In this task, you are given text for US Congressional and California state bills, your task is to generate a summary for this bill.

Example Input: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Alexis Agin Identity Theft 
Protection Act of 2013''.

SEC. 2. LIMITATION ON DISTRIBUTION OF DEATH INFORMATION FURNISHED TO OR 
              MAINTAINED BY THE SOCIAL SECURITY ADMINISTRATION.

    (a) In General.--Section 205(r) of the Social Security Act (42 
U.S.C. 405(r)) is amended--
            (1) in paragraph (2), by inserting ``, and to ensure 
        completeness, timeliness, and accuracy of,'' after 
        ``transmitting'';
            (2) by striking paragraph (3) and inserting the following:
    ``(3) The Commissioner of Social Security shall, to the extent 
feasible, provide for the use of information regarding deceased 
individuals furnished to or maintained by the Commissioner, subject to 
such safeguards as the Commissioner of Social Security determines are 
necessary or appropriate to protect the information from unauthorized 
use or disclosure, to any Federal or State agency providing or 
administering Federally funded benefits to individuals, other than 
benefits under this Act, through a cooperative arrangement with such 
agency designed to ensure proper payment of those benefits with respect 
to such individuals if--
            ``(A) under such arrangement the agency provides 
        reimbursement to the Commissioner of Social Security for the 
        reasonable costs of carrying out such arrangement, including 
        the reasonable costs associated with the collection and 
        maintenance of information regarding deceased individuals 
        furnished to the Commissioner pursuant to paragraph (1); and
            ``(B) such arrangement does not conflict with the duties of 
        the Commissioner of Social Security under paragraph (1).'';
            (3) in paragraph (4), by inserting ``or in benefit and 
        pension plans for employees of the States or local 
        governments'' after ``by the States'';
            (4) by striking paragraph (5) and inserting the following:
    ``(5)(A) The Commissioner of Social Security may use or provide for 
the use of information regarding deceased individuals furnished to or 
maintained by the Commissioner, subject to such safeguards as the 
Commissioner of Social Security determines are necessary or appropriate 
to protect the information from unauthorized use or disclosure, 
provided the requirements of subparagraphs (A) and (B) of paragraph (3) 
are met and such information is provided--
            ``(i) to any Federal agency through a cooperative agreement 
        with such agency for the purpose of law enforcement or tax 
        administration; or
            ``(ii) for statistical and research activities conducted by 
        Federal and State agencies.
    ``(B) A Federal or State agency may disclose death information 
obtained from the Commissioner to a contractor for the purposes of 
assisting with such law enforcement, tax administration, or statistical 
and research activities, provided that the agency ensures, at a 
minimum, that the contractor fulfills the requirements of clauses (ii) 
and (iv) of paragraph (7)(E).'';
            (5) by striking paragraph (7) and inserting the following:
    ``(7)(A) For purposes of this paragraph, death information shall 
consist of information regarding deceased individuals maintained by the 
Commissioner of Social Security, except for information furnished to or 
maintained by the Commissioner pursuant to paragraphs (1) or (2), and 
the death information to be provided shall consist only of the name, 
social security number, date of birth, and date of death of a deceased 
individual.''
    ``(B) The Commissioner may disclose death information under this 
paragraph to the Secretary of Defense provided that--
            ``(i) the Secretary uses the information provided solely 
        for the purpose of assisting in the identification of 
        unidentified remains, and
            ``(ii) the Secretary enforces requirements similar to those 
        in clauses (i), (ii), (iv), (v), (vi), and (vii) with respect 
        to any contractor the Secretary hires to assist in such 
        identifications.
    ``(C) The Commissioner of Social Security may disclose death 
information, except for information furnished to or maintained by the 
Commissioner of Social Security pursuant to paragraphs (1) or (2), 
provided the requirements of this paragraph and the requirements of 
subparagraphs (A) and (B) of paragraph (3) are met.
    ``(D) The Commissioner may disclose--
            ``(i) to any entity, information maintained by the 
        Commissioner concerning individuals whose date of death 
        occurred at least 3 calendar years prior to the year that the 
        entity requests such information pursuant to a written 
        agreement; and
            ``(ii) to any entity `certified' by the Commissioner under 
        subparagraph (E), information maintained by the Commissioner 
        concerning individuals whose date of death does not satisfy the 
        requirements of clause (i), pursuant to a written agreement 
        between the Commissioner and the entity.
    ``(E) For purposes of this paragraph an entity is `certified' only 
if the Commissioner--
            ``(i) establishes procedures to certify and decertify 
        entities eligible to obtain such information;
            ``(ii) includes in the agreement with such an entity 
