(3) define the roles and responsibilities for the 
participants from institutions of higher education 
and industry in such entity; 
(4) propose guidelines for assigning intellectual 
property rights, for the transfer of research and devel-
opment results to the private sector; and 
(5) make recommendations for how such entity 
could be funded from Federal, State, and nongovern-
mental sources. 
(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the Office of Science 
and Technology Policy shall appoint an equal number of 
individuals from institutions of higher education, including 
minority-serving institutions and community colleges, and 
from industry with knowledge and expertise in cybersecu-
rity. 
(d) REPORT.—Not later than 12 months after the date 
of enactment of this Act, the Director of the Office of Science 
and Technology Policy shall transmit to the Congress a re-
port describing the findings and recommendations of the 
task force. 
(e) TERMINATION.—The task force shall terminate 
upon transmittal of the report required under subsection 
(d). 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(f) COMPENSATION AND EXPENSES.—Members of the 
task force shall serve without compensation. 
SEC. 109. CYBERSECURITY AUTOMATION AND CHECKLISTS 
FOR GOVERNMENT SYSTEMS. 
Section 8(c) of the Cyber Security Research and Devel-
opment Act (15 U.S.C. 7406(c)) is amended to read as fol-
lows: 
‘‘(c) SECURITY AUTOMATION AND CHECKLISTS FOR 
GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the National 
Institute of Standards and Technology shall develop, 
and revise as necessary, security automation stand-
ards, associated reference materials (including proto-
cols), and checklists providing settings and option se-
lections that minimize the security risks associated 
with each information technology hardware or soft-
ware system and security tool that is, or is likely to 
become, widely used within the Federal Government 
in order to enable standardized and interoperable 
technologies, architectures, and frameworks for contin-
uous monitoring of information security within the 
Federal Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
ment of standards, reference materials, and checklists 
under this subsection on the basis of— 
‘‘(A) the security risks associated with the 
use of the system; 
‘‘(B) the number of agencies that use a par-
ticular system or security tool; 
‘‘(C) the usefulness of the standards, ref-
erence materials, or checklists to Federal agencies 
that are users or potential users of the system; 
‘‘(D) the effectiveness of the associated 
standard, reference material, or checklist in cre-
ating or enabling continuous monitoring of in-
formation security; or 
‘‘(E) such other factors as the Director of 
the National Institute of Standards and Tech-
nology determines to be appropriate. 
‘‘(3) EXCLUDED SYSTEMS.—The Director of the 
National Institute of Standards and Technology may 
exclude from the application of paragraph (1) any in-
formation technology hardware or software system or 
security tool for which such Director determines that 
the development of a standard, reference material, or 
checklist is inappropriate because of the infrequency 
of use of the system, the obsolescence of the system, or 
the inutility or impracticability of developing a 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
standard, reference material, or checklist for the sys-
tem. 
‘‘(4) DISSEMINATION
OF
STANDARDS
AND
RE-
LATED MATERIALS.—The Director of the National In-
stitute of Standards and Technology shall ensure that 
Federal agencies are informed of the availability of 
any standard, reference material, checklist, or other 
item developed under this subsection. 
‘‘(5) AGENCY USE REQUIREMENTS.—The develop-
ment of standards, reference materials, and checklists 
under paragraph (1) for an information technology 
hardware or software system or tool does not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the standard, reference material, or checklist for 
the system; 
‘‘(B) establish conditions or prerequisites for 
Federal agency procurement or deployment of 
any such system; 
‘‘(C) imply an endorsement of any such sys-
tem by the Director of the National Institute of 
Standards and Technology; or 
‘‘(D) preclude any Federal agency from pro-
curing or deploying other information technology 
hardware or software systems for which no such 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
standard, reference material, or checklist has 
been developed or identified under paragraph 
(1).’’. 
SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND DE-
VELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redesig-
nating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following: 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execution 
of a wide variety of resource protection policies and 
that is amenable to implementation within a wide 
variety of existing and emerging computing environ-
ments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and networks; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; and 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(4) carry out research associated with improv-
ing security of industrial control systems.’’. 
TITLE II—ADVANCEMENT OF CY-
BERSECURITY 
TECHNICAL 
STANDARDS 
SEC. 201. DEFINITIONS. 
