(1) the advisory committee established under 
section 101(b)(1) of the High-Performance Com-
puting Act of 1991 (15 U.S.C. 5511(b)(1)); and 
(2) a wide range of stakeholders, including in-
dustry, academia, including representatives of mi-
nority serving institutions and community colleges, 
National Laboratories, and other relevant organiza-
tions and institutions. 
(e) APPENDING TO REPORT.—The implementation 
roadmap required under subsection (c), and its annual up-
dates, shall be appended to the report required under sec-
tion 101(a)(2)(D) of the High-Performance Computing 
Act of 1991 (15 U.S.C. 5511(a)(2)(D)). 
SEC. 104. SOCIAL AND BEHAVIORAL RESEARCH IN CYBER-
SECURITY. 
Section 4(a)(1) of the Cyber Security Research and 
Development Act (15 U.S.C. 7403(a)(1)) is amended— 
(1) by inserting ‘‘and usability’’ after ‘‘to the 
structure’’; 
(2) in subparagraph (H), by striking ‘‘and’’ 
after the semicolon; 
(3) in subparagraph (I), by striking the period 
at the end and inserting ‘‘; and’’; and 
(4) by adding at the end the following new sub-
paragraph:
‘‘(J) social and behavioral factors, includ-
ing human-computer interactions, usability, 
user motivations, and organizational cultures.’’. 
SEC. 105. NATIONAL SCIENCE FOUNDATION CYBERSECU-
RITY RESEARCH AND DEVELOPMENT PRO-
GRAMS. 
(a) COMPUTER AND NETWORK SECURITY RESEARCH 
AREAS.—Section 4(a)(1) of the Cyber Security Research 
and Development Act (15 U.S.C. 7403(a)(1)) is amend-
ed— 
(1) in subparagraph (A) by inserting ‘‘identity 
management,’’ after ‘‘cryptography,’’; and 
(2) by amending subparagraph (I) to read as 
follows: 
‘‘(I) enhancement of the ability of law en-
forcement to detect, investigate, and prosecute 
cyber-crimes, including crimes that involve pi-
racy of intellectual property, crimes against 
children, and organized crime.’’. 
(b) COMPUTER AND NETWORK SECURITY RESEARCH 
GRANTS.—Section 4(a)(3) of such Act (15 U.S.C. 
7403(a)(3)) is amended by striking subparagraphs (A) 
through (E) and inserting the following new subpara-
graphs: 
‘‘(A) $68,700,000 for fiscal year 2010;
‘‘(B) $73,500,000 for fiscal year 2011; 
‘‘(C) $78,600,000 for fiscal year 2012; 
‘‘(D) $84,200,000 for fiscal year 2013; 
and 
‘‘(E) $90,000,000 for fiscal year 2014.’’. 
(c) COMPUTER AND NETWORK SECURITY RESEARCH 
CENTERS.—Section 4(b) of such Act (15 U.S.C. 7403(b)) 
is amended— 
(1) in paragraph (4)— 
(A) in subparagraph (C), by striking 
‘‘and’’ after the semicolon; 
(B) in subparagraph (D), by striking the 
period and inserting ‘‘; and’’; and 
(C) by adding at the end the following new 
subparagraph: 
‘‘(E) how the center will partner with gov-
ernment laboratories, for-profit entities, other 
institutions of higher education, or nonprofit re-
search institutions.’’; and 
(2) by amending paragraph (7) to read as fol-
lows: 
‘‘(7) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’. 
(d) COMPUTER AND NETWORK SECURITY CAPACITY 
BUILDING GRANTS.—Section 5(a) of such Act (15 U.S.C. 
7404(a)) is amended— 
(1) in paragraph (3)(A), by inserting ‘‘, includ-
ing curriculum on the principles and techniques of 
designing secure software’’ after ‘‘network security’’; 
and 
(2) by amending paragraph (6) to read as fol-
lows: 
‘‘(6) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’. 
(e) SCIENTIFIC AND ADVANCED TECHNOLOGY ACT 
GRANTS.—Section 5(b)(2) of such Act (15 U.S.C. 
