(3) interact and collaborate with Computer and 
Network Security Research Centers to foster the ex-
change of technical information and best practices; 
(4) perform research to support the develop-
ment of technologies for testing hardware and soft-
ware products to validate operational readiness and 
certify stated security levels; 
(5) coordinate cybersecurity education and 
training opportunities nationally; 
(6) enhance technology transfer and commer-
cialization that promote cybersecurity innovation; 
and 
(7) perform research on cybersecurity social 
and behavioral factors, including human-computer 
interactions, usability, user motivations, and organi-
zational cultures. 
SEC. 113. CYBERSECURITY INFRASTRUCTURE REPORT. 
Not later than 1 year after the date of enactment 
of this Act, the Comptroller General shall transmit to the 
Congress a report examining key weaknesses within the 
current cybersecurity infrastructure, along with rec-
ommendations on how to address such weaknesses in the 
future and on the technology that is needed to do so.
TITLE II—ADVANCEMENT OF CY-
BERSECURITY 
TECHNICAL 
STANDARDS 
SEC. 201. DEFINITIONS. 
In this title: 
(1) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the National Institute of Standards 
and Technology. 
(2) INSTITUTE.—The term ‘‘Institute’’ means 
the National Institute of Standards and Technology. 
SEC. 202. INTERNATIONAL CYBERSECURITY TECHNICAL 
STANDARDS. 
The Director, in coordination with appropriate Fed-
eral authorities, shall— 
(1) ensure coordination of United States Gov-
ernment representation in the international develop-
ment of technical standards related to cybersecurity; 
and 
(2) not later than 1 year after the date of en-
actment of this Act, develop and transmit to the 
Congress a proactive plan to engage international 
standards bodies with respect to the development of 
technical standards related to cybersecurity.
SEC. 203. PROMOTING CYBERSECURITY AWARENESS AND 
EDUCATION. 
(a) PROGRAM.—The Director, in collaboration with 
relevant Federal agencies, industry, educational institu-
tions, and other organizations, shall develop and imple-
ment a cybersecurity awareness and education program to 
increase public awareness, including among children and 
young adults, of cybersecurity risks, consequences, and 
best practices through— 
(1) the widespread dissemination of cybersecu-
rity technical standards and best practices identified 
by the Institute; and 
(2) efforts to make cybersecurity technical 
standards and best practices usable by individuals, 
small to medium-sized businesses, State, local, and 
tribal governments, and educational institutions, es-
pecially with respect to novice computer users, elder-
ly populations, low-income populations, and popu-
lations in areas of planned broadband expansion or 
deployment. 
(b) WORKSHOPS.—In carrying out activities under 
subsection (a)(1), the Institute is authorized to host re-
gional workshops to provide an overview of cybersecurity 
risks and best practices to businesses, State, local, and 
tribal governments, and educational institutions.
(c) MANUFACTURING EXTENSION PARTNERSHIP.— 
The Director shall, to the extent appropriate, implement 
subsection (a) through the Manufacturing Extension Part-
nership program under section 25 of the National Insti-
tute of Standards and Technology Act (15 U.S.C. 278k). 
(d) REPORT TO CONGRESS.—Not later than 90 days 
after the date of enactment of this Act, the Director shall 
transmit to the Congress a report containing a strategy 
for implementation of this section. 
SEC. 204. IDENTITY MANAGEMENT RESEARCH AND DEVEL-
OPMENT. 
The Director shall establish a program to support the 
development of technical standards, metrology, testbeds, 
and conformance criteria, taking into account appropriate 
user concerns, to— 
(1) improve interoperability among identity 
management technologies; 
(2) strengthen authentication methods of iden-
tity management systems; 
(3) improve privacy protection in identity man-
agement systems, including health information tech-
nology systems, through authentication and security 
protocols; and 
(4) improve the usability of identity manage-
ment systems.
SEC. 205. PRACTICES AND STANDARDS. 
The National Institute of Standards and Technology 
shall work with other Federal, State, and private sector 
partners, as appropriate, to develop a framework that 
States may follow in order to achieve effective cybersecu-
rity practices in a timely and cost-effective manner. 
Passed the House of Representatives February 4, 
2010. 
Attest: 
Clerk.
111TH CONGRESS 
2D SESSION 
H. R. 4061 
AN ACT 
To advance cybersecurity research, development, 
and technical standards, and for other purposes.