, or both, in 
the case of an offense under subsection (a)(6) 
of this section; or 
‘‘(F) a fine under this title or imprison-
ment for not more than 10 years, or both, in 
the case of an offense under subsection (a)(7) 
of this section.’’. 
SEC. 302. TRAFFICKING IN PASSWORDS. 
Section 1030(a)(6) of title 18, United States Code, 
is amended to read as follows: 
‘‘(6) knowingly and with intent to defraud traf-
fics (as defined in section 1029) in any password or 
similar information or means of access through 
which a protected computer (as defined in subpara-
graphs (A) and (B) of subsection (e)(2)) may be 
accessed without authorization.’’. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00070
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
SEC. 
303. 
CONSPIRACY 
AND 
ATTEMPTED 
COMPUTER 
FRAUD OFFENSES. 
Section 1030(b) of title 18, United States Code, is 
amended by inserting ‘‘as if for the completed offense’’ 
after ‘‘punished as provided’’. 
SEC. 304. CRIMINAL AND CIVIL FORFEITURE FOR FRAUD 
AND RELATED ACTIVITY IN CONNECTION 
WITH COMPUTERS. 
Section 1030 of title 18, United States Code, is 
amended by striking subsections (i) and (j) and inserting 
the following: 
‘‘(i) CRIMINAL FORFEITURE.— 
‘‘(1) The court, in imposing sentence on any 
person convicted of a violation of this section, or 
convicted of conspiracy to violate this section, shall 
order, in addition to any other sentence imposed and 
irrespective of any provision of State law, that such 
person forfeit to the United States— 
‘‘(A) such persons interest in any property, 
real or personal, that was used, or intended to 
be used, to commit or facilitate the commission 
of such violation; and 
‘‘(B) any property, real or personal, consti-
tuting or derived from any gross proceeds, or 
any property traceable to such property, that 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00071
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
such person obtained, directly or indirectly, as 
a result of such violation. 
‘‘(2) The criminal forfeiture of property under 
this subsection, including any seizure and disposition 
of the property, and any related judicial or adminis-
trative proceeding, shall be governed by the provi-
sions of section 413 of the Comprehensive Drug 
Abuse Prevention and Control Act of 1970 (21 
U.S.C. 853), except subsection (d) of that section. 
‘‘(j) CIVIL FORFEITURE.— 
‘‘(1) The following shall be subject to forfeiture 
to the United States and no property right, real or 
personal, shall exist in them: 
‘‘(A) Any property, real or personal, that 
was used, or intended to be used, to commit or 
facilitate the commission of any violation of this 
section, or a conspiracy to violate this section. 
‘‘(B) Any property, real or personal, con-
stituting or derived from any gross proceeds ob-
tained directly or indirectly, or any property 
traceable to such property, as a result of the 
commission of any violation of this section, or 
a conspiracy to violate this section. 
‘‘(2) Seizures and forfeitures under this sub-
section shall be governed by the provisions in chap-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00072
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
ter 46 relating to civil forfeitures, except that such 
duties as are imposed on the Secretary of the Treas-
ury under the customs laws described in section 
981(d) shall be performed by such officers, agents 
and other persons as may be designated for that 
purpose by the Secretary of Homeland Security or 
the Attorney General.’’. 
SEC. 305. DAMAGE TO CRITICAL INFRASTRUCTURE COM-
PUTERS. 
(a) IN GENERAL.—Chapter 47 of title 18, United 
States Code, is amended by inserting after section 1030 
the following: 
‘‘§ 1030A. Aggravated damage to a critical infrastruc-
ture computer 
‘‘(a) DEFINITIONS.—In this section— 
‘‘(1) the term ‘computer’ has the meaning given 
the term in section 1030; 
‘‘(2) the term ‘critical infrastructure computer’ 
means a computer that manages or controls systems 
or assets vital to national defense, national security, 
national economic security, public health or safety, 
or any combination of those matters, whether pub-
licly or privately owned or operated, including— 
‘‘(A) oil and gas production, storage, con-
version, and delivery systems; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00073
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(B) water supply systems; 
‘‘(C) telecommunication networks; 
‘‘(D) electrical power generation and deliv-
ery systems; 
‘‘(E) finance and banking systems; 
‘‘(F) emergency services; 
‘‘(G) transportation systems and services; 
and 
‘‘(H) government operations that provide 
essential services to the public; and 
‘‘(3) the term ‘damage’ has the meaning given 
the term in section 1030. 
‘‘(b) OFFENSE.—It shall be unlawful, during and in 
relation to a felony violation of section 1030, to knowingly 
cause or attempt to cause damage to a critical infrastruc-
ture computer if the damage results in (or, in the case 
of an attempt, if completed, would have resulted in) the 
substantial impairment— 
‘‘(1) of the operation of the critical infrastruc-
ture computer; or 
‘‘(2) of the critical infrastructure associated 
with the computer. 
‘‘(c) PENALTY.—Any person who violates subsection 
(b) shall be— 
‘‘(1) fined under this title; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00074
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(2) imprisoned for not less than 3 years but 
not more than 20 years; or 
‘‘(3) penalized under paragraphs (1) and (2). 
‘‘(d) CONSECUTIVE
SENTENCE.—Notwithstanding 
any other provision of law— 
‘‘(1) a court shall not place on probation any 
person convicted of a violation of this section; 
‘‘(2) except as provided in paragraph (4), no 
term of imprisonment imposed on a person under 
this section shall run concurrently with any other 
term of imprisonment, including any term of impris-
onment imposed on the person under any other pro-
vision of law, including any term of imprisonment 
imposed for a felony violation of section 1030; 
‘‘(3) in determining any term of imprisonment 
to be imposed for a felony violation of section 1030, 
a court shall not in any way reduce the term to be 
imposed for such crime so as to compensate for, or 
otherwise take into account, any separate term of 
imprisonment imposed or to be imposed for a viola-
tion of this section; and 
‘‘(4) a term of imprisonment imposed on a per-
son for a violation of this section may, in the discre-
tion of the court, run concurrently, in whole or in 
part, only with another term of imprisonment that 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00075
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
is imposed by the court at the same time on that 
person for an additional violation of this section, 
provided that such discretion shall be exercised in 
accordance with any applicable guidelines and policy 
statements issued by the United States Sentencing 
Commission pursuant to section 994 of title 28.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The chapter analysis for chapter 47 of title 18, United 
States Code, is amended by inserting after the item relat-
ing to section 1030 the following: 
‘‘1030A. Aggravated damage to a critical infrastructure computer.’’. 
SEC. 306. LIMITATION ON ACTIONS INVOLVING UNAUTHOR-
IZED USE. 
Section 1030(e)(6) of title 18, United States Code, 
is amended by striking ‘‘alter;’’ and inserting ‘‘alter, but 
does not include access in violation of a contractual obliga-
tion or agreement, such as an acceptable use policy or 
terms of service agreement, with an Internet service pro-
vider, Internet website, or non-government employer, if 
such violation constitutes the sole basis for determining 
that access to a protected computer is unauthorized;’’. 
SEC. 307. NO NEW FUNDING. 
