IB 
Union Calendar No. 236 
111TH CONGRESS 
2D SESSION 
H. R. 4061 
[Report No. 111–405] 
To advance cybersecurity research, development, and technical standards, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 7, 2009 
Mr. LIPINSKI (for himself, Mr. MCCAUL, Mr. WU, Mr. EHLERS, Ms. EDDIE 
BERNICE JOHNSON of Texas, Mr. SMITH of Nebraska, Mr. GORDON of 
Tennessee, Mr. HALL of Texas, Mr. LUJA´N, and Mr. ROTHMAN of New 
Jersey) introduced the following bill; which was referred to the Committee 
on Science and Technology 
JANUARY 27, 2010 
Reported with an amendment, committed to the Committee of the Whole 
House on the State of the Union, and ordered to be printed 
[Strike out all after the enacting clause and insert the part printed in italic] 
[For text of introduced bill, see copy of bill as introduced on November 7, 2009] 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
A BILL 
To advance cybersecurity research, development, and 
technical standards, and for other purposes. 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Cybersecurity Enhance-
ment Act of 2009’’. 
TITLE I—RESEARCH AND 
DEVELOPMENT 
SEC. 101. DEFINITIONS. 
In this title: 
(1) NATIONAL COORDINATION OFFICE.—The term 
National Coordination Office means the National Co-
ordination Office for the Networking and Information 
Technology Research and Development program. 
(2) PROGRAM.—The term Program means the 
Networking and Information Technology Research 
and Development program which has been established 
under section 101 of the High-Performance Com-
puting Act of 1991 (15 U.S.C. 5511). 
SEC. 102. FINDINGS. 
Section 2 of the Cyber Security Research and Develop-
ment Act (15 U.S.C. 7401) is amended— 
(1) by amending paragraph (1) to read as fol-
lows: 
‘‘(1) Advancements in information and commu-
nications technology have resulted in a globally inter-
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
connected network of government, commercial, sci-
entific, and education infrastructures, including crit-
ical infrastructures for electric power, natural gas 
and petroleum production and distribution, tele-
communications, transportation, water supply, bank-
ing and finance, and emergency and government serv-
ices.’’; 
(2) in paragraph (2), by striking ‘‘Exponential 
increases in interconnectivity have facilitated en-
hanced communications, economic growth,’’ and in-
serting ‘‘These advancements have significantly con-
tributed to the growth of the United States economy’’; 
(3) by amending paragraph (3) to read as fol-
lows: 
‘‘(3) The Cyberspace Policy Review published by 
the President in May, 2009, concluded that our infor-
mation technology and communications infrastruc-
ture is vulnerable and has ‘suffered intrusions that 
have allowed criminals to steal hundreds of millions 
of dollars and nation-states and other entities to steal 
intellectual property and sensitive military informa-
tion’.’’; 
(4) by redesignating paragraphs (4) through (6) 
as paragraphs (5) through (7), respectively; 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(5) by inserting after paragraph (3) the fol-
lowing new paragraph: 
‘‘(4) In a series of hearings held before Congress 
in 2009, experts testified that the Federal cybersecu-
rity research and development portfolio was too fo-
cused on short-term, incremental research and that it 
lacked the prioritization and coordination necessary 
to address the long-term challenge of ensuring a se-
cure and reliable information technology and commu-
nications infrastructure.’’; and 
(6) by amending paragraph (7), as so redesig-
nated by paragraph (4) of this section, to read as fol-
lows: 
‘‘(7) While African-Americans, Hispanics, and 
Native Americans constitute 33 percent of the college- 
age population, members of these minorities comprise 
less than 20 percent of bachelor degree recipients in 
the field of computer sciences.’’. 
SEC. 103. CYBERSECURITY STRATEGIC RESEARCH AND DE-
VELOPMENT PLAN. 
(a) IN GENERAL.—Not later than 12 months after the 
date of enactment of this Act, the agencies identified in sub-
section 101(a)(3)(B)(i) through (x) of the High-Performance 
Computing Act of 1991 (15 U.S.C. 5511(a)(3)(B)(i) 
through (x)) or designated under section 101(a)(3)(B)(xi) 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
of such Act, working through the National Science and 
Technology Council and with the assistance of the National 
Coordination Office, shall transmit to Congress a strategic 
plan based on an assessment of cybersecurity risk to guide 
the overall direction of Federal cybersecurity and informa-
tion assurance research and development for information 
technology and networking systems. Once every 3 years 
after the initial strategic plan is transmitted to Congress 
under this section, such agencies shall prepare and transmit 
to Congress an update of such plan. 