        provisions to require such entity to safeguard the information 
        provided, assure that the information is used only for the 
        purpose which was the basis for the certification, assure that 
        the information is not disclosed by the entity to any other 
        entity, and include contractual penalties, including monetary 
        penalties and loss of certification, for the violation of any 
        requirements imposed by the Commissioner as a condition of 
        receiving the information;
            ``(iii) requires that the entity demonstrate that--
                    ``(I) it has a legitimate business need for the 
                information, which shall include a requirement that the 
                information regarding a deceased individual will aid in 
                preventing financial harm to the entity or to a 
                customer or client of the entity or will aid in 
                permitting the entity to fulfill an obligation to a 
                beneficiary of an individual that is contingent upon 
                the death of such individual; or
                    ``(II) it has a legitimate interest in preventing 
                fraud or unauthorized financial transactions;
            ``(iv) requires that the entity demonstrate that it has 
        infrastructure and procedures in place to prevent wrongful 
        access to or the disclosure of information provided by the 
        Commissioner;
            ``(v) determines that the entity has adequate experience 
        and expertise in maintaining the confidentiality and security 
        of information;
            ``(vi) includes such other requirements and restrictions as 
        the Commissioner deems appropriate to assure the 
        confidentiality of the information; and
            ``(vii) requires that the entity permit periodic and 
        unscheduled audits of the entity to assure compliance with the 
        requirements established by the Commissioner.
    ``(F) The Commissioner shall establish application and other fees 
to be paid by entities seeking to be certified or to maintain 
certification under this paragraph so that the Commissioner is fully 
reimbursed for all costs associated with development of the 
certification process, evaluating applications, auditing compliance 
with the requirements established by the Commissioner, inspecting 
records and assuring compliance with contract requirements, and any 
other costs associated with assuring continuing eligibility for 
certification under this paragraph.
    ``(G) For purposes of this paragraph, the terms `entity' or 
`entities' includes `individual' and `individuals' respectively.
    ``(H) The Commissioner may delegate any of the activities under 
this paragraph to another agency and may perform any activity through a 
contractor, provided that the delegation or contract requires such 
agency or contractor to comply with all requirements of this section 
and of the implementing policies developed by the Commissioner.'';
            (6) by adding at the end the following new paragraph:
    ``(10) Information related to a deceased individual received by the 
Commissioner of Social Security other than as described in paragraph 
(1) shall be treated for purposes of paragraph (6) in the same manner 
as information received as described in paragraph (1).''.
    (b) Report.--Not later than 1 year after the date of the enactment 
of this Act and each year thereafter through 2019, the Commissioner of 
Social Security shall submit to the Committee on Finance of the Senate 
and the Committee on Ways and Means of the House of Representatives a 
report describing the entities certified by the Commissioner under 
section 205(r)(7) of the Social Security Act (42 U.S.C. 405(r)(7)) 
during the preceding year and their compliance with the requirements of 
subparagraph (E) of such section.
    (c) Effective Dates.--
            (1) In general.--Except as provided in paragraph (2), the 
        amendments made by this section take effect on the date that is 
        60 days after the date of the enactment of this Act.
            (2) Exception.--The amendment made by subsection (a)(6) 
        shall take effect on January 1, 2014.
    (d) Sunset.--Subparagraphs (C) through (H) of section 205(r)(7) of 
the Social Security Act (42 U.S.C. 405(r)(7)) (as amended by subsection 
(a)) shall cease to be effective on January 1, 2019, except that--
            (1) clauses (ii) and (iv) of subparagraph (E) of such 
        section shall continue to apply for purposes of section 
        205(r)(5)(B) of such Act (42 U.S.C. 405(r)(5)(B)) (as amended 
        by subsection (a)).
Example Output: Alexis Agin Identity Theft Protection Act of 2013 - Amends title II (Old Age, Survivors and Disability Insurance) (OASDI) of the Social Security Act to revise the treatment of death information furnished to or maintained by the Social Security Administration (SSA). Authorizes the Commissioner of Social Security to use or provide such information to federal and state agencies for statistical and research activities or to any federal agency for law enforcement or tax administration purposes. Authorizes disclosure of such information by: (1) federal and state agencies to contractors to assist with similar activities, (2) the Commissioner to entities concerning certain individuals who died more than three years earlier as well as to entities certified by the Commissioner, and (3) the Commissioner to the Secretary of Defense (DOD) to assist in the identification of remains. 

