†
HR 3394 EAS
‘‘(D) how the for-profit entities, nonprofit
research institutions, and any other partners
will participate in developing and carrying out
the research and education agenda of the part-
nership.
‘‘(d) PROGRAM OPERATION.—
‘‘(1) MANAGEMENT.—The program established
under subsection (a) shall be managed by individuals
who shall have both expertise in research related to
the security of computer systems and knowledge of the
vulnerabilities of existing computer systems. The Di-
rector shall designate such individuals as program
managers.
‘‘(2) MANAGERS MAY BE EMPLOYEES.—Program
managers designated under paragraph (1) may be
new or existing employees of the Institute or individ-
uals on assignment at the Institute under the Inter-
governmental Personnel Act of 1970, except that indi-
viduals on assignment at the Institute under the
Intergovernmental Personnel Act of 1970 shall not di-
rectly manage such employees.
‘‘(3) 
MANAGER
RESPONSIBILITY.—Program
managers designated under paragraph (1) shall be re-
sponsible for—
†
HR 3394 EAS
‘‘(A) establishing and publicizing the broad
research goals for the program;
‘‘(B) soliciting applications for specific re-
search projects to address the goals developed
under subparagraph (A);
‘‘(C) selecting research projects for support
under the program from among applications
submitted to the Institute, following consider-
ation of—
‘‘(i) the novelty and scientific and
technical merit of the proposed projects;
‘‘(ii) the demonstrated capabilities of
the individual or individuals submitting the
applications to successfully carry out the
proposed research;
‘‘(iii) the impact the proposed projects
will have on increasing the number of com-
puter security researchers;
‘‘(iv) the nature of the participation by
for-profit entities and the extent to which
the proposed projects address the concerns of
industry; and
‘‘(v) other criteria determined by the
Director, based on information specified for
†
HR 3394 EAS
inclusion in applications under subsection
(c); and
‘‘(D) monitoring the progress of research
projects supported under the program.
‘‘(4) REPORTS.—The Director shall report to the
Senate Committee on Commerce, Science, and Trans-
portation and the House of Representatives Com-
mittee on Science annually on the use and responsi-
bility of individuals on assignment at the Institute
under the Intergovernmental Personnel Act of 1970
who are performing duties under subsection (d).
‘‘(e) REVIEW OF PROGRAM.—
‘‘(1) PERIODIC REVIEW.—The Director shall pe-
riodically review the portfolio of research awards
monitored by each program manager designated in
accordance with subsection (d). In conducting those
reviews, the Director shall seek the advice of the Com-
puter System Security and Privacy Advisory Board,
established under section 21, on the appropriateness
of the research goals and on the quality and utility
of research projects managed by program managers in
accordance with subsection (d).
‘‘(2) COMPREHENSIVE 5-YEAR REVIEW.—The Di-
rector shall also contract with the National Research
Council for a comprehensive review of the program es-
†
HR 3394 EAS
tablished under subsection (a) during the 5th year of
the program. Such review shall include an assessment
of the scientific quality of the research conducted, the
relevance of the research results obtained to the goals
of the program established under subsection (d)(3)(A),
and the progress of the program in promoting the de-
velopment of a substantial academic research commu-
nity working at the leading edge of knowledge in the
field. The Director shall submit to Congress a report
on the results of the review under this paragraph no
later than 6 years after the initiation of the program.
‘‘(f) DEFINITIONS.—In this section:
‘‘(1) COMPUTER SYSTEM.—The term ‘computer
system’ has the meaning given that term in section
20(d)(1).
‘‘(2) INSTITUTION OF HIGHER EDUCATION.—The
term ‘institution of higher education’ has the meaning
given that term in section 101(a) of the Higher Edu-
cation Act of 1965 (20 U.S.C. 1001(a)).’’.
(b) AMENDMENT
OF COMPUTER
SYSTEM DEFINI-
TION.—Section 20(d)(1)(B)(i) of National Institute of
Standards and Technology Act (15 U.S.C. 278g–
3(d)(1)(B)(i)) is amended to read as follows:
‘‘(i) computers and computer net-
works;’’.
†
HR 3394 EAS
(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.—
(1) IN GENERAL.—The Director of the National
Institute of Standards and Technology shall develop,
and revise as necessary, a checklist setting forth set-
tings and option selections that minimize the security
risks associated with each computer hardware or soft-
ware system that is, or is likely to become, widely
used within the Federal government.
(2) PRIORITIES FOR DEVELOPMENT; EXCLUDED
SYSTEMS.—The Director of the National Institute of
Standards and Technology may establish priorities
for the development of checklists under this paragraph
on the basis of the security risks associated with the
use of the system, the number of agencies that use a
particular system, the usefulness of the checklist to
Federal agencies that are users or potential users of
the system, or such other factors as the Director deter-
mines to be appropriate. The Director of the National
Institute of Standards and Technology may exclude
from the application of paragraph (1) any computer
hardware or software system for which the Director of
the National Institute of Standards and Technology
determines that the development of a checklist is inap-
propriate because of the infrequency of use of the sys-
tem, the obsolescence of the system, or the inutility or
†
HR 3394 EAS
impracticability of developing a checklist for the sys-
tem.
