1.Short title; table of
contents
(a)This Act may be cited as the Strengthening and Enhancing Cybersecurity by Using
Research, Education, Information, and Technology Act of
2012
or the SECURE IT Act of 2012
.
(b)The table of contents of this Act is as follows:
Sec. 1. Short title; table of contents.
Title I—Facilitating Sharing of Cyber Threat
Information
Sec. 101. Definitions.
Sec. 102. Authorization to share cyber threat
information.
Sec. 103. Information sharing by the Federal
Government.
Sec. 104. Report on implementation.
Sec. 105. Inspector General review.
Sec. 106. Technical amendments.
Sec. 107. Access to classified information.
Title II—Coordination of Federal Information Security
Policy
Sec. 201. Coordination of Federal information security
policy.
Sec. 202. Management of information technology.
Sec. 203. No new funding.
Sec. 204. Technical and conforming amendments.
Title III—Criminal Penalties
Sec. 301. Penalties for fraud and related activity in
connection with computers.
Sec. 302. Trafficking in passwords.
Sec. 303. Conspiracy and attempted computer fraud
offenses.
Sec. 304. Criminal and civil forfeiture for fraud and related
activity in connection with computers.
Sec. 305. Damage to critical infrastructure
computers.
Sec. 306. Limitation on actions involving unauthorized
use.
Title IV—Cybersecurity Research and Development
Sec. 401. National High-Performance Computing Program planning
and coordination.
Sec. 402. Research in areas of national importance.
Sec. 403. Program improvements.
Sec. 404. Cloud computing services for research.
Sec. 405. Cybersecurity university-industry task
force.
Sec. 406. Improving education of networking and information
technology, including high-performance computing.
Sec. 407. Conforming and technical amendments to the
High-Performance Computing Act of 1991.
Sec. 408. Federal Cyber Scholarship-for-Service
program.
Sec. 409. Study and analysis of certification and training of
information infrastructure professionals.
Sec. 410. Cybersecurity strategic research and development
plan.
Sec. 411. International cybersecurity technical
standards.
Sec. 412. Identity management research and
development.
Sec. 413. Federal cybersecurity research and development
programs.
Sec. 414. Cybersecurity automation and checklists for
Government systems.
Sec. 415. National Institute of Standards and Technology
cybersecurity research and development.
<enum>I</enum><header>Facilitating
Sharing of Cyber Threat Information</header>
<section id="H031D3E1A831E4E358E50930E46F286E7" section-type="subsequent-section"><enum>101.</enum><header>Definitions</header><text display-inline="no-display-inline">In this title:</text>
<paragraph id="HCA7435AF700243CA89BF75F8F98795A3"><enum>(1)</enum><header>Agency</header><text>The
term <term>agency</term> has the meaning given the term in section 3502 of
title 44, United States Code.</text>
</paragraph><paragraph id="H7A89465EA2EC40B984D1F9AE61E61B41"><enum>(2)</enum><header>Antitrust
laws</header><text>The term <term>antitrust laws</term>—</text>
<subparagraph id="H41EBB9C90370476D90840BBD2C37DE04"><enum>(A)</enum><text>has the meaning
given the term in section 1(a) of the Clayton Act (15 U.S.C. 12(a));</text>
</subparagraph><subparagraph id="H04E2C1A5E3814FE39A2760804D2CBE7E"><enum>(B)</enum><text>includes section 5
of the Federal Trade Commission Act (15 U.S.C. 45) to the extent that section 5
of that Act applies to unfair methods of competition; and</text>
</subparagraph><subparagraph id="HF17021CAB87945ED9516BB073F69AB0A"><enum>(C)</enum><text>includes any State
law that has the same intent and effect as the laws under subparagraphs (A) and
(B).</text>
</subparagraph></paragraph><paragraph id="HB522B3231359498C9706675A9CEDF581"><enum>(3)</enum><header>Countermeasure</header><text>The
term <term>countermeasure</term> means an automated or a manual action with
defensive intent to mitigate cyber threats.</text>
</paragraph><paragraph id="H6DAC464988EB42D6A70D0099D0384041"><enum>(4)</enum><header>Cyber threat
information</header><text>The term <term>cyber threat information</term> means
information that may be indicative of or describes—</text>
<subparagraph id="H7CFDB7D43FD9419F83F2B448703B8217"><enum>(A)</enum><text>a technical or
operation vulnerability or a cyber threat mitigation measure;</text>
</subparagraph><subparagraph id="HE6EEA9A835E848539C9262BEEC5101CB"><enum>(B)</enum><text>an action or
operation to mitigate a cyber threat;</text>
</subparagraph><subparagraph id="H5D6DC41B36BE4B429C71F8134ED45B19"><enum>(C)</enum><text>malicious
reconnaissance, including anomalous patterns of network activity that appear to
be transmitted for the purpose of gathering technical information related to a
cybersecurity threat;</text>
</subparagraph><subparagraph id="H76493506960746BCAF576D59FC9E7C52"><enum>(D)</enum><text>a method of
defeating a technical control;</text>
</subparagraph><subparagraph id="H14F2215DE6074E2FA185CF2B4F054455"><enum>(E)</enum><text>a method of
defeating an operational control;</text>
</subparagraph><subparagraph id="H19A8DDE85B134F8EA43B76746BF9CE8A"><enum>(F)</enum><text>network activity
or protocols known to be associated with a malicious cyber actor or that
signify malicious cyber intent;</text>
</subparagraph><subparagraph id="H65BC8AB488984752B551B55A74BBA480"><enum>(G)</enum><text>a method of
causing a user with legitimate access to an information system or information
that is stored on, processed by, or transiting an information system to
inadvertently enable the defeat of a technical or operational control;</text>
</subparagraph><subparagraph id="H52321AF7CC854ACDBC6DA5A1A6B4C779"><enum>(H)</enum><text>any other
attribute of a cybersecurity threat or cyber defense information that would
foster situational awareness of the United States cybersecurity posture, if
disclosure of such attribute or information is not otherwise prohibited by
law;</text>
</subparagraph><subparagraph id="HE494E80648F341B2B5BDB7611C1EAF5B"><enum>(I)</enum><text>the actual or
potential harm caused by a cyber incident, including information exfiltrated
when it is necessary in order to identify or describe a cybersecurity threat;
or</text>
</subparagraph><subparagraph id="HB1E0FC6D37424A84A51FA75057DFF632"><enum>(J)</enum><text>any combination
thereof.</text>
</subparagraph></paragraph><paragraph id="HCE23625E58114A43B724974E60A2F6E8"><enum>(5)</enum><header>Cybersecurity
center</header><text>The term <term>cybersecurity center</term> means the
Department of Defense Cyber Crime Center, the Intelligence Community Incident
Response Center, the United States Cyber Command Joint Operations Center, the
National Cyber Investigative Joint Task Force, the National Security
Agency/Central Security Service Threat Operations Center, the National
Cybersecurity and Communications Integration Center, and any successor
center.</text>
</paragraph><paragraph id="H7D78F39494B4429A8984C7CF3168EEDC"><enum>(6)</enum><header>Cybersecurity
system</header><text>The term <term>cybersecurity system</term> means a system
designed or employed to ensure the integrity, confidentiality, or availability
of, or to safeguard, a system or network, including measures intended to
protect a system or network from—</text>
<subparagraph id="HB4EC087461544AEEB2E96419CB5F2D04"><enum>(A)</enum><text>efforts to
degrade, disrupt, or destroy such system or network; or</text>
</subparagraph><subparagraph id="H5EF0682B206C44F99788DFEC9B51DF37"><enum>(B)</enum><text>theft or
misappropriations of private or government information, intellectual property,
or personally identifiable information.</text>
</subparagraph></paragraph><paragraph id="H1BF50031896244669C5D48D5E1B7F6EE"><enum>(7)</enum><header>Entity</header><text>The
term <term>entity</term> means any private entity, non-Federal Government
agency or department, or State, tribal, or local government agency or
department (including an officer, employee, or agent thereof).</text>
</paragraph><paragraph id="HB2903F478F7541DA82E14F62D6A8813B"><enum>(8)</enum><header>Information
security</header><text>The term <term>information security</term> means
protecting information and information systems from disruption or unauthorized
access, use, disclosure, modification, or destruction in order to
provide—</text>
<subparagraph id="H303B1F8B87214A2B837BAB884E1D91BE"><enum>(A)</enum><text>integrity, by
guarding against improper information modification or destruction, including by
ensuring information nonrepudiation and authenticity;</text>
</subparagraph><subparagraph id="HDEC67F401FF84C31A51FA9E60099416E"><enum>(B)</enum><text>confidentiality,
by preserving authorized restrictions on access and disclosure, including means
for protecting personal privacy and proprietary information; or</text>
</subparagraph><subparagraph id="HC5AED8BD9CC449C785E2E2F471E52E94"><enum>(C)</enum><text>availability, by
ensuring timely and reliable access to and use of information.</text>
</subparagraph></paragraph><paragraph id="HDB8F2CCFC84D4C55BF63ED386CC8C94C"><enum>(9)</enum><header>Information
system</header><text>The term <term>information system</term> has the meaning
given the term in section 3502 of title 44, United States Code.</text>
</paragraph><paragraph id="H493E07FFD9AE4DFE962BFCB1182B3A70"><enum>(10)</enum><header>Malicious
reconnaissance</header><text>The term <term>malicious reconnaissance</term>
means a method for actively probing or passively monitoring an information
system for the purpose of discerning technical vulnerabilities of the
information system, if such method is associated with a known or suspected
cybersecurity threat.</text>
</paragraph><paragraph id="H2D1C4FF7A66D44599D893E8BFFACB8E5"><enum>(11)</enum><header>Operational
control</header><text>The term <term>operational control</term> means a
security control for an information system that primarily is implemented and
executed by people.</text>
</paragraph><paragraph id="HB03DB7D79D244EDAAAED9C236BE0E073"><enum>(12)</enum><header>Operational
vulnerability</header><text>The term <term>operational vulnerability</term>
means any attribute of policy, process, or procedure that could enable or
facilitate the defeat of an operational control.</text>
</paragraph><paragraph id="H0EA3A4A32A364167AE7B1B21276FDF25"><enum>(13)</enum><header>Private
entity</header><text>The term <term>private entity</term> means any individual
or any private group, organization, or corporation, including an officer,
employee, or agent thereof.</text>
</paragraph><paragraph id="HB0BCCA706D184028BC82B7F1F9800F1E"><enum>(14)</enum><header>Technical
control</header><text>The term <term>technical control</term> means a hardware
or software restriction on, or audit of, access or use of an information system
or information that is stored on, processed by, or transiting an information
system that is intended to ensure the confidentiality, integrity, or
availability of that system.</text>
</paragraph><paragraph id="HC1456AB32D724EF89E8974F0F367F874"><enum>(15)</enum><header>Technical
vulnerability</header><text>The term <term>technical vulnerability</term> means
any attribute of hardware or software that could enable or facilitate the
defeat of a technical control.</text>
</paragraph></section><section id="H8012AF09094D4569A7CDE00DD9D7A2B5"><enum>102.</enum><header>Authorization
to share cyber threat information</header>
<subsection id="H7F17FDDFEDE843E6BA990DAC0D3F072A"><enum>(a)</enum><header>Voluntary
disclosure</header>
<paragraph id="H1C9A9EDCAEB24C6488034B36BBDE9ED3"><enum>(1)</enum><header>Private
entities</header><text>Notwithstanding any other provision of law, a private
entity may, for the purpose of preventing, investigating, or otherwise
mitigating threats to information security, on its own networks, or as
authorized by another entity, on such entity’s networks, employ countermeasures
and use cybersecurity systems in order to obtain, identify, or otherwise
possess cyber threat information.</text>
</paragraph><paragraph id="HCB62663B53584C1980D02F795F09188A"><enum>(2)</enum><header>Entities</header><text>Notwithstanding
any other provision of law, an entity may disclose cyber threat information
to—</text>
<subparagraph id="H1350296A6EF346D09121DF305AD49773"><enum>(A)</enum><text>a cybersecurity
center; or</text>
</subparagraph><subparagraph id="H06053DBD3CDE46A9BF07F9D985D12D02"><enum>(B)</enum><text>any other entity
in order to assist with preventing, investigating, or otherwise mitigating
threats to information security.</text>
</subparagraph></paragraph><paragraph id="HE5CB951453924A37A0704BD74F08F6BC"><enum>(3)</enum><header>Information
security providers</header><text>If the cyber threat information described in
paragraph (1) is obtained, identified, or otherwise possessed in the course of
providing information security products or services under contract to another
entity, that entity shall, at any time prior to disclosure of such information,
be given a reasonable opportunity to authorize or prevent such disclosure or to
request anonymization of such information.</text>
</paragraph></subsection><subsection id="H4DE0D5E51416473BA2506E9C8B4D4020"><enum>(b)</enum><header>Required
disclosure</header>
<paragraph id="HE848ECFBE42C452BB1917F79955C3C93"><enum>(1)</enum><header>In
general</header><text>An entity providing electronic communication services,
remote computing services, or cybersecurity services under contract to a
Federal agency or department shall immediately provide to such agency or
department, and may provide to a cybersecurity center, any cyber threat
information directly related to such contract that is obtained, identified, or
otherwise possessed by such entity.</text>
</paragraph><paragraph id="H0E72EA3E9F474BAD94FC4AA23EABA309"><enum>(2)</enum><header>Disclosure to
cybersecurity centers</header><text>A Federal agency or department receiving
cyber threat information under paragraph (1) shall immediately disclose such
information to a cybersecurity center.</text>
</paragraph><paragraph id="H5FE1CCD5218C4C0CB82FF928ECB51C7A"><enum>(3)</enum><header>Limitation on
Application</header><text>This subsection shall not apply with respect to
services provided under a contract in effect on the date of the enactment of
this Act.</text>
</paragraph></subsection><subsection id="H19C698B84CEA4F74B639F4A205E591B5"><enum>(c)</enum><header>Information
shared with or provided to a cybersecurity center</header><text>Cyber threat
information provided to a cybersecurity center under this section—</text>
<paragraph id="H43B53C994B01476E8814BF123D49B62D"><enum>(1)</enum><text>may be disclosed
to and used by, consistent with otherwise applicable law, any Federal agency or
department, component, officer, employee, or agent of the Federal Government
for a cybersecurity purpose, a national security purpose, or in order to
prevent, investigate, or prosecute any of the offenses listed in section 2516
of title 18, United States Code;</text>
</paragraph><paragraph id="H762E888D697D430E97CFF125E88950E5"><enum>(2)</enum><text>may, with the
prior written consent of the entity submitting such information, be disclosed
to and used by a State, tribal, or local government or government agency for
the purpose of protecting information systems, or in furtherance of preventing,
investigating, or prosecuting a criminal act, except that if the need for
immediate disclosure prevents obtaining written consent, such consent may be
provided orally with subsequent documentation of such consent;</text>
</paragraph><paragraph id="H6DB66D14BD324DEAB8C2EC027AD01AE4"><enum>(3)</enum><text>shall be
considered the commercial, financial, or proprietary information of the entity
providing such information to the Federal Government and any disclosure outside
the Federal Government may only be made upon the prior written consent by such
entity and shall not constitute a waiver of any applicable privilege or
protection provided by law, except that if the need for immediate disclosure