An applicable Federal agency shall carry out the pro-
visions of this title with existing facilities and funds other-
wise available, through such means as the head of the 
agency considers appropriate. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00076
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
TITLE IV—CYBERSECURITY 
RESEARCH AND DEVELOPMENT 
SEC. 401. NATIONAL HIGH-PERFORMANCE COMPUTING 
PROGRAM PLANNING AND COORDINATION. 
(a) GOALS AND PRIORITIES.—Section 101 of the 
High-Performance Computing Act of 1991 (15 U.S.C. 
5511) is amended by adding at the end the following: 
‘‘(d) GOALS AND PRIORITIES.—The goals and prior-
ities for Federal high-performance computing research, 
development, networking, and other activities under sub-
section (a)(2)(A) shall include— 
‘‘(1) encouraging and supporting mechanisms 
for interdisciplinary research and development in 
networking and information technology, including— 
‘‘(A) through collaborations across agen-
cies; 
‘‘(B) through collaborations across Pro-
gram Component Areas; 
‘‘(C) through collaborations with industry; 
‘‘(D) through collaborations with institu-
tions of higher education; 
‘‘(E) through collaborations with Federal 
laboratories (as defined in section 4 of the Ste-
venson-Wydler Technology Innovation Act of 
1980 (15 U.S.C. 3703)); and 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00077
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(F) through collaborations with inter-
national organizations; 
‘‘(2) addressing national, multi-agency, multi- 
faceted challenges of national importance; and 
‘‘(3) fostering the transfer of research and de-
velopment results into new technologies and applica-
tions for the benefit of society.’’. 
(b) DEVELOPMENT OF STRATEGIC PLAN.—Section 
101 of the High-Performance Computing Act of 1991 (15 
U.S.C. 5511) is amended by adding at the end the fol-
lowing: 
‘‘(e) STRATEGIC PLAN.— 
‘‘(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of the Strengthening and En-
hancing Cybersecurity by Using Research, Edu-
cation, Information, and Technology Act of 2013, 
the agencies under subsection (a)(3)(B), working 
through the National Science and Technology Coun-
cil and with the assistance of the Office of Science 
and Technology Policy shall develop a 5-year stra-
tegic plan to guide the activities under subsection 
(a)(1). 
‘‘(2) CONTENTS.—The strategic plan shall 
specify— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00078
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(A) the near-term objectives for the Pro-
gram; 
‘‘(B) the long-term objectives for the Pro-
gram; 
‘‘(C) the anticipated time frame for achiev-
ing the near-term objectives; 
‘‘(D) the metrics that will be used to as-
sess any progress made toward achieving the 
near-term objectives and the long-term objec-
tives; and 
‘‘(E) how the Program will achieve the 
goals and priorities under subsection (d). 
‘‘(3) IMPLEMENTATION ROADMAP.— 
‘‘(A) IN
GENERAL.—The agencies under 
subsection (a)(3)(B) shall develop and annually 
update an implementation roadmap for the 
strategic plan. 
‘‘(B) REQUIREMENTS.—The information in 
the implementation roadmap shall be coordi-
nated with the database under section 102(c) 
and the annual report under section 101(a)(3). 
The implementation roadmap shall— 
‘‘(i) specify the role of each Federal 
agency in carrying out or sponsoring re-
search and development to meet the re-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00079
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
search objectives of the strategic plan, in-
cluding a description of how progress to-
ward the research objectives will be evalu-
ated, with consideration of any relevant 
recommendations of the advisory com-
mittee; 
‘‘(ii) specify the funding allocated to 
each major research objective of the stra-
tegic plan and the source of funding by 
agency for the current fiscal year; and 
‘‘(iii) estimate the funding required 
for each major research objective of the 
strategic plan for the next 3 fiscal years. 
‘‘(4) RECOMMENDATIONS.—The agencies under 
subsection (a)(3)(B) shall take into consideration 
when developing the strategic plan under paragraph 
(1) the recommendations of— 
‘‘(A) the advisory committee under sub-
section (b); and 
‘‘(B) 
the 
stakeholders 
under 
section 
102(a)(3). 
‘‘(5) REPORT TO CONGRESS.—The Director of 
the Office of Science and Technology Policy shall 
transmit the strategic plan under this subsection, in-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00080
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
cluding the implementation roadmap and any up-
dates under paragraph (3), to— 
‘‘(A) the advisory committee under sub-
section (b); 
‘‘(B) 
the 
Committee 
on 
Commerce, 
Science, and Transportation of the Senate; and 
‘‘(C) the Committee on Science and Tech-
nology of the House of Representatives.’’. 
(c) PERIODIC REVIEWS.—Section 101 of the High- 
Performance Computing Act of 1991 (15 U.S.C. 5511) 
is amended by adding at the end the following: 
‘‘(f) PERIODIC REVIEWS.—The agencies under sub-
section (a)(3)(B) shall— 
‘‘(1) periodically assess the contents and fund-
ing levels of the Program Component Areas and re-
structure the Program when warranted, taking into 
consideration any relevant recommendations of the 
advisory committee under subsection (b); and 
‘‘(2) ensure that the Program includes national, 
multi-agency, multi-faceted research and develop-
ment activities, including activities described in sec-
tion 104.’’. 
(d) ADDITIONAL RESPONSIBILITIES OF DIRECTOR.— 
Section 101(a)(2) of the High-Performance Computing 
Act of 1991 (15 U.S.C. 5511(a)(2)) is amended— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00081
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(1) by redesignating subparagraphs (E) and 
(F) as subparagraphs (G) and (H), respectively; and 
(2) by inserting after subparagraph (D) the fol-
lowing: 
‘‘(E) encourage and monitor the efforts of 
the agencies participating in the Program to al-
locate the level of resources and management 
attention necessary— 
‘‘(i) to ensure that the strategic plan 
under subsection (e) is developed and exe-
cuted effectively; and 
‘‘(ii) to ensure that the objectives of 
the Program are met; 
‘‘(F) working with the Office of Manage-
ment and Budget and in coordination with the 
creation of the database under section 102(c), 
direct the Office of Science and Technology Pol-
icy and the agencies participating in the Pro-
gram to establish a mechanism (consistent with 
existing law) to track all ongoing and completed 
research and development projects and associ-
ated funding;’’. 
(e) ADVISORY COMMITTEE.—Section 101(b) of the 
High-Performance Computing Act of 1991 (15 U.S.C. 
5511(b)) is amended— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00082
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(1) in paragraph (1)— 
(A) by inserting after the first sentence the 
following: ‘‘The co-chairs of the advisory com-
mittee shall meet the qualifications of com-
mittee members and may be members of the 
Presidents Council of Advisors on Science and 
Technology.’’; and 
(B) by striking ‘‘high-performance’’ in sub-
paragraph (D) and inserting ‘‘high-end’’; and 
(2) by amending paragraph (2) to read as fol-
lows: 
‘‘(2) In addition to the duties under paragraph 
(1), the advisory committee shall conduct periodic 
evaluations of the funding, management, coordina-
tion, implementation, and activities of the Program. 
The advisory committee shall report its findings and 
recommendations not less frequently than once every 
3 fiscal years to the Committee on Commerce, 
Science, and Transportation of the Senate and the 
Committee on Science and Technology of the House 
of Representatives. The report shall be submitted in 
conjunction with the update of the strategic plan.’’. 