(b) CONTENTS OF PLAN.—The strategic plan required 
under subsection (a) shall— 
(1) specify and prioritize near-term, mid-term 
and long-term research objectives, including objectives 
associated with the research areas identified in sec-
tion 4(a)(1) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7403(a)(1)) and how the 
near-term objectives complement research and develop-
ment areas in which the private sector is actively en-
gaged; 
(2) describe how the Program will focus on inno-
vative, transformational technologies with the poten-
tial to enhance the security, reliability, resilience, and 
trustworthiness of the digital infrastructure; 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(3) describe how the Program will foster the 
transfer of research and development results into new 
cybersecurity technologies and applications for the 
benefit of society and the national interest, including 
through the dissemination of best practices and other 
outreach activities; 
(4) describe how the Program will establish and 
maintain a national research infrastructure for cre-
ating, testing, and evaluating the next generation of 
secure networking and information technology sys-
tems; 
(5) describe how the Program will facilitate ac-
cess by academic researchers to the infrastructure de-
scribed in paragraph (4), as well as to relevant data, 
including event data; and 
(6) describe how the Program will engage females 
and individuals identified in section 33 or 34 of the 
Science and Engineering Equal Opportunities Act 
(42 U.S.C. 1885a or 1885b) to foster a more diverse 
workforce in this area. 
(c) DEVELOPMENT OF ROADMAP.—The agencies de-
scribed in subsection (a) shall develop and annually update 
an implementation roadmap for the strategic plan required 
in this section. Such roadmap shall— 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(1) specify the role of each Federal agency in 
carrying out or sponsoring research and development 
to meet the research objectives of the strategic plan, 
including a description of how progress toward the re-
search objectives will be evaluated; 
(2) specify the funding allocated to each major 
research objective of the strategic plan and the source 
of funding by agency for the current fiscal year; and 
(3) estimate the funding required for each major 
research objective of the strategic plan for the fol-
lowing 3 fiscal years. 
(d) RECOMMENDATIONS.—In developing and updating 
the strategic plan under subsection (a), the agencies in-
volved shall solicit recommendations and advice from— 
(1) the advisory committee established under sec-
tion 101(b)(1) of the High-Performance Computing 
Act of 1991 (15 U.S.C. 5511(b)(1)); and 
(2) a wide range of stakeholders, including in-
dustry, academia, including representatives of minor-
ity serving institutions, and other relevant organiza-
tions and institutions. 
(e) APPENDING
TO REPORT.—The implementation 
roadmap required under subsection (c), and its annual up-
dates, shall be appended to the report required under section 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(2) by amending paragraph (7) to read as fol-
lows: 
‘‘(7) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are necessary 
to carry out this subsection for each of the fiscal years 
2010 through 2014.’’. 
(d) COMPUTER AND NETWORK SECURITY CAPACITY 
BUILDING GRANTS.—Section 5(a)(6) of such Act (15 U.S.C. 
7404(a)(6)) is amended to read as follows: 
‘‘(6) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are necessary 
to carry out this subsection for each of the fiscal years 
2010 through 2014.’’. 
(e) SCIENTIFIC
AND ADVANCED TECHNOLOGY ACT 
GRANTS.—Section 5(b)(2) of such Act (15 U.S.C. 
7404(b)(2)) is amended to read as follows: 
‘‘(2) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are necessary 
to carry out this subsection for each of the fiscal years 
2010 through 2014.’’. 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(f) GRADUATE TRAINEESHIPS IN COMPUTER AND NET-
WORK SECURITY.—Section 5(c)(7) of such Act (15 U.S.C. 
7404(c)(7)) is amended to read as follows: 
‘‘(7) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are necessary 
to carry out this subsection for each of the fiscal years 
2010 through 2014.’’. 
(g) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CY-
BERSECURITY.—Section 5(e) of such Act (15 U.S.C. 