7404(b)(2)) is amended to read as follows: 
‘‘(2) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’.
(f) GRADUATE TRAINEESHIPS IN COMPUTER AND 
NETWORK SECURITY.—Section 5(c)(7) of such Act (15 
U.S.C. 7404(c)(7)) is amended to read as follows: 
‘‘(7) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’. 
(g) POSTDOCTORAL RESEARCH FELLOWSHIPS IN CY-
BERSECURITY.—Section 5(e) of such Act (15 U.S.C. 
7404(e)) is amended to read as follows: 
‘‘(e) POSTDOCTORAL RESEARCH FELLOWSHIPS IN 
CYBERSECURITY.— 
‘‘(1) IN GENERAL.—The Director shall carry 
out a program to encourage young scientists and en-
gineers to conduct postdoctoral research in the fields 
of cybersecurity and information assurance, includ-
ing the research areas described in section 4(a)(1), 
through the award of competitive, merit-based fel-
lowships. 
‘‘(2) AUTHORIZATION
OF
APPROPRIATIONS.— 
There are authorized to be appropriated to the Na-
tional Science Foundation such sums as are nec-
essary to carry out this subsection for each of the 
fiscal years 2010 through 2014.’’.
(h) PROHIBITION ON EARMARKS.—None of the funds 
appropriated under this section, and the amendments 
made by this section may be used for a Congressional ear-
mark as defined in clause 9(d) of rule XXI of the Rules 
of the House of Representatives. 
(i) COMPUTER AND NETWORK SECURITY CAPACITY 
BUILDING
GRANTS—MANUFACTURING
EXTENSION 
PARTNERSHIP.—Section 5(a)(3) of the Cyber Security 
Research and Development Act (15 U.S.C. 7404(a)(3)) is 
amended— 
(1) by striking ‘‘and’’ at the end of subpara-
graph (I); 
(2) by redesignating subparagraph (J) as sub-
paragraph (K); and 
(3) by inserting after subparagraph (I) the fol-
lowing new subparagraph: 
‘‘(J) establishing or enhancing collabora-
tion in computer and network security between 
community colleges, universities, and Manufac-
turing Extension Partnership Centers; and’’. 
SEC. 106. FEDERAL CYBER SCHOLARSHIP FOR SERVICE 
PROGRAM. 
(a) IN GENERAL.—The Director of the National 
Science Foundation shall carry out a Scholarship for Serv-
ice program to recruit and train the next generation of
Federal cybersecurity professionals and to increase the ca-
pacity of the higher education system to produce an infor-
mation technology workforce with the skills necessary to 
enhance the security of the Nation’s communications and 
information infrastructure. 
(b) CHARACTERISTICS OF PROGRAM.—The program 
under this section shall— 
(1) provide, through qualified institutions of 
higher education, scholarships that provide tuition, 
fees, and a competitive stipend for up to 2 years to 
students pursing a bachelor’s or master’s degree and 
up to 3 years to students pursuing a doctoral degree 
in a cybersecurity field; 
(2) provide the scholarship recipients with sum-
mer internship opportunities or other meaningful 
temporary appointments in the Federal information 
technology workforce or, at the discretion of the Di-
rector, with appropriate private sector entities; and 
(3) increase the capacity of institutions of high-
er education throughout all regions of the United 
States to produce highly qualified cybersecurity pro-
fessionals, through the award of competitive, merit- 
reviewed grants that support such activities as— 
(A) faculty professional development, in-
cluding technical, hands-on experiences in the
private sector or government, workshops, semi-
nars, conferences, and other professional devel-
opment opportunities that will result in im-
proved instructional capabilities; 
(B) institutional partnerships, including 
minority serving institutions and community 
colleges; 
(C) development of cybersecurity-related 
courses and curricula; and 
(D) outreach to secondary schools and 2- 
year institutions to increase the interest and re-
cruitment of students into cybersecurity-related 
fields. 