prevents obtaining written consent, such consent may be provided orally with
subsequent documentation of such consent;</text>
</paragraph><paragraph id="H076E48F84C3647CCAFC084E0439AA4CB"><enum>(4)</enum><text>shall be deemed
voluntarily shared information and exempt from disclosure under section 552 of
title 5, United States Code, and any State, tribal, or local law requiring
disclosure of information or records;</text>
</paragraph><paragraph id="H1BBC4CC9A25C4975A42D6ADE050BA4AA"><enum>(5)</enum><text>shall be, without
discretion, withheld from the public under section 552(b)(3)(B) of title 5,
United States Code, and any State, tribal, or local law requiring disclosure of
information or records;</text>
</paragraph><paragraph id="HCE0BABC7533346DA986FC80438F4CB62"><enum>(6)</enum><text>shall not be
subject to the rules of any Federal agency or department or any judicial
doctrine regarding ex parte communications with a decisionmaking
official;</text>
</paragraph><paragraph id="HE934467FBE924A35A49532F23AB1C17B"><enum>(7)</enum><text>shall not, if
subsequently provided to a State, tribal, or local government or government
agency, otherwise be disclosed or distributed to any entity by such State,
tribal, or local government or government agency without the prior written
consent of the entity submitting such information, notwithstanding any State,
tribal, or local law requiring disclosure of information or records, except
that if the need for immediate disclosure prevents obtaining written consent,
such consent may be provided orally with subsequent documentation of such
consent; and</text>
</paragraph><paragraph id="HD435A4E6BC5B4021B32CC8F7DCF669B2"><enum>(8)</enum><text>shall not be
directly used by any Federal, State, tribal, or local department or agency to
regulate the lawful activities of an entity, including activities relating to
obtaining, identifying, or otherwise possessing cyber threat information,
except that the procedures required to be developed and implemented under this
title shall not be considered regulations within the meaning of this
paragraph.</text>
</paragraph></subsection><subsection id="HB5DFEFCC5CE94558803B4C96DD19FB33"><enum>(d)</enum><header>Procedures
relating to information sharing with a cybersecurity center</header><text>Not
later than 60 days after the date of enactment of this Act, the heads of each
department or agency containing a cybersecurity center shall jointly develop,
promulgate, and submit to Congress procedures to ensure that cyber threat
information shared with or provided to—</text>
<paragraph id="H70E1A88AD7054679BE5074BC5A7B867D"><enum>(1)</enum><text>a
cybersecurity center under this section—</text>
<subparagraph id="H881BB1295BAC44D195911012EE799118"><enum>(A)</enum><text>may be submitted
to a cybersecurity center by an entity, to the greatest extent possible,
through a uniform, publicly available process or format that is easily
accessible on the Web site of such cybersecurity center, and that includes the
ability to provide relevant details about the cyber threat information and
written consent to any subsequent disclosures authorized by this
paragraph;</text>
</subparagraph><subparagraph id="HD9225EB01E8245C7B018E7089D6CF74F"><enum>(B)</enum><text>shall immediately
be further shared with each cybersecurity center in order to prevent,
investigate, or otherwise mitigate threats to information security across the
Federal Government;</text>
</subparagraph><subparagraph id="HFAFFBD62BE5E48589EA753EA7FD65CB8"><enum>(C)</enum><text>is handled by the
Federal Government in a reasonable manner, including consideration of the need
to protect the privacy and civil liberties of individuals through anonymization
or other appropriate methods, while fully accomplishing the objectives of this
title; and</text>
</subparagraph><subparagraph id="H971D66C82EDB4ABD979256E5A8DE5258"><enum>(D)</enum><text>except as provided
in this section, shall only be used, disclosed, or handled in accordance with
the provisions of subsection (c); and</text>
</subparagraph></paragraph><paragraph id="HAF72B05CEB754E14AD7D74CD235376E0"><enum>(2)</enum><text>a
Federal agency or department under subsection (b) is provided immediately to a
cybersecurity center in order to prevent, investigate, or otherwise mitigate
threats to information security across the Federal Government.</text>
</paragraph></subsection><subsection id="HAF84927BC13043E59E35BC3B82913EDE"><enum>(e)</enum><header>Information
shared between private entities</header>
<paragraph id="HD7A399C792A4435BAB73AA6B90D8BFE8"><enum>(1)</enum><header>In
general</header><text>A private entity sharing cyber threat information with
another private entity under this title may restrict the use or sharing of such
information by such other private entity.</text>
</paragraph><paragraph id="HCC9FF90B6EA3430CA294758270FFEE38"><enum>(2)</enum><header>Further
sharing</header><text>Cyber threat information shared by any private entity
with another private entity under this title—</text>
<subparagraph id="HB89FC944DA52408C8EBF94B6B49D7ABB"><enum>(A)</enum><text>shall only be
further shared in accordance with any restrictions placed on the sharing of
such information by the private entity authorizing such sharing, such as
appropriate anonymization of such information; and</text>
</subparagraph><subparagraph id="H0B366D144F29449D9250A67902D4D865"><enum>(B)</enum><text>may not be used by
any private entity to gain an unfair competitive advantage to the detriment of
the private entity authorizing the sharing of such information, except that the
conduct described in paragraph (3) shall not constitute unfair competitive
conduct.</text>
</subparagraph></paragraph><paragraph id="H0A4E15EA717142D7A9821FAC48E8AD6E"><enum>(3)</enum><header>Antitrust
exemption</header><text>The exchange or provision of cyber threat information
or assistance between 2 or more private entities under this title shall not be
considered a violation of any provision of antitrust laws if exchanged or
provided in order to assist with—</text>
<subparagraph id="HE5622C062CB341AAAD00E5CE06B7975E"><enum>(A)</enum><text>facilitating the
prevention, investigation, or mitigation of threats to information security;
or</text>
</subparagraph><subparagraph id="H2E34C7C3EF254D1AAA78EDD550D4BBC1"><enum>(B)</enum><text>communicating or
disclosing of cyber threat information to help prevent, investigate or
otherwise mitigate the effects of a threat to information security.</text>
</subparagraph></paragraph></subsection><subsection id="H62A21F5FD7DF4FBABC0863F2E6098432"><enum>(f)</enum><header>Federal
preemption</header>
<paragraph id="HD84B6036467F4472A259FF4DD61D3334"><enum>(1)</enum><header>In
general</header><text>This section supersedes any statute or other law of a
State or political subdivision of a State that restricts or otherwise expressly
regulates an activity authorized under this section.</text>
</paragraph><paragraph id="H2F4CAB6C458E4E33BF69DA71E53A51D7"><enum>(2)</enum><header>State law
enforcement</header><text>Nothing in this section shall be construed to
supercede any statute or other law of a State or political subdivision of a
State concerning the use of authorized law enforcement techniques.</text>
</paragraph><paragraph id="H8A918C8E00F94B16B5FAD6D30A132043"><enum>(3)</enum><header>Public
disclosure</header><text>No information shared with or provided to a State,
tribal, or local government or government agency pursuant to this section shall
be made publicly available pursuant to any State, tribal, or local law
requiring disclosure of information or records.</text>
</paragraph></subsection><subsection id="H84FB046AB6A847638AE0FC424CFC3980"><enum>(g)</enum><header>Civil and
criminal liability</header>
<paragraph id="HB2654352FC614B3695260982BB8AA0BF"><enum>(1)</enum><header>General
protections</header>
<subparagraph id="HBDEC12234A0D42E49D98461066F6BB35"><enum>(A)</enum><header>Private
entities</header><text>No cause of action shall lie or be maintained in any
court against any private entity for—</text>
<clause id="H561CBF570903419A8361A6D6B2F1DF94"><enum>(i)</enum><text>the
use of countermeasures and cybersecurity systems as authorized by this
title;</text>
</clause><clause id="H67D7870BD6154032A1AF1732AB931161"><enum>(ii)</enum><text>the
use, receipt, or disclosure of any cyber threat information as authorized by
this title; or</text>
</clause><clause id="H159D8F688CA247AD8E1A1EFEA54BE346"><enum>(iii)</enum><text>the subsequent
actions or inactions of any lawful recipient of cyber threat information
provided by such private entity.</text>
</clause></subparagraph><subparagraph id="HDCF279A1A5394D33BB2AB1DD14EC04EF"><enum>(B)</enum><header>Entities</header><text>No
cause of action shall lie or be maintained in any court against any entity
for—</text>
<clause id="H109039D5784D4C9CB1B762C80943B4F2"><enum>(i)</enum><text>the
use, receipt, or disclosure of any cyber threat information as authorized by
this title; or</text>
</clause><clause id="H30B3178BB3724D6AA7D28895B6F4696C"><enum>(ii)</enum><text>the
subsequent actions or inactions of any lawful recipient of cyber threat
information provided by such entity.</text>
</clause></subparagraph></paragraph><paragraph id="H2716C78DA4B44F7BB40E7D6003F7F300"><enum>(2)</enum><header>Construction</header><text>Nothing
in this subsection shall be construed as creating any immunity against, or
otherwise affecting, any action brought by the Federal Government, or any
agency or department thereof, to enforce any law, executive order, or procedure
governing the appropriate handling, disclosure, and use of classified
information.</text>
</paragraph></subsection><subsection id="HA9235167C90F4B10922635A7B5E3959E"><enum>(h)</enum><header>Otherwise lawful
disclosures</header><text>Nothing in this section shall be construed to limit
or prohibit otherwise lawful disclosures of communications, records, or other
information by a private entity to any other governmental or private entity not
covered under this section.</text>
</subsection><subsection id="HE9D11669194F4833859E3774024718A8"><enum>(i)</enum><header>Whistleblower
protection</header><text>Nothing in this Act shall be construed to preempt or
preclude any employee from exercising rights currently provided under any
whistleblower law, rule, or regulation.</text>
</subsection></section><section id="H5179DA04FD154F2F85B63FB7C93F14DF"><enum>103.</enum><header>Information
sharing by the Federal Government</header>
<subsection id="H858FB3A28ED847FF936CBAD3C6A2F262"><enum>(a)</enum><header>Classified
information</header>
<paragraph id="HF00998085B2F49A58343FD5C47E55515"><enum>(1)</enum><header>Procedures</header><text>Consistent
with the protection of intelligence sources and methods, and as otherwise
determined appropriate, the Director of National Intelligence and the Secretary
of Defense shall, in consultation with the heads of the appropriate Federal
departments or agencies, develop and promulgate procedures to facilitate and
promote—</text>
<subparagraph id="H4FC49627EC3847F99ED4573234D7CC01"><enum>(A)</enum><text>the immediate
sharing, through the cybersecurity centers, of classified cyber threat
information in the possession of the Federal Government with appropriately
cleared representatives of any appropriate entity; and</text>
</subparagraph><subparagraph id="H11D8B3AB00364816A2FB9DB0737566E8"><enum>(B)</enum><text display-inline="yes-display-inline">the declassification and immediate sharing,
through the cybersecurity centers, with any entity or, if appropriate, public
availability of cyber threat information in the possession of the Federal
Government.</text>
</subparagraph></paragraph><paragraph id="H73CE72232F8144DEAA4632FC651F3792"><enum>(2)</enum><header>Handling of
classified information</header><text>The procedures developed under paragraph
(1) shall ensure that each entity receiving classified cyber threat information
pursuant to this section has acknowledged in writing the ongoing obligation to
comply with all laws, executive orders, and procedures concerning the
appropriate handling, disclosure, or use of classified information.</text>
</paragraph></subsection><subsection id="HD6D935B825C34921BB2C845C16A05220"><enum>(b)</enum><header>Unclassified
cyber threat information</header><text display-inline="yes-display-inline">The
head of each department or agency containing a cybersecurity center shall
jointly develop and promulgate procedures that ensure that, consistent with the
provisions of this section, unclassified cyber threat information, including
sensitive but unclassified cyber information, in the possession of the Federal
Government—</text>
<paragraph id="H2BF1E9AC2DCE4AC59589C57CD9A6F7EA"><enum>(1)</enum><text>is shared in an
immediate and adequate manner with appropriate entities; and</text>
</paragraph><paragraph id="H5B51B2A844BA4B139297F9624F64A33F"><enum>(2)</enum><text>if appropriate, is
made publicly available.</text>
</paragraph></subsection><subsection id="HBDB33BA5A9144A10971F000A8216E92F"><enum>(c)</enum><header>Development of
procedures</header>
<paragraph id="H0240DB0F458D4B7CB6173937CD3E7FAB"><enum>(1)</enum><header>Existing
processes</header><text>The procedures developed under this section shall, to
the greatest extent possible, incorporate existing processes utilized by
sector-specific information sharing and analysis centers.</text>
</paragraph><paragraph id="H2F86C7241DF142BE9779F6A30910F4F8"><enum>(2)</enum><header>Coordination
with entities</header><text>In developing the procedures required under this
section, the Director of National Intelligence and the head of each department
or agency containing a cybersecurity center shall coordinate with appropriate
entities to ensure that protocols are implemented that will facilitate and
promote the sharing of cyber threat information by the Federal
Government.</text>
</paragraph></subsection><subsection id="H6D79863A0F694345B340470E97906A72"><enum>(d)</enum><header>Submission to
Congress</header><text>Not later than 60 days after the date of enactment of
this Act, the Director of National Intelligence, in coordination with the
appropriate head of a department or an agency containing a cybersecurity
center, shall submit the procedures required by this section to
Congress.</text>
</subsection></section><section id="HB37522DFE0E3418781F7C863CA70A733"><enum>104.</enum><header>Report on
implementation</header>
<subsection id="HF69F7E1230D34D55A4F7DA8D4611D7F1"><enum>(a)</enum><header>Content of
report</header><text>Not later than 1 year after the date of enactment of this
Act, and biennially thereafter, the heads of each department or agency
containing a cybersecurity center shall jointly submit, in coordination with
the privacy and civil liberties officials of such departments or agencies and
the Privacy and Civil Liberties Oversight Board, a detailed report to Congress
concerning the implementation of this title, including—</text>
<paragraph id="H5514577A9B714EF99C1BC9E1FA14F898"><enum>(1)</enum><text>an assessment of
the sufficiency of the procedures developed under section 103 of this Act in
ensuring that cyber threat information in the possession of the Federal
Government is provided in an immediate and adequate manner to appropriate
entities or, if appropriate, is made publicly available;</text>
</paragraph><paragraph id="H598B2F24478C471E8F405D4E3174E7C6"><enum>(2)</enum><text>an assessment of
whether information has been appropriately classified and an accounting of the
number of security clearances authorized by the Federal Government for purposes
of this title;</text>
</paragraph><paragraph id="H30F4607A18CE4FFE8C2B1B62E8DB9A26"><enum>(3)</enum><text>a
review of the type of cyber threat information shared with a cybersecurity
center under section 102 of this Act, including whether such information meets
the definition of cyber threat information under section 101, the degree to