Example Input: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``SSI Disability Reform Act of 1993''.

SEC. 2. REPRESENTATIVE PAYEE REFORMS.

    (a) Authority of Government Agencies to Become Paid Representative 
Payees.--Section 1631(a)(2)(D)(ii) of the Social Security Act (42 
U.S.C. 1383(a)(2)(D)(ii)) is amended by adding at the end the 
following: ``The term `qualified organization' also includes any 
government agency that meets the requirements of items (aa) and (bb) of 
subclause (II).''.
    (b) Maximum Fee Payable to Representative Payees.--Section 
1631(a)(2)(D)(i) of such Act (42 U.S.C. 1383(a)(2)(D)(i)) is amended by 
striking ``the lesser of--'' and all that follows and inserting ``10 
percent of the monthly benefit involved.''.

SEC. 3. REFORM OF SSI DISABILITY BENEFITS BASED ON SUBSTANCE ABUSE.

    (a) In General.--Section 1611(e)(3) of the Social Security Act (42 
U.S.C. 1382(e)(3)) is amended--
            (1) by striking all that precedes subparagraph (B) and 
        inserting the following:
    ``(3)(A) Notwithstanding paragraphs (1) and (2), a person who (but 
for this subparagraph) would be an eligible individual or eligible 
spouse for purposes of this title solely by reason of disability and 
who is medically determined to be a drug addict or an alcoholic shall 
not be such an eligible individual or eligible spouse until--
            ``(i) the person, through an outpatient rehabilitation 
        program, has undergone treatment appropriate for such condition 
        for 3 months at an institution or facility approved by the 
        Secretary for purposes of this paragraph, and has complied with 
        the terms, conditions, and requirements of such treatment and 
        with the requirements imposed under subparagraph (D); and
            ``(ii) the State in which the person resides determines 
        that--
                    ``(I) the person has made progress towards 
                recovery, or has recovered; or
                    ``(II) if the person has not made progress towards 
                recovery, the person meets such requirements 
                established in regulations as the Secretary deems 
                appropriate to effectuate the purposes of this 
                title.'';
            (2) by redesignating subparagraph (B) as subparagraph (D);
            (3) by inserting after the matter added by paragraph (1) of 
        this subsection the following:
    ``(B) If, after the 3-month treatment period referred to in 
subparagraph (A)(i), the State determines that the person has not 
recovered from the condition treated, then, as a condition of receiving 
benefits under this title by reason of disability, the person must 
continue to comply with the terms, conditions, and requirements of such 
treatment and with the requirements imposed under subparagraph (D), 
until recovery.
    ``(C)(i) A person who fails to continue treatment as required by 
subparagraph (B) shall not be an eligible individual or an eligible 
spouse for purposes of this title by reason of disability, until the 
person has completed 2 weeks of such treatment.
    ``(ii) A person who has become an eligible individual or an 
eligible spouse for purposes of this title by reason of disability 
after clause (i) has been applied to the person, and who fails to 
continue treatment as required by subparagraph (B), shall not be an 
eligible individual or an eligible spouse for purposes of this title by 
reason of disability, until the person has completed 2 months of such 
treatment.
    ``(iii) A person who has become an eligible individual or an 
eligible spouse for purposes of this title by reason of disability 
after clause (ii) has been applied to the person, and who fails to 
continue treatment as required by subparagraph (B), shall not again 
become an eligible individual or an eligible spouse for purposes of 
this title by reason of disability.''; and
            (4) by adding at the end the following:
    ``(E) The Secretary, in consultation with drug and alcohol 
treatment professionals, shall develop standards for drug and alcohol 
treatment programs, and in consultation with States, shall develop 
guidelines to be used to review and evaluate the progress of 
participants in such programs.''.
    (b) Preservation of Medicaid Benefits.--Section 1634 of such title 
(42 U.S.C. 1383c) is amended by adding at the end the following:
    ``(e) For purposes of title XIX, each person who is not an eligible 
individual or an eligible spouse solely by reason of section 1611(e)(3) 
shall be treated as receiving benefits under this title for so long as 
such person would be eligible for such benefits in the absence of such 
section.''.