In this title: 
(1) DIRECTOR.—The term ‘‘Director’’ means the 
Director of the National Institute of Standards and 
Technology. 
(2) INSTITUTE.—The term ‘‘Institute’’ means the 
National Institute of Standards and Technology. 
SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
(a) IN GENERAL.—The Director, in coordination with 
appropriate Federal authorities, shall— 
(1) as appropriate, ensure coordination of Fed-
eral agencies engaged in the development of inter-
national technical standards related to information 
system security; and 
(2) not later than 1 year after the date of enact-
ment of this Act, develop and transmit to the Con-
gress a plan for ensuring such Federal agency coordi-
nation. 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(b) CONSULTATION WITH THE PRIVATE SECTOR.—In 
carrying out the activities specified in subsection (a)(1), the 
Director shall ensure consultation with appropriate private 
sector stakeholders. 
SEC. 203. CLOUD COMPUTING STRATEGY. 
(a) IN GENERAL.—The Director, in collaboration with 
the Federal CIO Council, and in consultation with other 
relevant Federal agencies and stakeholders from the private 
sector, shall continue to develop and implement a com-
prehensive strategy for the use and broad adoption of cloud 
computing services by the Federal Government. 
(b) ACTIVITIES.—In carrying out the strategy devel-
oped under subsection (a), the Director shall give consider-
ation to activities that— 
(1) accelerate the development of standards that 
address interoperability and portability of cloud com-
puting services; 
(2) support the development of conformance test 
systems; and 
(3) address appropriate security frameworks and 
reference materials for use by Federal agencies to ad-
dress their security and privacy requirements, includ-
ing— 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
(A) the physical security of cloud computing 
data centers and the data stored in such centers; 
and 
(B) accessibility of the data stored in cloud 
computing data centers. 
SEC. 204. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, National Laboratories, and other organizations, shall 
continue to coordinate a cybersecurity awareness and edu-
cation program to increase knowledge, skills, and awareness 
of cybersecurity risks, consequences, and best practices 
through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; and 
(2) efforts to make cybersecurity technical stand-
ards and best practices usable by individuals, small 
to medium-sized businesses, State, local, and tribal 
governments, and educational institutions. 
(b) STRATEGIC PLAN.—The Director shall, in coopera-
tion with relevant Federal agencies and other stakeholders, 
develop and implement a strategic plan to guide Federal 
programs and activities in support of a comprehensive cy-
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
bersecurity awareness and education program as described 
under subsection (a). 
(c) REPORT TO CONGRESS.—Not later than 1 year 
after the date of enactment of this Act and every 5 years 
thereafter, the Director shall transmit the strategic plan re-
quired under subsection (b) to the Committee on Science, 
Space, and Technology of the House of Representatives and 
the Committee on Commerce, Science, and Transportation 
of the Senate. 
SEC. 205. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director shall continue a program to support the 
development of technical standards, metrology, testbeds, and 
conformance criteria, taking into account appropriate user 
concerns, to— 
(1) improve interoperability among identity 
management technologies; 
(2) strengthen authentication methods of identity 
management systems; 
(3) improve privacy protection in identity man-
agement systems, including health information tech-
nology systems, through authentication and security 
protocols; and 
(4) improve the usability of identity manage-
ment systems. 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 206. AUTHORIZATIONS. 
No additional funds are authorized to carry out this 
title and the amendments made by this title or to carry 
out the amendments made by sections 109 and 110 of this 
Act. This title and the amendments made by this title and 
the amendments made by sections 109 and 110 of this Act 
shall be carried out using amounts otherwise authorized or 
appropriated. 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS
Union Calendar No. 177 
112TH CONGRESS 
1ST SESSION 
H. R. 2096 
[Report No. 112–264] 
A BILL 
To advance cybersecurity research, development, 
and technical standards, and for other purposes. 
OCTOBER 31, 2011 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Mar 15 2010 
21:00 Oct 31, 2011
Jkt 019200
PO 00000
Frm 00034
Fmt 6651
Sfmt 6651
E:\BILLS\H2096.RH
H2096
mstockstill on DSK4VPTVN1PROD with BILLS