which such information may impact the privacy and civil liberties of
individuals, and the adequacy of any steps taken to reduce such impact;</text>
</paragraph><paragraph id="H6E3094237009404E80013E33560FD78D"><enum>(4)</enum><text>a
review of actions taken by the Federal Government based on information provided
to a cybersecurity center under section 102 of this Act, including the
appropriateness of any subsequent use under section 102(c)(1)(A) of this
Act;</text>
</paragraph><paragraph id="H73783ED0C87443A08FD61E3C79A81C75"><enum>(5)</enum><text>a
description of any violations of the requirements of this title by the Federal
Government;</text>
</paragraph><paragraph id="H79384F72B5DE434B97B2F22F8F0EE10C"><enum>(6)</enum><text>with respect to an
entity providing electronic communication services, remote computing service,
or cybersecurity services to a Federal agency or department, a description of
any violations of the requirements of subsection (b) or (c) of section 102 of
this Act related to the performance of such services;</text>
</paragraph><paragraph id="H9B3330A1F7DC4A26AB6425F1F7FEDBB3"><enum>(7)</enum><text>a
classified list of entities that received classified information from the
Federal Government under section 103 of this Act and a description of any
indication that such information may not have been appropriately
handled;</text>
</paragraph><paragraph id="HCB53CF5DC31C45179B6A61DBF88BB42D"><enum>(8)</enum><text>a
summary of any breach of information security, if known, attributable to a
specific failure by the Federal Government to act on cyber threat information
in the possession of the Federal Government that resulted in substantial
economic harm or injury to a specific entity or the Federal Government;
and</text>
</paragraph><paragraph id="H6EC9CC572FCB4AF7B742268814644BF7"><enum>(9)</enum><text>any recommendation
for improvements or modifications to the authorities under this title.</text>
</paragraph></subsection><subsection id="H224372E36189485D89871B6C72EAF96C"><enum>(b)</enum><header>Form of
report</header><text>The report under subsection (a) shall be submitted in
unclassified form, but shall include a classified annex.</text>
</subsection></section><section id="HBF04589B943F4668B6365625B1854405"><enum>105.</enum><header>Inspector
General review</header>
<subsection id="HBD7F43E9A5E34D138AD8657272270E7A"><enum>(a)</enum><header>In
general</header><text>The Council of the Inspectors General on Integrity and
Efficiency may review compliance by the cybersecurity centers, and by any
Federal department or agency receiving cyber threat information from such
cybersecurity centers, with the procedures required under section 102.</text>
</subsection><subsection id="H2DC19E40CC53494E9A0A54B98C3CA64E"><enum>(b)</enum><header>Considerations</header><text>Each
review described in subsection (a) shall consider whether the Federal
Government has handled such cyber threat information in a reasonable manner,
including consideration of the need to protect the privacy and civil liberties
of individuals through anonymization or other appropriate methods, while fully
accomplishing the objectives of this title.</text>
</subsection><subsection id="H88F622854E1F410FA13C4960093038E1"><enum>(c)</enum><header>Submission to
congress</header><text>The Council shall provide the results of any review
conducted under this section to Congress no later than 30 days after the date
of completion of the review.</text>
</subsection></section><section id="HD1582CB76C074376AAA19857EE9B039A"><enum>106.</enum><header>Technical
amendments</header><text display-inline="no-display-inline">Section 552(b) of
title 5, United States Code, is amended—</text>
<paragraph id="H98082EE407AD45BCA9DC3AB3BBC4D333"><enum>(1)</enum><text display-inline="yes-display-inline">in paragraph (8), by striking
<quote>or</quote>;</text>
</paragraph><paragraph id="H618C4155235C49DCBB4C953B688F2F72"><enum>(2)</enum><text>in paragraph (9),
by striking <quote>wells.</quote> and inserting <quote>wells; or</quote>;
and</text>
</paragraph><paragraph id="H88B9D437CF4A4A898AAAF6215C540950"><enum>(3)</enum><text>by adding at the
end the following:</text>
<quoted-block display-inline="no-display-inline" id="H05D34F2CDD644CBFBC01A7FB283BF8A9" style="OLC">
<paragraph id="H4BA2A7BF2090423DB1FF0BBC4AE77949"><enum>(10)</enum><text>information
shared with or provided to a cybersecurity center under section 102 of title I
of the <short-title>Strengthening and Enhancing
Cybersecurity by Using Research, Education, Information, and Technology Act of
2012</short-title>.</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></section><section id="H0E714823DE9E48E6809FA8C1E2B5D0E6"><enum>107.</enum><header>Access to
classified information</header>
<subsection id="H3CAF8621C25147D09A30BC10197B2904"><enum>(a)</enum><header>Authorization
required</header><text>No person shall be provided with access to classified
information (as defined in section 6.1 of Executive Order 13526 (50 U.S.C. 435
note; relating to classified national security information)) relating to cyber
security threats or cyber security vulnerabilities under this title without the
appropriate security clearances.</text>
</subsection><subsection id="H02A9B10A176D43B3A98E5EEB60669DC1"><enum>(b)</enum><header>Security
clearances</header><text>The appropriate Federal agencies or departments shall,
consistent with applicable procedures and requirements, and if otherwise deemed
appropriate, assist an individual in timely obtaining an appropriate security
clearance where such individual has been determined to be eligible for such
clearance and has a need-to-know (as defined in section 6.1 of that Executive
Order) classified information to carry out this title.</text>
</subsection></section><enum>II</enum><header>Coordination of
Federal information security policy</header>
<section id="H005B561044EB483D9C84C82091C8FD8D" section-type="subsequent-section"><enum>201.</enum><header>Coordination of
Federal information security policy</header>
<subsection id="HA5473E769ACF4B069C1F53FD5CEDC1FF"><enum>(a)</enum><header>In
General</header><text display-inline="yes-display-inline">Chapter 35 of title
44, United States Code, is amended by striking subchapters II and III and
inserting the following:</text>
<quoted-block display-inline="no-display-inline" id="H10B7CB1BD8F84F98B6A60D58D9DE8099" style="USC">
<subchapter id="HD517FF8CC8B84D3EAE64F0443D573E08"><enum>II</enum><header>Information
Security</header>
<section id="H6C7745B207FA4DECB7010E1D922D973E" section-type="subsequent-section"><enum>3551.</enum><header>Purposes</header><text display-inline="no-display-inline">The purposes of this subchapter are—</text>
<paragraph id="HA21073A203234241A9ED6C2B66B35A12"><enum>(1)</enum><text display-inline="yes-display-inline">to provide a comprehensive framework for
ensuring the effectiveness of information security controls over information
resources that support Federal operations and assets;</text>
</paragraph><paragraph id="HA8E4D20595DA4BA299EC6D125C1C3C17"><enum>(2)</enum><text>to recognize the
highly networked nature of the current Federal computing environment and
provide effective government-wide management of policies, directives,
standards, and guidelines, as well as effective and nimble oversight of and
response to information security risks, including coordination of information
security efforts throughout the Federal civilian, national security, and law
enforcement communities;</text>
</paragraph><paragraph id="H78B2B17C85A44DA6BE017BC688CF4B2C"><enum>(3)</enum><text>to provide for
development and maintenance of controls required to protect agency information
and information systems and contribute to the overall improvement of agency
information security posture;</text>
</paragraph><paragraph id="H8928972292BF44C8AC95F9967EF2097D"><enum>(4)</enum><text>to provide for the
development of tools and methods to assess and respond to real-time situational
risk for Federal information system operations and assets; and</text>
</paragraph><paragraph id="HE4FE67A5AD76435396114B5DA0B690FB"><enum>(5)</enum><text>to provide a
mechanism for improving agency information security programs through continuous
monitoring of agency information systems and streamlined reporting requirements
rather than overly prescriptive manual reporting.</text>
</paragraph></section><section id="H831230EE6CCB4E7991885FE7872962CF"><enum>3552.</enum><header>Definitions</header><text display-inline="no-display-inline">In this subchapter:</text>
<paragraph id="H5406845273564CD08E9BA3B1803F83E7"><enum>(1)</enum><header>Adequate
security</header><text>The term <term>adequate security</term> means security
commensurate with the risk and magnitude of the harm resulting from the
unauthorized access to or loss, misuse, destruction, or modification of
information.</text>
</paragraph><paragraph id="H6F44C69E2C2F4FAFB260D56D2236053D"><enum>(2)</enum><header>Agency</header><text>The
term <term>agency</term> has the meaning given the term in section 3502 of
title 44.</text>
</paragraph><paragraph id="H534FC53957CD4AE8B02A1FD21BDDF20E"><enum>(3)</enum><header>Cybersecurity
center</header><text>The term <term>cybersecurity center</term> means the
Department of Defense Cyber Crime Center, the Intelligence Community Incident
Response Center, the United States Cyber Command Joint Operations Center, the
National Cyber Investigative Joint Task Force, the National Security
Agency/Central Security Service Threat Operations Center, the National
Cybersecurity and Communications Integration Center, and any successor
center.</text>
</paragraph><paragraph id="H7A2AFFE2EBE44A7982F7BFC3C397ECE3"><enum>(4)</enum><header>Cyber threat
information</header><text>The term <term>cyber threat information</term> means
information that may be indicative of or describes—</text>
<subparagraph id="HEC3F304791C84A7B8236AA720AF3A4DD"><enum>(A)</enum><text>a technical or
operation vulnerability or a cyber threat mitigation measure;</text>
</subparagraph><subparagraph id="H0BDC9A40A161429A9882BF7AF45C4591"><enum>(B)</enum><text>an action or
operation to mitigate a cyber threat;</text>
</subparagraph><subparagraph id="H2EEFE191C1BC4D70A5D9159BE5071BAF"><enum>(C)</enum><text>malicious
reconnaissance, including anomalous patterns of network activity that appear to
be transmitted for the purpose of gathering technical information related to a
cybersecurity threat;</text>
</subparagraph><subparagraph id="H608DD0110BCB456E85B3A7AFE7E837DA"><enum>(D)</enum><text>a method of
defeating a technical control;</text>
</subparagraph><subparagraph id="H89AC5FEED7884BA38E8446BE3C715D32"><enum>(E)</enum><text>a method of
defeating an operational control;</text>
</subparagraph><subparagraph id="HB64E9A497C6843FBAEB036605AF24D22"><enum>(F)</enum><text>network activity
or protocols known to be associated with a malicious cyber actor or that may
signify malicious intent;</text>
</subparagraph><subparagraph id="H193E09D9B52043E5A2EAB2C4D46686F1"><enum>(G)</enum><text>a method of
causing a user with legitimate access to an information system or information
that is stored on, processed by, or transiting an information system to
inadvertently enable the defeat of a technical or operational control;</text>
</subparagraph><subparagraph id="H22549861BA2A4DB695956AA3756B14A3"><enum>(H)</enum><text>any other
attribute of a cybersecurity threat or information that would foster
situational awareness of the United States security posture, if disclosure of
such attribute or information is not otherwise prohibited by law;</text>
</subparagraph><subparagraph id="H35A78AD088424690AFA6186B5FF2E92C"><enum>(I)</enum><text>the actual or
potential harm caused by a cyber incident, including information exfiltrated
when it is necessary in order to identify or describe a cybersecurity threat;
or</text>
</subparagraph><subparagraph id="H94D8BFCE64A34281BDEA63566EA1F196"><enum>(J)</enum><text>any combination
thereof.</text>
</subparagraph></paragraph><paragraph id="H012DF724102F467680C4C3278C3888D2"><enum>(5)</enum><header>Director</header><text>The
term <term>Director</term> means the Director of the Office of Management and
Budget unless otherwise specified.</text>
</paragraph><paragraph id="H1A5DB60186A04F218FA5B375A845C730"><enum>(6)</enum><header>Environment of
operation</header><text>The term <term>environment of operation</term> means
the information system and environment in which those systems operate,
including changing threats, vulnerabilities, technologies, and missions and
business practices.</text>
</paragraph><paragraph id="HC5CDC11D7881436FAE5CE3450E2669DF"><enum>(7)</enum><header>Federal
information system</header><text>The term <term>Federal information
system</term> means an information system used or operated by an executive
agency, by a contractor of an executive agency, or by another organization on
behalf of an executive agency.</text>
</paragraph><paragraph id="HAB68288CBBEE462F915DCF4FEFC23098"><enum>(8)</enum><header>Incident</header><text>The
term <term>incident</term> means an occurrence that—</text>
<subparagraph id="H108761CC3BFD4A8CABFDAF1AA41B3127"><enum>(A)</enum><text>actually or
imminently jeopardizes the integrity, confidentiality, or availability of an
information system or the information that system controls, processes, stores,
or transmits; or</text>
</subparagraph><subparagraph id="HA2BCF85785464497B26EC37AEF9BF178"><enum>(B)</enum><text>constitutes a
violation of law or an imminent threat of violation of a law, a security
policy, a security procedure, or an acceptable use policy.</text>
</subparagraph></paragraph><paragraph id="H98C99F694DF94E9E8C6DAB684CE45454"><enum>(9)</enum><header>Information
resources</header><text>The term <term>information resources</term> has the
meaning given the term in section 3502 of title 44.</text>
</paragraph><paragraph id="H3D6F773FA93D4DB4974D935102BF7B10"><enum>(10)</enum><header>Information
security</header><text>The term <term>information security</term> means
protecting information and information systems from disruption or unauthorized
access, use, disclosure, modification, or destruction in order to
provide—</text>
<subparagraph id="HC02EC38D1EB343B99A4CFF845C15CB03"><enum>(A)</enum><text>integrity, by
guarding against improper information modification or destruction, including by
ensuring information nonrepudiation and authenticity;</text>
</subparagraph><subparagraph id="H7D027648F489474896656831B931E464"><enum>(B)</enum><text>confidentiality,
by preserving authorized restrictions on access and disclosure, including means
for protecting personal privacy and proprietary information; or</text>
</subparagraph><subparagraph id="HB0CD2BFCCD334783BBFB83B4C6D89DED"><enum>(C)</enum><text>availability, by
ensuring timely and reliable access to and use of information.</text>
</subparagraph></paragraph><paragraph id="HD5CD93ABB4204E7691AE8110D8672176"><enum>(11)</enum><header>Information
system</header><text>The term <term>information system</term> has the meaning
given the term in section 3502 of title 44.</text>
</paragraph><paragraph id="HC6CFBA4F14FB408193FAC547D3B0D4B5"><enum>(12)</enum><header>Information
technology</header><text>The term <term>information technology</term> has the
meaning given the term in section 11101 of title 40.</text>
</paragraph><paragraph id="H98BCE34CDF41476FA2E04BB30C436DD0"><enum>(13)</enum><header>Malicious
reconnaissance</header><text>The term <term>malicious reconnaissance</term>
means a method for actively probing or passively monitoring an information
system for the purpose of discerning technical vulnerabilities of the
information system, if such method is associated with a known or suspected
cybersecurity threat.</text>
</paragraph><paragraph id="HE18E180BCC8E4C90A76DB0920A759345"><enum>(14)</enum><header>National
security system</header>
<subparagraph id="H0F67946A45C741AA984E85557F336F39"><enum>(A)</enum><header>In
general</header><text>The term <term>national security system</term> means any
