HR 4061 RFS 
SEC. 109. CYBERSECURITY CHECKLIST DEVELOPMENT AND 
DISSEMINATION. 
Section 8(c) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7406(c)) is amended to read 
as follows: 
‘‘(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the Na-
tional Institute of Standards and Technology shall 
develop or identify and revise or adapt as necessary, 
checklists, configuration profiles, and deployment 
recommendations for products and protocols that 
minimize the security risks associated with each 
computer hardware or software system that is, or is 
likely to become, widely used within the Federal 
Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
ment of checklists under this subsection. Such prior-
ities may be based on the security risks associated 
with the use of each system, the number of agencies 
that use a particular system, the usefulness of the 
checklist to Federal agencies that are users or po-
tential users of the system, or such other factors as 
the Director determines to be appropriate. 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS
HR 4061 RFS 
‘‘(3) EXCLUDED
SYSTEMS.—The Director of 
the National Institute of Standards and Technology 
may exclude from the requirements of paragraph (1) 
any computer hardware or software system for 
which the Director determines that the development 
of a checklist is inappropriate because of the infre-
quency of use of the system, the obsolescence of the 
system, or the inutility or impracticability of devel-
oping a checklist for the system. 
‘‘(4) AUTOMATION SPECIFICATIONS.—The Di-
rector of the National Institute of Standards and 
Technology shall develop automated security speci-
fications (such as the Security Content Automation 
Protocol) with respect to checklist content and asso-
ciated security related data. 
‘‘(5) DISSEMINATION
OF
CHECKLISTS.—The 
Director of the National Institute of Standards and 
Technology shall ensure that Federal agencies are 
informed of the availability of any product developed 
or identified under the National Checklist Program 
for any information system, including the Security 
Content Automation Protocol and other automated 
security specifications. 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS
HR 4061 RFS 
‘‘(6) AGENCY USE REQUIREMENTS.—The devel-
opment of a checklist under paragraph (1) for a 
computer hardware or software system does not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the checklist for the system; 
‘‘(B) establish conditions or prerequisites 
for Federal agency procurement or deployment 
of any such system; 
‘‘(C) imply an endorsement of any such 
system by the Director of the National Institute 
of Standards and Technology; or 
‘‘(D) preclude any Federal agency from 
procuring or deploying other computer hard-
ware or software systems for which no such 
checklist has been developed or identified under 
paragraph (1).’’. 
SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND 
DEVELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redes-
ignating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following: 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS
HR 4061 RFS 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execu-
tion of a wide variety of resource protection policies 
and that is amenable to implementation within a 
wide variety of existing and emerging computing en-
vironments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and net-
works; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; and 
‘‘(4) carry out research associated with improv-
ing security of industrial control systems.’’. 
SEC. 111. NATIONAL ACADEMY OF SCIENCES STUDY ON 
THE ROLE OF COMMUNITY COLLEGES IN CY-
BERSECURITY EDUCATION. 
Not later than 120 days after the date of enactment 
of this Act, the Director of the Office of Science and Tech-
nology Policy, in consultation with the Director of the Na-
tional Coordination Office, shall enter into a contract with 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS
HR 4061 RFS 
the National Academy of Sciences to conduct and complete 
a study to describe the role of community colleges in cy-
bersecurity education and to identify exemplary practices 
and partnerships related to cybersecurity education be-
tween community colleges and 4-year educational institu-
tions. 
SEC. 112. NATIONAL CENTER OF EXCELLENCE FOR CYBER-
SECURITY. 
(a) IN GENERAL.—As part of the Program, the Di-
rector of the National Science Foundation shall, in coordi-
nation with other Federal agencies participating in the 
Program, establish a National Center of Excellence for 
Cybersecurity. 
(b) MERIT REVIEW.—The National Center of Excel-
lence for Cybersecurity shall be awarded on a merit-re-
viewed, competitive basis. 
(c) ACTIVITIES SUPPORTED.—The National Center 
of Excellence for Cybersecurity shall— 
(1) involve institutions of higher education or 
national laboratories and other partners, which may 
include States and industry; 
(2) make use of existing expertise in cybersecu-
rity; 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS
HR 4061 RFS 
(3) interact and collaborate with Computer and 
Network Security Research Centers to foster the ex-
change of technical information and best practices; 
(4) perform research to support the develop-
ment of technologies for testing hardware and soft-
ware products to validate operational readiness and 
certify stated security levels; 
(5) coordinate cybersecurity education and 
training opportunities nationally; 
(6) enhance technology transfer and commer-
cialization that promote cybersecurity innovation; 
and 
(7) perform research on cybersecurity social 
and behavioral factors, including human-computer 
interactions, usability, user motivations, and organi-
zational cultures. 
SEC. 113. CYBERSECURITY INFRASTRUCTURE REPORT. 
Not later than 1 year after the date of enactment 
of this Act, the Comptroller General shall transmit to the 
Congress a report examining key weaknesses within the 
current cybersecurity infrastructure, along with rec-
ommendations on how to address such weaknesses in the 
future and on the technology that is needed to do so. 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS
HR 4061 RFS 
SEC. 203. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, and other organizations, shall develop and imple-
ment a cybersecurity awareness and education program to 
increase public awareness, including among children and 
young adults, of cybersecurity risks, consequences, and 
best practices through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; and 
(2) efforts to make cybersecurity technical 
standards and best practices usable by individuals, 
small to medium-sized businesses, State, local, and 
tribal governments, and educational institutions, es-
pecially with respect to novice computer users, elder-
ly populations, low-income populations, and popu-
lations in areas of planned broadband expansion or 
deployment. 
(b) WORKSHOPS.—In carrying out activities under 
subsection (a)(1), the Institute is authorized to host re-
gional workshops to provide an overview of cybersecurity 
risks and best practices to businesses, State, local, and 
tribal governments, and educational institutions. 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS
HR 4061 RFS 
(c) MANUFACTURING EXTENSION PARTNERSHIP.— 
The Director shall, to the extent appropriate, implement 
subsection (a) through the Manufacturing Extension Part-
nership program under section 25 of the National Insti-
tute of Standards and Technology Act (15 U.S.C. 278k). 
(d) REPORT TO CONGRESS.—Not later than 90 days 
after the date of enactment of this Act, the Director shall 
transmit to the Congress a report containing a strategy 
for implementation of this section. 
SEC. 204. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director shall establish a program to support the 
development of technical standards, metrology, testbeds, 
and conformance criteria, taking into account appropriate 
user concerns, to— 
(1) improve interoperability among identity 
management technologies; 
(2) strengthen authentication methods of iden-
tity management systems; 
(3) improve privacy protection in identity man-
agement systems, including health information tech-
nology systems, through authentication and security 
protocols; and 
(4) improve the usability of identity manage-
ment systems. 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS
HR 4061 RFS 
SEC. 205. PRACTICES AND STANDARDS. 
The National Institute of Standards and Technology 
shall work with other Federal, State, and private sector 
partners, as appropriate, to develop a framework that 
States may follow in order to achieve effective cybersecu-
rity practices in a timely and cost-effective manner. 
Passed the House of Representatives February 4, 
2010. 
Attest: 
LORRAINE C. MILLER, 
Clerk. 
VerDate Nov 24 2008 
00:56 Feb 10, 2010
Jkt 089200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H4061.RFS
H4061
smartinez on DSKB9S0YB1PROD with BILLS