(f) REPORT.—Section 101(a)(3) of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5511(a)(3)) 
is amended— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00083
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(1) in subparagraph (C)— 
(A) by striking ‘‘is submitted,’’ and insert-
ing ‘‘is submitted, the levels for the previous 
fiscal year,’’; and 
(B) by striking ‘‘each Program Component 
Area’’ and inserting ‘‘each Program Component 
Area and each research area supported in ac-
cordance with section 104’’; 
(2) in subparagraph (D)— 
(A) by striking ‘‘each Program Component 
Area,’’ and inserting ‘‘each Program Compo-
nent Area and each research area supported in 
accordance with section 104,’’; 
(B) by striking ‘‘is submitted,’’ and insert-
ing ‘‘is submitted, the levels for the previous 
fiscal year,’’; and 
(C) by striking ‘‘and’’ after the semicolon; 
(3) by redesignating subparagraph (E) as sub-
paragraph (G); and 
(4) by inserting after subparagraph (D) the fol-
lowing: 
‘‘(E) include a description of how the ob-
jectives for each Program Component Area, and 
the objectives for activities that involve multiple 
Program Component Areas, relate to the objec-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00084
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
tives of the Program identified in the strategic 
plan under subsection (e); 
‘‘(F) include— 
‘‘(i) a description of the funding re-
quired by the Office of Science and Tech-
nology Policy to perform the functions 
under subsections (a) and (c) of section 
102 for the next fiscal year by category of 
activity; 
‘‘(ii) a description of the funding re-
quired by the Office of Science and Tech-
nology Policy to perform the functions 
under subsections (a) and (c) of section 
102 for the current fiscal year by category 
of activity; and 
‘‘(iii) the amount of funding provided 
for the Office of Science and Technology 
Policy for the current fiscal year by each 
agency participating in the Program; and’’. 
(g) DEFINITIONS.—Section 4 of the High-Perform-
ance Computing Act of 1991 (15 U.S.C. 5503) is amend-
ed— 
(1) by redesignating paragraphs (1) and (2) as 
paragraphs (2) and (3), respectively; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00085
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(2) by redesignating paragraph (3) as para-
graph (6); 
(3) by redesignating paragraphs (6) and (7) as 
paragraphs (7) and (8), respectively; 
(4) by inserting before paragraph (2), as redes-
ignated, the following: 
‘‘(1) ‘cyber-physical systems’ means physical or 
engineered systems whose networking and informa-
tion technology functions and physical elements are 
deeply integrated and are actively connected to the 
physical world through sensors, actuators, or other 
means to perform monitoring and control func-
tions;’’; 
(5) in paragraph (3), as redesignated, by strik-
ing ‘‘high-performance computing’’ and inserting 
‘‘networking and information technology’’; 
(6) in paragraph (6), as redesignated— 
(A) by striking ‘‘high-performance com-
puting’’ and inserting ‘‘networking and infor-
mation technology’’; and 
(B) by striking ‘‘supercomputer’’ and in-
serting ‘‘high-end computing’’; 
(7) in paragraph (5), by striking ‘‘network re-
ferred to as’’ and all that follows through the semi-
colon and inserting ‘‘network, including advanced 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00086
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
computer networks of Federal agencies and depart-
ments’’; and 
(8) in paragraph (7), as redesignated, by strik-
ing ‘‘National High-Performance Computing Pro-
gram’’ and inserting ‘‘networking and information 
technology research and development program’’. 
SEC. 402. RESEARCH IN AREAS OF NATIONAL IMPORTANCE. 
(a) RESEARCH
IN AREAS
OF NATIONAL IMPOR-
TANCE.—Title I of the High-Performance Computing Act 
of 1991 (15 U.S.C. 5511 et seq.) is amended by adding 
at the end the following: 
‘‘SEC. 104. RESEARCH IN AREAS OF NATIONAL IMPOR-
TANCE. 
‘‘(a) IN GENERAL.—The Program shall encourage 
agencies under section 101(a)(3)(B) to support, maintain, 
and improve national, multi-agency, multi-faceted, re-
search and development activities in networking and infor-
mation technology directed toward application areas that 
have the potential for significant contributions to national 
economic competitiveness and for other significant societal 
benefits. 
‘‘(b) TECHNICAL SOLUTIONS.—An activity under 
subsection (a) shall be designed to advance the develop-
ment of research discoveries by demonstrating technical 
solutions to important problems in areas including— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00087
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(1) cybersecurity; 
‘‘(2) health care; 
‘‘(3) energy management and low-power sys-
tems and devices; 
‘‘(4) transportation, including surface and air 
transportation; 
‘‘(5) cyber-physical systems; 
‘‘(6) large-scale data analysis and modeling of 
physical phenomena; 
‘‘(7) large scale data analysis and modeling of 
behavioral phenomena; 
‘‘(8) supply chain quality and security; and 
‘‘(9) privacy protection and protected disclosure 
of confidential data. 
‘‘(c) RECOMMENDATIONS.—The advisory committee 
under section 101(b) shall make recommendations to the 
Program for candidate research and development areas for 
support under this section. 
‘‘(d) CHARACTERISTICS.— 
‘‘(1) IN GENERAL.—Research and development 
activities under this section— 
‘‘(A) shall include projects selected on the 
basis of applications for support through a com-
petitive, merit-based process; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00088
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(B) shall leverage, when possible, Federal 
investments through collaboration with related 
State initiatives; 
‘‘(C) shall include a plan for fostering the 
transfer of research discoveries and the results 
of technology demonstration activities, including 
from institutions of higher education and Fed-
eral laboratories, to industry for commercial de-
velopment; 
‘‘(D) shall involve collaborations among re-
searchers in institutions of higher education 
and industry; and 
‘‘(E) may involve collaborations among 
nonprofit research institutions and Federal lab-
oratories, as appropriate. 
‘‘(2) COST-SHARING.—In selecting applications 
for support, the agencies under section 101(a)(3)(B) 
shall give special consideration to projects that in-
clude cost sharing from non-Federal sources. 
‘‘(3) 
MULTIDISCIPLINARY
RESEARCH
CEN-
TERS.—Research and development activities under 
this section shall be supported through multidisci-
plinary research centers, including Federal labora-
tories, that are organized to investigate basic re-
search questions and carry out technology dem-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00089
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
onstration activities in areas described in subsection 
(a). Research may be carried out through existing 
multidisciplinary centers, including those authorized 
under section 7024(b)(2) of the America COM-
PETES Act (42 U.S.C. 1862o–10(2)).’’. 
(b) CYBER-PHYSICAL SYSTEMS.—Section 101(a)(1) 
of the High-Performance Computing Act of 1991 (15 
U.S.C. 5511(a)(1)) is amended— 
(1) in subparagraph (H), by striking ‘‘and’’ 
after the semicolon; 
(2) in subparagraph (I), by striking the period 
at the end and inserting a semicolon; and 
(3) by adding at the end the following: 
‘‘(J) provide for increased understanding 
of the scientific principles of cyber-physical sys-
tems and improve the methods available for the 
design, development, and operation of cyber- 
physical systems that are characterized by high 
reliability, safety, and security; and 
‘‘(K) provide for research and development 
on human-computer interactions, visualization, 
and big data.’’. 
