H. R. 4346—114 
‘‘(4) improve the accuracy, usability, and inclusivity of 
identity management systems. 
‘‘(b) DIGITAL IDENTITY TECHNICAL ROADMAP.—The Director, in 
consultation with other relevant Federal agencies and stakeholders 
from the private sector, shall develop and maintain a technical 
roadmap for digital identity management research and development 
focused on enabling the voluntary use and adoption of modern 
digital identity solutions that align with the four criteria in sub-
section (a). 
‘‘(c) DIGITAL IDENTITY MANAGEMENT GUIDANCE.— 
‘‘(1) IN GENERAL.—The Director shall develop, and periodi-
cally update, in collaboration with other public and private 
sector organizations, common definitions and voluntary guid-
ance for digital identity management systems, including 
identity and attribute validation services provided by Federal, 
State, and local governments. 
‘‘(2) GUIDANCE.—The Guidance shall— 
‘‘(A) align with the four criteria in subsection (a), as 
practicable; 
‘‘(B) provide case studies of implementation of guid-
ance; 
‘‘(C) incorporate voluntary technical standards and 
industry best practices; and 
‘‘(D) not prescribe or otherwise require the use of spe-
cific technology products or services. 
‘‘(3) CONSULTATION.—In carrying out this subsection, the 
Director shall consult with— 
‘‘(A) Federal and State agencies; 
‘‘(B) industry; 
‘‘(C) potential end-users and individuals that will use 
services related to digital identity verification; and 
‘‘(D) experts with relevant experience in the systems 
that enable digital identity verification, as determined by 
the Director.’’. 
SEC. 10226. BIOMETRICS RESEARCH AND TESTING. 
(a) IN GENERAL.—The Secretary, acting through the Director, 
shall establish a program to support measurement research to 
inform the development of best practices, benchmarks, methodolo-
gies, procedures, and voluntary, consensus-based technical stand-
ards for biometric identification systems, including facial recognition 
systems, to assess and improve the performance of such systems. 
In carrying out such program, the Director may— 
(1) conduct measurement research to support efforts to 
improve the performance of biometric identification systems, 
including in areas related to conformity assessment, image 
quality and interoperability, contactless biometric capture tech-
nologies, and human-in-the-loop biometric identification sys-
tems and processes; 
(2) convene and engage with relevant stakeholders to estab-
lish common definitions and characterizations for biometric 
identification systems, which may include accuracy, fairness, 
bias, privacy, consent, and other properties, taking into account 
definitions in relevant international technical standards and 
other publications; 
(3) carry out measurement research and testing on a range 
of biometric modalities, such as fingerprints, voice, iris, face,
H. R. 4346—115 
vein, behavioral biometrics, genetics, multimodal biometrics, 
and emerging applications of biometric identification tech-
nology; 
(4) study the use of privacy-enhancing technologies and 
other technical protective controls to facilitate access, as appro-
priate, to public data sets for biometric research; 
(5) conduct outreach and coordination to share technical 
expertise with relevant industry and nonindustry stakeholders 
and standards development organizations to assist such entities 
in the development of best practices and voluntary technical 
standards; and 
(6) develop such standard reference artifacts as the Director 
determines is necessary to further the development of such 
voluntary technical standards. 
(b) BIOMETRICS TEST PROGRAM.— 
(1) IN
GENERAL.—The Secretary, acting through the 
Director, shall carry out a test program to provide biometrics 
vendors the opportunity to test biometric identification tech-
nologies across a range of modalities. 
(2) ACTIVITIES.—In carrying out the program under this 
subsection, the Director shall— 
(A) conduct research and regular testing to improve 
and benchmark the accuracy, efficacy, and bias of biometric 
identification technologies, which may include research and 
testing on demographic variations, capture devices, presen-
tation attack detection, partially occluded or computer gen-
erated images, privacy and security designs and controls, 
template protection, de-identification, and comparison of 
algorithm, human, and combined algorithm-human recogni-
tion capability; 
(B) develop an approach for testing software and cloud- 
based biometrics applications, including remote systems, 
in Institute test facilities; 
(C) establish reference use cases for biometric identi-
fication technologies and performance criteria for assessing 
each use case, including accuracy, efficacy, and bias 
metrics; 
(D) produce public-facing reports of the findings from 
such testing for a general audience; 
(E) develop policies and procedures accounting for the 
legal and social implications of activities under this para-
graph when working with a foreign entity of concern (as 
such term is defined in section 10612); 
(F) establish procedures to prioritize testing of bio-
metrics identification technologies developed by entities 
headquartered in the United States; and 
(G) conduct such other activities as determined nec-
essary by the Director. 
(c) GAO REPORT TO CONGRESS.—Not later than 18 months 
after the date of the enactment of this Act, the Comptroller General 
of the United States shall submit a detailed report to Congress 
on the impact of biometric identification technologies on historically 
marginalized communities, including low-income communities and 
minority religious, racial, and ethnic groups. Such report should 
be made publicly available on an internet website.
H. R. 4346—116 
SEC. 10227. FEDERAL BIOMETRIC PERFORMANCE STANDARDS. 
