(3) SERVICE OBLIGATION.—If an individual re-
ceives a scholarship under this section, as a condi-
tion of receiving such scholarship, the individual 
upon completion of their degree must serve as a cy-
bersecurity professional within the Federal workforce 
for a period of time as provided in paragraph (5). 
If a scholarship recipient is not offered employment 
by a Federal agency or a federally funded research 
and development center, the service requirement can 
be satisfied at the Director’s discretion by— 
(A) serving as a cybersecurity professional 
in a State, local, or tribal government agency; 
or 
(B) teaching cybersecurity courses at an 
institution of higher education. 
(4) CONDITIONS OF SUPPORT.—As a condition 
of acceptance of a scholarship under this section, a 
recipient shall agree to provide the awardee institu-
tion with annual verifiable documentation of employ-
ment and up-to-date contact information. 
(5) LENGTH OF SERVICE.—The length of serv-
ice required in exchange for a scholarship under this 
subsection shall be 1 year more than the number of 
years for which the scholarship was received.
(d) FAILURE
TO
COMPLETE
SERVICE
OBLIGA-
TION.— 
(1) GENERAL RULE.—If an individual who has 
received a scholarship under this section— 
(A) fails to maintain an acceptable level of 
academic standing in the educational institution 
in which the individual is enrolled, as deter-
mined by the Director; 
(B) is dismissed from such educational in-
stitution for disciplinary reasons; 
(C) withdraws from the program for which 
the award was made before the completion of 
such program; 
(D) declares that the individual does not 
intend to fulfill the service obligation under this 
section; or 
(E) fails to fulfill the service obligation of 
the individual under this section, 
such individual shall be liable to the United States 
as provided in paragraph (3). 
(2) MONITORING COMPLIANCE.—As a condition 
of participating in the program, a qualified institu-
tion of higher education receiving a grant under this 
section shall—
(A) enter into an agreement with the Di-
rector of the National Science Foundation to 
monitor the compliance of scholarship recipients 
with respect to their service obligation; and 
(B) provide to the Director, on an annual 
basis, post-award employment information re-
quired under subsection (c)(4) for scholarship 
recipients through the completion of their serv-
ice obligation. 
(3) AMOUNT OF REPAYMENT.— 
(A) LESS THAN ONE YEAR OF SERVICE.— 
If a circumstance described in paragraph (1) 
occurs before the completion of 1 year of a 
service obligation under this section, the total 
amount of awards received by the individual 
under this section shall be repaid or such 
amount shall be treated as a loan to be repaid 
in accordance with subparagraph (C). 
(B) MORE THAN ONE YEAR OF SERVICE.— 
If a circumstance described in subparagraph 
(D) or (E) of paragraph (1) occurs after the 
completion of 1 year of a service obligation 
under this section, the total amount of scholar-
ship awards received by the individual under 
this section, reduced by the ratio of the number
of years of service completed divided by the 
number of years of service required, shall be re-
paid or such amount shall be treated as a loan 
to be repaid in accordance with subparagraph 
(C). 
(C) REPAYMENTS.—A loan described in 
subparagraph (A) or (B) shall be treated as a 
Federal Direct Unsubsidized Stafford Loan 
under part D of title IV of the Higher Edu-
cation Act of 1965 (20 U.S.C. 1087a and fol-
lowing), and shall be subject to repayment, to-
gether with interest thereon accruing from the 
date of the scholarship award, in accordance 
with terms and conditions specified by the Di-
rector (in consultation with the Secretary of 
Education) in regulations promulgated to carry 
out this paragraph. 
(4) COLLECTION OF REPAYMENT.— 
(A) IN
GENERAL.—In the event that a 
scholarship recipient is required to repay the 
scholarship under this subsection, the institu-
tion providing the scholarship shall— 
(i) be responsible for determining the 
repayment amounts and for notifying the
recipient and the Director of the amount 
owed; and 
(ii) collect such repayment amount 
within a period of time as determined 
under the agreement described in para-
graph (2), or the repayment amount shall 
be treated as a loan in accordance with 
paragraph (3)(C). 
