basis for a disapproval of the security measure, or 
combination thereof, proposed by the owner or oper-
ator of covered critical infrastructure if the proposed 
security measure, or combination thereof, otherwise 
satisfies the security performance requirements es-
tablished by the Director under (c). 
‘‘(i) ENFORCEMENT CERTIFICATIONS, AUDITS AND 
INSPECTIONS.—The sector-specific agency or first-party 
regulatory agency, in enforcing the requirements under 
subsection (c), shall require an entity with a cybersecurity 
plan approved under subsection (g) to certify that the cy-
bersecurity plan has been implemented, and may conduct 
announced or unannounced audits and inspections of any 
such entity to determine compliance. 
‘‘(j) REPORTING OF CYBER INCIDENTS ON COVERED 
CRITICAL INFRASTRUCTURE NETWORKS.—The require-
ments under subsection (c) shall include a requirement 
that each covered critical infrastructure entity report any 
cyber incidents on its networks to the first-party regu-
latory agency for the entity or to the sector-specific agency 
for the entity (if there is no first-party regulatory agency), 
and to US CERT. 
‘‘(k) RESPONDING TO CYBER INCIDENTS ON PRI-
VATE NETWORKS.—If an incident is reported under sub-
section (j), the United States Computer Emergency Readi-
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
ness Team may, at the invitation of and in coordination 
with the reporting entity, investigate the incident to deter-
mine and report to the Director and the reporting entity— 
‘‘(1) the extent of any compromise; 
‘‘(2) an identification of any attackers, includ-
ing any affiliations with terrorists, terrorist organi-
zations, state entities, and nonstate entities; 
‘‘(3) the method of penetration; 
‘‘(4) ramifications of any such compromise on 
future operations; 
‘‘(5) secondary ramifications of any such com-
promise on other Federal or non-Federal networks; 
‘‘(6) ramifications of any such compromise on 
national security, including war fighting capability; 
and 
‘‘(7) recommended mitigation activities. 
‘‘(l) SAFETY ACT INCENTIVES.—The Director may 
recommend SAFETY Act designation and certification to 
entities determined under subsections (g) and (i) to be in 
compliance with the requirements of this section. 
‘‘(m) PENALTIES.—In the case of noncompliance 
with the requirements of this section the Director may rec-
ommend recision or suspension of SAFETY Act designa-
tion and certification during the period of noncompliance, 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
and may levy civil penalties, not to exceed $100,000 per 
day, for each instance of noncompliance.’’. 
(b) DEADLINES.—The Cybersecurity Compliance Di-
vision of the Department of Homeland Security shall— 
(1) not later than six months after such date of 
enactment of this Act, publish a notice of proposed 
rulemaking for regulations required under section 
224 of the Homeland Security Act of 2002, as 
amended by this section; and 
(2) not later than one year after such date of 
enactment of this Act, promulgate final regulations 
required under such section. 
(c) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to provide authority to any sector- 
specific agency or first-party regulatory agency to estab-
lish standards or other measures outside of the require-
ments of this Act except as required by this Act and the 
amendments made by this Act. 
(d) CLERICAL AMENDMENT.—The table of contents 
in section 1(b) of such Act is amended by striking the 
items relating to sections 221 through 225 and inserting 
the following: 
‘‘Sec. 221. Definitions. 
‘‘Sec. 222. Office of Cybersecurity and Communications. 
‘‘Sec. 223. Department responsibilities and authorities for securing Federal 
Government networks. 
‘‘Sec. 224. Department responsibilities and authorities for securing private sec-
tor networks. 
‘‘Sec. 225. Procedures for sharing information. 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6211
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
‘‘Sec. 226. Privacy Officer. 
‘‘Sec. 227. Enhancement of non-Federal cybersecurity. 
‘‘Sec. 228. Net guard. 
‘‘Sec. 229. Cyber Security Enhancement Act of 2002.’’. 