information system (including any telecommunications system) used or operated
by an agency or by a contractor of an agency, or other organization on behalf
of an agency—</text>
<clause id="H1B262D8570BC4BED8858606513D2F618"><enum>(i)</enum><text>the function,
operation, or use of which—</text>
<subclause id="H0F24F412071243E3978F6E4F4293FE8F"><enum>(I)</enum><text>involves
intelligence activities;</text>
</subclause><subclause id="H6E4070FF4C3B427FBF924B7F7E05479B"><enum>(II)</enum><text>involves
cryptologic activities related to national security;</text>
</subclause><subclause id="H115963EF442340F9821F0215D27F5479"><enum>(III)</enum><text>involves command
and control of military forces;</text>
</subclause><subclause id="HE98A9048E9DC4A188A028EAFF2AE2CDD"><enum>(IV)</enum><text>involves
equipment that is an integral part of a weapon or weapons system; or</text>
</subclause><subclause id="H72F931213A8543FC8759BCC644843564"><enum>(V)</enum><text>subject to
subparagraph (B), is critical to the direct fulfillment of military or
intelligence missions; or</text>
</subclause></clause><clause id="H16EF90D209CA4FD09924148F3D543DC4"><enum>(ii)</enum><text>is protected at
all times by procedures established for information that have been specifically
authorized under criteria established by an Executive Order or an Act of
Congress to be kept classified in the interest of national defense or foreign
policy.</text>
</clause></subparagraph><subparagraph id="HBA3977BFE35E4A6491CFCC94D722C29A"><enum>(B)</enum><header>Limitation</header><text>Subparagraph
(A)(i)(V) does not include a system that is to be used for routine
administrative and business applications (including payroll, finance,
logistics, and personnel management applications).</text>
</subparagraph></paragraph><paragraph id="HB4ABE3B3AD684EAC87AD845EF18C3ED6"><enum>(15)</enum><header>Operational
control</header><text>The term <term>operational control</term> means a
security control for an information system that primarily is implemented and
executed by people.</text>
</paragraph><paragraph id="H4A577E37272B465AA37C8261BC4B4E35"><enum>(16)</enum><header>Person</header><text>The
term <quote>person</quote> has the meaning given the term in section 3502 of
title 44.</text>
</paragraph><paragraph id="H0A30D03D77034602913B4D361ED10A9E"><enum>(17)</enum><header>Secretary</header><text>The
term <term>Secretary</term> means the Secretary of Commerce unless otherwise
specified.</text>
</paragraph><paragraph id="H7D601042E8D940AD9936323EA3DCAF08"><enum>(18)</enum><header>Security
control</header><text>The term <term>security control</term> means the
management, operational, and technical controls, including safeguards or
countermeasures, prescribed for an information system to protect the
confidentiality, integrity, and availability of the system and its
information.</text>
</paragraph><paragraph id="H1191ADDE1A04463D8E6B7C0EF3F0E38F"><enum>(19)</enum><header>Technical
control</header><text>The term <term>technical control</term> means a hardware
or software restriction on, or audit of, access or use of an information system
or information that is stored on, processed by, or transiting an information
system that is intended to ensure the confidentiality, integrity, or
availability of that system.</text>
</paragraph></section><section id="HA746A4918FCC4F06879EC90F4CCD0478"><enum>3553.</enum><header>Federal
information security authority and coordination</header>
<subsection id="H43AEB446C91A496DAD0BF6B4EAC10E5A"><enum>(a)</enum><header>In
general</header><text>The Secretary, in consultation with the Secretary of
Homeland Security, shall—</text>
<paragraph id="H9CEB096A78FC47D08503EE2214A75049"><enum>(1)</enum><text>issue compulsory
and binding policies and directives governing agency information security
operations, and require implementation of such policies and directives,
including—</text>
<subparagraph id="HBE714E623AE34515AF315F7057C906AC"><enum>(A)</enum><text>policies and
directives consistent with the standards and guidelines promulgated under
section 11331 of title 40 to identify and provide information security
protections prioritized and commensurate with the risk and impact resulting
from the unauthorized access, use, disclosure, disruption, modification, or
destruction of—</text>
<clause id="H4433040612484726A6C6B1D74ECD5F1A"><enum>(i)</enum><text>information
collected or maintained by or on behalf of an agency; or</text>
</clause><clause id="H510C4085DBD440AE82A14AB804D1C595"><enum>(ii)</enum><text>information
systems used or operated by an agency or by a contractor of an agency or other
organization on behalf of an agency;</text>
</clause></subparagraph><subparagraph id="H7A2AD27BA40C43CAB9E76B4752757193"><enum>(B)</enum><text>minimum
operational requirements for Federal Government to protect agency information
systems and provide common situational awareness across all agency information
systems;</text>
</subparagraph><subparagraph id="H4DD46704C0744CE5981A14E71AA57CCE"><enum>(C)</enum><text>reporting
requirements, consistent with relevant law, regarding information security
incidents and cyber threat information;</text>
</subparagraph><subparagraph id="H954829EBB28744EC8FB07F8AF68922CF"><enum>(D)</enum><text>requirements for
agencywide information security programs;</text>
</subparagraph><subparagraph id="H8754529E4D594A419A87E00482C3367D"><enum>(E)</enum><text>performance
requirements and metrics for the security of agency information systems;</text>
</subparagraph><subparagraph id="H843B59F770FC4273B63BE57E43DA3EAA"><enum>(F)</enum><text>training
requirements to ensure that agencies are able to fully and timely comply with
the policies and directives issued by the Secretary under this
subchapter;</text>
</subparagraph><subparagraph id="HE9734395A25748379982B0EF6B9D4C93"><enum>(G)</enum><text>training
requirements regarding privacy, civil rights, and civil liberties, and
information oversight for agency information security personnel;</text>
</subparagraph><subparagraph id="H173EDC3C42924B93A65D8A1B59BAEF24"><enum>(H)</enum><text>requirements for
the annual reports to the Secretary under section 3554(d);</text>
</subparagraph><subparagraph id="H14F946EC20F44C2E9812244F1D97F02A"><enum>(I)</enum><text>any other
information security operations or information security requirements as
determined by the Secretary in coordination with relevant agency heads;
and</text>
</subparagraph><subparagraph id="H54357A83D1F242D591BCE92C1215E9A2"><enum>(J)</enum><text>coordinating the
development of standards and guidelines under section 20 of the National
Institute of Standards and Technology Act (15 U.S.C. 278g–3) with agencies and
offices operating or exercising control of national security systems (including
the National Security Agency) to assure, to the maximum extent feasible, that
such standards and guidelines are complementary with standards and guidelines
developed for national security systems;</text>
</subparagraph></paragraph><paragraph id="H320822F5EE084BABBA4EFA62048DE491"><enum>(2)</enum><text>review the
agencywide information security programs under section 3554; and</text>
</paragraph><paragraph id="HABB29DD667F243DD947F73A05887B28D"><enum>(3)</enum><text>designate an
individual or an entity at each cybersecurity center, among other
responsibilities—</text>
<subparagraph id="HB5940C25CC194EA29E76EAB86349B3A7"><enum>(A)</enum><text>to receive reports
and information about information security incidents, cyber threat information,
and deterioration of security control affecting agency information systems;
and</text>
</subparagraph><subparagraph id="H4D542B10262C419B99212D4CBD5BB09D"><enum>(B)</enum><text>to act on or share
the information under subparagraph (A) in accordance with this
subchapter.</text>
</subparagraph></paragraph></subsection><subsection id="HE7A311FEC9334E6B913C51F4BCF2F9FB"><enum>(b)</enum><header>Considerations</header><text>When
issuing policies and directives under subsection (a), the Secretary shall
consider any applicable standards or guidelines developed by the National
Institute of Standards and Technology under section 11331 of title 40.</text>
</subsection><subsection id="H57D8B4BF6C3C40B3AD7D7F2E8B3E912A"><enum>(c)</enum><header>Limitation of
authority</header><text>The authorities of the Secretary under this section
shall not apply to national security systems. Information security policies,
directives, standards and guidelines for national security systems shall be
overseen as directed by the President and, in accordance with that direction,
carried out under the authority of the heads of agencies that operate or
exercise authority over such national security systems.</text>
</subsection><subsection id="H4CF44077290D41E99F20B57F584D290F"><enum>(d)</enum><header>Statutory
construction</header><text>Nothing in this subchapter shall be construed to
alter or amend any law regarding the authority of any head of an agency over
such agency.</text>
</subsection></section><section id="H1D507FEECFF94E8CA8F551DBE6BD00A7"><enum>3554.</enum><header>Agency
responsibilities</header>
<subsection id="HD54F4BAC4C6E4324AD13F19CC82E4263"><enum>(a)</enum><header>In
general</header><text>The head of each agency shall—</text>
<paragraph id="H57EA8E5D791E4FA59FD9E855DAC4B605"><enum>(1)</enum><text>be responsible
for—</text>
<subparagraph id="HA529E22ED8C144ABBF1946260E45F612"><enum>(A)</enum><text>complying with the
policies and directives issued under section 3553;</text>
</subparagraph><subparagraph id="H369A5F88A56E43D1A9756C6AA6FAEA4C"><enum>(B)</enum><text>providing
information security protections commensurate with the risk resulting from
unauthorized access, use, disclosure, disruption, modification, or destruction
of—</text>
<clause id="H3B506C52D97F4B19A82ACB5DAE11FAC0"><enum>(i)</enum><text>information
collected or maintained by the agency or by a contractor of an agency or other
organization on behalf of an agency; and</text>
</clause><clause id="HD065B7712BCA43EBA3879811713B5561"><enum>(ii)</enum><text>information
systems used or operated by an agency or by a contractor of an agency or other
organization on behalf of an agency;</text>
</clause></subparagraph><subparagraph id="H0E1D9828B3A34CD0AB4975B4F83875B6"><enum>(C)</enum><text>complying with the
requirements of this subchapter, including—</text>
<clause id="H8EBA47BF61504F46BAEE7CCF4BA78C98"><enum>(i)</enum><text>information
security standards and guidelines promulgated under section 11331 of title
40;</text>
</clause><clause id="H6395C8D0FC76409A86BB9AEA173B48DC"><enum>(ii)</enum><text>for any national
security systems operated or controlled by that agency, information security
policies, directives, standards and guidelines issued as directed by the
President; and</text>
</clause><clause id="H032FD1ED0EE2498D86EFF9298F918B46"><enum>(iii)</enum><text>for any
non-national security systems operated or controlled by that agency,
information security policies, directives, standards and guidelines issued
under section 3553;</text>
</clause></subparagraph><subparagraph id="HC4433D10F5CC4468BC097A66464FB880"><enum>(D)</enum><text>ensuring that
information security management processes are integrated with agency strategic
and operational planning processes;</text>
</subparagraph><subparagraph id="H613D325A3EAB41D1962CB8D27ADC1D5F"><enum>(E)</enum><text>reporting and
sharing, for an agency operating or exercising control of a national security
system, information about information security incidents, cyber threat
information, and deterioration of security controls to the individual or entity
designated at each cybersecurity center and to other appropriate entities
consistent with policies and directives for national security systems issued as
directed by the President; and</text>
</subparagraph><subparagraph id="HD4AAF9ABCA9640AD889CAE7054F17DC2"><enum>(F)</enum><text>reporting and
sharing, for those agencies operating or exercising control of non-national
security systems, information about information security incidents, cyber
threat information, and deterioration of security controls to the individual or
entity designated at each cybersecurity center and to other appropriate
entities consistent with policies and directives for non-national security
systems as prescribed under section 3553(a); including information to assist
the Secretary of Homeland Security with carrying out the ongoing security
analysis under section 3555;</text>
</subparagraph></paragraph><paragraph id="HD051CC29C14E4351812257302580379C"><enum>(2)</enum><text>ensure that each
senior agency official provides information security for the information and
information systems that support the operations and assets under the senior
agency official's control, including by—</text>
<subparagraph id="HE643DD85AF7F471F8CA03708E036F647"><enum>(A)</enum><text>assessing the risk
and impact that could result from the unauthorized access, use, disclosure,
disruption, modification, or destruction of such information or information
systems;</text>
</subparagraph><subparagraph id="HAC05029691914D40950599355192D6AF"><enum>(B)</enum><text>determining the
level of information security appropriate to protect such information and
information systems in accordance with policies and directives issued under
section 3553(a), and standards and guidelines promulgated under section 11331
of title 40 for information security classifications and related
requirements;</text>
</subparagraph><subparagraph id="H39F2A69B7733438EBD831FC80E1AE490"><enum>(C)</enum><text>implementing
policies, procedures, and capabilities to reduce risks to an acceptable level
in a cost-effective manner;</text>
</subparagraph><subparagraph id="H92E79A2AEC9B4EB39F8AF2E943F62D66"><enum>(D)</enum><text>actively
monitoring the effective implementation of information security controls and
techniques; and</text>
</subparagraph><subparagraph id="HC9DFCEA83EE5477CB6B18E37C32359BF"><enum>(E)</enum><text>reporting
information about information security incidents, cyber threat information, and
deterioration of security controls in a timely and adequate manner to the
entity designated under section 3553(a)(3) in accordance with paragraph
(1);</text>
</subparagraph></paragraph><paragraph id="HC189A0E8AE6040AA9E8877BDBCE6C76E"><enum>(3)</enum><text>assess and
maintain the resiliency of information technology systems critical to agency
mission and operations;</text>
</paragraph><paragraph id="H28962A353C6746EF9EA9A962C2FD27BE"><enum>(4)</enum><text>designate the
agency Inspector General (or an independent entity selected in consultation
with the Director and the Council of Inspectors General on Integrity and
Efficiency if the agency does not have an Inspector General) to conduct the
annual independent evaluation required under section 3556, and allow the agency
Inspector General to contract with an independent entity to perform such
evaluation;</text>
</paragraph><paragraph id="HA815DD3FC2E141DBA96E2228DC886CF2"><enum>(5)</enum><text>delegate to the
Chief Information Officer or equivalent (or to a senior agency official who
reports to the Chief Information Officer or equivalent)—</text>
<subparagraph id="H9CD64F30E8AF44B9B19C287CA0218A3F"><enum>(A)</enum><text>the authority and
primary responsibility to implement an agencywide information security program;
and</text>
</subparagraph><subparagraph id="HA1FA797487A04E4E90A84DF01981F4AC"><enum>(B)</enum><text>the authority to
provide information security for the information collected and maintained by
the agency (or by a contractor, other agency, or other source on behalf of the
agency) and for the information systems that support the operations, assets,
and mission of the agency (including any information system provided or managed
by a contractor, other agency, or other source on behalf of the agency);</text>
</subparagraph></paragraph><paragraph id="HE6C15C1789A449C8A0E8FA1D352C1A3C"><enum>(6)</enum><text>delegate to the