(3) DISSEMINATION OF CHECKLISTS.—The Di-
rector of the National Institute of Standards and
Technology shall make any checklist developed under
this paragraph for any computer hardware or soft-
ware system available to each Federal agency that is
a user or potential user of the system.
(4) AGENCY USE REQUIREMENTS.—The develop-
ment of a checklist under paragraph (1) for a com-
puter hardware or software system does not—
(A) require any Federal agency to select the
specific settings or options recommended by the
checklist for the system;
(B) establish conditions or prerequisites for
Federal agency procurement or deployment of
any such system;
(C) represent an endorsement of any such
system by the Director of the National Institute
of Standards and Technology; nor
(D) preclude any Federal agency from pro-
curing or deploying other computer hardware or
software systems for which no such checklist has
been developed.
†
HR 3394 EAS
(d) FEDERAL AGENCY INFORMATION SECURITY PRO-
GRAMS.—
(1) IN GENERAL.—In developing the agencywide
information security program required by section
3534(b) of title 44, United States Code, an agency
that deploys a computer hardware or software system
for which the Director of the National Institute of
Standards and Technology has developed a checklist
under subsection (c) of this section—
(A) shall include in that program an expla-
nation of how the agency has considered such
checklist in deploying that system; and
(B) may treat the explanation as if it were
a portion of the agency’s annual performance
plan properly classified under criteria estab-
lished by an Executive Order (within the mean-
ing of section 1115(d) of title 31, United States
Code).
(2) LIMITATION.—Paragraph (1) does not apply
to any computer hardware or software system for
which the National Institute of Standards and Tech-
nology does not have responsibility under section
20(a)(3) of the National Institute of Standards and
Technology Act (15 U.S.C.278g-3(a)(3)).
†
HR 3394 EAS
SEC. 9. COMPUTER SECURITY REVIEW, PUBLIC MEETINGS,
AND INFORMATION.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) is amended by adding
at the end the following new subsection:
‘‘(e) AUTHORIZATION OF APPROPRIATIONS.—There are
authorized to be appropriated to the Secretary $1,060,000
for fiscal year 2003 and $1,090,000 for fiscal year 2004
to enable the Computer System Security and Privacy Advi-
sory Board, established by section 21, to identify emerging
issues, including research needs, related to computer secu-
rity, privacy, and cryptography and, as appropriate, to
convene public meetings on those subjects, receive presen-
tations, and publish reports, digests, and summaries for
public distribution on those subjects.’’.
SEC. 10. INTRAMURAL SECURITY RESEARCH.
Section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3), as amended by this Act,
is further amended by redesignating subsection (e) as sub-
section (f), and by inserting after subsection (d) the fol-
lowing:
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of
the research activities conducted in accordance with sub-
section (b)(4), the Institute shall—
‘‘(1) conduct a research program to address
emerging technologies associated with assembling a
†
HR 3394 EAS
networked computer system from components while
ensuring it maintains desired security properties;
‘‘(2) carry out research associated with improv-
ing the security of real-time computing and commu-
nications systems for use in process control; and
‘‘(3) carry out multidisciplinary, long-term,
high-risk research on ways to improve the security of
computer systems.’’.
SEC. 11. AUTHORIZATION OF APPROPRIATIONS.
There are authorized to be appropriated to the Sec-
retary of Commerce for the National Institute of Standards
and Technology—
(1) for activities under section 22 of the National
Institute of Standards and Technology Act, as added
by section 8 of this Act—
(A) $25,000,000 for fiscal year 2003;
(B) $40,000,000 for fiscal year 2004;
(C) $55,000,000 for fiscal year 2005;
(D) $70,000,000 for fiscal year 2006;
(E) $85,000,000 for fiscal year 2007; and
(2) for activities under section 20(f) of the Na-
tional Institute of Standards and Technology Act, as
added by section 10 of this Act—
(A) $6,000,000 for fiscal year 2003;
(B) $6,200,000 for fiscal year 2004;
†
HR 3394 EAS
(C) $6,400,000 for fiscal year 2005;
(D) $6,600,000 for fiscal year 2006; and
(E) $6,800,000 for fiscal year 2007.
SEC. 12. NATIONAL ACADEMY OF SCIENCES STUDY ON COM-
PUTER AND NETWORK SECURITY IN CRITICAL
INFRASTRUCTURES.