SEC. 3. INFORMATION SHARING. 
The Assistant Secretary for Cybersecurity and Com-
munications of the Department of Homeland Security in 
coordination with the Assistant Secretary Infrastructure 
Protection of the Department of Homeland Security shall, 
to the maximum extent possible, consistent with rules for 
the handling of classified information, share relevant in-
formation 
regarding 
cybersecurity 
threats 
and 
vulnerabilities, and any proposed actions to mitigate them, 
with all Federal agencies, appropriate State, local, or trib-
al authority representatives, and all covered critical infra-
structure owners and operators, including by expediting 
necessary security clearances for designated points of con-
tact for critical infrastructures. 
SEC. 4. INFORMATION PROTECTION. 
The Assistant Secretary for Cybersecurity and Com-
munications of the Department of Homeland Security 
shall designate, as appropriate, information received from 
Federal agencies pursuant to the requirements enacted by 
section 2 (including the amendments made by such sec-
tion), information received from covered critical infra-
structure owners and operators pursuant to such section, 
and information provided to Federal agencies or covered 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
critical infrastructure owners and operators pursuant to 
this section as sensitive security information and shall re-
quire and enforce sensitive security information require-
ments for handling, storage, and dissemination of any 
such information. 
SEC. 5. CYBERSECURITY RESEARCH AND DEVELOPMENT. 
(a) IN GENERAL.—The Under Secretary for Science 
and Technology of the Department of Homeland Security 
shall support research, development, testing, evaluation, 
and transition of cybersecurity technology, including fun-
damental, long-term research to improve the ability of the 
United States to prevent, protect against, detect, respond 
to, and recover from acts of terrorism and cyber attacks, 
with an emphasis on research and development relevant 
to large-scale, high-impact attacks. 
(b) ACTIVITIES.—The research and development sup-
ported under subsection (a) shall include work to— 
(1) advance the development and accelerate the 
deployment of more secure versions of fundamental 
Internet protocols and architectures, including for 
the domain name system and routing protocols; 
(2) improve and create technologies for detect-
ing attacks or intrusions, including real-time moni-
toring and real-time analytic technologies; 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
(3) improve and create mitigation and recovery 
methodologies, including techniques and policies for 
real-time containment of attacks, and development 
of resilient networks and systems that degrade 
gracefully; 
(4) develop and support infrastructure and tools 
to support cybersecurity research and development 
efforts, including modeling, test beds, and data sets 
for assessment of new cybersecurity technologies; 
(5) assist the development and support of tech-
nologies to reduce vulnerabilities in process control 
systems; 
(6) develop and support cyber forensics and at-
tack attribution; and 
(7) test, evaluate, and facilitate the transfer of 
technologies associated with the engineering of less 
vulnerable software and securing the information 
technology software development lifecycle. 
(c) COORDINATION.—In carrying out this section, the 
Under Secretary shall coordinate activities with— 
(1) the Under Secretary for National Protection 
and Programs, the Assistant Secretary for Cyberse-
curity and Communications, and the Assistant Sec-
retary for Infrastructure Protection of the Depart-
ment of Homeland Security; and 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
(2) the heads of other relevant Federal depart-
ments and agencies, including the National Science 
Foundation, 
the 
Defense 
Advanced 
Research 
Projects Agency, the Information Assurance Direc-
torate of the National Security Agency, the National 
Institute of Standards and Technology, the Depart-
ment of Commerce, and other appropriate working 
groups established by the President to identify 
unmet needs and cooperatively support activities, as 
appropriate. 
SEC. 6. CYBER WORKFORCE RECRUITMENT, DEVELOP-
MENT, AND RETENTION. 