SEC. 4. MANDATORY MEDICAID COVERAGE OF SUBSTANCE ABUSE TREATMENT 
              PROGRAMS FOR DISABLED SSI BENEFICIARIES.

    (a) In General.--Section 1905 of the Social Security Act (42 U.S.C. 
1396d) is amended--
            (1) in subsection (a)--
                    (A) by striking ``and'' at the end of paragraph 
                (21),
                    (B) by striking the comma at the end of paragraph 
                (24) and inserting a semicolon,
                    (C) by redesignating paragraphs (22), (23), and 
                (24) as paragraphs (25), (22), and (23), respectively, 
                and by transferring and inserting paragraph (25) after 
                paragraph (23), as so redesignated, and
                    (D) by inserting after paragraph (23) the following 
                new paragraph:
            ``(24) approved substance abuse treatment services for 
        certain disabled beneficiaries (as described in subsection 
        (t)(1)); and''; and
            (2) by adding at the end the following new subsection:
    ``(t)(1) For purposes of subsection (a)(24), approved substance 
abuse treatment services for certain disabled beneficiaries are 
services provided to an individual described in section 1611(e)(3)(A) 
through a program approved by the Secretary to provide substance abuse 
treatment services for purposes of enabling such individuals to meet 
the requirements of clause (i) of such section.
    ``(2) No payment shall be made under section 1903(a) to a State for 
medical assistance for approved substance abuse treatment services for 
certain disabled beneficiaries provided to any individual after the 3-
month period that begins on the date the individual first receives such 
services.''.
    (b) 100 Percent Federal Matching Rate.--The first sentence of 
section 1905(b) of such Act (42 U.S.C. 1396d(b)) is amended--
            (1) by inserting ``subject to clause (3),'' after ``except 
        that (1)'',
            (2) by striking ``and (2)'' and inserting ``(2)'', and
            (3) by inserting before the period at the end the 
        following: ``, and (3) subject to clause (2), the Federal 
        medical assistance percentage shall be 100 percent with respect 
        to expenditures as medical assistance for approved substance 
        abuse treatment services for certain disabled beneficiaries (as 
        described in section 1905(t)(1))''.
    (c) Conforming Amendments.--
            (1) Section 1902 of such Act (42 U.S.C. 1396a) is amended--
                    (A) in subsection (a)(10)(A) in the matter 
                preceding clause (i), by striking ``(17) and (21)'' and 
                inserting ``(17), (21), and (24)'';
                    (B) in subsection (a)(10)(C)(iv), by striking 
                ``through (21)'' and inserting ``through (24)''; and
                    (C) in subsection (j), by striking ``through (22)'' 
                and inserting ``through (25)''.
            (2) Section 1903(i) of such Act (42 U.S.C. 1396b(i)), as 
        amended by section 2(b)(2) of the Medicaid Voluntary 
        Contribution and Provider-Specific Tax Amendments of 1991, is 
        amended--
                    (A) in paragraph (10), by striking all that follows 
                ``1927(g)'' and inserting a semicolon;
                    (B) by redesignating the paragraph (12) inserted by 
                section 4752(a)(2) of the Omnibus Budget Reconciliation 
                Act of 1990 as paragraph (11), by transferring and 
                inserting it after paragraph (10), and by striking the 
                period at the end and inserting a semicolon;
                    (C) by redesignating the paragraph (14) inserted by 
                section 4752(e) of the Omnibus Budget Reconciliation 
                Act of 1990 as paragraph (12), by transferring and 
                inserting it after paragraph (11), and by striking the 
                period at the end and inserting a semicolon;
                    (D) by redesignating the paragraph (11) inserted by 
                section 4801(e)(16)(A) of the Omnibus Budget 
                Reconciliation Act of 1990 as paragraph (13), by 
                transferring and inserting it after paragraph (12), and 
                by striking the period at the end and inserting ``; 
                or''; and
                    (E) by inserting after paragraph (13), as so 
                redesignated, the following new paragraph:
            ``(14) with respect to any amount expended for medical 
        assistance for approved substance abuse treatment services for 
        certain disabled beneficiaries (as described in section 
        1905(t)(1)) which are provided in violation of paragraph (2) of 
        section 1905(t).''.
    (d) Effective Date.--The amendments made by this section apply to 
payments under title XIX of the Social Security Act for calendar 
quarters beginning on or after the first day of the second calendar 
quarter that begins on or after the date of the enactment of this Act, 
without regard to whether or not final regulations to carry out such 
amendments have been promulgated by such date.

