I 
117TH CONGRESS 
1ST SESSION H. R. 4259 
To direct the Secretary of Commerce, acting through the Director of the 
National Institute of Standards and Technology, to direct the Institute 
to establish a robust program focusing on driving improvements in Amer-
ica’s cybersecurity posture by creating more robust digital identity man-
agement standards and guidelines. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 30, 2021 
Mr. FOSTER (for himself and Ms. WEXTON) introduced the following bill; 
which was referred to the Committee on Science, Space, and Technology 
A BILL 
To direct the Secretary of Commerce, acting through the 
Director of the National Institute of Standards and 
Technology, to direct the Institute to establish a robust 
program focusing on driving improvements in America’s 
cybersecurity posture by creating more robust digital 
identity management standards and guidelines. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Strengthening Digital 
Identity Act of 2021’’. 
VerDate Sep 11 2014 
02:27 Jul 15, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4259.IH
H4259
kjohnson on DSK79L0C42PROD with BILLS
SEC. 2. FINDINGS. 
Congress finds the following: 
(1) NIST’s work in identity research and stand-
ards is unmatched anywhere in the world, with glob-
al standards development organizations like the Fi-
nancial Action Task Force (FATF) pointing to 
NIST guidance in its own standards. Given that ad-
versaries continue to exploit weaknesses in digital 
identity systems to conduct successful cyber-attacks, 
additional NIST resources are needed to help gov-
ernment and industry secure identity in cyberspace. 
(2) The lack of an easy, affordable, and reliable 
way for organizations and businesses to identify 
whether an individual is who they claim to be online 
creates an attack vector that is widely exploited by 
adversaries in cyberspace and precludes many high 
value transactions from being available online. 
(3) According to the identity theft resource cen-
ter, incidents of identity theft and identity fraud 
continue to rise in the United States, where more 
than 164,000,000 consumer records containing per-
sonally identifiable information were breached in 
2019, increasing the total number of data breaches 
by 17 percent from the previous year. 
VerDate Sep 11 2014 
02:27 Jul 15, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4259.IH
H4259
kjohnson on DSK79L0C42PROD with BILLS
(4) According to the Insurance Information In-
stitute, in 2018, losses resulting from identity fraud 
amounted to $16,800,000,000. 
(5) The inadequacy of current digital identity 
solutions degrades security and privacy for all Amer-
icans, and next generation solutions are needed that 
improve both security and privacy. 
(6) 
Government 
entities, 
as 
authoritative 
issuers of identity in the United States, are uniquely 
positioned to deliver critical components that ad-
dress deficiencies in our digital identity infrastruc-
ture and augment private sector digital identity and 
authentication solutions. 
(7) State governments are particularly well 
suited to play a role in enhancing digital identity so-
lutions used by both the public and private sectors, 
given the role of State governments as the issuers of 
driver’s licenses and other identity documents com-
monly used today. 
(8) It should be the policy of the Government 
to use the authorities and capabilities of the Govern-
ment to enhance the security, reliability, privacy, 
and convenience of digital identity solutions that 
support and protect transactions between individ-
VerDate Sep 11 2014 
02:27 Jul 15, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4259.IH
H4259
kjohnson on DSK79L0C42PROD with BILLS
uals, government entities, and businesses, and that 
enable Americans to prove who they are online. 
SEC. 3. IDENTITY MANAGEMENT RESEARCH AND DEVELOP-
MENT. 
Section 504 of the Cybersecurity Enhancement Act 
of 2014 (15 U.S.C. 7464) is amended to read as follows: 
‘‘SEC. 504. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
‘‘(a) IN GENERAL.—The Director shall administer a 
program to support the development of voluntary and 
cost-effective technical standards, metrology, testbeds, and 
conformance criteria, taking into account appropriate user 
concerns— 
‘‘(1) to improve interoperability among identity 
management technologies; 
‘‘(2) to strengthen identity proofing and au-
thentication methods used in identity management 
systems; 
‘‘(3) to improve privacy protection in identity 
management systems, including health information 
technology systems, through authentication and se-
curity protocols; and 
‘‘(4) to improve the usability and inclusivity of 
identity management systems. 
VerDate Sep 11 2014 
02:27 Jul 15, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4259.IH
H4259
kjohnson on DSK79L0C42PROD with BILLS
‘‘(b) DIGITAL IDENTITY TECHNICAL ROADMAP.— 
The Director, in consultation with other relevant Federal 
agencies and stakeholders from the private sector, shall 
develop, implement, and maintain a technical roadmap for 
identity management research and the development of 
standards and guidelines focused on enabling the use and 
adoption of modern digital identity solutions that align 
with the four criteria in subsection (a). This roadmap and 
any subsequent updates shall be made public. 
‘‘(c) ACTIVITIES.—In carrying out the program de-
scribed under subsection (a), the Director shall give con-
sideration to activities that— 
‘‘(1) accelerate the development, in collabora-
tion with the private sector, of standards that ad-
dress interoperability and portability of digital iden-
tity solutions; 
‘‘(2) addresses gaps in current private-sector- 
led identity management research and development 
and standards work, both for consumer-focused and 
enterprise-focused identity management; 
‘‘(3) advances the development of conformance 
testing performed by the private sector in support of 
digital identity standardization; 
VerDate Sep 11 2014 
02:27 Jul 15, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4259.IH
H4259
kjohnson on DSK79L0C42PROD with BILLS
‘‘(4) addresses challenges with inclusivity of ex-
isting digital identity and identity management tools; 
and 
‘‘(5) support, in consultation with other rel-
evant Federal agencies and stakeholders from the 
private sector, the development of appropriate secu-
rity frameworks and reference materials, and the 
identification of best practices, for use by Federal 
agencies and the private sector to address security 
and privacy requirements to enable the use and 
adoption of digital identity services.’’. 
SEC. 4. DIGITAL IDENTITY FRAMEWORK. 
(a) ESTABLISHMENT OF A FRAMEWORK.—Not later 
than 1 year after the date of the enactment of this Act, 
the Director shall develop and periodically update a frame-
work of standards, methodologies, procedures, and proc-
esses (in this section referred to as the ‘‘Framework’’) as 
a guide for Federal, State, and local governments to follow 
when providing services to support digital identity 
verification. 
(b) CONSIDERATION.—In developing the Framework, 
the Director shall consider— 
(1) methods to protect the privacy of individ-
uals; 
(2) security needs; and 
VerDate Sep 11 2014 
02:27 Jul 15, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4259.IH
H4259
kjohnson on DSK79L0C42PROD with BILLS
(3) the needs of potential end-users and individ-
uals that will use services related to digital identity 
verification. 
(c) CONSULTATION.—In carrying out subsection (a) 
the Director shall consult with— 
(1) Federal and State agencies; 
(2) potential end-users and individuals that will 
use services related to digital identity verification; 
and 
(3) experts with relevant experience in the sys-
tems that enable digital identity verification, as de-
termined by the Director. 
(d) INTERIM PUBLICATION.—Not later than 240 
days after the date of the enactment of this Act, the Direc-
tor shall publish an interim version of the Framework. 
(e) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized 
to 
be 
appropriated 
to 
the 
Secretary 
$10,000,000 for each of fiscal years 2022 through 2026 
to carry out this Act and the amendments made by this 
Act. 
SEC. 5. DEFINITIONS. 
For purposes of this Act: 
(1) DIGITAL
IDENTITY
VERIFICATION.—The 
term ‘‘digital identity verification’’ means a process 
VerDate Sep 11 2014 
02:27 Jul 15, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4259.IH
H4259
kjohnson on DSK79L0C42PROD with BILLS