(A) IN GENERAL.—In the event that a schol-
arship recipient is required to repay the scholar-
ship under this subsection, the institution pro-
viding the scholarship shall— 
(i) be responsible for determining the 
repayment amounts and for notifying the 
recipient and the Director of the amount 
owed; and 
(ii) collect such repayment amount 
within a period of time as determined 
under the agreement described in paragraph 
(2), or the repayment amount shall be treat-
ed as a loan in accordance with paragraph 
(3)(C). 
(B) RETURNED TO TREASURY.—Except as 
provided in subparagraph (C) of this paragraph, 
any such repayment shall be returned to the 
Treasury of the United States. 
(C) RETAIN PERCENTAGE.—An institution 
of higher education may retain a percentage of 
any repayment the institution collects under this 
paragraph to defray administrative costs associ-
ated with the collection. The Director shall estab-
lish a single, fixed percentage that will apply to 
all eligible entities. 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
(5) EXCEPTIONS.—The Director may provide for 
the partial or total waiver or suspension of any serv-
ice or payment obligation by an individual under 
this section whenever compliance by the individual 
with the obligation is impossible or would involve ex-
treme hardship to the individual, or if enforcement of 
such obligation with respect to the individual would 
be unconscionable. 
(e) HIRING AUTHORITY.— 
(1) APPOINTMENT IN EXCEPTED SERVICE.—Not-
withstanding any provision of chapter 33 of title 5, 
United States Code, governing appointments in the 
competitive service, an agency shall appoint in the 
excepted service an individual who has completed the 
academic program for which a scholarship was 
awarded. 
(2) NONCOMPETITIVE
CONVERSION.—Except as 
provided in paragraph (4), upon fulfillment of the 
service term, an employee appointed under paragraph 
(1) may be converted noncompetitively to term, ca-
reer-conditional or career appointment. 
(3) TIMING OF CONVERSION.—An agency may 
noncompetitively convert a term employee appointed 
under paragraph (2) to a career-conditional or career 
appointment before the term appointment expires. 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
(4) AUTHORITY TO DECLINE CONVERSION.—An 
agency may decline to make the noncompetitive con-
version or appointment under paragraph (2) for 
cause. 
SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT. 
Not later than 180 days after the date of enactment 
of this Act the President shall transmit to the Congress a 
report addressing the cybersecurity workforce needs of the 
Federal Government. The report shall include— 
(1) an examination of the current state of and 
the projected needs of the Federal cybersecurity work-
force, including a comparison of the different agencies 
and departments, and an analysis of the capacity of 
such agencies and departments to meet those needs; 
(2) an analysis of the sources and availability of 
cybersecurity talent, a comparison of the skills and 
expertise sought by the Federal Government and the 
private sector, an examination of the current and fu-
ture capacity of United States institutions of higher 
education, including community colleges, to provide 
current 
and 
future 
cybersecurity 
professionals, 
through education and training activities, with those 
skills sought by the Federal Government, State and 
local entities, and the private sector, and a descrip-
tion of how successful programs are engaging the tal-
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
ents of females and individuals identified in section 
33 or 34 of the Science and Engineering Equal Op-
portunities Act (42 U.S.C. 1885a or 1885b); 
(3) an examination of the effectiveness of the Na-
tional Centers of Academic Excellence in Information 
Assurance Education, the Centers of Academic Excel-
lence in Research, and the Federal Cyber Scholarship 
for Service programs in promoting higher education 
and research in cybersecurity and information assur-
ance and in producing a growing number of profes-
sionals with the necessary cybersecurity and informa-
tion assurance expertise, including individuals from 
States or regions in which the unemployment rate ex-
ceeds the national average; 
(4) an analysis of any barriers to the Federal 
Government recruiting and hiring cybersecurity tal-
ent, including barriers relating to compensation, the 
hiring process, job classification, and hiring flexibili-
ties; and 
(5) recommendations for Federal policies to en-
sure an adequate, well-trained Federal cybersecurity 
workforce. 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 108. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 
FORCE. 
(a) ESTABLISHMENT OF UNIVERSITY-INDUSTRY TASK 
FORCE.—Not later than 180 days after the date of enact-
ment of this Act, the Director of the Office of Science and 
Technology Policy shall convene a task force to explore 
mechanisms for carrying out collaborative research, devel-
opment, education, and training activities for cybersecurity 
through a consortium or other appropriate entity with par-
ticipants from institutions of higher education and indus-
try. 