appropriate agency official (who is responsible for a particular agency system
or subsystem) the responsibility to ensure and enforce compliance with all
requirements of the agency’s agencywide information security program in
coordination with the Chief Information Officer or equivalent (or the senior
agency official who reports to the Chief Information Officer or equivalent)
under paragraph (5);</text>
</paragraph><paragraph id="H2C942DC4020F405DB1BA68AF9664A469"><enum>(7)</enum><text>ensure that an
agency has trained personnel who have obtained any necessary security
clearances to permit them to assist the agency in complying with this
subchapter;</text>
</paragraph><paragraph id="H5B5B4F4162DE4DBDB63749EB495B689C"><enum>(8)</enum><text>ensure that the
Chief Information Officer or equivalent (or the senior agency official who
reports to the Chief Information Officer or equivalent) under paragraph (5), in
coordination with other senior agency officials, reports to the agency head on
the effectiveness of the agencywide information security program, including the
progress of any remedial actions; and</text>
</paragraph><paragraph id="H6502A4776037428F860EE54899A6A246"><enum>(9)</enum><text>ensure that the
Chief Information Officer or equivalent (or the senior agency official who
reports to the Chief Information Officer or equivalent) under paragraph (5) has
the necessary qualifications to administer the functions described in this
subchapter and has information security duties as a primary duty of that
official.</text>
</paragraph></subsection><subsection id="H04E8E66FFC814CC499D2EF443852A42E"><enum>(b)</enum><header>Chief
Information Officers</header><text>Each Chief Information Officer or equivalent
(or the senior agency official who reports to the Chief Information Officer or
equivalent) under subsection (a)(5) shall—</text>
<paragraph id="HB1A2BE86A2E64DD3B5DD3883130707E1"><enum>(1)</enum><text>establish and
maintain an enterprise security operations capability that on a continuous
basis—</text>
<subparagraph id="HD8CDB4CDB8C44D00A014C3E972489907"><enum>(A)</enum><text>detects, reports,
contains, mitigates, and responds to information security incidents that impair
adequate security of the agency’s information or information system in a timely
manner and in accordance with the policies and directives under section 3553;
and</text>
</subparagraph><subparagraph id="HE52A90619C6E49B381B1627CDDED044C"><enum>(B)</enum><text>reports any
information security incident under subparagraph (A) to the entity designated
under section 3555;</text>
</subparagraph></paragraph><paragraph id="H2A251321215A4A80B35CA91601AFDC85"><enum>(2)</enum><text>develop, maintain,
and oversee an agencywide information security program;</text>
</paragraph><paragraph id="HCC88596B2AFE4EC3B066216D2E4A9367"><enum>(3)</enum><text>develop, maintain,
and oversee information security policies, procedures, and control techniques
to address applicable requirements, including requirements under section 3553
of this title and section 11331 of title 40; and</text>
</paragraph><paragraph id="H0E2AE5830FEB4CCCA01321FEF0D64B38"><enum>(4)</enum><text>train and oversee
the agency personnel who have significant responsibility for information
security with respect to that responsibility.</text>
</paragraph></subsection><subsection id="H5D80F3F68DCC46759EA83B7E89DCAA40"><enum>(c)</enum><header>Agencywide
information security programs</header>
<paragraph id="H4225355B55484951B9C471E6BFD2EF63"><enum>(1)</enum><header>In
general</header><text>Each agencywide information security program under
subsection (b)(2) shall include—</text>
<subparagraph id="HA328C4DF05DF48798902A9778E45E1EC"><enum>(A)</enum><text>security
engineering throughout the development and acquisition lifecycle;</text>
</subparagraph><subparagraph id="H5B79AE55513640D4A602F7108E0909DC"><enum>(B)</enum><text>security testing
commensurate with risk and impact;</text>
</subparagraph><subparagraph id="HDA7507FEC54F4896A2C59DDF6679DB95"><enum>(C)</enum><text>mitigation of
deterioration of security controls commensurate with risk and impact;</text>
</subparagraph><subparagraph id="H02D84317629B4162AFB3B02128196999"><enum>(D)</enum><text>risk-based
continuous monitoring of the operational status and security of agency
information systems to enable evaluation of the effectiveness of and compliance
with information security policies, procedures, and practices, including a
relevant and appropriate selection of security controls of information systems
identified in the inventory under section 3505(c);</text>
</subparagraph><subparagraph id="H1F32291E5A7E412EADABD0107A0E8F88"><enum>(E)</enum><text>operation of
appropriate technical capabilities in order to detect, mitigate, report, and
respond to information security incidents, cyber threat information, and
deterioration of security controls in a manner that is consistent with the
policies and directives under section 3553, including—</text>
<clause id="HCF93EB836B394C1D8684B9532D9F6044"><enum>(i)</enum><text>mitigating risks
associated with such information security incidents;</text>
</clause><clause id="H9DE755DCC4194E04B76CFFCC5B5781B6"><enum>(ii)</enum><text>notifying and
consulting with the entity designated under section 3555; and</text>
</clause><clause id="H1EC8F47D291D4FF5B5B0FF0E16E8DB2F"><enum>(iii)</enum><text>notifying and
consulting with, as appropriate—</text>
<subclause id="HC182589BF5C0456CB4CE6B35C08A1FAE"><enum>(I)</enum><text>law enforcement
and the relevant Office of the Inspector General; and</text>
</subclause><subclause id="HC937D58824DE49B39F7F09EA157380AB"><enum>(II)</enum><text>any other entity,
in accordance with law and as directed by the President;</text>
</subclause></clause></subparagraph><subparagraph id="HDEF768AC9D7142F2BB8018B6A71EDB3E"><enum>(F)</enum><text>a process to
ensure that remedial action is taken to address any deficiencies in the
information security policies, procedures, and practices of the agency;
and</text>
</subparagraph><subparagraph id="H4152220D029F448CB9967E76C5802975"><enum>(G)</enum><text>a plan and
procedures to ensure the continuity of operations for information systems that
support the operations and assets of the agency.</text>
</subparagraph></paragraph><paragraph id="HAD1C6B0DD804426A8569AF515E4A0099"><enum>(2)</enum><header>Risk management
strategies</header><text>Each agencywide information security program under
subsection (b)(2) shall include the development and maintenance of a risk
management strategy for information security. The risk management strategy
shall include—</text>
<subparagraph id="HD08ADBA425044AB099EB682C231D601B"><enum>(A)</enum><text>consideration of
information security incidents, cyber threat information, and deterioration of
security controls; and</text>
</subparagraph><subparagraph id="H9A53C1C769E24B899C5FAA1187A76F64"><enum>(B)</enum><text>consideration of
the consequences that could result from the unauthorized access, use,
disclosure, disruption, modification, or destruction of information and
information systems that support the operations and assets of the agency,
including any information system provided or managed by a contractor, other
agency, or other source on behalf of the agency.</text>
</subparagraph></paragraph><paragraph id="HB4F21D8B3F7B4AB8A38BF01C0977FBA0"><enum>(3)</enum><header>Policies and
procedures</header><text>Each agencywide information security program under
subsection (b)(2) shall include policies and procedures that—</text>
<subparagraph id="H45924F36029143DE969388B7E1FED40B"><enum>(A)</enum><text>are based on the
risk management strategy under paragraph (2);</text>
</subparagraph><subparagraph id="H5E3EADE26A2345359F086BBAEF235D73"><enum>(B)</enum><text>reduce information
security risks to an acceptable level in a cost-effective manner;</text>
</subparagraph><subparagraph id="H8D706528D09749D4A5E46E9E466F2EE5"><enum>(C)</enum><text>ensure that
cost-effective and adequate information security is addressed throughout the
life cycle of each agency information system; and</text>
</subparagraph><subparagraph id="H173DA0A0E5CF403EA6F36B847313478D"><enum>(D)</enum><text>ensure compliance
with—</text>
<clause id="HBD962134BAAB4224B7A2B364CAC137D6"><enum>(i)</enum><text>this subchapter;
and</text>
</clause><clause id="H72EB9765D2434CA69337ED24002EBBCD"><enum>(ii)</enum><text>any other
applicable requirements.</text>
</clause></subparagraph></paragraph><paragraph id="H0C6822B178CC43DA90B80647252EA668"><enum>(4)</enum><header>Training
requirements</header><text>Each agencywide information security program under
subsection (b)(2) shall include information security, privacy, civil rights,
civil liberties, and information oversight training that meets any applicable
requirements under section 3553. The training shall inform each information
security personnel that has access to agency information systems (including
contractors and other users of information systems that support the operations
and assets of the agency) of—</text>
<subparagraph id="HBBA082E062C6490898497F46F08335DC"><enum>(A)</enum><text>the information
security risks associated with the information security personnel's activities;
and</text>
</subparagraph><subparagraph id="H5254928F78FC4AE98EF9BEEACEDF2BDC"><enum>(B)</enum><text>the individual's
responsibility to comply with the agency policies and procedures that reduce
the risks under subparagraph (A).</text>
</subparagraph></paragraph></subsection><subsection id="HF76717B128BF4A3490E14227BFBC8380"><enum>(d)</enum><header>Annual
report</header><text>Each agency shall submit a report annually to the
Secretary of Homeland Security on its agencywide information security program
and information systems.</text>
</subsection></section><section id="H991DF9D9AC0047BEBB437C6EDEF0C7C8"><enum>3555.</enum><header>Multiagency
ongoing threat assessment</header>
<subsection id="H7BAF1DEF48C94455A8C93C1EC4F9D877"><enum>(a)</enum><header>Purpose</header><text>The
purpose of this section is to provide a framework for each agency to provide to
the designee of the Secretary of Homeland Security under subsection (b)—</text>
<paragraph id="HD213E7907B8C418691D806126B968EF7"><enum>(1)</enum><text>timely and
actionable cyber threat information; and</text>
</paragraph><paragraph id="H563DDB3CBE4B484AA4BF4C70D45EFFD3"><enum>(2)</enum><text>information on the
environment of operation of an agency information system.</text>
</paragraph></subsection><subsection id="HCEC6FAE1E30B4D64B0286798304E50D0"><enum>(b)</enum><header>Designee</header><text>The
Secretary of Homeland Security shall designate an entity within the Department
of Homeland Security—</text>
<paragraph id="H65DB57B29D0F47EF831DDE494A0B269C"><enum>(1)</enum><text>to conduct ongoing
security analysis concerning agency information systems—</text>
<subparagraph id="H13AF56BCA57E4918B1DBDA2A992B3289"><enum>(A)</enum><text>based on cyber
threat information;</text>
</subparagraph><subparagraph id="H103E99EF076F4593979E6D320AA3A5BE"><enum>(B)</enum><text>based on agency
information system and environment of operation changes, including—</text>
<clause id="HD964BD6542E94EB980320E20C02CFD60"><enum>(i)</enum><text>an
ongoing evaluation of the information system security controls; and</text>
</clause><clause id="H2EC1CB8C429F41B48581A0C1B802FACE"><enum>(ii)</enum><text>the security
state, risk level, and environment of operation of an agency information
system, including—</text>
<subclause id="H4267E43ACFD445FD8CDB25EC61E2301A"><enum>(I)</enum><text>a change in risk
level due to a new cyber threat;</text>
</subclause><subclause id="H9E6A8FC3B89A4B73B2E8CA10F5AF4278"><enum>(II)</enum><text>a change
resulting from a new technology;</text>
</subclause><subclause id="H6D13D86E53F441739897F1CDE126CB3D"><enum>(III)</enum><text>a change
resulting from the agency's mission; and</text>
</subclause><subclause id="HF9B10ABB37BC488284C4DF6C07A046A0"><enum>(IV)</enum><text>a change
resulting from the business practice; and</text>
</subclause></clause></subparagraph><subparagraph id="HF15C8760342B429CAA5C8FA70C235884"><enum>(C)</enum><text>using automated
processes to the maximum extent possible—</text>
<clause id="H365AB40A7117439ABBAEDEFA7F3034D4"><enum>(i)</enum><text>to
increase information system security;</text>
</clause><clause id="H30534AD698CA40F191064E4C034CC241"><enum>(ii)</enum><text>to reduce
paper-based reporting requirements; and</text>
</clause><clause id="HA721362A70ED46AFBAC173C1D8B9DAF0"><enum>(iii)</enum><text>to maintain
timely and actionable knowledge of the state of the information system
security.</text>
</clause></subparagraph></paragraph><paragraph id="H1A897ACDF1814505B139C07F7AF62F88"><enum>(2)</enum><header>Standards</header><text>The
National Institute of Standards and Technology may promulgate standards, in
coordination with the Secretary of Homeland Security, to assist an agency with
its duties under this section.</text>
</paragraph><paragraph id="HBC929D01080749A3BC561C37ED72EC94"><enum>(3)</enum><header>Compliance</header><text>The
head of each appropriate agency shall be responsible for ensuring compliance
with this section. The Secretary of Homeland Security, in consultation with the
head of each appropriate agency, shall—</text>
<subparagraph id="HF5890F2CF7584E3A9BBCFB2454E6B2E6"><enum>(A)</enum><text>monitor compliance
under this section;</text>
</subparagraph><subparagraph id="H04F0D422349347F68440C324A48A93F7"><enum>(B)</enum><text>develop a timeline
for each agency—</text>
<clause id="HD027140867EE4CE9B90069AB112D32D4"><enum>(i)</enum><text>to
adopt any technology, system, or method that facilitates continuous monitoring
of an agency information system; and</text>
</clause><clause id="H0B2600B2E3AC4B889E7281B971597BD6"><enum>(ii)</enum><text>to adopt any
technology, system, or method that satisfies a requirement under this
section.</text>
</clause></subparagraph></paragraph><paragraph id="HB821D52E8FB04C65A28AC23C242A03D1"><enum>(4)</enum><header>Limitation of
Authority</header><text>The authorities of the Secretary of Homeland Security
under this section shall not apply to national security systems.</text>
</paragraph><paragraph id="H55089A91B6E54065B5DB221989058098"><enum>(5)</enum><header>Report</header><text>Not
later than 6 months after the date of enactment of the
<short-title>Strengthening and Enhancing Cybersecurity by
Using Research, Education, Information, and Technology Act of
2012</short-title>, the Secretary of Homeland Security shall report to Congress
each agency's status toward implementing this section.</text>
</paragraph></subsection></section><section id="HFB4EED2A2C44490AA68C3F529E3907BE"><enum>3556.</enum><header>Independent
evaluations</header>
<subsection commented="no" id="HBCB33E58FE9349D98730A113020D1C87"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">The Council of
Inspectors General on Integrity and Efficiency, in consultation with the
Director and the Secretary of Homeland Security, the Secretary of Commerce, and
the Secretary of Defense, shall issue and maintain criteria for the timely,
cost-effective, risk-based, and independent evaluation of each agencywide
information security program (and practices) to determine the effectiveness of
the agencywide information security program (and practices). The criteria shall
include measures to assess any conflicts of interest in the performance of the
evaluation and whether the agencywide information security program includes
appropriate safeguards against disclosure of information where such disclosure
may adversely affect information security.</text>
</subsection><subsection commented="no" id="H7662D2C3CBCB4E288C5C9875C291490E"><enum>(b)</enum><header>Annual
independent evaluations</header><text display-inline="yes-display-inline">Each
agency shall perform an annual independent evaluation of its agencywide
information security program (and practices) in accordance with the criteria
under subsection (a).</text>