7404(e)) is amended to read as follows: 
‘‘(e) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CY-
BERSECURITY.— 
‘‘(1) IN GENERAL.—The Director shall carry out 
a program to encourage young scientists and engi-
neers to conduct postdoctoral research in the fields of 
cybersecurity and information assurance, including 
the research areas described in section 4(a)(1), 
through the award of competitive, merit-based fellow-
ships. 
‘‘(2) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are necessary 
to carry out this subsection for each of the fiscal years 
2010 through 2014.’’. 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
SEC. 106. FEDERAL CYBER SCHOLARSHIP FOR SERVICE 
PROGRAM. 
(a) IN GENERAL.—The Director of the National 
Science Foundation shall carry out a Scholarship for Serv-
ice program to recruit and train the next generation of Fed-
eral cybersecurity professionals and to increase the capacity 
of the higher education system to produce an information 
technology workforce with the skills necessary to enhance 
the security of the Nation’s communications and informa-
tion infrastructure. 
(b) CHARACTERISTICS OF PROGRAM.—The program 
under this section shall— 
(1) provide, through qualified institutions of 
higher education, scholarships that provide tuition, 
fees, and a competitive stipend for up to 2 years to 
students pursing a bachelor’s or master’s degree and 
up to 3 years to students pursuing a doctoral degree 
in a cybersecurity field; 
(2) provide the scholarship recipients with sum-
mer internship opportunities or other meaningful 
temporary appointments in the Federal information 
technology workforce; and 
(3) increase the capacity of institutions of higher 
education throughout all regions of the United States 
to produce highly qualified cybersecurity profes-
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
sionals, through the award of competitive, merit-re-
viewed grants that support such activities as— 
(A) faculty professional development, in-
cluding technical, hands-on experiences in the 
private sector or government, workshops, semi-
nars, conferences, and other professional develop-
ment opportunities that will result in improved 
instructional capabilities; 
(B) institutional partnerships, including 
minority serving institutions; and 
(C) development of cybersecurity-related 
courses and curricula. 
(c) SCHOLARSHIP REQUIREMENTS.— 
(1) ELIGIBILITY.—Scholarships under this sec-
tion shall be available only to students who— 
(A) are citizens or permanent residents of 
the United States; 
(B) are full-time students in an eligible de-
gree program, as determined by the Director, 
that is focused on computer security or informa-
tion assurance at an awardee institution; and 
(C) accept the terms of a scholarship pursu-
ant to this section. 
(2) SELECTION.—Individuals shall be selected to 
receive scholarships primarily on the basis of aca-
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
demic merit, with consideration given to financial 
need and to the goal of promoting the participation 
of individuals identified in section 33 or 34 of the 
Science and Engineering Equal Opportunities Act 
(42 U.S.C. 1885a or 1885b). 
(3) SERVICE OBLIGATION.—If an individual re-
ceives a scholarship under this section, as a condition 
of receiving such scholarship, the individual upon 
completion of their degree must serve as a cybersecu-
rity professional within the Federal workforce for a 
period of time equal to the length of the scholarship. 
If a scholarship recipient is not offered employment 
by a Federal agency or a federally funded research 
and development center, the service requirement can 
be satisfied at the Director’s discretion by— 
(A) serving as a cybersecurity professional 
in a State, local, or tribal government agency; or 
(B) teaching cybersecurity courses at an in-
stitution of higher education. 
(4) CONDITIONS OF SUPPORT.—As a condition of 
acceptance of a scholarship under this section, a re-
cipient shall agree to provide the awardee institution 
with annual verifiable documentation of employment 
and up-to-date contact information. 
(d) FAILURE TO COMPLETE SERVICE OBLIGATION.— 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(1) GENERAL RULE.—If an individual who has 
received a scholarship under this section— 
(A) fails to maintain an acceptable level of 
academic standing in the educational institution 
in which the individual is enrolled, as deter-
mined by the Director; 
(B) is dismissed from such educational in-
stitution for disciplinary reasons; 
(C) withdraws from the program for which 
the award was made before the completion of 
such program; 
(D) declares that the individual does not in-
tend to fulfill the service obligation under this 
section; or 
(E) fails to fulfill the service obligation of 
the individual under this section, 
such individual shall be liable to the United States as 
provided in paragraph (3). 