Subsection (b) of section 20 of the National Institute of Stand-
ards and Technology Act (15 U.S.C. 278g–3) is amended— 
(1) in paragraph (2), by striking ‘‘and’’ after the semicolon; 
(2) in paragraph (3), by striking the period and inserting 
‘‘; and’’; and 
(3) by adding at the end the following: 
‘‘(4) performance standards and guidelines for high risk 
biometric identification systems, including facial recognition 
systems, accounting for various use cases, types of biometric 
identification systems, and relevant operational conditions.’’. 
SEC. 10228. PROTECTING RESEARCH FROM CYBERSECURITY THEFT. 
Subparagraph (A) of section 2(e)(1) of the National Institute 
of Standards and Technology Act (15 U.S.C. 272(e)(1)) is amended— 
(1) in clause (viii), by striking ‘‘and’’ after the semicolon; 
(2) by redesignating clause (ix) as clause (x); and 
(3) by inserting after clause (viii) the following: 
‘‘(ix) consider institutions of higher education (as 
such term is defined in section 101 of the Higher 
Education Act of 1965 (20 U.S.C. 1001)); and’’. 
SEC. 10229. DISSEMINATION OF RESOURCES FOR RESEARCH INSTITU-
TIONS. 
(a) DISSEMINATION
OF RESOURCES
FOR RESEARCH INSTITU-
TIONS.— 
(1) IN GENERAL.—Not later than one year after the date 
of the enactment of this Act, the Director shall, using the 
authorities of the Director under subsections (c)(15) and 
(e)(1)(A)(ix) of section 2 of the National Institute of Standards 
and Technology Act (15 U.S.C. 272), disseminate and make 
publicly available tailored resources to help qualifying institu-
tions identify, assess, manage, and reduce their cybersecurity 
risk related to conducting research. 
(2) REQUIREMENTS.—The Director shall ensure that the 
resources disseminated pursuant to paragraph (1)— 
(A) are generally applicable and usable by a wide range 
of qualifying institutions; 
(B) vary with the nature and size of the qualifying 
institutions, and the nature and sensitivity of the data 
collected or stored on the information systems or devices 
of the qualifying institutions; 
(C) include elements that promote awareness of simple, 
basic controls, a workplace cybersecurity culture, and third- 
party stakeholder relationships, to assist qualifying institu-
tions in mitigating common cybersecurity risks; 
(D) include case studies, examples, and scenarios of 
practical application; 
(E) are outcomes-based and can be implemented using 
a variety of technologies that are commercial and off-the- 
shelf; and 
(F) to the extent practicable, are based on international 
technical standards. 
(3) NATIONAL CYBERSECURITY AWARENESS AND EDUCATION 
PROGRAM.—The Director shall ensure that the resources 
disseminated under paragraph (1) are consistent with the
H. R. 4346—117 
efforts of the Director under section 303 of the Cybersecurity 
Enhancement Act of 2014 (15 U.S.C. 7443). 
(4) UPDATES.—The Director shall review periodically and 
update the resources under paragraph (1) as the Director deter-
mines appropriate. 
(5) VOLUNTARY
RESOURCES.—The use of the resources 
disseminated under paragraph (1) shall be considered vol-
untary. 
(b) OTHER FEDERAL CYBERSECURITY REQUIREMENTS.—Nothing 
in this section may be construed to supersede, alter, or otherwise 
affect any cybersecurity requirements applicable to Federal agen-
cies. 
(c) DEFINITIONS.—In this section: 
(1) 
QUALIFYING
INSTITUTIONS.—The 
term 
‘‘qualifying 
institutions’’ means institutions of higher education that are 
awarded in excess of $50,000,000 per year in total Federal 
research funding. 
(2) RESOURCES.—The term ‘‘resources’’ means guidelines, 
tools, best practices, technical standards, methodologies, and 
other ways of providing information. 
SEC. 10230. ADVANCED COMMUNICATIONS RESEARCH. 
The National Institute of Standards and Technology Act (15 
U.S.C. 271 et seq.) is amended— 
(1) by redesignating section 35 as section 36; and 
(2) by inserting after section 34 the following: 
‘‘SEC. 35. ADVANCED COMMUNICATIONS RESEARCH ACTIVITIES. 
‘‘(a) ADVANCED COMMUNICATIONS RESEARCH.— 
‘‘(1) IN GENERAL.—The Director, in consultation with the 
Assistant Secretary for Communications and Information, the 
Director of the National Science Foundation, and heads of 
other Federal agencies, as appropriate, shall carry out a pro-
gram of measurement research for advanced communications 
technologies. 
‘‘(2) RESEARCH AREAS.—Research areas may include— 
‘‘(A) radio frequency emissions and interference, 
including technologies and techniques to mitigate such 
emissions and interference; 
‘‘(B) advanced antenna arrays and artificial intelligence 
systems capable of operating advanced antenna arrays; 
‘‘(C) artificial intelligence systems to enable internet 
of things networks, immersive technology, and other 
advanced communications technologies; 
‘‘(D) network sensing and monitoring technologies; 
‘‘(E) technologies to enable spectrum flexibility and 
agility; 
‘‘(F) optical and quantum communications technologies; 
‘‘(G) security of advanced communications systems; 
‘‘(H) public safety communications; 
‘‘(I) resilient internet of things applications for 
advanced manufacturing; and 
‘‘(J) other research areas determined necessary by the 
Director. 
‘‘(3) TESTBEDS.—In coordination with the Assistant Sec-
retary for Communications and Information, the private sector, 
and other Federal agencies as appropriate, the Director may 
develop and manage testbeds for research and development