(b) FUNCTIONS.—The task force shall— 
(1) develop options for a collaborative model and 
an organizational structure for such entity under 
which the joint research and development activities 
could be planned, managed, and conducted effectively, 
including mechanisms for the allocation of resources 
among the participants in such entity for support of 
such activities; 
(2) identify and prioritize at least three cyberse-
curity grand challenges, focused on nationally signifi-
cant problems requiring collaborative and inter-
disciplinary solutions; 
(3) propose a process for developing a research 
and development agenda for such entity to address the 
grand challenges identified under paragraph (2); 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
(4) define the roles and responsibilities for the 
participants from institutions of higher education 
and industry in such entity; 
(5) propose guidelines for assigning intellectual 
property rights and for the transfer of research and 
development results to the private sector; and 
(6) make recommendations for how such entity 
could be funded from Federal, State, and nongovern-
mental sources. 
(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the Office of Science 
and Technology Policy shall appoint an equal number of 
individuals from institutions of higher education, including 
minority-serving institutions and community colleges, and 
from industry with knowledge and expertise in cybersecu-
rity. 
(d) REPORT.—Not later than 12 months after the date 
of enactment of this Act, the Director of the Office of Science 
and Technology Policy shall transmit to the Congress a re-
port describing the findings and recommendations of the 
task force. 
(e) TERMINATION.—The task force shall terminate 
upon transmittal of the report required under subsection 
(d). 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
(f) COMPENSATION AND EXPENSES.—Members of the 
task force shall serve without compensation. 
SEC. 109. CYBERSECURITY AUTOMATION AND CHECKLISTS 
FOR GOVERNMENT SYSTEMS. 
Section 8(c) of the Cyber Security Research and Devel-
opment Act (15 U.S.C. 7406(c)) is amended to read as fol-
lows: 
‘‘(c) SECURITY AUTOMATION AND CHECKLISTS FOR 
GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the National 
Institute of Standards and Technology shall develop, 
and revise as necessary, security automation stand-
ards, associated reference materials (including proto-
cols), and checklists providing settings and option se-
lections that minimize the security risks associated 
with each information technology hardware or soft-
ware system and security tool that is, or is likely to 
become, widely used within the Federal Government 
in order to enable standardized and interoperable 
technologies, architectures, and frameworks for contin-
uous monitoring of information security within the 
Federal Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
ment of standards, reference materials, and checklists 
under this subsection on the basis of— 
‘‘(A) the security risks associated with the 
use of the system; 
‘‘(B) the number of agencies that use a par-
ticular system or security tool; 
‘‘(C) the usefulness of the standards, ref-
erence materials, or checklists to Federal agencies 
that are users or potential users of the system; 
‘‘(D) the effectiveness of the associated 
standard, reference material, or checklist in cre-
ating or enabling continuous monitoring of in-
formation security; or 
‘‘(E) such other factors as the Director of 
the National Institute of Standards and Tech-
nology determines to be appropriate. 
‘‘(3) EXCLUDED SYSTEMS.—The Director of the 
National Institute of Standards and Technology may 
exclude from the application of paragraph (1) any in-
formation technology hardware or software system or 
security tool for which such Director determines that 
the development of a standard, reference material, or 
checklist is inappropriate because of the infrequency 
of use of the system, the obsolescence of the system, or 
the inutility or impracticability of developing a 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
standard, reference material, or checklist for the sys-
tem. 
‘‘(4) DISSEMINATION
OF
STANDARDS
AND
RE-
LATED MATERIALS.—The Director of the National In-
stitute of Standards and Technology shall ensure that 
Federal agencies are informed of the availability of 
any standard, reference material, checklist, or other 
item developed under this subsection. 
‘‘(5) AGENCY USE REQUIREMENTS.—The develop-
ment of standards, reference materials, and checklists 
under paragraph (1) for an information technology 
hardware or software system or tool does not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the standard, reference material, or checklist for 
the system; 
‘‘(B) establish conditions or prerequisites for 
Federal agency procurement or deployment of 
any such system; 
‘‘(C) imply an endorsement of any such sys-
tem by the Director of the National Institute of 
Standards and Technology; or 
‘‘(D) preclude any Federal agency from pro-
curing or deploying other information technology 
hardware or software systems for which no such 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
standard, reference material, or checklist has 
been developed or identified under paragraph 
(1).’’. 
SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND DE-
VELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redesig-
nating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following: 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execution 
of a wide variety of resource protection policies and 
that is amenable to implementation within a wide 
variety of existing and emerging computing environ-
ments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and networks; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
‘‘(4) carry out research associated with improv-
ing security of industrial control systems; and 
‘‘(5) carry out research associated with improv-
ing the security and integrity of the information tech-
nology supply chain.’’. 
SEC. 111. RESEARCH ON THE SCIENCE OF CYBERSECURITY. 
The Director of the National Science Foundation and 
the Director of the National Institute of Standards and 
Technology shall, through existing programs and activities, 
support research that will lead to the development of a sci-
entific foundation for the field of cybersecurity, including 
research that increases understanding of the underlying 
principles of securing complex networked systems, enables 
repeatable experimentation, and creates quantifiable secu-
rity metrics. 
TITLE II—ADVANCEMENT OF CY-
BERSECURITY 
TECHNICAL 
STANDARDS 
SEC. 201. DEFINITIONS. 