</subsection><subsection commented="no" id="HDB1870DA16CC4B61AE83479D07A8E734"><enum>(c)</enum><header>Distribution of
reports</header><text display-inline="yes-display-inline">Not later than 30
days after receiving an independent evaluation under subsection (b), each
agency head shall transmit a copy of the independent evaluation to the
Secretary of Homeland Security, the Secretary of Commerce, and the Secretary of
Defense.</text>
</subsection><subsection commented="no" id="H8822014CFD954CFBBDE87E5EF5B66D76"><enum>(d)</enum><header>National
security systems</header><text display-inline="yes-display-inline">Evaluations
involving national security systems shall be conducted as directed by
President.</text>
</subsection></section><section commented="no" id="H451208FD036C476ABC10BB9E93994108"><enum>3557.</enum><header>National
security systems.</header><text display-inline="no-display-inline">The head of
each agency operating or exercising control of a national security system shall
be responsible for ensuring that the agency—</text>
<paragraph commented="no" id="H84014297F66740CFAEA01664B5893020"><enum>(1)</enum><text display-inline="yes-display-inline">provides information security protections
commensurate with the risk and magnitude of the harm resulting from the
unauthorized access, use, disclosure, disruption, modification, or destruction
of the information contained in such system; and</text>
</paragraph><paragraph commented="no" id="H5CCC1AEEAC5C476D943AFCDBFC1AC778"><enum>(2)</enum><text display-inline="yes-display-inline">implements information security policies
and practices as required by standards and guidelines for national security
systems, issued in accordance with law and as directed by the
President.</text>
</paragraph></section></subchapter><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H24F25DEC7C3A407E83A425723D3D7209"><enum>(b)</enum><header>Savings
Provisions</header>
<paragraph id="HF2E56816805F424D8F3E3AAAB18E29C9"><enum>(1)</enum><header>Policy and
compliance guidance</header><text display-inline="yes-display-inline">Policy
and compliance guidance issued by the Director before the date of enactment of
this Act under section 3543(a)(1) of title 44, United States Code, (as in
effect on the day before the date of enactment of this Act) shall continue in
effect, according to its terms, until modified, terminated, superseded, or
repealed pursuant to section 3553(a)(1) of title 44, United States Code.</text>
</paragraph><paragraph id="HB76A4ED2665640279C1FA99044E1F059"><enum>(2)</enum><header>Standards and
guidelines</header><text display-inline="yes-display-inline">Standards and
guidelines issued by the Secretary of Commerce or by the Director before the
date of enactment of this Act under section 11331(a)(1) of title 40, United
States Code, (as in effect on the day before the date of enactment of this Act)
shall continue in effect, according to their terms, until modified, terminated,
superseded, or repealed pursuant to section 11331(a)(1) of title 40, United
States Code, as amended by this Act.</text>
</paragraph></subsection><subsection id="H05E3072CB7A04C0CA6691FE4AC2CD58F"><enum>(c)</enum><header>Technical and
conforming amendments</header>
<paragraph id="H30AAFDA2FCE14077A9A9105E877857E8"><enum>(1)</enum><header>Chapter
analysis</header><text display-inline="yes-display-inline">The chapter analysis
for chapter 35 of title 44, United States Code, is amended—</text>
<subparagraph id="H594B01C4746E4C4DAF70120818932419"><enum>(A)</enum><text display-inline="yes-display-inline">by striking the items relating to sections
3531 through 3538;</text>
</subparagraph><subparagraph id="H0A59B899115F46B58424F07E68F0E0CF"><enum>(B)</enum><text display-inline="yes-display-inline">by striking the items relating to sections
3541 through 3549; and</text>
</subparagraph><subparagraph id="H08AF51C904BF45398164EDDA35854373"><enum>(C)</enum><text display-inline="yes-display-inline">by inserting the following:</text>
<quoted-block display-inline="no-display-inline" id="HACEC416C0FFA42A68E1537EBBB3366C6" style="OLC">
<toc>
<toc-entry bold="off" level="section">3551. Purposes.</toc-entry>
<toc-entry bold="off" level="section">3552. Definitions.</toc-entry>
<toc-entry bold="off" level="section">3553. Federal information
security authority and coordination.</toc-entry>
<toc-entry bold="off" level="section">3554. Agency
responsibilities.</toc-entry>
<toc-entry bold="off" level="section">3555. Multiagency ongoing
threat assessment.</toc-entry>
<toc-entry bold="off" level="section">3556. Independent
evaluations.</toc-entry>
<toc-entry bold="off" level="section">3557. National security
systems.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</subparagraph></paragraph><paragraph id="H6AD9E78E321E4FC6912FFBA409A94545"><enum>(2)</enum><header>Other
references</header>
<subparagraph id="HD868D14618944851AD62260BCCF5304B"><enum>(A)</enum><text display-inline="yes-display-inline">Section 1001(c)(1)(A) of the Homeland
Security Act of 2002 (6 U.S.C. 511(1)(A)) is amended by striking <quote>section
3532(3)</quote> and inserting <quote>section 3552</quote>.</text>
</subparagraph><subparagraph id="HFCEC41FDE5CA4113986CDA7AF69A5BCF"><enum>(B)</enum><text display-inline="yes-display-inline">Section 2222(j)(5) of title 10, United
States Code, is amended by striking <quote>section 3542(b)(2)</quote> and
inserting <quote>section 3552</quote>.</text>
</subparagraph><subparagraph id="HB55FDF173D2141269CA454376F7701C7"><enum>(C)</enum><text display-inline="yes-display-inline">Section 2223(c)(3) of title 10, United
States Code, is amended, by striking <quote>section 3542(b)(2)</quote> and
inserting <quote>section 3552</quote>.</text>
</subparagraph><subparagraph id="HDA8C3909DF6D4170BC7D2AE161616869"><enum>(D)</enum><text display-inline="yes-display-inline">Section 2315 of title 10, United States
Code, is amended by striking <quote>section 3542(b)(2)</quote> and inserting
<quote>section 3552</quote>.</text>
</subparagraph><subparagraph id="H95B4F81C33784CD480DB53F5397F34C5"><enum>(E)</enum><text display-inline="yes-display-inline">Section 20 of the National Institute of
Standards and Technology Act (15 U.S.C. 278g–3) is amended—</text>
<clause id="HD8484EE5A9BC43C696B164DF05B4E742"><enum>(i)</enum><text display-inline="yes-display-inline">in subsection (a)(2), by striking
<quote>section 3532(b)(2)</quote> and inserting <quote>section
3552</quote>;</text>
</clause><clause id="H93852E38166347DAB0D51CFFCB7E2B32"><enum>(ii)</enum><text>in
subsection (c)(3), by striking <quote>Director of the Office of Management and
Budget</quote> and inserting <quote>Secretary of Commerce</quote>;</text>
</clause><clause id="H96E78FAE7391478EBC949EED9B2C17AE"><enum>(iii)</enum><text>in
subsection (d)(1), by striking <quote>Director of the Office of Management and
Budget</quote> and inserting <quote>Secretary of Commerce</quote>;</text>
</clause><clause id="HDF212E95F58B4F3AA195844FD4E9C625"><enum>(iv)</enum><text>in
subsection (d)(8) by striking <quote>Director of the Office of Management and
Budget</quote> and inserting <quote>Secretary of Commerce</quote>;</text>
</clause><clause id="HF275B23F81184C9E9751ABC7262442FB"><enum>(v)</enum><text>in
subsection (d)(8), by striking <quote>submitted to the Director</quote> and
inserting <quote>submitted to the Secretary</quote>;</text>
</clause><clause id="HC500B28808664635819F0D1E6198D28A"><enum>(vi)</enum><text>in
subsection (e)(2), by striking <quote>section 3532(1) of such title</quote> and
inserting <quote>section 3552 of title 44</quote>; and</text>
</clause><clause id="H60123B4F6DE14316BF7BB1A7129F9CAE"><enum>(vii)</enum><text>in
subsection (e)(5), by striking <quote>section 3532(b)(2) of such title</quote>
and inserting <quote>section 3552 of title 44</quote>.</text>
</clause></subparagraph><subparagraph id="HF3CAE5072BA64A199849DD51CC9C8484"><enum>(F)</enum><text display-inline="yes-display-inline">Section 8(d)(1) of the Cyber Security
Research and Development Act (15 U.S.C. 7406(d)(1)) is amended by striking
<quote>section 3534(b)</quote> and inserting <quote>section
3554(b)(2)</quote>.</text>
</subparagraph></paragraph></subsection></section><section id="H56E907286D834AE788E6EC69F34A85DC"><enum>202.</enum><header>Management of
information technology</header>
<subsection id="H2BF275783710443898D1981D47FF2D27"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">Section 11331 of
title 40, United States Code, is amended to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="HCE332C2F46A84DA184B25BF6C55974F9" style="USC">
<section id="H69F0191B1D26482886D9B8B2745CC981"><enum>11331.</enum><header>Responsibilities
for Federal information systems standards</header>
<subsection id="H31527B2DDF9543319911E267C918F239"><enum>(a)</enum><header>Standards and
guidelines</header>
<paragraph id="HE3FA6AE09C9C480E8FF3904E4C7DBD6F"><enum>(1)</enum><header>Authority to
prescribe</header><text display-inline="yes-display-inline">Except as provided
under paragraph (2), the Secretary of Commerce shall prescribe standards and
guidelines pertaining to Federal information systems—</text>
<subparagraph id="H8169D299177F41D29FC373CB0A688488"><enum>(A)</enum><text display-inline="yes-display-inline">in consultation with the Secretary of
Homeland Security; and</text>
</subparagraph><subparagraph id="HE350FFD6EAE144909636493481D6ADDB"><enum>(B)</enum><text display-inline="yes-display-inline">on the basis of standards and guidelines
developed by the National Institute of Standards and Technology under
paragraphs (2) and (3) of section 20(a) of the National Institute of Standards
and Technology Act (15 U.S.C. 278g–3(a)(2) and (a)(3)).</text>
</subparagraph></paragraph><paragraph id="H4FDCDA504051445497739A03823F6749"><enum>(2)</enum><header>National
security systems</header><text display-inline="yes-display-inline">Standards
and guidelines for national security systems shall be developed, prescribed,
enforced, and overseen as otherwise authorized by law and as directed by the
President.</text>
</paragraph></subsection><subsection id="HBAB08092624341C4A2590B44D4F58D95"><enum>(b)</enum><header>Mandatory
standards and guidelines</header>
<paragraph id="H3FCD77DEB3584725A0F27888B0A4E7B7"><enum>(1)</enum><header>Authority to
make mandatory standards and guidelines</header><text display-inline="yes-display-inline">The Secretary of Commerce shall make
standards and guidelines under subsection (a)(1) compulsory and binding to the
extent determined necessary by the Secretary of Commerce to improve the
efficiency of operation or security of Federal information systems.</text>
</paragraph><paragraph id="H3EC08E9A7882472ABEA2BBAAE2309380"><enum>(2)</enum><header>Required
mandatory standards and guidelines</header>
<subparagraph id="HD6E03328E1B043178D557D8DE5354821"><enum>(A)</enum><header>In
general</header><text display-inline="yes-display-inline">Standards and
guidelines under subsection (a)(1) shall include information security standards
that—</text>
<clause id="H3B80CE49863F4E5ABF6869BD1F07298F"><enum>(i)</enum><text display-inline="yes-display-inline">provide minimum information security
requirements as determined under section 20(b) of the National Institute of
Standards and Technology Act (15 U.S.C. 278g–3(b)); and</text>
</clause><clause id="HB5AA9C1E0A5D4C01B5C46389A4562C71"><enum>(ii)</enum><text display-inline="yes-display-inline">are otherwise necessary to improve the
security of Federal information and information systems.</text>
</clause></subparagraph><subparagraph id="H5DD61CA529D6411F9F03BD91169A0574"><enum>(B)</enum><header>Binding
effect</header><text display-inline="yes-display-inline">Information security
standards under subparagraph (A) shall be compulsory and binding.</text>
</subparagraph></paragraph></subsection><subsection id="HDE8C7D685048421EAFA1DBCDD70C1C0E"><enum>(c)</enum><header>Exercise of
authority</header><text display-inline="yes-display-inline">To ensure fiscal
and policy consistency, the Secretary of Commerce shall exercise the authority
conferred by this section subject to direction by the President and in
coordination with the Director.</text>
</subsection><subsection id="HF6D261FF86264A68B773F399FA938C18"><enum>(d)</enum><header>Application of
more stringent standards and guidelines</header><text display-inline="yes-display-inline">The head of an executive agency may employ
standards for the cost-effective information security for information systems
within or under the supervision of that agency that are more stringent than the
standards and guidelines the Secretary of Commerce prescribes under this
section if the more stringent standards and guidelines—</text>
<paragraph id="H02728443AE3142F98D38CB4B0664A003"><enum>(1)</enum><text display-inline="yes-display-inline">contain at least the applicable standards
and guidelines made compulsory and binding by the Secretary of Commerce;
and</text>
</paragraph><paragraph id="HE2526CE484AC46E59A5EB995EA1E4B13"><enum>(2)</enum><text display-inline="yes-display-inline">are otherwise consistent with the policies,
directives, and implementation memoranda issued under section 3553(a) of title
44.</text>
</paragraph></subsection><subsection id="HF38BA816A3CB4CBAAD626CF8A5E3449F"><enum>(e)</enum><header>Decisions on
promulgation of standards and guidelines</header><text display-inline="yes-display-inline">The decision by the Secretary of Commerce
regarding the promulgation of any standard or guideline under this section
shall occur not later than 6 months after the date of submission of the
proposed standard to the Secretary of Commerce by the National Institute of
Standards and Technology under section 20 of the National Institute of
Standards and Technology Act (15 U.S.C. 278g–3).</text>
</subsection><subsection commented="no" id="HBDCC6983F9874B45A6E14C72C7C4CDAE"><enum>(f)</enum><header>Notice and
comment</header><text display-inline="yes-display-inline">A decision by the
Secretary of Commerce to significantly modify, or not promulgate, a proposed
standard submitted to the Secretary by the National Institute of Standards and
Technology under section 20 of the National Institute of Standards and
Technology Act (15 U.S.C. 278g–3) shall be made after the public is given an
opportunity to comment on the Secretary’s proposed decision.</text>
</subsection><subsection id="HF563E6148C724AACBCCD2236BFABB167"><enum>(g)</enum><header>Definitions</header><text display-inline="yes-display-inline">In this section:</text>
<paragraph id="H6D02DC3229134E1F9A162B6CD22EAA0D"><enum>(1)</enum><header>Federal
information system</header><text display-inline="yes-display-inline">The term
<term>Federal information system</term> has the meaning given the term in
section 3552 of title 44.</text>
</paragraph><paragraph id="HB8E5449A58EC419680D93BFEF086407E"><enum>(2)</enum><header>Information
security</header><text display-inline="yes-display-inline">The term
<term>information security</term> has the meaning given the term in section
3552 of title 44.</text>
</paragraph><paragraph id="H67004AF24FB84C0ABCB1630A83954419"><enum>(3)</enum><header>National
security system</header><text display-inline="yes-display-inline">The term
<term>national security system</term> has the meaning given the term in section
3552 of title
44.</text>
</paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection></section><section id="H5840522380CA4398878DC35114BF4E9D"><enum>203.</enum><header>No new
funding</header><text display-inline="no-display-inline">An applicable Federal
agency shall carry out the provisions of this title with existing facilities
and funds otherwise available, through such means as the head of the agency
considers appropriate.</text>
</section><section id="H6945F2D2DC744D63A6FAA53F43A69A25"><enum>204.</enum><header>Technical and
conforming amendments</header><text display-inline="no-display-inline">Section
21(b) of the National Institute of Standards and Technology Act (15 U.S.C.