(c) TASK FORCE.—Title I of the High-Performance 
Computing Act of 1991 (15 U.S.C. 5511 et seq.), as 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00090
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
amended by section 402(a) of this Act, is amended by add-
ing at the end the following: 
‘‘SEC. 105. TASK FORCE. 
‘‘(a) ESTABLISHMENT.—Not later than 180 days 
after the date of enactment the Strengthening and En-
hancing Cybersecurity by Using Research, Education, In-
formation, and Technology Act of 2013, the Director of 
the Office of Science and Technology Policy under section 
102 shall convene a task force to explore mechanisms for 
carrying out collaborative research and development activi-
ties for cyber-physical systems (including the related tech-
nologies required to enable these systems) through a con-
sortium or other appropriate entity with participants from 
institutions of higher education, Federal laboratories, and 
industry. 
‘‘(b) FUNCTIONS.—The task force shall— 
‘‘(1) develop options for a collaborative model 
and an organizational structure for such entity 
under which the joint research and development ac-
tivities could be planned, managed, and conducted 
effectively, including mechanisms for the allocation 
of resources among the participants in such entity 
for support of such activities; 
‘‘(2) propose a process for developing a re-
search and development agenda for such entity, in-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00091
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
cluding guidelines to ensure an appropriate scope of 
work focused on nationally significant challenges and 
requiring collaboration and to ensure the develop-
ment of related scientific and technological mile-
stones; 
‘‘(3) define the roles and responsibilities for the 
participants from institutions of higher education, 
Federal laboratories, and industry in such entity; 
‘‘(4) propose guidelines for assigning intellec-
tual property rights and for transferring research re-
sults to the private sector; and 
‘‘(5) make recommendations for how such enti-
ty could be funded from Federal, State, and non- 
governmental sources. 
‘‘(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the Office of Science 
and Technology Policy shall appoint an equal number of 
individuals from institutions of higher education and from 
industry with knowledge and expertise in cyber-physical 
systems, and may appoint not more than 2 individuals 
from Federal laboratories. 
‘‘(d) REPORT.—Not later than 1 year after the date 
of enactment of the Strengthening and Enhancing Cyber-
security by Using Research, Education, Information, and 
Technology Act of 2013, the Director of the Office of 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00092
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
Science and Technology Policy shall transmit to the Com-
mittee on Commerce, Science, and Transportation of the 
Senate and the Committee on Science and Technology of 
the House of Representatives a report describing the find-
ings and recommendations of the task force. 
‘‘(e) TERMINATION.—The task force shall terminate 
upon transmittal of the report required under subsection 
(d). 
‘‘(f) COMPENSATION AND EXPENSES.—Members of 
the task force shall serve without compensation.’’. 
SEC. 403. PROGRAM IMPROVEMENTS. 
Section 102 of the High-Performance Computing Act 
of 1991 (15 U.S.C. 5512) is amended to read as follows: 
‘‘SEC. 102. PROGRAM IMPROVEMENTS. 
‘‘(a) FUNCTIONS.—The Director of the Office of 
Science and Technology Policy shall continue— 
‘‘(1) to provide technical and administrative 
support to— 
‘‘(A) the agencies participating in planning 
and implementing the Program, including sup-
port needed to develop the strategic plan under 
section 101(e); and 
‘‘(B) the advisory committee under section 
101(b); 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00093
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(2) to serve as the primary point of contact on 
Federal networking and information technology ac-
tivities for government agencies, academia, industry, 
professional societies, State computing and net-
working technology programs, interested citizen 
groups, and others to exchange technical and pro-
grammatic information; 
‘‘(3) to solicit input and recommendations from 
a wide range of stakeholders during the development 
of each strategic plan under section 101(e) by con-
vening at least 1 workshop with invitees from aca-
demia, industry, Federal laboratories, and other rel-
evant organizations and institutions; 
‘‘(4) to conduct public outreach, including the 
dissemination of the advisory committee’s findings 
and recommendations, as appropriate; 
‘‘(5) to promote access to and early application 
of the technologies, innovations, and expertise de-
rived from Program activities to agency missions 
and systems across the Federal Government and to 
United States industry; 
‘‘(6) to ensure accurate and detailed budget re-
porting of networking and information technology 
research and development investment; and 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00094
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(7) to encourage agencies participating in the 
Program to use existing programs and resources to 
strengthen networking and information technology 
education and training, and increase participation in 
such fields, including by women and underrep-
resented minorities. 
‘‘(b) SOURCE OF FUNDING.— 
‘‘(1) IN GENERAL.—The functions under this 
section shall be supported by funds from each agen-
cy participating in the Program. 
‘‘(2) SPECIFICATIONS.—The portion of the total 
budget of the Office of Science and Technology Pol-
icy that is provided by each agency participating in 
the Program for each fiscal year shall be in the 
same proportion as each agency’s share of the total 
budget for the Program for the previous fiscal year, 
as specified in the database under section 102(c). 
‘‘(c) DATABASE.— 
‘‘(1) IN GENERAL.—The Director of the Office 
of Science and Technology Policy shall develop and 
maintain a database of projects funded by each 
agency for the fiscal year for each Program Compo-
nent Area. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00095
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(2) PUBLIC ACCESSIBILITY.—The Director of 
the Office of Science and Technology Policy shall 
make the database accessible to the public. 
‘‘(3) DATABASE
CONTENTS.—The database 
shall include, for each project in the database— 
‘‘(A) a description of the project; 
‘‘(B) each agency, industry, institution of 
higher education, Federal laboratory, or inter-
national institution involved in the project; 
‘‘(C) the source funding of the project (set 
forth by agency); 
‘‘(D) the funding history of the project; 
and 
‘‘(E) whether the project has been com-
pleted.’’. 
SEC. 404. IMPROVING EDUCATION OF NETWORKING AND 
INFORMATION 
TECHNOLOGY, 
INCLUDING 
HIGH PERFORMANCE COMPUTING. 
Section 201(a) of the High-Performance Computing 
Act of 1991 (15 U.S.C. 5521(a)) is amended— 
(1) by redesignating paragraphs (2) through 
(4) as paragraphs (3) through (5), respectively; and 
(2) by inserting after paragraph (1) the fol-
lowing: 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00096
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
‘‘(2) the National Science Foundation shall use 
its existing programs, in collaboration with other 
agencies, as appropriate, to improve the teaching 
and learning of networking and information tech-
nology at all levels of education and to increase par-
ticipation in networking and information technology 
fields;’’. 
SEC. 405. CONFORMING AND TECHNICAL AMENDMENTS TO 
THE HIGH-PERFORMANCE COMPUTING ACT 
OF 1991. 