(c) SCHOLARSHIP REQUIREMENTS.— 
(1) ELIGIBILITY.—Scholarships under this sec-
tion shall be available only to students who— 
(A) are citizens or permanent residents of 
the United States; 
(B) are full-time students in an eligible de-
gree program, as determined by the Director, 
that is focused on computer security or infor-
mation assurance at an awardee institution; 
and 
(C) accept the terms of a scholarship pur-
suant to this section.
(2) SELECTION.—Individuals shall be selected 
to receive scholarships primarily on the basis of aca-
demic merit, with consideration given to financial 
need, to the goal of promoting the participation of 
individuals identified in section 33 or 34 of the 
Science and Engineering Equal Opportunities Act 
(42 U.S.C. 1885a or 1885b), and to veterans. For 
purposes of this paragraph, the term ‘‘veteran’’ 
means a person who— 
(A) served on active duty (other than ac-
tive duty for training) in the Armed Forces of 
the United States for a period of more than 
180 consecutive days, and who was discharged 
or released therefrom under conditions other 
than dishonorable; or 
(B) served on active duty (other than ac-
tive duty for training) in the Armed Forces of 
the United States and was discharged or re-
leased from such service for a service-connected 
disability before serving 180 consecutive days. 
For purposes of subparagraph (B), the term ‘‘serv-
ice-connected’’ has the meaning given such term 
under section 101 of title 38, United States Code. 
(3) SERVICE OBLIGATION.—If an individual re-
ceives a scholarship under this section, as a condi-
tion of receiving such scholarship, the individual 
upon completion of their degree must serve as a cy-
bersecurity professional within the Federal workforce 
for a period of time as provided in paragraph (5). 
If a scholarship recipient is not offered employment 
by a Federal agency or a federally funded research 
and development center, the service requirement can 
be satisfied at the Director’s discretion by— 
(A) serving as a cybersecurity professional 
in a State, local, or tribal government agency; 
or 
(B) teaching cybersecurity courses at an 
institution of higher education. 
(4) CONDITIONS OF SUPPORT.—As a condition 
of acceptance of a scholarship under this section, a 
recipient shall agree to provide the awardee institu-
tion with annual verifiable documentation of employ-
ment and up-to-date contact information. 
(5) LENGTH OF SERVICE.—The length of serv-
ice required in exchange for a scholarship under this 
subsection shall be as follows: 
(A) For a recipient in a bachelor’s degree 
program, 1 year more than the number of years 
for which the scholarship was received.
(B) For a recipient in a master’s degree 
program, 2 years more than the number of 
years for which the scholarship was received. 
(C) For a recipient in a doctorate degree 
program, 3 years more than the number of 
years for which the scholarship was received. 
(d) FAILURE TO COMPLETE SERVICE OBLIGATION.— 
(1) GENERAL RULE.—If an individual who has 
received a scholarship under this section— 
(A) fails to maintain an acceptable level of 
academic standing in the educational institution 
in which the individual is enrolled, as deter-
mined by the Director; 
(B) is dismissed from such educational in-
stitution for disciplinary reasons; 
(C) withdraws from the program for which 
the award was made before the completion of 
such program; 
(D) declares that the individual does not 
intend to fulfill the service obligation under this 
section; or 
(E) fails to fulfill the service obligation of 
the individual under this section, 
such individual shall be liable to the United States 
as provided in paragraph (3).
(2) MONITORING COMPLIANCE.—As a condition 
of participating in the program, a qualified institu-
tion of higher education receiving a grant under this 
section shall— 
(A) enter into an agreement with the Di-
rector of the National Science Foundation to 
monitor the compliance of scholarship recipients 
with respect to their service obligation; and 
(B) provide to the Director, on an annual 
basis, post-award employment information re-
quired under subsection (c)(4) for scholarship 
recipients through the completion of their serv-
ice obligation. 
(3) AMOUNT OF REPAYMENT.— 
(A) LESS THAN ONE YEAR OF SERVICE.— 
If a circumstance described in paragraph (1) 
occurs before the completion of 1 year of a 
service obligation under this section, the total 
amount of awards received by the individual 
under this section shall be repaid or such 
amount shall be treated as a loan to be repaid 
in accordance with subparagraph (C). 