278g–4(b)) is amended—</text>
<paragraph id="HEC9917AFA1C641B087989ACF07644316"><enum>(1)</enum><text display-inline="yes-display-inline">in paragraph (2), by striking <quote>and
the Director of the Office of Management and Budget</quote> and inserting
<quote>, the Secretary of Commerce, and the Secretary of Homeland
Security</quote>; and</text>
</paragraph><paragraph id="H41D0AC5FF6964AA897E746426D032B59"><enum>(2)</enum><text>in paragraph (3),
by inserting <quote>, the Secretary of Homeland Security,</quote> after
<quote>the Secretary of Commerce</quote>.</text>
</paragraph></section><enum>III</enum><header>Criminal
penalties</header>
<section id="H852CB99C271C49F78F5B3404F97E7BFD"><enum>301.</enum><header>Penalties for
fraud and related activity in connection with computers</header><text display-inline="no-display-inline">Section 1030(c) of title 18, United States
Code, is amended to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="HA9CD03B7ABAD4F7B9D5CB54D4BBC05E4" style="USC">
<subsection id="H24065D1B5A554B1AB76F7AEC4D1C28C0"><enum>(c)</enum><text display-inline="yes-display-inline">The punishment for an offense under
subsection (a) or (b) of this section is—</text>
<paragraph id="HB7CF5F5A8ADC4177A7FFDCB744A51C6D"><enum>(1)</enum><text display-inline="yes-display-inline">a fine under this title or imprisonment for
not more than 20 years, or both, in the case of an offense under subsection
(a)(1) of this section;</text>
</paragraph><paragraph id="HBD81DFCC39B54FD69DE7981AF1CB4D19"><enum>(2)</enum><subparagraph commented="no" display-inline="yes-display-inline" id="HF927370870314C278AC87D5666FA0F52"><enum>(A)</enum><text display-inline="yes-display-inline">except as provided in subparagraph (B), a
fine under this title or imprisonment for not more than 3 years, or both, in
the case of an offense under subsection (a)(2); or</text>
</subparagraph><subparagraph id="H714F2B65C60C483A985AD3078DE23EAC" indent="up1"><enum>(B)</enum><text display-inline="yes-display-inline">a
fine under this title or imprisonment for not more than ten years, or both, in
the case of an offense under subsection (a)(2) of this section, if—</text>
<clause id="H1E1B6855E21843C5BFCEC79DB36E5075"><enum>(i)</enum><text display-inline="yes-display-inline">the offense was committed for purposes of
commercial advantage or private financial gain;</text>
</clause><clause id="H2984A934BA84433C80C768BA30B9ACAE"><enum>(ii)</enum><text display-inline="yes-display-inline">the offense was committed in the
furtherance of any criminal or tortuous act in violation of the Constitution or
laws of the United States, or of any State; or</text>
</clause><clause id="H5E3C42EC3EC247B0B9F7BA4CD458BF41"><enum>(iii)</enum><text display-inline="yes-display-inline">the value of the information obtained, or
that would have been obtained if the offense was completed, exceeds
$5,000;</text>
</clause></subparagraph></paragraph><paragraph id="H1A4EF7AA182D4665B394350275FB9152"><enum>(3)</enum><text display-inline="yes-display-inline">a fine under this title or imprisonment for
not more than 10 years, or both, in the case of an offense under subsection
(a)(3) of this section;</text>
</paragraph><paragraph id="HEF48FB27908D417A8B464AF53D0AE25B"><enum>(4)</enum><text display-inline="yes-display-inline">a fine under this title or imprisonment of
not more than 20 years, or both, in the case of an offense under subsection
(a)(4) of this section;</text>
</paragraph><paragraph id="H308450411D544AA6A0225546FE72AB1E"><enum>(5)</enum><subparagraph commented="no" display-inline="yes-display-inline" id="H134416312EA047AC86E64E7F897F6FA0"><enum>(A)</enum><text display-inline="yes-display-inline">except as provided in subparagraph (C), a
fine under this title, imprisonment for not more than 20 years, or both, in the
case of an offense under subsection (a)(5)(A) of this section, if the offense
caused—</text>
<clause id="H9C26B52416614E1A8A91DAFA5742FC71" indent="up1"><enum>(i)</enum><text display-inline="yes-display-inline">loss to 1 or more persons during any 1-year
period (and, for purposes of an investigation, prosecution, or other proceeding
brought by the United States only, loss resulting from a related course of
conduct affecting 1 or more other protected computers) aggregating at least
$5,000 in value;</text>
</clause><clause id="HB69E98C53ADB4FF486C06AE472008851" indent="up1"><enum>(ii)</enum><text display-inline="yes-display-inline">the modification or impairment, or
potential modification or impairment, of the medical examination, diagnosis,
treatment, or care of 1 or more individuals;</text>
</clause><clause id="H2E87B530DCA7433D944ECC1432A1077F" indent="up1"><enum>(iii)</enum><text display-inline="yes-display-inline">physical injury to any person;</text>
</clause><clause id="HD5DA4ADD381D4273B98A6CDF092EE7D9" indent="up1"><enum>(iv)</enum><text display-inline="yes-display-inline">a threat to public health or safety;</text>
</clause><clause id="H72FEABBA50EC4B7792F351B20CD755F4" indent="up1"><enum>(v)</enum><text display-inline="yes-display-inline">damage affecting a computer used by, or on
behalf of, an entity of the United States Government in furtherance of the
administration of justice, national defense, or national security; or</text>
</clause><clause id="H5D333379651E4F85BE28FEF046F5D6CB" indent="up1"><enum>(vi)</enum><text display-inline="yes-display-inline">damage affecting 10 or more protected
computers during any 1-year period;</text>
</clause></subparagraph><subparagraph id="H77AC9B95C6894A12B95F41A61D79E8DE" indent="up1"><enum>(B)</enum><text display-inline="yes-display-inline">a
fine under this title, imprisonment for not more than 20 years, or both, in the
case of an offense under subsection (a)(5)(B), if the offense caused a harm
provided in clause (i) through (vi) of subparagraph (A) of this
subsection;</text>
</subparagraph><subparagraph id="HF2460AA447A642B1884C7432CE47E50B" indent="up1"><enum>(C)</enum><text display-inline="yes-display-inline">if
the offender attempts to cause or knowingly or recklessly causes death from
conduct in violation of subsection (a)(5)(A), a fine under this title,
imprisonment for any term of years or for life, or both;</text>
</subparagraph><subparagraph id="HB01878D3191B484FA2451C42CE7A8BC3" indent="up1"><enum>(D)</enum><text display-inline="yes-display-inline">a
fine under this title, imprisonment for not more than 10 years, or both, for
any other offense under subsection (a)(5);</text>
</subparagraph><subparagraph id="HFE771199FF5B4D81817FE18533A6BB5D" indent="up1"><enum>(E)</enum><text display-inline="yes-display-inline">a
fine under this title or imprisonment for not more than 10 years, or both, in
the case of an offense under subsection (a)(6) of this section; or</text>
</subparagraph><subparagraph id="HE97FC1B5D71141D6B1374DB76A4ACF6A" indent="up1"><enum>(F)</enum><text display-inline="yes-display-inline">a
fine under this title or imprisonment for not more than 10 years, or both, in
the case of an offense under subsection (a)(7) of this
section.</text>
</subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section id="HBB59FD8319834E9C9504A6D1281589E6"><enum>302.</enum><header>Trafficking in
passwords</header><text display-inline="no-display-inline">Section 1030(a)(6)
of title 18, United States Code, is amended to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="H94A07FB0DF9F4820BF51B4D956926F55" style="OLC">
<paragraph id="HF9EE40987E244B138B4C203BCBD6A294"><enum>(6)</enum><text display-inline="yes-display-inline">knowingly and with intent to defraud
traffics (as defined in section 1029) in any password or similar information or
means of access through which a protected computer (as defined in subparagraphs
(A) and (B) of subsection (e)(2)) may be accessed without
authorization.</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section id="HB0F55AA38B61489C870BF365CFE27E49"><enum>303.</enum><header>Conspiracy and
attempted computer fraud offenses</header><text display-inline="no-display-inline">Section 1030(b) of title 18, United States
Code, is amended by inserting <quote>as if for the completed offense</quote>
after <quote>punished as provided</quote>.</text>
</section><section id="HC43EF0C8F743404AA10031C9E9A3F7AA"><enum>304.</enum><header>Criminal and
civil forfeiture for fraud and related activity in connection with
computers</header><text display-inline="no-display-inline">Section 1030 of
title 18, United States Code, is amended by striking subsections (i) and (j)
and inserting the following:</text>
<quoted-block display-inline="no-display-inline" id="HE092763325B24EBEA178B13543895B42" style="USC">
<subsection id="H56FCEBDABC604A4AB8C98E0EC21BD645"><enum>(i)</enum><header>Criminal
forfeiture</header>
<paragraph id="HC7C47EE3642E48ACBE17DC4E072B4DD0"><enum>(1)</enum><text display-inline="yes-display-inline">The court, in imposing sentence on any
person convicted of a violation of this section, or convicted of conspiracy to
violate this section, shall order, in addition to any other sentence imposed
and irrespective of any provision of State law, that such person forfeit to the
United States—</text>
<subparagraph id="H739DE3947CE94BF9B7777DB2CBA12D64"><enum>(A)</enum><text display-inline="yes-display-inline">such person’s interest in any property,
real or personal, that was used, or intended to be used, to commit or
facilitate the commission of such violation; and</text>
</subparagraph><subparagraph id="H3D31097B850549ECBC642E0F0DA6F667"><enum>(B)</enum><text display-inline="yes-display-inline">any property, real or personal,
constituting or derived from any gross proceeds, or any property traceable to
such property, that such person obtained, directly or indirectly, as a result
of such violation.</text>
</subparagraph></paragraph><paragraph id="HCD486B2C92F24D6B9D08E737EF001BDA"><enum>(2)</enum><text display-inline="yes-display-inline">The criminal forfeiture of property under
this subsection, including any seizure and disposition of the property, and any
related judicial or administrative proceeding, shall be governed by the
provisions of section 413 of the Comprehensive Drug Abuse Prevention and
Control Act of 1970 (21 U.S.C. 853), except subsection (d) of that
section.</text>
</paragraph></subsection><subsection id="H149C80E6D1094D89924C1FC174CC17FE"><enum>(j)</enum><header>Civil
forfeiture</header>
<paragraph id="HA7088F22E3A149A488733B6355CA371B"><enum>(1)</enum><text display-inline="yes-display-inline">The following shall be subject to
forfeiture to the United States and no property right, real or personal, shall
exist in them:</text>
<subparagraph id="HF9FAA8B8DF174AA382DC19FA82A34FEF"><enum>(A)</enum><text display-inline="yes-display-inline">Any property, real or personal, that was
used, or intended to be used, to commit or facilitate the commission of any
violation of this section, or a conspiracy to violate this section.</text>
</subparagraph><subparagraph id="HB24947F34D9E4EC28089D037D1DFC0B5"><enum>(B)</enum><text display-inline="yes-display-inline">Any property, real or personal,
constituting or derived from any gross proceeds obtained directly or
indirectly, or any property traceable to such property, as a result of the
commission of any violation of this section, or a conspiracy to violate this
section.</text>
</subparagraph></paragraph><paragraph id="HF7ACAE491E3D41888A32DEF60E030CEA"><enum>(2)</enum><text display-inline="yes-display-inline">Seizures and forfeitures under this
subsection shall be governed by the provisions in chapter 46 relating to civil
forfeitures, except that such duties as are imposed on the Secretary of the
Treasury under the customs laws described in section 981(d) shall be performed
by such officers, agents and other persons as may be designated for that
purpose by the Secretary of Homeland Security or the Attorney
General.</text>
</paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section id="HA995F53033FB4091ABD96FB196D2B89A"><enum>305.</enum><header>Damage to
critical infrastructure computers</header>
<subsection id="HA9F55D167980441B8471897246C4F3AD"><enum>(a)</enum><header>In
general</header><text>Chapter 47 of title 18, United States Code, is amended by
inserting after section 1030 the following:</text>
<quoted-block display-inline="no-display-inline" id="HF76AE0649F0948BC93B0EE7C26936D23" style="USC">
<section id="HE71420A4F794438F96B7E7EC55675737"><enum>1030A.</enum><header>Aggravated
damage to a critical infrastructure computer</header>
<subsection id="HD25A21824C0C4E5EAB38AD806113A241"><enum>(a)</enum><header>Definitions</header><text>In
this section—</text>
<paragraph id="HC017F166E5454D3399C2448A432131AB"><enum>(1)</enum><text>the term
<term>computer</term> has the meaning given the term in section 1030;</text>
</paragraph><paragraph id="HCCA0777CE2314017B50B3F7527E643B0"><enum>(2)</enum><text>the term
<term>critical infrastructure computer</term> means a computer that manages or
controls systems or assets vital to national defense, national security,
national economic security, public health or safety, or any combination of
those matters, whether publicly or privately owned or operated,
including—</text>
<subparagraph id="HA38C6964FEFA4F03A28DC3EF340A639F"><enum>(A)</enum><text>gas and oil
production, storage, conversion, and delivery systems;</text>
</subparagraph><subparagraph id="H1832CA341C014CA9B80F64B18494C6AC"><enum>(B)</enum><text>water supply
systems;</text>
</subparagraph><subparagraph id="HB39DAD89EAE54A8A8E407A2B97018216"><enum>(C)</enum><text>telecommunication
networks;</text>
</subparagraph><subparagraph id="H5E7C8C685741492181C116BB9ADEBAC7"><enum>(D)</enum><text>electrical power
generation and delivery systems;</text>
</subparagraph><subparagraph id="HECC1D07F0DE14936A24AB5A97B5821D5"><enum>(E)</enum><text>finance and
banking systems;</text>
</subparagraph><subparagraph id="H3E0505DB6A1C43348B3809C66EF05AA4"><enum>(F)</enum><text>emergency
services;</text>
</subparagraph><subparagraph id="HFD302BA33E0F43069062653003F48E73"><enum>(G)</enum><text>transportation
systems and services; and</text>
</subparagraph><subparagraph id="HD4A2A7EE7A174DA9899AA2CAF129A0D3"><enum>(H)</enum><text>government
operations that provide essential services to the public; and</text>