(B) RETURNED TO TREASURY.—Except as 
provided in subparagraph (C) of this para-
graph, any such repayment shall be returned to 
the Treasury of the United States. 
(C) RETAIN PERCENTAGE.—An institution 
of higher education may retain a percentage of 
any repayment the institution collects under 
this paragraph to defray administrative costs 
associated with the collection. The Director 
shall establish a single, fixed percentage that 
will apply to all eligible entities. 
(5) EXCEPTIONS.—The Director may provide 
for the partial or total waiver or suspension of any 
service or payment obligation by an individual under 
this section whenever compliance by the individual 
with the obligation is impossible or would involve ex-
treme hardship to the individual, or if enforcement
of such obligation with respect to the individual 
would be unconscionable. 
(e) HIRING AUTHORITY.—For purposes of any law 
or regulation governing the appointment of individuals in 
the Federal civil service, upon successful completion of 
their degree, students receiving a scholarship under this 
section shall be hired under the authority provided for in 
section 213.3102(r) of title 5, Code of Federal Regula-
tions, and be exempted from competitive service. Upon ful-
fillment of the service term, such individuals shall be con-
verted to a competitive service position without competi-
tion if the individual meets the requirements for that posi-
tion. 
SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT. 
Not later than 180 days after the date of enactment 
of this Act the President shall transmit to the Congress 
a report addressing the cybersecurity workforce needs of 
the Federal Government. The report shall include— 
(1) an examination of the current state of and 
the projected needs of the Federal cybersecurity 
workforce, including a comparison of the different 
agencies and departments, and an analysis of the ca-
pacity of such agencies and departments to meet 
those needs;
(2) an analysis of the sources and availability of 
cybersecurity talent, a comparison of the skills and 
expertise sought by the Federal Government and the 
private sector, an examination of the current and fu-
ture capacity of United States institutions of higher 
education, including community colleges, to provide 
current and future cybersecurity professionals, 
through education and training activities, with those 
skills sought by the Federal Government, State and 
local entities, and the private sector, and a descrip-
tion of how successful programs are engaging the 
talents of females and individuals identified in sec-
tion 33 or 34 of the Science and Engineering Equal 
Opportunities Act (42 U.S.C. 1885a or 1885b); 
(3) an examination of the effectiveness of the 
National Centers of Academic Excellence in Infor-
mation Assurance Education, the Centers of Aca-
demic Excellence in Research, and the Federal 
Cyber Scholarship for Service programs in pro-
moting higher education and research in cybersecu-
rity and information assurance and in producing a 
growing number of professionals with the necessary 
cybersecurity and information assurance expertise, 
including individuals from States or regions in which 
the unemployment rate exceeds the national average;
(4) an analysis of any barriers to the Federal 
Government recruiting and hiring cybersecurity tal-
ent, including barriers relating to compensation, the 
hiring process, job classification, and hiring flexibili-
ties; and 
(5) recommendations for Federal policies to en-
sure an adequate, well-trained Federal cybersecurity 
workforce. 
SEC. 108. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 
FORCE. 
(a) ESTABLISHMENT
OF
UNIVERSITY-INDUSTRY 
TASK FORCE.—Not later than 180 days after the date of 
enactment of this Act, the Director of the Office of Science 
and Technology Policy shall convene a task force to ex-
plore mechanisms for carrying out collaborative research, 
development, education, and training activities for cyber-
security through a consortium or other appropriate entity 
with participants from institutions of higher education and 
industry. 