(B) MORE THAN ONE YEAR OF SERVICE.— 
If a circumstance described in subparagraph 
(D) or (E) of paragraph (1) occurs after the
completion of 1 year of a service obligation 
under this section, the total amount of scholar-
ship awards received by the individual under 
this section, reduced by the ratio of the number 
of years of service completed divided by the 
number of years of service required, shall be re-
paid or such amount shall be treated as a loan 
to be repaid in accordance with subparagraph 
(C). 
(C) REPAYMENTS.—A loan described in 
subparagraph (A) or (B) shall be treated as a 
Federal Direct Unsubsidized Stafford Loan 
under part D of title IV of the Higher Edu-
cation Act of 1965 (20 U.S.C. 1087a and fol-
lowing), and shall be subject to repayment, to-
gether with interest thereon accruing from the 
date of the scholarship award, in accordance 
with terms and conditions specified by the Di-
rector (in consultation with the Secretary of 
Education) in regulations promulgated to carry 
out this paragraph. 
(4) COLLECTION OF REPAYMENT.— 
(A) IN
GENERAL.—In the event that a 
scholarship recipient is required to repay the
scholarship under this subsection, the institu-
tion providing the scholarship shall— 
(i) be responsible for determining the 
repayment amounts and for notifying the 
recipient and the Director of the amount 
owed; and 
(ii) collect such repayment amount 
within a period of time as determined 
under the agreement described in para-
graph (2), or the repayment amount shall 
be treated as a loan in accordance with 
paragraph (3)(C). 
(B) RETURNED TO TREASURY.—Except as 
provided in subparagraph (C) of this para-
graph, any such repayment shall be returned to 
the Treasury of the United States. 
(C) RETAIN PERCENTAGE.—An institution 
of higher education may retain a percentage of 
any repayment the institution collects under 
this paragraph to defray administrative costs 
associated with the collection. The Director 
shall establish a single, fixed percentage that 
will apply to all eligible entities. 
(5) EXCEPTIONS.—The Director may provide 
for the partial or total waiver or suspension of any
service or payment obligation by an individual under 
this section whenever compliance by the individual 
with the obligation is impossible or would involve ex-
treme hardship to the individual, or if enforcement 
of such obligation with respect to the individual 
would be unconscionable. 
(e) HIRING AUTHORITY.—For purposes of any law 
or regulation governing the appointment of individuals in 
the Federal civil service, upon successful completion of 
their degree, students receiving a scholarship under this 
section shall be hired under the authority provided for in 
section 213.3102(r) of title 5, Code of Federal Regula-
tions, and be exempted from competitive service. Upon ful-
fillment of the service term, such individuals shall be con-
verted to a competitive service position without competi-
tion if the individual meets the requirements for that posi-
tion. 
(f) AUTHORIZATION
OF APPROPRIATIONS.—There 
are authorized to appropriated to the National Science 
Foundation to carry out this section— 
(1) $18,700,000 for fiscal year 2010; 
(2) $20,100,000 for fiscal year 2011; 
(3) $21,600,000 for fiscal year 2012; 
(4) $23,300,000 for fiscal year 2013; and 
(5) $25,000,000 for fiscal year 2014.
SEC. 107. CYBERSECURITY WORKFORCE ASSESSMENT. 