(a) STUDY.—Not later than 3 months after the date
of the enactment of this Act, the Director of the National
Institute of Standards and Technology shall enter into an
arrangement with the National Research Council of the Na-
tional Academy of Sciences to conduct a study of the
vulnerabilities of the Nation’s network infrastructure and
make recommendations for appropriate improvements. The
National Research Council shall—
(1) review existing studies and associated data
on 
the 
architectural, 
hardware, 
and 
software
vulnerabilities and interdependencies in United
States critical infrastructure networks;
(2) identify and assess gaps in technical capa-
bility for robust critical infrastructure network secu-
rity and make recommendations for research prior-
ities and resource requirements; and
(3) review any and all other essential elements
of computer and network security, including security
†
HR 3394 EAS
of industrial process controls, to be determined in the
conduct of the study.
(b) REPORT.—The Director of the National Institute
of Standards and Technology shall transmit a report con-
taining the results of the study and recommendations re-
quired by subsection (a) to the Senate Committee on Com-
merce, Science, and Transportation and the House of Rep-
resentatives Committee on Science not later than 21 months
after the date of enactment of this Act.
(c) SECURITY.—The Director of the National Institute
of Standards and Technology shall ensure that no informa-
tion that is classified is included in any publicly released
version of the report required by this section.
(d) AUTHORIZATION OF APPROPRIATIONS.—There are
authorized to be appropriated to the Secretary of Commerce
for the National Institute of Standards and Technology for
the purposes of carrying out this section, $700,000.
SEC. 13. COORDINATION OF FEDERAL CYBER SECURITY RE-
SEARCH AND DEVELOPMENT
The Director of the National Science Foundation and
the Director of the National Institute of Standards and
Technology shall coordinate the research programs author-
ized by this Act or pursuant to amendments made by this
Act. The Director of the Office of Science and Technology
Policy shall work with the Director of the National Science
†
HR 3394 EAS
Foundation and the Director of the National Institute of
Standards and Technology to ensure that programs author-
ized by this Act or pursuant to amendments made by this
Act are taken into account in any government-wide cyber
security research effort.
SEC. 14. OFFICE OF SPACE COMMERCIALIZATION.
Section 8(a) of the Technology Administration Act of
1998 (15 U.S.C. 1511e(a)) is amended by inserting ‘‘the
Technology Administration of’’ after ‘‘within’’.
SEC. 15. TECHNICAL CORRECTION OF NATIONAL CON-
STRUCTION SAFETY TEAM ACT.
Section 2(c)(1)(d) of the National Construction Safety
Team Act is amended by striking ‘‘section 8;’’ and inserting
‘‘section 7;’’.
SEC. 16. GRANT ELIGIBILITY REQUIREMENTS AND COMPLI-
ANCE WITH IMMIGRATION LAWS.
(a) IMMIGRATION STATUS.—No grant or fellowship
may be awarded under this Act, directly or indirectly, to
any individual who is in violation of the terms of his or
her status as a nonimmigrant under section 101(a)(15)(F),
(M), or (J) of the Immigration and Nationality Act (8
U.S.C. 1101(a)(15)(F), (M), or (J)).
(b) ALIENS FROM CERTAIN COUNTRIES.—No grant or
fellowship may be awarded under this Act, directly or indi-
rectly, to any alien from a country that is a state sponsor
†
HR 3394 EAS
of international terrorism, as defined under section 306(b)
of the Enhanced Border Security and VISA Entry Reform
Act (8 U.S.C. 1735(b)), unless the Secretary of State deter-
mines, in consultation with the Attorney General and the
heads of other appropriate agencies, that such alien does
not pose a threat to the safety or national security of the
United States.
(c) NON-COMPLYING INSTITUTIONS.—No grant or fel-
lowship may be awarded under this Act, directly or indi-
rectly, to any institution of higher education or non-profit
institution (or consortia thereof) that has—
(1) materially failed to comply with the record-
keeping and reporting requirements to receive non-
immigrant students or exchange visitor program par-
ticipants under section 101(a)(15)(F), (M), or (J) of
the Immigration and Nationality Act (8 U.S.C.
1101(a)(15)(F), (M), or (J)), or section 641 of the Il-
legal Immigration Reform and Responsibility Act of
1996 (8 U.S.C. 1372), as required by section 502 of
the Enhanced Border Security and VISA Entry Re-
form Act (8 U.S.C. 1762); or
(2) been suspended or terminated pursuant to
section 502(c) of the Enhanced Border Security and
VISA Entry Reform Act (8 U.S.C 1762(c)).
†
HR 3394 EAS
SEC. 17. REPORT ON GRANT AND FELLOWSHIP PROGRAMS.
Within 24 months after the date of enactment of this
Act, the Director, in consultation with the Assistant to the
President for National Security Affairs, shall submit to
Congress a report reviewing this Act to ensure that the pro-
grams and fellowships are being awarded under this Act
to individuals and institutions of higher education who are
in compliance with the Immigration and Nationality Act
(8 U.S.C. 1101 et seq.) in order to protect our national secu-
rity.
Attest:
Secretary.