(a) SECTION 3.—Section 3 of the High-Performance 
Computing Act of 1991 (15 U.S.C. 5502) is amended— 
(1) in the matter preceding paragraph (1), by 
striking ‘‘high-performance computing’’ and insert-
ing ‘‘networking and information technology’’; 
(2) in paragraph (1)— 
(A) in the matter preceding subparagraph 
(A), by striking ‘‘high-performance computing’’ 
and inserting ‘‘networking and information 
technology’’; 
(B) in subparagraphs (A), (F), and (G), by 
striking ‘‘high-performance computing’’ each 
place it appears and inserting ‘‘networking and 
information technology’’; and 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00097
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(C) in subparagraph (H), by striking 
‘‘high-performance’’ and inserting ‘‘high-end’’; 
and 
(3) in paragraph (2)— 
(A) by striking ‘‘high-performance com-
puting and’’ and inserting ‘‘networking and in-
formation technology, and’’; and 
(B) by striking ‘‘high-performance com-
puting network’’ and inserting ‘‘networking and 
information technology’’. 
(b) TITLE HEADING.—The heading of title I of the 
High-Performance Computing Act of 1991 (105 Stat. 
1595) is amended by striking ‘‘HIGH-PERFORM-
ANCE 
COMPUTING’’ 
and 
inserting 
‘‘NET-
WORKING 
AND 
INFORMATION 
TECH-
NOLOGY’’. 
(c) SECTION 101.—Section 101 of the High-Perform-
ance Computing Act of 1991 (15 U.S.C. 5511) is amend-
ed— 
(1) in the section heading, by striking ‘‘HIGH- 
PERFORMANCE
COMPUTING’’ 
and 
inserting 
‘‘NETWORKING
AND
INFORMATION
TECH-
NOLOGY RESEARCH AND DEVELOPMENT’’; 
(2) in subsection (a)— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00098
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
(A) in the subsection heading, by striking 
‘‘NATIONAL HIGH-PERFORMANCE COMPUTING’’ 
and inserting ‘‘NETWORKING
AND INFORMA-
TION TECHNOLOGY RESEARCH AND DEVELOP-
MENT’’; 
(B) in paragraph (1)— 
(i) by striking ‘‘National High-Per-
formance Computing Program’’ and insert-
ing ‘‘networking and information tech-
nology research and development pro-
gram’’; 
(ii) in subparagraph (A), by striking 
‘‘high-performance computing, including 
networking’’ and inserting ‘‘networking 
and information technology’’; 
(iii) in subparagraphs (B) and (G), by 
striking ‘‘high-performance’’ each place it 
appears and inserting ‘‘high-end’’; and 
(iv) in subparagraph (C), by striking 
‘‘high-performance computing and net-
working’’ and inserting ‘‘high-end com-
puting, distributed, and networking’’; and 
(C) in paragraph (2)— 
(i) in subparagraphs (A) and (C)— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00099
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
100 
(I) by striking ‘‘high-performance 
computing’’ each place it appears and 
inserting ‘‘networking and information 
technology’’; and 
(II) by striking ‘‘development, 
networking,’’ each place it appears 
and inserting ‘‘development,’’; and 
(ii) in subparagraphs (G) and (H), as 
redesignated by section 401(d) of this Act, 
by striking ‘‘high-performance’’ each place 
it appears and inserting ‘‘high-end’’; 
(3) in subsection (b)(1), in the matter pre-
ceding subparagraph (A), by striking ‘‘high-perform-
ance computing’’ each place it appears and inserting 
‘‘networking and information technology’’; and 
(4) in subsection (c)(1)(A), by striking ‘‘high- 
performance computing’’ and inserting ‘‘networking 
and information technology’’. 
(d) SECTION 201.—Section 201(a)(1) of the High- 
Performance Computing Act of 1991 (15 U.S.C. 
5521(a)(1)) is amended by striking ‘‘high-performance 
computing and advanced high-speed computer net-
working’’ and inserting ‘‘networking and information tech-
nology research and development’’. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00100
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
103 
(k) SECTION 208.—Section 208 of the High-Per-
formance Computing Act of 1991 (15 U.S.C. 5528) is 
amended— 
(1) in the section heading, by striking ‘‘HIGH- 
PERFORMANCE
COMPUTING’’ 
and 
inserting 
‘‘NETWORKING
AND
INFORMATION
TECH-
NOLOGY’’; and 
(2) in subsection (a)— 
(A) in paragraph (1), by striking ‘‘High- 
performance computing and associated’’ and in-
serting ‘‘Networking and information’’; 
(B) in paragraph (2), by striking ‘‘high- 
performance computing’’ and inserting ‘‘net-
working and information technologies’’; 
(C) in paragraph (3), by striking ‘‘high- 
performance’’ and inserting ‘‘high-end’’; 
(D) in paragraph (4), by striking ‘‘high- 
performance computers and associated’’ and in-
serting ‘‘networking and information’’; and 
(E) in paragraph (5), by striking ‘‘high- 
performance computing and associated’’ and in-
serting ‘‘networking and information’’. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00103
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
104 
SEC. 406. FEDERAL CYBER SCHOLARSHIP-FOR-SERVICE 
PROGRAM. 
(a) IN GENERAL.—The Director of the National 
Science Foundation, in coordination with the Secretary of 
Homeland Security, shall carry out a Federal cyber schol-
arship-for-service program to recruit and train the next 
generation of information technology professionals and se-
curity managers to meet the needs of the cybersecurity 
mission for the Federal Government. 
(b) PROGRAM DESCRIPTION AND COMPONENTS.— 
The program shall— 
(1) annually assess the workforce needs of the 
Federal Government for cybersecurity professionals, 
including network engineers, software engineers, and 
other experts in order to determine how many schol-
arships should be awarded annually to ensure that 
the workforce needs following graduation match the 
number of scholarships awarded; 
(2) provide scholarships for up to 1,000 stu-
dents per year in their pursuit of undergraduate or 
graduate degrees in the cybersecurity field, in an 
amount that may include coverage for full tuition, 
fees, and a stipend; 
(3) require each scholarship recipient, as a con-
dition of receiving a scholarship under the program, 
to serve in a Federal information technology work-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00104
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
105 
force for a period equal to one and one-half times 
each year, or partial year, of scholarship received, in 
addition to an internship in the cybersecurity field, 
if applicable, following graduation; 
(4) provide a procedure for the National 
Science Foundation or a Federal agency, consistent 
with regulations of the Office of Personnel Manage-
ment, to request and fund a security clearance for 
a scholarship recipient, including providing for clear-
ance during a summer internship and upon gradua-
tion; and 
(5) provide opportunities for students to receive 
temporary appointments for meaningful employment 
in the Federal information technology workforce 
during school vacation periods and for internships. 
(c) HIRING AUTHORITY.— 
(1) IN GENERAL.—For purposes of any law or 
regulation governing the appointment of an indi-
vidual in the Federal civil service, upon the success-
ful completion of the student’s studies, a student re-
ceiving a scholarship under the program may— 
(A) be hired under section 213.3102(r) of 
title 5, Code of Federal Regulations; and 
(B) be exempt from competitive service. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00105
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
106 
(2) COMPETITIVE SERVICE.—Upon satisfactory 
fulfillment of the service term under paragraph (1), 
an individual may be converted to a competitive 
service position without competition if the individual 
meets the requirements for that position. 
(d) ELIGIBILITY.—The eligibility requirements for a 
scholarship under this section shall include that a scholar-
ship applicant— 
(1) be a citizen of the United States; 
(2) be eligible to be granted a security clear-
ance; 
(3) maintain a grade point average of 3.2 or 
above on a 4.0 scale for undergraduate study or a 
3.5 or above on a 4.0 scale for postgraduate study; 
(4) demonstrate a commitment to a career in 
improving the security of the information infrastruc-
ture; and 
(5) has demonstrated a level of proficiency in 
math or computer sciences. 