SEC. 5. EFFECTIVE DATE.

    Except as provided in section 4(d), the amendments made by this Act 
shall apply to benefits payable for months beginning 90 or more days 
after the date of the enactment of this Act.
Example Output: SSI Disability Reform Act of 1993 - Amends title XVI (Supplemental Security Income) (SSI) of the Social Security Act (SSA) to:  (1) allow government agencies to serve as paid representative payees; (2) set the maximum fee payable to representative payees at ten percent of the monthly benefit involved; and (3) revise the provision of SSI benefits to the disabled based on substance abuse. 
Amends SSA title XIX (Medicaid) to provide for mandatory Medicaid coverage of approved substance abuse treatment programs for certain disabled SSI beneficiaries.

Example Input: SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Cyberterrorism Preparedness Act of 
2002''.

SEC. 2. GRANT FOR PROGRAM FOR PROTECTION OF INFORMATION INFRASTRUCTURE 
              AGAINST DISRUPTION.

    (a) In General.--The National Institute of Standards and Technology 
shall, using amounts authorized to be appropriated by section 5, award 
a grant to a qualifying nongovernmental entity for purposes of a 
program to support the development of appropriate cybersecurity best 
practices, support long-term cybersecurity research and development, 
and perform functions relating to such activities. The purpose of the 
program shall be to provide protection for the information 
infrastructure of the United States against terrorist or other 
disruption or attack or other unwarranted intrusion.
    (b) Qualifying Nongovernmental Entity.--For purposes of this 
section, a qualifying nongovernmental entity is any entity that--
            (1) is a nonprofit, nongovernmental consortium composed of 
        at least three academic centers of expertise in cybersecurity 
        and at least three private sector centers of expertise in 
        cybersecurity;
            (2) has a board of directors of at least 12 members who 
        include senior administrators of academic centers of expertise 
        in cybersecurity and senior managers of private sector centers 
        of expertise in cybersecurity and of whom not more than one 
        third are affiliated with the centers comprising the 
        consortium;
            (3) is operated by individuals from academia, the private 
        sector, or both who have--
                    (A) a demonstrated expertise in cybersecurity; and
                    (B) the capacity to carry out the program required 
                under subsection (g);
            (4) has in place a set of rules to ensure that conflicts of 
        interest involving officers, employees, and members of the 
        board of directors of the entity do not undermine the 
        activities of the entity;
            (5) has developed a detailed plan for the program required 
        under subsection (g); and
            (6) meets any other requirements established by the 
        National Institute of Standards and Technology for purposes of 
        this Act.
    (c) Application.--Any entity seeking a grant under this section 
shall submit to the National Institute of Standards and Technology an 
application therefor, in such form and containing such information as 
the National Institute for Standards and Technology shall require.
    (d) Selection of Grantee.--The entity awarded a grant under this 
section shall be selected after full and open competition among 
qualifying nongovernmental entities.
    (e) Dispersal of Grant Amount.--Amounts available for the grant 
under this section pursuant to the authorization of appropriations in 
section 5 shall be dispersed on a fiscal year basis over the five 
fiscal years beginning with fiscal year 2003.
    (f) Consultation.--In carrying out activities under this section, 
including selecting an entity for the award of a grant, dispersing 
grant amounts, and overseeing activities of the entity receiving the 
grant, the National Institute of Standards and Technology--
            (1) shall consult with an existing interagency entity, or 
        new interagency entity, consisting of the elements of the 
        Federal Government having a substantial interest and expertise 
        in cybersecurity and designated by the President for purposes 
        of this Act; and
            (2) may consult separately with any such element of the 
        Federal Government.
    (g) Program Using Grant Amount.--
            (1) In general.--The entity awarded a grant under this 
        section shall carry out a national program for the purpose of 
        protecting the information infrastructure of the United States 
        against disruption. The program shall consist of--
                    (A) multi-disciplinary research and development to 
                identify appropriate cybersecurity best practices, to 
                measure the effectiveness of cybersecurity best 
                practices that are put into use, and to identify sound 
                means to achieve widespread use of appropriate 
                cybersecurity best practices that have proven 
                effective;
                    (B) multi-disciplinary, long-term, or high-risk 
                research and development (including associated human 
                resource development) to improve cybersecurity; and
                    (C) the activities required under paragraphs (3) 
                and (4).
            (2) Conduct of research and development.--
                    (A) In general.--Except as provided in subparagraph 
                (B), research and development under subparagraphs (A) 
                and (B) of paragraph (1) shall be carried out using 
                funds and other support provided by the grantee to 
                entities selected by the grantee after full and open 
                competition among entities determined by the grantee to 
                be qualified to carry out such research and 
                development.
                    (B) Conduct by grantee.--The grantee may carry out 
                research and development referred to in subparagraph 
                (A) in any fiscal year using not more than 15 percent 
                of the amount dispersed to the grantee under this Act 