(2) MONITORING COMPLIANCE.—As a condition 
of participating in the program, a qualified institu-
tion of higher education receiving a grant under this 
section shall— 
(A) enter into an agreement with the Direc-
tor of the National Science Foundation to mon-
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
itor the compliance of scholarship recipients with 
respect to their service obligation; and 
(B) provide to the Director, on an annual 
basis, post-award employment information re-
quired under subsection (c)(4) for scholarship re-
cipients through the completion of their service 
obligation. 
(3) AMOUNT OF REPAYMENT.— 
(A) LESS THAN ONE YEAR OF SERVICE.—If 
a circumstance described in paragraph (1) oc-
curs before the completion of 1 year of a service 
obligation under this section, the total amount of 
awards received by the individual under this sec-
tion shall be repaid or such amount shall be 
treated as a loan to be repaid in accordance with 
subparagraph (C). 
(B) MORE THAN ONE YEAR OF SERVICE.— 
If a circumstance described in subparagraph (D) 
or (E) of paragraph (1) occurs after the comple-
tion of 1 year of a service obligation under this 
section, the total amount of scholarship awards 
received by the individual under this section, re-
duced by the ratio of the number of years of serv-
ice completed divided by the number of years of 
service required, shall be repaid or such amount 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
shall be treated as a loan to be repaid in accord-
ance with subparagraph (C). 
(C) REPAYMENTS.—A loan described in 
subparagraph (A) or (B) shall be treated as a 
Federal Direct Unsubsidized Stafford Loan 
under part D of title IV of the Higher Education 
Act of 1965 (20 U.S.C. 1087a and following), 
and shall be subject to repayment, together with 
interest thereon accruing from the date of the 
scholarship award, in accordance with terms and 
conditions specified by the Director (in consulta-
tion with the Secretary of Education) in regula-
tions promulgated to carry out this paragraph. 
(4) COLLECTION OF REPAYMENT.— 
(A) IN GENERAL.—In the event that a schol-
arship recipient is required to repay the scholar-
ship under this subsection, the institution pro-
viding the scholarship shall— 
(i) be responsible for determining the 
repayment amounts and for notifying the 
recipient and the Director of the amount 
owed; and 
(ii) collect such repayment amount 
within a period of time as determined 
under the agreement described in paragraph 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(2), or the repayment amount shall be treat-
ed as a loan in accordance with paragraph 
(3)(C). 
(B) RETURNED TO TREASURY.—Except as 
provided in subparagraph (C) of this paragraph, 
any such repayment shall be returned to the 
Treasury of the United States. 
(C) RETAIN PERCENTAGE.—An institution 
of higher education may retain a percentage of 
any repayment the institution collects under this 
paragraph to defray administrative costs associ-
ated with the collection. The Director shall estab-
lish a single, fixed percentage that will apply to 
all eligible entities. 
(5) EXCEPTIONS.—The Director may provide for 
the partial or total waiver or suspension of any serv-
ice or payment obligation by an individual under 
this section whenever compliance by the individual 
with the obligation is impossible or would involve ex-
treme hardship to the individual, or if enforcement of 
such obligation with respect to the individual would 
be unconscionable. 
(e) HIRING AUTHORITY.—For purposes of any law or 
regulation governing the appointment of individuals in the 
Federal civil service, upon successful completion of their de-
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
gree, students receiving a scholarship under this section 
shall be hired under the authority provided for in section 
213.3102(r) of title 5, Code of Federal Regulations, and be 
exempted from competitive service. Upon fulfillment of the 
service term, such individuals shall be converted to a com-
petitive service position without competition if the indi-
vidual meets the requirements for that position. 
(f) AUTHORIZATION OF APPROPRIATIONS.—There are 
authorized to appropriated to the National Science Founda-
tion to carry out this section— 
(1) $18,700,000 for fiscal year 2010; 
(2) $20,100,000 for fiscal year 2011; 
(3) $21,600,000 for fiscal year 2012; 
(4) $23,300,000 for fiscal year 2013; and 
(5) $25,000,000 for fiscal year 2014. 
SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT. 