(a) WORKFORCE PLAN.—Not later than 180 days 
after the date of enactment of this Act and in every subse-
quent year, the Assistant Secretary for Cybersecurity and 
Communication of the Department of Homeland Security 
shall develop a strategic cybersecurity workforce plan as 
part of the Federal agency performance plan required 
under section 1115 of title 31, United States Code, that 
includes— 
(1) a description of the Department’s cyberse-
curity mission; and 
(2) a description and analysis, relating to the 
specialized workforce needed by the Department to 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
fulfill the Federal agency’s cybersecurity mission, in-
cluding— 
(A) the cybersecurity workforce needs of 
the Department on the date of the report, and 
near-, mid-, and long-term projections of work-
force needs; 
(B) hiring projections to meet cybersecu-
rity workforce needs, including, for at least a 2- 
year period, specific occupation and grade lev-
els; 
(C) long-term and short-term strategic 
goals to address critical skills deficiencies, in-
cluding analysis of the numbers of and reasons 
for attrition of employees; 
(D) recruitment strategies to attract highly 
qualified candidates from diverse backgrounds 
and geographic locations; 
(E) an assessment of the sources and 
availability of individuals with needed expertise; 
(F) ways to streamline the hiring process; 
(G) the barriers to recruiting and hiring 
individuals qualified in cybersecurity and rec-
ommendations to overcome the barriers; and 
(H) a training and development plan to en-
hance and improve the knowledge of employees. 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
(b) TRAINING.— 
(1) FEDERAL GOVERNMENT EMPLOYEES AND 
FEDERAL CONTRACTORS.—The Assistant Secretary 
for Cybersecurity and Communications shall estab-
lish a cybersecurity awareness and education cur-
riculum that shall be required for all Federal em-
ployees and contractors engaged in the design, devel-
opment, or operation of civilian Federal agency com-
puter networks. 
(2) CONTENTS.—The curriculum established 
under paragraph (1) may include— 
(A) role-based security awareness training; 
(B) recommended cybersecurity practices; 
(C) cybersecurity recommendations for 
traveling abroad; 
(D) unclassified counterintelligence infor-
mation; 
(E) information regarding industrial espio-
nage; 
(F) information regarding malicious activ-
ity online; 
(G) information regarding cybersecurity 
and law enforcement; 
(H) identity management information; 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
(I) information regarding supply chain se-
curity; 
(J) information security risks associated 
with the activities of Federal employees; and 
(K) the responsibilities of Federal employ-
ees in complying with policies and procedures 
designed to reduce information security risks 
identified under subparagraph (J). 
(c) EDUCATION
OPPORTUNITIES.—The Assistant 
Secretary for Cybersecurity and Communications shall de-
velop and implement a strategy to provide Federal employ-
ees who work in cybersecurity-related areas with the op-
portunity to obtain additional education. 
(d) DIRECT HIRE AUTHORITY.—Without regard to 
the civil service laws (other than sections 3303 and 3328 
of title 5, United States Code), the Secretary, acting 
through the Assistant Secretary for Cybersecurity and 
Communications, in consultation with the Under Sec-
retary for Management, may appoint not more than 500 
employees under this subsection to carry out the require-
ments of this Act at a rate of pay that may not exceed 
the maximum rate of basic pay payable under section 
5376 of title 5, United States Code, upon certification to 
the Congress that standard Federal hiring processes have 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS
not resulted in the required number of critical cybersecu-
rity positions being filled. 
(e) RETENTION BONUSES.—Notwithstanding section 
5754 of title 5, United States Code, the Director may pay 
a retention bonus under that section to any individual ap-
pointed under this section, if the Secretary, acting through 
Assistant Secretary for Cybersecurity and Communica-
tions, in consultation with the Under Secretary for Man-
agement, determines that, in the absence of a retention 
bonus, there is a high risk that the individual would likely 
leave employment with the Department. The Secretary 
shall submit a written explanation of this determination 
to Congress prior to announcing the use of this authority. 
Æ 
VerDate Mar 15 2010 
22:05 Jan 11, 2011
Jkt 099200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6301
E:\BILLS\H174.IH
H174
srobinson on DSKHWCL6B1PROD with BILLS