                in such fiscal year by the National Institute of 
Standards and Technology.
            (3) Recommendations on cybersecurity best practices.--
                    (A) Recommendations.--Not later than 18 months 
                after the selection of the grantee under this section, 
                the grantee shall prepare a report containing 
                recommendations for appropriate cybersecurity best 
                practices.
                    (B) Updates.--The grantee shall update the 
                recommendations made under subparagraph (A) not less 
                often than once every six months, and may update any 
                portion of such recommendations more frequently if the 
                grantee determines that circumstances so require.
                    (C) Considerations.--In making recommendations 
                under subparagraph (A), and any update of such 
                recommendations under subparagraph (B), the grantee 
                shall--
                            (i) review the most current cybersecurity 
                        best practices identified by the National 
                        Institute of Standards and Technology under 
                        section 3(a); and
                            (ii) consult with--
                                    (I) the entities carrying out 
                                research and development under 
                                paragraph (1)(A);
                                    (II) entities employing 
                                cybersecurity best practices; and
                                    (III) a wide range of academic, 
                                private sector, and public entities.
                    (D) Dissemination.--The grantee shall submit the 
                report under subparagraph (A), and any update of the 
                report under paragraph (B), to the bodies and officials 
                specified in paragraph (5), and shall widely 
                disseminate the report, and any such update, among 
                government (including State and local government), 
                private, and academic entities.
            (4) Activities relating to widespread use of cybersecurity 
        best practices.--
                    (A) In general.--Not later than two years after the 
                selection of the grantee under this section, the 
                grantee shall submit to the bodies and officials 
                specified in paragraph (5) a report containing--
                            (i) an assessment of the advisability of 
                        requiring the contractors and grantees of the 
                        Federal Government to use appropriate 
                        cybersecurity best practices; and
                            (ii) recommendations for sound means to 
                        achieve widespread use of appropriate 
                        cybersecurity best practices that have proven 
                        effective.
                    (B) Report elements.--The report under subparagraph 
                (A) shall set forth--
                            (i) whether or not the requirement 
                        described in subparagraph (A)(i) is advisable, 
                        including whether the requirement would impose 
                        undue or inappropriate burdens, or other 
                        inefficiencies, on contractors and grantees of 
                        the Federal Government;
                            (ii) if the requirement is determined 
                        advisable--
                                    (I) whether, and to what extent, 
                                the requirement should be subject to 
                                exceptions or limitations for 
                                particular contractors or grantees, 
                                including the types of contractors or 
                                grantees and the nature of the 
                                exceptions or limitations; and
                                    (II) which cybersecurity best 
                                practices should be covered by the 
                                requirement and with what, if any, 
                                exceptions or limitations; and
                            (iii) any other matters that the grantee 
                        considers appropriate.
            (5) Specified bodies and officials.--The bodies and 
        officials specified in this paragraph are as follows:
                    (A) The appropriate committees of Congress.
                    (B) The President.
                    (C) The Director of the Office of Management and 
                Budget.
                    (D) The National Institute of Standards and 
                Technology.
                    (E) The interagency entity designated by the 
                President under subsection (f)(1).
    (h) Grant Administration.--
            (1) Use of grant competition and management systems.--The 
        National Institute of Standards and Technology may permit the 
        entity awarded the grant under this section to utilize the 
        grants competition system and grants management system of the 
        National Institute of Standards and Technology for purposes of 
        the efficient administration of activities by the entity under 
        subsection (g).
            (2) Rules.--The National Institute of Standards and 
        Technology shall establish any rules and procedures that the 
        National Institute of Standards and Technology considers 
        appropriate to further the purposes of this section. Such rules 
        may include provisions relating to the ownership of any 
        intellectual property created by the entity awarded the grant 
        under this section or funded by the entity under subsection 
        (g).
    (i) Supplement Not Supplant.--The National Institute of Standards 
and Technology shall take appropriate actions to ensure that activities 
under this section supplement, rather than supplant, other current 
governmental and nongovernmental efforts to protect the information 
infrastructure of the United States.