Not later than 180 days after the date of enactment 
of this Act the President shall transmit to the Congress a 
report addressing the cybersecurity workforce needs of the 
Federal Government. The report shall include— 
(1) an examination of the current state of and 
the projected needs of the Federal cybersecurity work-
force, including a comparison of the different agencies 
and departments, and an analysis of the capacity of 
such agencies and departments to meet those needs; 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(2) an analysis of the sources and availability of 
cybersecurity talent, a comparison of the skills and 
expertise sought by the Federal Government and the 
private sector, and an examination of the current and 
future capacity of United States institutions of higher 
education to provide cybersecurity professionals with 
those skills sought by the Federal Government and the 
private sector; 
(3) an examination of the effectiveness of the Na-
tional Centers of Academic Excellence in Information 
Assurance Education, the Centers of Academic Excel-
lence in Research, and the Federal Cyber Scholarship 
for Service programs in promoting higher education 
and research in cybersecurity and information assur-
ance and in producing a growing number of profes-
sionals with the necessary cybersecurity and informa-
tion assurance expertise; 
(4) an analysis of any barriers to the Federal 
Government recruiting and hiring cybersecurity tal-
ent, including barriers relating to compensation, the 
hiring process, job classification, and hiring flexibili-
ties; and 
(5) recommendations for Federal policies to en-
sure an adequate, well-trained Federal cybersecurity 
workforce. 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
SEC. 108. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 
FORCE. 
(a) ESTABLISHMENT OF UNIVERSITY-INDUSTRY TASK 
FORCE.—Not later than 180 days after the date of enact-
ment of this Act, the Director of the Office of Science and 
Technology Policy shall convene a task force to explore 
mechanisms for carrying out collaborative research and de-
velopment activities for cybersecurity through a consortium 
or other appropriate entity with participants from institu-
tions of higher education and industry. 
(b) FUNCTIONS.—The task force shall— 
(1) develop options for a collaborative model and 
an organizational structure for such entity under 
which the joint research and development activities 
could be planned, managed, and conducted effectively, 
including mechanisms for the allocation of resources 
among the participants in such entity for support of 
such activities; 
(2) propose a process for developing a research 
and development agenda for such entity, including 
guidelines to ensure an appropriate scope of work fo-
cused on nationally significant challenges and requir-
ing collaboration; 
(3) define the roles and responsibilities for the 
participants from institutions of higher education 
and industry in such entity; 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(4) propose guidelines for assigning intellectual 
property rights and for the transfer of research and 
development results to the private sector; and 
(5) make recommendations for how such entity 
could be funded from Federal, State, and nongovern-
mental sources. 
(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the Office of Science 
and Technology Policy shall appoint an equal number of 
individuals from institutions of higher education and from 
industry with knowledge and expertise in cybersecurity. 
(d) REPORT.—Not later than 12 months after the date 
of enactment of this Act, the Director of the Office of Science 
and Technology Policy shall transmit to the Congress a re-
port describing the findings and recommendations of the 
task force. 
SEC. 109. CYBERSECURITY CHECKLIST DEVELOPMENT AND 
DISSEMINATION. 
Section 8(c) of the Cyber Security Research and Devel-
opment Act (15 U.S.C. 7406(c)) is amended to read as fol-
lows: 
‘‘(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the National 
Institute of Standards and Technology shall develop 
or identify and revise or adapt as necessary, check-
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
lists, configuration profiles, and deployment rec-
ommendations for products and protocols that mini-
mize the security risks associated with each computer 
hardware or software system that is, or is likely to be-
come, widely used within the Federal Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
ment of checklists under this subsection. Such prior-
ities may be based on the security risks associated 
with the use of each system, the number of agencies 
that use a particular system, the usefulness of the 
checklist to Federal agencies that are users or poten-
tial users of the system, or such other factors as the 
Director determines to be appropriate. 
‘‘(3) EXCLUDED SYSTEMS.—The Director of the 
National Institute of Standards and Technology may 
exclude from the requirements of paragraph (1) any 
computer hardware or software system for which the 
Director determines that the development of a check-
list is inappropriate because of the infrequency of use 
of the system, the obsolescence of the system, or the 
inutility or impracticability of developing a checklist 
for the system. 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
‘‘(4) AUTOMATION SPECIFICATIONS.—The Direc-
tor of the National Institute of Standards and Tech-
nology shall develop automated security specifications 
(such as the Security Content Automation Protocol) 
with respect to checklist content and associated secu-
rity related data. 