Not later than 180 days after the date of enactment 
of this Act the President shall transmit to the Congress 
a report addressing the cybersecurity workforce needs of 
the Federal Government. The report shall include— 
(1) an examination of the current state of and 
the projected needs of the Federal cybersecurity 
workforce, including a comparison of the different 
agencies and departments, the extent to which dif-
ferent agencies and departments rely on contractors 
to support the Federal cybersecurity workforce, and 
an analysis of the capacity of such agencies and de-
partments to meet those needs; 
(2) an analysis of the sources and availability of 
cybersecurity talent, a comparison of the skills and 
expertise sought by the Federal Government and the 
private sector, an examination of the current and fu-
ture capacity of United States institutions of higher 
education, including community colleges, to provide 
cybersecurity professionals with those skills sought 
by the Federal Government and the private sector, 
and a description of how successful programs are en-
gaging the talents of women and African-Americans, 
Hispanics, and Native Americans in the cybersecu-
rity workforce;
(3) an examination of the effectiveness of the 
National Centers of Academic Excellence in Infor-
mation Assurance Education, the Centers of Aca-
demic Excellence in Research, and the Federal 
Cyber Scholarship for Service programs in pro-
moting higher education and research in cybersecu-
rity and information assurance and in producing a 
growing number of professionals with the necessary 
cybersecurity and information assurance expertise; 
(4) an analysis of any barriers to the Federal 
Government recruiting and hiring cybersecurity tal-
ent, including barriers relating to compensation, the 
hiring process, job classification, job security clear-
ance and suitability requirements, and hiring flexi-
bilities; 
(5) a specific analysis of the capacity of the 
agency workforce to manage contractors who are 
performing cybersecurity work on behalf of the Fed-
eral Government; and 
(6) recommendations for Federal policies to en-
sure an adequate, well-trained Federal cybersecurity 
workforce, including recommendations on the tem-
porary assignment of private sector cybersecurity 
professionals to Federal agencies.
SEC. 108. CYBERSECURITY UNIVERSITY-INDUSTRY TASK 
FORCE. 
(a) ESTABLISHMENT
OF
UNIVERSITY-INDUSTRY 
TASK FORCE.—Not later than 180 days after the date of 
enactment of this Act, the Director of the Office of Science 
and Technology Policy shall convene a task force to ex-
plore mechanisms for carrying out collaborative research 
and development activities for cybersecurity through a 
consortium or other appropriate entity with participants 
from institutions of higher education and industry. 
(b) FUNCTIONS.—The task force shall— 
(1) develop options for a collaborative model 
and an organizational structure for such entity 
under which the joint research and development ac-
tivities could be planned, managed, and conducted 
effectively, including mechanisms for the allocation 
of resources among the participants in such entity 
for support of such activities; 
(2) propose a process for developing a research 
and development agenda for such entity, including 
guidelines to ensure an appropriate scope of work fo-
cused on nationally significant challenges and requir-
ing collaboration; 
(3) define the roles and responsibilities for the 
participants from institutions of higher education 
and industry in such entity;
(4) propose guidelines for assigning intellectual 
property rights, for the transfer of research and de-
velopment results to the private sector, and for the 
sharing of lessons learned on the effectiveness of 
new technologies from the private sector with the 
public sector; and 
(5) make recommendations for how such entity 
could be funded from Federal, State, and nongovern-
mental sources. 
(c) COMPOSITION.—In establishing the task force 
under subsection (a), the Director of the Office of Science 
and Technology Policy shall appoint an equal number of 
individuals from institutions of higher education, including 
community colleges, and from industry with knowledge 
and expertise in cybersecurity, and shall include represent-
atives from minority-serving institutions. 
(d) REPORT.—Not later than 12 months after the 
date of enactment of this Act, the Director of the Office 
of Science and Technology Policy shall transmit to the 
Congress a report describing the findings and rec-
ommendations of the task force.
SEC. 109. CYBERSECURITY CHECKLIST DEVELOPMENT AND 
DISSEMINATION. 
Section 8(c) of the Cyber Security Research and De-
velopment Act (15 U.S.C. 7406(c)) is amended to read 
as follows: 
‘‘(c) CHECKLISTS FOR GOVERNMENT SYSTEMS.— 
‘‘(1) IN GENERAL.—The Director of the Na-
tional Institute of Standards and Technology shall 
develop or identify and revise or adapt as necessary, 
checklists, configuration profiles, and deployment 
recommendations for products and protocols that 
minimize the security risks associated with each 
computer hardware or software system that is, or is 
likely to become, widely used within the Federal 
Government. 
‘‘(2) PRIORITIES FOR DEVELOPMENT.—The Di-
rector of the National Institute of Standards and 
Technology shall establish priorities for the develop-
ment of checklists under this subsection. Such prior-
ities may be based on the security risks associated 
with the use of each system, the number of agencies 
that use a particular system, the usefulness of the 
checklist to Federal agencies that are users or po-
tential users of the system, or such other factors as 
the Director determines to be appropriate.