SEC. 3. APPROPRIATE CYBERSECURITY BEST PRACTICES FOR THE FEDERAL 
              GOVERNMENT.

    (a) NIST Recommendations.--
            (1) In general.--Not later than 180 days after the date of 
        the enactment of this Act, the National Institute of Standards 
        and Technology shall submit to the bodies and officials 
        specified in subsection (e) a report that--
                    (A) identifies appropriate cybersecurity best 
                practices that could reasonably be adopted by the 
departments and agencies of the Federal Government over the 24-month 
period beginning on the date of the report; and
                    (B) sets forth proposed demonstration projects for 
                the adoption of such best practices by various 
                departments and agencies of the Federal Government 
                beginning 90 days after the date of the report.
            (2) Updates.--The National Institute of Standards and 
        Technology may submit to the bodies and officials specified in 
        subsection (e) any updates of the report under paragraph (1) 
        that the National Institute of Standards and Technology 
        consider appropriate due to changes in circumstances.
            (3) Consultation.--In preparing the report under paragraph 
        (1), and any updates of the report under paragraph (2), the 
        National Institute of Standards and Technology shall consult 
        with departments and agencies of the Federal Government having 
        an interest in the report and such updates, and with academic 
        centers of expertise in cybersecurity and private sector 
        centers of expertise in cybersecurity.
    (b) Demonstration Projects for Implementation of Recommendations.--
            (1) In general.--Commencing not later than 90 days after 
        receipt of the report under subsection (a), the President shall 
        carry out the demonstration projects set forth in the report, 
        including any modification of any such demonstration project 
        that the President considers appropriate.
            (2) Updates.--If the National Institute of Standards and 
        Technology updates under subsection (a)(2) any recommendation 
        under subsection (a)(1)(A) that is relevant to a demonstration 
        project under paragraph (1), the President shall modify the 
        demonstration project to take into account such update.
            (3) Report.--Not later than nine months after commencement 
        of the demonstration projects under this subsection, the 
        President shall submit to the appropriate committees of 
        Congress a report on the demonstration projects. The report 
        shall set forth the following:
                    (A) An assessment of the extent to which the 
                adoption of appropriate cybersecurity best practices by 
                departments and agencies of the Federal Government 
                under the demonstration projects has improved 
                cybersecurity at such departments and agencies.
                    (B) An assessment whether or not the adoption of 
                appropriate cybersecurity best practices by departments 
                and agencies of the Federal Government under the 
                demonstration projects has affected the capability of 
                such departments and agencies to carry out their 
                missions.
                    (C) A description of the cost of the adoption of 
                appropriate cybersecurity best practices by departments 
                and agencies of the Federal Government under the 
                demonstration projects.
                    (D) A description of a security-enhancing, 
                missions-compatible, cost-effective program, to the 
                extent such program is feasible, for the adoption of 
                appropriate cybersecurity best practices government-
                wide.
                    (E) Any other matters that the President considers 
                appropriate.
    (c) Adoption of Cybersecurity Best Practices Government-Wide.--The 
President shall implement a program for the adoption of appropriate 
cybersecurity best practices government-wide commencing not later than 
six months after the date of the report.
    (d) Incorporation of Recommendations.--If during the development or 
implementation of the program under subsection (c) the President 
receives any recommendations under paragraph (3) or (4) of section 
3(g), the President shall modify the program in order to take into 
account such recommendations.
    (e) Specified Bodies and Officials.--The bodies and officials 
specified in this subsection are as follows:
            (1) The appropriate committees of Congress.
            (2) The President.
            (3) The Director of the Office of Management and Budget.
            (4) The interagency entity designated by the President 
        under section 3(f)(1).