(e) FAILURE
TO
COMPLETE
SERVICE
OBLIGA-
TION.— 
(1) IN
GENERAL.—A scholarship recipient 
under this section shall be liable to the United 
States under paragraph (2) if the scholarship recipi-
ent— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00106
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
107 
(A) fails to maintain an acceptable level of 
academic standing in the educational institution 
in which the individual is enrolled, as deter-
mined by the Director; 
(B) is dismissed from such educational in-
stitution for disciplinary reasons; 
(C) withdraws from the program for which 
the award was made before the completion of 
such program; 
(D) declares that the individual does not 
intend to fulfill the service obligation under this 
section; 
(E) fails to fulfill the service obligation of 
the individual under this section; or 
(F) loses a security clearance or becomes 
ineligible for a security clearance. 
(2) REPAYMENT AMOUNTS.— 
(A) LESS THAN 1 YEAR OF SERVICE.—If a 
circumstance under paragraph (1) occurs before 
the completion of 1 year of a service obligation 
under this section, the total amount of awards 
received by the individual under this section 
shall be repaid. 
(B) ONE OR MORE YEARS OF SERVICE.— 
If a circumstance described in subparagraph 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00107
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
108 
(D) or (E) of paragraph (1) occurs after the 
completion of 1 year of a service obligation 
under this section, the total amount of scholar-
ship awards received by the individual under 
this section, reduced by the ratio of the number 
of years of service completed divided by the 
number of years of service required, shall be re-
paid. 
(f) EVALUATION AND REPORT.—The Director of the 
National Science Foundation shall— 
(1) evaluate the success of recruiting individ-
uals for scholarships under this section and of hiring 
and retaining those individuals in the public sector 
workforce, including the annual cost and an assess-
ment of how the program actually improves the Fed-
eral workforce; and 
(2) periodically report the findings under para-
graph (1) to Congress. 
(g) AUTHORIZATION
OF APPROPRIATIONS.—From 
amounts made available under section 503 of the America 
COMPETES Reauthorization Act of 2010 (124 Stat. 
4005), the Secretary may use funds to carry out the re-
quirements of this section for fiscal years 2014 through 
2015. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00108
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
109 
SEC. 407. STUDY AND ANALYSIS OF CERTIFICATION AND 
TRAINING OF INFORMATION INFRASTRUC-
TURE PROFESSIONALS. 
(a) STUDY.—The President shall enter into an agree-
ment with the National Academies to conduct a com-
prehensive study of government, academic, and private- 
sector accreditation, training, and certification programs 
for personnel working in information infrastructure. The 
agreement shall require the National Academies to consult 
with sector coordinating councils and relevant govern-
mental agencies, regulatory entities, and nongovernmental 
organizations in the course of the study. 
(b) SCOPE.—The study shall include— 
(1) an evaluation of the body of knowledge and 
various skills that specific categories of personnel 
working in information infrastructure should possess 
in order to secure information systems; 
(2) an assessment of whether existing govern-
ment, academic, and private-sector accreditation, 
training, and certification programs provide the body 
of knowledge and various skills described in para-
graph (1); 
(3) an analysis of any barriers to the Federal 
Government recruiting and hiring cybersecurity tal-
ent, including barriers relating to compensation, the 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00109
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
110 
hiring process, job classification, and hiring flexi-
bility; and 
(4) an analysis of the sources and availability of 
cybersecurity talent, a comparison of the skills and 
expertise sought by the Federal Government and the 
private sector, an examination of the current and fu-
ture capacity of United States institutions of higher 
education, including community colleges, to provide 
current and future cybersecurity professionals, 
through education and training activities, with those 
skills sought by the Federal Government, State and 
local entities, and the private sector. 
(c) REPORT.—Not later than 1 year after the date 
of enactment of this Act, the National Academies shall 
submit to the President and Congress a report on the re-
sults of the study. The report shall include— 
(1) findings regarding the state of information 
infrastructure accreditation, training, and certifi-
cation programs, including specific areas of defi-
ciency and demonstrable progress; and 
(2) recommendations for the improvement of in-
formation infrastructure accreditation, training, and 
certification programs. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00110
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
111 
SEC. 408. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
(a) IN GENERAL.—The Director of the National In-
stitute of Standards and Technology, in coordination with 
appropriate Federal authorities, shall— 
(1) as appropriate, ensure coordination of Fed-
eral agencies engaged in the development of inter-
national technical standards related to information 
system security; and 
(2) not later than 1 year after the date of en-
actment of this Act, develop and transmit to Con-
gress a plan for ensuring such Federal agency co-
ordination. 
(b) CONSULTATION WITH THE PRIVATE SECTOR.— 
In carrying out the activities under subsection (a)(1), the 
Director shall ensure consultation with appropriate private 
sector stakeholders. 
SEC. 409. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director of the National Institute of Standards 
and Technology shall continue a program to support the 
development of technical standards, metrology, testbeds, 
and conformance criteria, taking into account appropriate 
user concerns— 
(1) to improve interoperability among identity 
management technologies; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00111
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
112 
(2) to strengthen authentication methods of 
identity management systems; 
(3) to improve privacy protection in identity 
management systems, including health information 
technology systems, through authentication and se-
curity protocols; and 
(4) to improve the usability of identity manage-
ment systems. 
SEC. 410. FEDERAL CYBERSECURITY RESEARCH AND DE-
VELOPMENT. 
(a) NATIONAL SCIENCE FOUNDATION COMPUTER 
AND NETWORK SECURITY RESEARCH GRANT AREAS.— 
Section 4(a)(1) of the Cyber Security Research and Devel-
opment Act (15 U.S.C. 7403(a)(1)) is amended— 
(1) in subparagraph (H), by striking ‘‘and’’ 
after the semicolon; 
(2) in subparagraph (I), by striking ‘‘property.’’ 
and inserting ‘‘property;’’; and 
(3) by adding at the end the following: 
‘‘(J) secure fundamental protocols that are 
at the heart of inter-network communications 
and data exchange; 
‘‘(K) system security that addresses the 
building of secure systems from trusted and 
untrusted components; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00112
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
113 
‘‘(L) monitoring and detection; and 
‘‘(M) resiliency and rapid recovery meth-
ods.’’. 
(b) NATIONAL SCIENCE FOUNDATION COMPUTER 
AND NETWORK SECURITY GRANTS.—Section 4(a)(3) of 
the Cyber Security Research and Development Act (15 
U.S.C. 7403(a)(3)) is amended— 
(1) in subparagraph (D), by striking ‘‘and’’; 
(2) in subparagraph (E), by striking ‘‘2007.’’ 
and inserting ‘‘2007;’’; and 
(3) by adding at the end the following: 
‘‘(F) such funds from amounts made avail-
able under section 503 of the America COM-
PETES Reauthorization Act of 2010 (124 
Stat. 4005), as the Secretary finds necessary to 
carry out the requirements of this subsection 
for fiscal years 2014 through 2015.’’. 