In this title: 
(1) DIRECTOR.—The term ‘‘Director’’ means the 
Director of the National Institute of Standards and 
Technology. 
(2) INSTITUTE.—The term ‘‘Institute’’ means the 
National Institute of Standards and Technology. 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
(a) IN GENERAL.—The Director, in coordination with 
appropriate Federal authorities, shall— 
(1) as appropriate, ensure coordination of Fed-
eral agencies engaged in the development of inter-
national technical standards related to information 
system security; and 
(2) not later than 1 year after the date of enact-
ment of this Act, develop and transmit to the Con-
gress a plan for ensuring such Federal agency coordi-
nation. 
(b) CONSULTATION WITH THE PRIVATE SECTOR.—In 
carrying out the activities specified in subsection (a)(1), the 
Director shall ensure consultation with appropriate private 
sector stakeholders. 
SEC. 203. CLOUD COMPUTING STRATEGY. 
(a) IN GENERAL.—The Director, in collaboration with 
the Federal CIO Council, and in consultation with other 
relevant Federal agencies and stakeholders from the private 
sector, shall continue to develop and encourage the imple-
mentation of a comprehensive strategy for the use and adop-
tion of cloud computing services by the Federal Govern-
ment. 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
(b) ACTIVITIES.—In carrying out the strategy devel-
oped under subsection (a), the Director shall give consider-
ation to activities that— 
(1) accelerate the development, in collaboration 
with the private sector, of standards that address 
interoperability and portability of cloud computing 
services; 
(2) advance the development of conformance test-
ing performed by the private sector in support of 
cloud computing standardization; and 
(3) support, in consultation with the private sec-
tor, the development of appropriate security frame-
works and reference materials, and the identification 
of best practices, for use by Federal agencies to ad-
dress security and privacy requirements to enable the 
use and adoption of cloud computing services, includ-
ing activities— 
(A) to ensure the physical security of cloud 
computing data centers and the data stored in 
such centers; 
(B) to ensure secure access to the data 
stored in cloud computing data centers; 
(C) to develop security standards as re-
quired under section 20 of the National Institute 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
of Standards and Technology Act (15 U.S.C. 
278g–3); and 
(D) to support the development of the auto-
mation of continuous monitoring systems. 
SEC. 204. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, National Laboratories, the National Coordination Of-
fice of the Networking and Information Technology Re-
search and Development program, and other organizations, 
shall continue to coordinate a cybersecurity awareness and 
education program to increase knowledge, skills, and aware-
ness of cybersecurity risks, consequences, and best practices 
through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; 
(2) efforts to make cybersecurity best practices 
usable by individuals, small to medium-sized busi-
nesses, State, local, and tribal governments, and edu-
cational institutions; 
(3) improving the state of cybersecurity edu-
cation at all educational levels; 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
(4) efforts to attract, recruit, and retain quali-
fied professionals to the Federal cybersecurity work-
force; and 
(5) improving the skills, training, and profes-
sional development of the Federal cybersecurity work-
force. 
(b) STRATEGIC PLAN.—The Director shall, in coopera-
tion with relevant Federal agencies and other stakeholders, 
develop and implement a strategic plan to guide Federal 
programs and activities in support of a comprehensive cy-
bersecurity awareness and education program as described 
under subsection (a). 
(c) REPORT TO CONGRESS.—Not later than 1 year 
after the date of enactment of this Act and every 5 years 
thereafter, the Director shall transmit the strategic plan re-
quired under subsection (b) to the Committee on Science, 
Space, and Technology of the House of Representatives and 
the Committee on Commerce, Science, and Transportation 
of the Senate. 
SEC. 205. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director shall continue a program to support the 
development of technical standards, metrology, testbeds, and 
conformance criteria, taking into account appropriate user 
concerns, to— 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
(1) improve interoperability among identity 
management technologies; 
(2) strengthen authentication methods of identity 
management systems; 
(3) improve privacy protection in identity man-
agement systems, including health information tech-
nology systems, through authentication and security 
protocols; and 
(4) improve the usability of identity manage-
ment systems. 
SEC. 206. AUTHORIZATIONS. 
No additional funds are authorized to carry out this 
Act, and the amendments made by this Act. This Act, and 
the amendments made by this Act, shall be carried out using 
amounts otherwise authorized or appropriated. 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6203
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS
Union Calendar No. 19 
113TH CONGRESS 
1ST SESSION 
H. R. 756 
[Report No. 113–33] 
A BILL 
To advance cybersecurity research, development, 
and technical standards, and for other purposes. 
APRIL 11, 2013 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Mar 15 2010 
20:50 Apr 11, 2013
Jkt 029200
PO 00000
Frm 00036
Fmt 6651
Sfmt 6651
E:\BILLS\H756.RH
H756
mstockstill on DSK4VPTVN1PROD with BILLS