SEC. 4. DEFINITIONS.

    In this Act:
            (1) Appropriate committees of congress.--The term 
        ``appropriate committees of Congress'' means--
                    (A) the Committee on Commerce, Science, and 
                Transportation of the Senate; and
                    (B) the Committee on Science of the House of 
                Representatives.
            (2) Cybersecurity.--The term ``cybersecurity'' means 
        information assurance, including information security, 
        information technology disaster recovery, and information 
        privacy.
            (3) Cybersecurity best practice.--The term ``cybersecurity 
        best practice'' means a computer hardware or software 
        configuration, information system design, operational 
        procedure, or measure, structure, or method that most 
        effectively protects computer hardware, software, networks, or 
        network elements against an attack that would cause harm 
        through the installation of unauthorized computer software, 
        saturation of network traffic, alteration of data, disclosure 
        of confidential information, or other means.
            (4) Appropriate cybersecurity best practice.--The term 
        ``appropriate cybersecurity best practice'' means a 
        cybersecurity best practice that--
                    (A) permits, as needed, customization or expansion 
                for the computer hardware, software, network, or 
                network element to which the best practice applies;
                    (B) takes into account the need for security 
                protection that balances--
                            (i) the risk and magnitude of harm 
                        threatened by potential attack; and
                            (ii) the cost of imposing security 
                        protection; and
                    (C) takes into account the rapidly changing nature 
                of computer technology.

SEC. 5. AUTHORIZATION OF APPROPRIATIONS.

    There is hereby authorized to be appropriated for the National 
Institute of Standards and Technology for purposes of activities under 
this Act, amounts as follows:
            (1) For fiscal year 2003, $70,000,000.
            (2) For each of the fiscal years 2004 through 2007, such 
        sums as may be necessary.
Example Output:
Cyberterrorism Preparedness Act of 2002 - Directs the National Institute of Standards and Technology (NIST) to award a grant to a qualifying nongovernmental entity to conduct a program to support the development of appropriate cybersecurity best practices, long-term cybersecurity research and development, and related activities. Funds such grants for five fiscal years beginning with 2003. Requires the entity awarded a grant to: (1) carry out a national program to protect the U.S. information infrastructure against disruption; and (2) make recommendations for appropriate cybersecurity best practices and to update such recommendations every six months.Requires: (1) NIST to recommend to specified bodies and officials appropriate cybersecurity best practices for the Government; and (2) the President to carry out demonstration projects for the adoption of such practices.