(c) COMPUTER
AND
NETWORK
SECURITY
CEN-
TERS.—Section 4(b)(7) of the Cyber Security Research 
and Development Act (15 U.S.C. 7403(b)(7)) is amend-
ed— 
(1) in subparagraph (D), by striking ‘‘and’’; 
(2) in subparagraph (E), by striking ‘‘2007.’’ 
and inserting ‘‘2007;’’; and 
(3) by adding at the end the following: 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00113
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
114 
‘‘(F) such funds from amounts made avail-
able under section 503 of the America COM-
PETES Reauthorization Act of 2010 (124 
Stat. 4005), as the Secretary finds necessary to 
carry out the requirements of this subsection 
for fiscal years 2014 through 2015.’’. 
(d) COMPUTER AND NETWORK SECURITY CAPACITY 
BUILDING GRANTS.—Section 5(a)(6) of the Cyber Secu-
rity 
Research 
and 
Development 
Act 
(15 
U.S.C. 
7404(a)(6)) is amended— 
(1) in subparagraph (D), by striking ‘‘and’’; 
(2) in subparagraph (E), by striking ‘‘2007.’’ 
and inserting ‘‘2007;’’; and 
(3) by adding at the end the following: 
‘‘(F) such funds from amounts made avail-
able under section 503 of the America COM-
PETES Reauthorization Act of 2010 (124 
Stat. 4005), as the Secretary finds necessary to 
carry out the requirements of this subsection 
for fiscal years 2014 through 2015.’’. 
(e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT 
GRANTS.—Section 5(b)(2) of the Cyber Security Research 
and Development Act (15 U.S.C. 7404(b)(2)) is amend-
ed— 
(1) in subparagraph (D), by striking ‘‘and’’; 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00114
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
115 
(2) in subparagraph (E), by striking ‘‘2007.’’ 
and inserting ‘‘2007;’’; and 
(3) by adding at the end the following: 
‘‘(F) such funds from amounts made avail-
able under section 503 of the America COM-
PETES Reauthorization Act of 2010 (124 
Stat. 4005), as the Secretary finds necessary to 
carry out the requirements of this subsection 
for fiscal years 2014 through 2015.’’. 
(f) GRADUATE TRAINEESHIPS IN COMPUTER AND 
NETWORK SECURITY RESEARCH.—Section 5(c)(7) of the 
Cyber Security Research and Development Act (15 U.S.C. 
7404(c)(7)) is amended— 
(1) in subparagraph (D), by striking ‘‘and’’; 
(2) in subparagraph (E), by striking ‘‘2007.’’ 
and inserting ‘‘2007;’’; and 
(3) by adding at the end the following: 
‘‘(F) such funds from amounts made avail-
able under section 503 of the America COM-
PETES Reauthorization Act of 2010 (124 
Stat. 4005), as the Secretary finds necessary to 
carry out the requirements of this subsection 
for fiscal years 2014 through 2015.’’. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00115
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
116 
TITLE V—DATA SECURITY AND 
BREACH NOTIFICATION 
SEC. 501. REQUIREMENTS FOR INFORMATION SECURITY. 
Each covered entity shall take reasonable measures 
to protect and secure data in electronic form containing 
personal information. 
SEC. 502. NOTIFICATION OF INFORMATION SECURITY 
BREACH. 
(a) NOTIFICATION.— 
(1) IN GENERAL.—A covered entity that owns 
or licenses data in electronic form containing per-
sonal information shall give notice of any breach of 
the security of the system following discovery by the 
covered entity of the breach of the security of the 
system to each individual who is a citizen or resident 
of the United States whose personal information was 
or that the covered entity reasonably believes to have 
been accessed and acquired by an unauthorized per-
son and that the covered entity reasonably believes 
has caused or will cause, identity theft or other fi-
nancial harm. 
(2) LAW
ENFORCEMENT.—A covered entity 
shall notify the Secret Service or the Federal Bureau 
of Investigation of the fact that a breach of security 
has occurred if the number of individuals whose per-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00116
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
117 
sonal information the covered entity reasonably be-
lieves to have been accessed and acquired by an un-
authorized person exceeds 10,000. 
(b) SPECIAL NOTIFICATION REQUIREMENTS.— 
(1) THIRD-PARTY AGENTS.— 
(A) IN
GENERAL.—In the event of a 
breach of security of a system maintained by a 
third-party entity that has been contracted to 
maintain, store, or process data in electronic 
form containing personal information on behalf 
of a covered entity who owns or possesses such 
data, such third-party entity shall notify such 
covered entity of the breach of security. 
(B) COVERED ENTITIES WHO RECEIVE NO-
TICE
FROM
THIRD
PARTIES.—Upon receiving 
notification from a third party under subpara-
graph (A), a covered entity shall provide notifi-
cation as required under subsection (a). 
(C) 
EXCEPTION
FOR
SERVICE
PRO-
VIDERS.—A service provider shall not be consid-
ered a third-party agent for purposes of this 
paragraph. 
(2) SERVICE PROVIDERS.— 
(A) IN GENERAL.—If a service provider be-
comes aware of a breach of security involving 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00117
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
118 
data in electronic form containing personal in-
formation that is owned or possessed by a cov-
ered entity that connects to or uses a system or 
network provided by the service provider for the 
purpose of transmitting, routing, or providing 
intermediate or transient storage of such data, 
such service provider shall notify the covered 
entity who initiated such connection, trans-
mission, routing, or storage if such covered en-
tity can be reasonably identified. 
(B) COVERED ENTITIES WHO RECEIVE NO-
TICE FROM SERVICE PROVIDERS.—Upon receiv-
ing notification from a service provider under 
subparagraph (A), a covered entity shall provide 
notification as required under subsection (a). 
(c) TIMELINESS OF NOTIFICATION.— 
(1) IN GENERAL.—Unless subject to a delay au-
thorized under paragraph (2), a notification required 
under subsection (a) with respect to a security 
breach shall be made as expeditiously as practicable 
and without unreasonable delay, consistent with any 
measures necessary to determine the scope of the se-
curity breach and restore the reasonable integrity of 
the data system that was breached. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00118
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
119 
(2) DELAY OF NOTIFICATION AUTHORIZED FOR 
LAW ENFORCEMENT OR NATIONAL SECURITY PUR-
POSES.— 
(A) LAW
ENFORCEMENT.—If a Federal 
law enforcement agency determines that the no-
tification required under subsection (a) would 
impede a civil or criminal investigation, such 
notification shall be delayed upon the written 
request of the law enforcement agency for any 
period which the law enforcement agency deter-
mines is reasonably necessary. A law enforce-
ment agency may, by a subsequent written re-
quest, revoke such delay or extend the period 
set forth in the original request made under 
this subparagraph by a subsequent request if 
further delay is necessary. 
(B) NATIONAL
SECURITY.—If a Federal 
national security agency or homeland security 
agency determines that the notification required 
under this section would threaten national or 
homeland security, such notification may be de-
layed upon the written request of the national 
security agency or homeland security agency for 
any period which the national security agency 
or homeland security agency determines is rea-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00119
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
120 
sonably necessary. A Federal national security 
agency or homeland security agency may revoke 
such delay or extend the period set forth in the 
original request made under this subparagraph 
by a subsequent written request if further delay 
is necessary. 