(b) FUNCTIONS.—The task force shall— 
(1) develop options for a collaborative model 
and an organizational structure for such entity 
under which the joint research and development ac-
tivities could be planned, managed, and conducted 
effectively, including mechanisms for the allocation
of resources among the participants in such entity 
for support of such activities; 
(2) propose a process for developing a research 
and development agenda for such entity, including 
guidelines to ensure an appropriate scope of work fo-
cused on nationally significant challenges and requir-
ing collaboration; 
(3) define the roles and responsibilities for the 
participants from institutions of higher education 
and industry in such entity; 
(4) propose guidelines for assigning intellectual 
property rights and for the transfer of research and 
development results to the private sector; and 
(5) make recommendations for how such entity 
could be funded from Federal, State, and nongovern-
mental sources. 
(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the Office of Science 
and Technology Policy shall appoint an equal number of 
individuals from institutions of higher education, including 
minority-serving institutions and community colleges, and 
from industry with knowledge and expertise in cybersecu-
rity. 
(d) REPORT.—Not later than 12 months after the 
date of enactment of this Act, the Director of the Office
of Science and Technology Policy shall transmit to the 
Congress a report describing the findings and rec-
ommendations of the task force. 
(e) TERMINATION.—The task force shall terminate 
upon transmittal of the report required under subsection 
(d). 
(f) COMPENSATION
AND EXPENSES.—Members of 
the task force shall serve without compensation. 
SEC. 109. CYBERSECURITY AUTOMATION AND CHECKLISTS 
FOR GOVERNMENT SYSTEMS. 
Section 8(c) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7406(c)) is amended to read 
as follows: 
‘‘(c) SECURITY AUTOMATION AND CHECKLISTS FOR 
GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the Na-
tional Institute of Standards and Technology shall 
develop, and revise as necessary, security automation 
standards, associated reference materials (including 
protocols), and checklists providing settings and op-
tion selections that minimize the security risks asso-
ciated with each information technology hardware or 
software system and security tool that is, or is likely 
to become, widely used within the Federal Govern-
ment in order to enable standardized and interoper-
able technologies, architectures, and frameworks for 
continuous monitoring of information security within 
the Federal Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
ment of standards, reference materials, and check-
lists under this subsection on the basis of— 
‘‘(A) the security risks associated with the 
use of the system; 
‘‘(B) the number of agencies that use a 
particular system or security tool; 
‘‘(C) the usefulness of the standards, ref-
erence materials, or checklists to Federal agen-
cies that are users or potential users of the sys-
tem; 
‘‘(D) the effectiveness of the associated 
standard, reference material, or checklist in cre-
ating or enabling continuous monitoring of in-
formation security; or 
‘‘(E) such other factors as the Director of 
the National Institute of Standards and Tech-
nology determines to be appropriate. 
‘‘(3) EXCLUDED
SYSTEMS.—The Director of 
the National Institute of Standards and Technology
may exclude from the application of paragraph (1) 
any information technology hardware or software 
system or security tool for which such Director de-
termines that the development of a standard, ref-
erence material, or checklist is inappropriate because 
of the infrequency of use of the system, the obsoles-
cence of the system, or the inutility or imprac-
ticability of developing a standard, reference mate-
rial, or checklist for the system. 
‘‘(4) DISSEMINATION OF STANDARDS AND RE-
LATED MATERIALS.—The Director of the National 
Institute of Standards and Technology shall ensure 
that Federal agencies are informed of the avail-
ability of any standard, reference material, checklist, 
or other item developed under this subsection. 
‘‘(5) AGENCY USE REQUIREMENTS.—The devel-
opment of standards, reference materials, and check-
lists under paragraph (1) for an information tech-
nology hardware or software system or tool does 
not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the standard, reference material, or checklist 
for the system;
‘‘(B) establish conditions or prerequisites 
for Federal agency procurement or deployment 
of any such system; 
‘‘(C) imply an endorsement of any such 
system by the Director of the National Institute 
of Standards and Technology; or 
‘‘(D) preclude any Federal agency from 
procuring or deploying other information tech-
nology hardware or software systems for which 
no such standard, reference material, or check-
list has been developed or identified under para-
graph (1).’’. 
SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND 
DEVELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redes-
ignating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following: 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execu-