‘‘(3) EXCLUDED
SYSTEMS.—The Director of 
the National Institute of Standards and Technology 
may exclude from the requirements of paragraph (1) 
any computer hardware or software system for 
which the Director determines that the development 
of a checklist is inappropriate because of the infre-
quency of use of the system, the obsolescence of the 
system, or the inutility or impracticability of devel-
oping a checklist for the system. 
‘‘(4) AUTOMATION SPECIFICATIONS.—The Di-
rector of the National Institute of Standards and 
Technology shall develop automated security speci-
fications (such as the Security Content Automation 
Protocol) with respect to checklist content and asso-
ciated security related data. 
‘‘(5) DISSEMINATION
OF
CHECKLISTS.—The 
Director of the National Institute of Standards and 
Technology shall ensure that Federal agencies are 
informed of the availability of any product developed 
or identified under the National Checklist Program 
for any information system, including the Security 
Content Automation Protocol and other automated 
security specifications.
‘‘(6) AGENCY USE REQUIREMENTS.—The devel-
opment of a checklist under paragraph (1) for a 
computer hardware or software system does not— 
‘‘(A) require any Federal agency to select 
the specific settings or options recommended by 
the checklist for the system; 
‘‘(B) establish conditions or prerequisites 
for Federal agency procurement or deployment 
of any such system; 
‘‘(C) imply an endorsement of any such 
system by the Director of the National Institute 
of Standards and Technology; or 
‘‘(D) preclude any Federal agency from 
procuring or deploying other computer hard-
ware or software systems for which no such 
checklist has been developed or identified under 
paragraph (1).’’. 
SEC. 110. NATIONAL INSTITUTE OF STANDARDS AND TECH-
NOLOGY CYBERSECURITY RESEARCH AND 
DEVELOPMENT. 
Section 20 of the National Institute of Standards and 
Technology Act (15 U.S.C. 278g–3) is amended by redes-
ignating subsection (e) as subsection (f), and by inserting 
after subsection (d) the following:
‘‘(e) INTRAMURAL SECURITY RESEARCH.—As part of 
the research activities conducted in accordance with sub-
section (d)(3), the Institute shall— 
‘‘(1) conduct a research program to develop a 
unifying and standardized identity, privilege, and ac-
cess control management framework for the execu-
tion of a wide variety of resource protection policies 
and that is amenable to implementation within a 
wide variety of existing and emerging computing en-
vironments; 
‘‘(2) carry out research associated with improv-
ing the security of information systems and net-
works; 
‘‘(3) carry out research associated with improv-
ing the testing, measurement, usability, and assur-
ance of information systems and networks; and 
‘‘(4) carry out research associated with improv-
ing security of industrial control systems.’’. 
SEC. 111. NATIONAL ACADEMY OF SCIENCES STUDY ON 
THE ROLE OF COMMUNITY COLLEGES IN CY-
BERSECURITY EDUCATION. 
Not later than 120 days after the date of enactment 
of this Act, the Director of the Office of Science and Tech-
nology Policy, in consultation with the Director of the Na-
tional Coordination Office, shall enter into a contract with
the National Academy of Sciences to conduct and complete 
a study to describe the role of community colleges in cy-
bersecurity education and to identify exemplary practices 
and partnerships related to cybersecurity education be-
tween community colleges and 4-year educational institu-
tions. 
SEC. 112. NATIONAL CENTER OF EXCELLENCE FOR CYBER-
SECURITY. 
(a) IN GENERAL.—As part of the Program, the Di-
rector of the National Science Foundation shall, in coordi-
nation with other Federal agencies participating in the 
Program, establish a National Center of Excellence for 
Cybersecurity. 
(b) MERIT REVIEW.—The National Center of Excel-
lence for Cybersecurity shall be awarded on a merit-re-
viewed, competitive basis. 
(c) ACTIVITIES SUPPORTED.—The National Center 
of Excellence for Cybersecurity shall— 
(1) involve institutions of higher education or 
national laboratories and other partners, which may 
include States and industry; 
(2) make use of existing expertise in cybersecu-
rity;