(d) METHOD AND CONTENT OF NOTIFICATION.— 
(1) DIRECT NOTIFICATION.— 
(A) METHOD OF NOTIFICATION.—A cov-
ered entity required to provide notification to 
an individual under subsection (a) shall be in 
compliance with such requirement if the covered 
entity provides such notice by one of the fol-
lowing methods: 
(i) Written notification, sent to the 
postal address of the individual in the 
records of the covered entity. 
(ii) Telephone. 
(iii) Email or other electronic means. 
(B) CONTENT OF NOTIFICATION.—Regard-
less of the method by which notification is pro-
vided to an individual under subparagraph (A) 
with respect to a security breach, such notifica-
tion, to the extent practicable, shall include— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00120
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
121 
(i) the date, estimated date, or esti-
mated date range of the breach of security; 
(ii) a description of the personal infor-
mation that was accessed and acquired, or 
reasonably believed to have been accessed 
and acquired, by an unauthorized person 
as a part of the security breach; and 
(iii) information that the individual 
can use to contact the covered entity to in-
quire about— 
(I) the breach of security; or 
(II) the information the covered 
entity maintained about that indi-
vidual. 
(2) SUBSTITUTE NOTIFICATION.— 
(A) CIRCUMSTANCES GIVING RISE TO SUB-
STITUTE NOTIFICATION.—A covered entity re-
quired to provide notification to an individual 
under subsection (a) may provide substitute no-
tification in lieu of the direct notification re-
quired by paragraph (1) if such direct notifica-
tion is not feasible due to— 
(i) excessive cost to the covered entity 
required to provide such notification rel-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00121
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
122 
ative to the resources of such covered enti-
ty; or 
(ii) lack of sufficient contact informa-
tion for the individual required to be noti-
fied. 
(B) FORM
OF
SUBSTITUTE
NOTIFICA-
TION.—Such substitute notification shall in-
clude at least one of the following: 
(i) A conspicuous notice on the Inter-
net website of the covered entity (if such 
covered entity maintains such a website). 
(ii) Notification in print and to broad-
cast media, including major media in met-
ropolitan and rural areas where the indi-
viduals whose personal information was ac-
quired reside. 
(e) TREATMENT OF PERSONS GOVERNED BY OTHER 
FEDERAL LAW.—Except as provided in section 503(b), a 
covered entity who is in compliance with any other Federal 
law that requires such covered entity to provide notifica-
tion to individuals following a breach of security shall be 
deemed to be in compliance with this section. 
SEC. 503. APPLICATION AND ENFORCEMENT. 
(a) GENERAL APPLICATION.—The requirements of 
sections 501 and 502 apply to— 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00122
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
123 
(1) those persons, partnerships, or corporations 
over which the Commission has authority pursuant 
to section 5(a)(2) of the Federal Trade Commission 
Act (15 U.S.C. 45(a)(2)); and 
(2) notwithstanding section 5(a)(2) of the Fed-
eral Trade Commission Act (15 U.S.C. 45(a)(2)), 
common carriers subject to the Communications Act 
of 1934 (47 U.S.C. 151 et seq.). 
(b) APPLICATION TO CABLE OPERATORS, SATELLITE 
OPERATORS, AND TELECOMMUNICATIONS CARRIERS.— 
Sections 222, 338, and 631 of the Communications Act 
of 1934 (47 U.S.C. 222, 338, and 551), and any regula-
tions promulgated thereunder, shall not apply with respect 
to the information security practices, including practices 
relating to the notification of unauthorized access to data 
in electronic form, of any covered entity otherwise subject 
to those sections. 
(c) ENFORCEMENT BY FEDERAL TRADE COMMIS-
SION.— 
(1) UNFAIR
OR
DECEPTIVE
ACTS
OR
PRAC-
TICES.—A violation of section 501 or 502 shall be 
treated as an unfair or deceptive act or practice in 
violation of a regulation under section 18(a)(1)(B) 
of the Federal Trade Commission Act (15 U.S.C. 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00123
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
124 
57a(a)(1)(B)) regarding unfair or deceptive acts or 
practices. 
(2) POWERS OF COMMISSION.— 
(A) IN GENERAL.—Except as provided in 
subsection (a), the Commission shall enforce 
this title in the same manner, by the same 
means, and with the same jurisdiction, powers, 
and duties as though all applicable terms and 
provisions of the Federal Trade Commission 
Act (15 U.S.C. 41 et seq.) were incorporated 
into and made a part of this title. 
(B) PRIVILEGES
AND
IMMUNITIES.—Any 
person who violates section 502 or 503 shall be 
subject to the penalties and entitled to the 
privileges and immunities provided in such Act. 
(3) MAXIMUM
TOTAL
LIABILITY.—Notwith-
standing the number of actions which may be 
brought against a covered entity under this sub-
section, the maximum civil penalty for which any 
covered entity may be liable under this subsection 
for all actions shall not exceed— 
(A) $500,000 for all violations of section 
501 resulting from the same related act or 
omission; and 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00124
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
125 
(B) $500,000 for all violations of section 
502 resulting from a single breach of security. 
(d) NO PRIVATE CAUSE OF ACTION.—Nothing in 
this title shall be construed to establish a private cause 
of action against a person for a violation of this title. 
SEC. 504. DEFINITIONS. 
In this title: 
(1) BREACH OF SECURITY.—The term ‘‘breach 
of security’’ means unauthorized access and acquisi-
tion of data in electronic form containing personal 
information. 
(2) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(3) COVERED ENTITY.— 
(A) IN GENERAL.—The term ‘‘covered en-
tity’’ means a sole proprietorship, partnership, 
corporation, trust, estate, cooperative, associa-
tion, or other commercial entity that acquires, 
maintains, stores, or utilizes personal informa-
tion. 
(B) EXEMPTIONS.—The term ‘‘covered en-
tity’’ does not include the following: 
(i) Financial institutions subject to 
title V of the Gramm-Leach-Bliley Act (15 
U.S.C. 6801 et seq.). 
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00125
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS
126 
(ii) An entity covered by the regula-
tions issued under section 264(c) of the 
Health Insurance Portability and Account-
ability Act of 1996 (Public Law 104–191) 
to the extent that such entity is subject to 
the requirements of such regulations with 
respect to protected health information. 
(4) DATA
IN
ELECTRONIC
FORM.—The term 
‘‘data in electronic form’’ means any data stored 
electronically or digitally on any computer system or 
other database and includes recordable tapes and 
other mass storage devices. 
(5) PERSONAL INFORMATION.— 
(A) IN GENERAL.—The term ‘‘personal in-
formation’’ means an individual’s first name or 
first initial and last name in combination with 
any 1 or more of the following data elements 
for that individual: 
(i) Social Security number. 
(ii) Driver’s license number, passport 
number, military identification number, or 
other similar number issued on a govern-
ment document used to verify identity. 
(iii) Financial account number, or 
credit or debit card number, and any re-
VerDate Mar 15 2010 
00:23 Apr 17, 2013
Jkt 029200
PO 00000
Frm 00126
Fmt 6652
Sfmt 6201
E:\BILLS\H1468.IH
H1468
PWALKER on DSK7TPTVN1PROD with BILLS