‘‘(5) DISSEMINATION OF CHECKLISTS.—The Di-
rector of the National Institute of Standards and 
Technology shall ensure that Federal agencies are in-
formed of the availability of any product developed or 
identified under the National Checklist Program for 
any information system, including the Security Con-
tent Automation Protocol and other automated secu-
rity specifications. 
‘‘(6) AGENCY USE REQUIREMENTS.—The develop-
ment of a checklist under paragraph (1) for a com-
puter hardware or software system does not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the checklist for the system; 
‘‘(B) establish conditions or prerequisites for 
Federal agency procurement or deployment of 
any such system; 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
‘‘(C) imply an endorsement of any such sys-
tem by the Director of the National Institute of 
Standards and Technology; or 
‘‘(D) preclude any Federal agency from pro-
curing or deploying other computer hardware or 
software systems for which no such checklist has 
been developed or identified under paragraph 
(1).’’. 
SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND DE-
VELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redesig-
nating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following: 
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execution 
of a wide variety of resource protection policies and 
that is amenable to implementation within a wide 
variety of existing and emerging computing environ-
ments; 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
‘‘(2) carry out research associated with improv-
ing the security of information systems and networks; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; and 
‘‘(4) carry out research associated with improv-
ing security of industrial control systems.’’. 
TITLE II—ADVANCEMENT OF CY-
BERSECURITY 
TECHNICAL 
STANDARDS 
SEC. 201. DEFINITIONS. 
In this title: 
(1) DIRECTOR.—The term ‘‘Director’’ means the 
Director of the National Institute of Standards and 
Technology. 
(2) INSTITUTE.—The term ‘‘Institute’’ means the 
National Institute of Standards and Technology. 
SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
The Director, in coordination with appropriate Fed-
eral authorities, shall— 
(1) ensure coordination of United States Govern-
ment representation in the international development 
of technical standards related to cybersecurity; and 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(2) not later than 1 year after the date of enact-
ment of this Act, develop and transmit to the Con-
gress a proactive plan to engage international stand-
ards bodies with respect to the development of tech-
nical standards related to cybersecurity. 
SEC. 203. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, and other organizations, shall develop and implement 
a cybersecurity awareness and education program to in-
crease public awareness of cybersecurity risks, consequences, 
and best practices through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; and 
(2) efforts to make cybersecurity technical stand-
ards and best practices usable by individuals, small 
to medium-sized businesses, State, local, and tribal 
governments, and educational institutions. 
(b) MANUFACTURING EXTENSION PARTNERSHIP.—The 
Director shall, to the extent appropriate, implement sub-
section (a) through the Manufacturing Extension Partner-
ship program under section 25 of the National Institute of 
Standards and Technology Act (15 U.S.C. 278k). 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
(c) REPORT TO CONGRESS.—Not later than 90 days 
after the date of enactment of this Act, the Director shall 
transmit to the Congress a report containing a strategy for 
implementation of this section. 
SEC. 204. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director shall establish a program to support the 
development of technical standards, metrology, testbeds, and 
conformance criteria, taking into account appropriate user 
concerns, to— 
(1) improve interoperability among identity 
management technologies; 
(2) strengthen authentication methods of identity 
management systems; 
(3) improve privacy protection in identity man-
agement systems, including health information tech-
nology systems, through authentication and security 
protocols; and 
(4) improve the usability of identity manage-
ment systems. 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6203
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS
Union Calendar No. 236 
111TH CONGRESS 
2D SESSION 
H. R. 4061 
[Report No. 111–405] 
A BILL 
To advance cybersecurity research, development, 
and technical standards, and for other purposes. 
JANUARY 27, 2010 
Reported with an amendment, committed to the Com-
mittee of the Whole House on the State of the Union, 
and ordered to be printed 
VerDate Nov 24 2008 
21:05 Jan 27, 2010
Jkt 089200
PO 00000
Frm 00030
Fmt 6651
Sfmt 6651
E:\BILLS\H4061.RH
H4061
jlentini on DSKJ8SOYB1PROD with BILLS