</subparagraph></paragraph><paragraph id="H12A536A034214CF7895DA1F545547A2B"><enum>(3)</enum><text>the term
<term>damage</term> has the meaning given the term in section 1030.</text>
</paragraph></subsection><subsection id="HD30372724630464C8829562BD3988485"><enum>(b)</enum><header>Offense</header><text>It
shall be unlawful, during and in relation to a felony violation of section
1030, to knowingly cause or attempt to cause damage to a critical
infrastructure computer if the damage results in (or, in the case of an
attempt, if completed, would have resulted in) the substantial
impairment—</text>
<paragraph id="HD22B986BC30C4FCEA693EBBB5711557F"><enum>(1)</enum><text>of the operation
of the critical infrastructure computer; or</text>
</paragraph><paragraph id="H4018CE9A3EC24B0BA990CDE0EA0C3F40"><enum>(2)</enum><text>of the critical
infrastructure associated with the computer.</text>
</paragraph></subsection><subsection id="HF8818B0550F24D6D937C660C76549F06"><enum>(c)</enum><header>Penalty</header><text>Any
person who violates subsection (b) shall be—</text>
<paragraph id="H82167C3EDD5D47C0867DE6F900E6A37B"><enum>(1)</enum><text>fined under this
title;</text>
</paragraph><paragraph id="H878E878A94354129996E0DFBBC17A9AB"><enum>(2)</enum><text>imprisoned for not
less than 3 years but not more than 20 years; or</text>
</paragraph><paragraph id="HAC980C10B35543C59FF7F935ED561F9A"><enum>(3)</enum><text>penalized under
paragraphs (1) and (2).</text>
</paragraph></subsection><subsection id="HD9DB37D08B484133967B04E9FC717B8E"><enum>(d)</enum><header>Consecutive
sentence</header><text>Notwithstanding any other provision of law—</text>
<paragraph id="HDA7D237309D840F19F08DCB96E7EBF29"><enum>(1)</enum><text>a court shall not
place on probation any person convicted of a violation of this section;</text>
</paragraph><paragraph id="H4A4AF70A3E5847A383769EE6F825694D"><enum>(2)</enum><text>except as provided
in paragraph (4), no term of imprisonment imposed on a person under this
section shall run concurrently with any other term of imprisonment, including
any term of imprisonment imposed on the person under any other provision of
law, including any term of imprisonment imposed for a felony violation of
section 1030;</text>
</paragraph><paragraph id="H8F467CC9060A44309061A3BF2CED223B"><enum>(3)</enum><text>in determining any
term of imprisonment to be imposed for a felony violation of section 1030, a
court shall not in any way reduce the term to be imposed for such crime so as
to compensate for, or otherwise take into account, any separate term of
imprisonment imposed or to be imposed for a violation of this section;
and</text>
</paragraph><paragraph id="HB291A09EC911428399CA7B0F0477D429"><enum>(4)</enum><text>a term of
imprisonment imposed on a person for a violation of this section may, in the
discretion of the court, run concurrently, in whole or in part, only with
another term of imprisonment that is imposed by the court at the same time on
that person for an additional violation of this section, provided that such
discretion shall be exercised in accordance with any applicable guidelines and
policy statements issued by the United States Sentencing Commission pursuant to
section 994 of title
28.</text>
</paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="HA2F82A4F423C4F8EBF46DC915329EA56"><enum>(b)</enum><header>Technical and
conforming amendment</header><text>The chapter analysis for chapter 47 of title
18, United States Code, is amended by inserting after the item relating to
section 1030 the following:</text>
<quoted-block display-inline="no-display-inline" id="HC10790A08FAC402A81ACFD8DD2878FDB" style="OLC">
<toc>
<toc-entry bold="off" level="section">1030A. Aggravated damage to a
critical infrastructure
computer.</toc-entry>
</toc>
<after-quoted-block>.</after-quoted-block></quoted-block>
</subsection></section><section id="HFB43FA2B90EB46A5B43D4A29CC7427F4"><enum>306.</enum><header>Limitation on
actions involving unauthorized use</header><text display-inline="no-display-inline">Section 1030(e)(6) of title 18, United
States Code, is amended by striking <quote>alter;</quote> and inserting
<quote>alter, but does not include access in violation of a contractual
obligation or agreement, such as an acceptable use policy or terms of service
agreement, with an Internet service provider, Internet Web site, or
non-government employer, if such violation constitutes the sole basis for
determining that access to a protected computer is
unauthorized;</quote>.</text>
</section><enum>IV</enum><header>Cybersecurity
research and development</header>
<section id="H2FB5C45B4C404943A2AEB3AC475091DA"><enum>401.</enum><header>National
High-Performance Computing Program planning and coordination</header>
<subsection id="HA176EF61605D4277A16D67115B844D46"><enum>(a)</enum><header>Goals and
priorities</header><text>Section 101 of the High-Performance Computing Act of
1991 (15 U.S.C. 5511) is amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="H0310A779D99C4FD2AB9C082D92D0F716" style="OLC">
<subsection id="H2A2C7B2AE28D4BBB99919D8FF4440EC3"><enum>(d)</enum><header>Goals and
priorities</header><text>The goals and priorities for Federal high-performance
computing research, development, networking, and other activities under
subsection (a)(2)(A) shall include—</text>
<paragraph id="H2AD94F89A05441E8A24F8A21B573FA78"><enum>(1)</enum><text>encouraging and
supporting mechanisms for interdisciplinary research and development in
networking and information technology, including through collaborations—</text>
<subparagraph id="H505A0EE184064C00B5F75DF2BBC01163"><enum>(A)</enum><text>across
agencies;</text>
</subparagraph><subparagraph id="HED45C558AFDE4DBD9FBB9C855DC98341"><enum>(B)</enum><text>across Program
Component Areas;</text>
</subparagraph><subparagraph id="HEB2E0EB540F04B5D89A3D6DFBEC3D47C"><enum>(C)</enum><text>with
industry;</text>
</subparagraph><subparagraph id="H42AB254DBE0C423B97E92B2F1CFA8531"><enum>(D)</enum><text>with institutions
of higher education;</text>
</subparagraph><subparagraph id="HC16A1C308CFA40A6A6E7D3B122927A2A"><enum>(E)</enum><text>with Federal
laboratories (as defined in section 4 of the Stevenson-Wydler Technology
Innovation Act of 1980 (15 U.S.C. 3703)); and</text>
</subparagraph><subparagraph id="H7FDE6DF4785041E3BAE6D66799E48AD7"><enum>(F)</enum><text>with international
organizations;</text>
</subparagraph></paragraph><paragraph id="H914AFCA6BD584FA19BAFF5193350CE43"><enum>(2)</enum><text>addressing
national, multi-agency, multi-faceted challenges of national importance;
and</text>
</paragraph><paragraph id="H7F2CE74512DD4F09BF4E964A83A21853"><enum>(3)</enum><text>fostering the
transfer of research and development results into new technologies and
applications for the benefit of
society.</text>
</paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H58523EAF960040B79C680CF8A3110AE4"><enum>(b)</enum><header>Development of
strategic plan</header><text>Section 101 of the High-Performance Computing Act
of 1991 (15 U.S.C. 5511) is further amended by adding at the end the
following:</text>
<quoted-block display-inline="no-display-inline" id="H950B8A5C55E94A80B581A316B0D29269" style="OLC">
<subsection id="H487E7BD431F8407B91696264CED59608"><enum>(e)</enum><header>Strategic
plan</header>
<paragraph id="H9042DA12BED843C6A027DEFA4EB9C368"><enum>(1)</enum><header>In
general</header><text>Not later than 1 year after the date of enactment of the
<short-title>Strengthening and Enhancing Cybersecurity by
Using Research, Education, Information, and Technology Act of
2012</short-title>, the agencies under subsection (a)(3)(B), working through
the National Science and Technology Council and with the assistance of the
Office of Science and Technology Policy, shall develop a 5-year strategic plan
to guide the activities under subsection (a)(1).</text>
</paragraph><paragraph id="H47224C661BA44A269801167F659310B4"><enum>(2)</enum><header>Contents</header><text>The
strategic plan shall specify—</text>
<subparagraph id="H9977350BDFB048E688EA6E58F7EF1A65"><enum>(A)</enum><text>the near-term
objectives for the Program;</text>
</subparagraph><subparagraph id="HA67F83A5A1BD416D87029D88A8808023"><enum>(B)</enum><text>the long-term
objectives for the Program;</text>
</subparagraph><subparagraph id="H74E50A8457F24C89861B4A11728BA17E"><enum>(C)</enum><text>the anticipated
time frame for achieving the near-term objectives;</text>
</subparagraph><subparagraph id="HE6C8703F3E8C422F917255180BE10E2B"><enum>(D)</enum><text>the metrics that
will be used to assess any progress made toward achieving the near-term
objectives and the long-term objectives; and</text>
</subparagraph><subparagraph id="H77B22100410047219978BF7973388053"><enum>(E)</enum><text>how the Program
will achieve the goals and priorities under subsection (d).</text>
</subparagraph></paragraph><paragraph id="HD44A9E3DD8A84021A05E1F1897971D07"><enum>(3)</enum><header>Recommendations</header><text>When
developing the strategic plan under paragraph (1), such agencies shall take
into consideration the recommendations of—</text>
<subparagraph id="H114D482C504242C38E4F1DEFEBFBCB94"><enum>(A)</enum><text>the advisory
committee under subsection (b); and</text>
</subparagraph><subparagraph id="H5FDDF5F5339C4521A37B2F91EEF21EF5"><enum>(B)</enum><text display-inline="yes-display-inline">the stakeholders whose input was solicited
by the National Coordination Office, as required under section
102(b)(3).</text>
</subparagraph></paragraph><paragraph id="HDA35636513824107BAF3F13428D5FC2A"><enum>(4)</enum><header>Implementation
roadmap</header><text display-inline="yes-display-inline">Such agencies shall
develop and annually update an implementation roadmap for the strategic plan,
which shall—</text>
<subparagraph id="H89E7B3F0FCFF4953A1888E23E190779B"><enum>(A)</enum><text>specify the role
of each Federal agency in carrying out or sponsoring research and development
to meet the research objectives of the strategic plan, including a description
of how progress toward the research objectives will be evaluated, with
consideration of any relevant recommendations of the advisory committee;</text>
</subparagraph><subparagraph id="H73BB28B8D8B64DBABD52B89EEA75B604"><enum>(B)</enum><text>specify the
funding allocated to each major research objective of the strategic plan and
the source of funding by agency for the current fiscal year; and</text>
</subparagraph><subparagraph id="H7DB6BEDCF2BA4D8CA5C850F316A62528"><enum>(C)</enum><text>estimate the
funding required for each major research objective of the strategic plan for
the next 3 fiscal years.</text>
</subparagraph></paragraph><paragraph id="HED35C7FF7E1F41B6B061E78A2A1E740A"><enum>(5)</enum><header>Report to
Congress</header><text>The Director of the National Coordination Office shall
transmit the strategic plan under this subsection, including the implementation
roadmap and any updates under paragraph (4), to—</text>
<subparagraph id="H7B756D7D404F40D09A6538C4A549AFBB"><enum>(A)</enum><text>the advisory
committee under subsection (b);</text>
</subparagraph><subparagraph id="H36739DB3DBF444149A05ABC3F0871057"><enum>(B)</enum><text>the Committee on
Commerce, Science, and Transportation of the Senate; and</text>
</subparagraph><subparagraph id="HD31AEBE513D64208A1D308A5F74090D8"><enum>(C)</enum><text>the Committee on
Science, Space, and Technology of the House of
Representatives.</text>
</subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H07221988EC664384A138EE31186A37C6"><enum>(c)</enum><header>Periodic
reviews</header><text>Section 101 of the High-Performance Computing Act of 1991
(15 U.S.C. 5511) is further amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="H6F41902D78F04CADA8F77DF181748585" style="OLC">
<subsection id="H37B9BA6E2C5D481EAC9B4FF1558039CC"><enum>(f)</enum><header>Periodic
reviews</header><text>The agencies under subsection (a)(3)(B) shall—</text>
<paragraph id="H8A3935A65E8B4DDA8008406A55B2BA26"><enum>(1)</enum><text>periodically
assess the contents and funding levels of the Program Component Areas and
restructure the Program when warranted, taking into consideration any relevant
recommendations of the advisory committee under subsection (b); and</text>
</paragraph><paragraph id="H23773FE18A3B4F71A52A45CC90AAF373"><enum>(2)</enum><text>ensure that the
Program includes national, multi-agency, multi-faceted research and development
activities, including activities described in section
104.</text>
</paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H6CA0B62DA6254937A6FD88AB82438A41"><enum>(d)</enum><header>Additional
responsibilities of Director</header><text>Section 101(a)(2) of the
High-Performance Computing Act of 1991 (15 U.S.C. 5511(a)(2)) is
amended—</text>
<paragraph id="HD8733B4A98D649AE81FB345730CC3E01"><enum>(1)</enum><text>by redesignating
subparagraphs (E) and (F) as subparagraphs (G) and (H), respectively;
and</text>
</paragraph><paragraph id="HBD133D16733E4EBAB4A0C4F0C786D82D"><enum>(2)</enum><text>by inserting after
subparagraph (D) the following:</text>
<quoted-block display-inline="no-display-inline" id="H04AF9AEDDEB740139D81DCCCFE40E4F1" style="OLC">
<subparagraph id="HEA765B5E3B7D4A31B8D43CAACF932641" indent="up1"><enum>(E)</enum><text>encourage and monitor the efforts of
the agencies participating in the Program to allocate the level of resources
and management attention necessary to ensure that—</text>
<clause id="HE7053E67C4DF4C4EB9CC9AD34A2AE7A3"><enum>(i)</enum><text>the strategic plan under subsection
(e) is developed and executed effectively; and</text>
</clause><clause id="H962BF5E5ED024C2697CCFC86B5F7D087"><enum>(ii)</enum><text>the objectives of the Program are
met;</text>
</clause></subparagraph><subparagraph id="HD5ED9DBC3847484595FECAC5CA4F3ED8" indent="up1"><enum>(F)</enum><text>working with the Office of Management
and Budget, direct the Office of Science and Technology Policy and the agencies
participating in the Program to establish a mechanism (consistent with existing
law) to track all ongoing and completed research and development projects and
associated
funding;</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="HAC7E65BAECB24A6C8B835CCF46FDBBBA"><enum>(e)</enum><header>Advisory
committee</header><text>Section 101(b) of the High-Performance Computing Act of
1991 (15 U.S.C. 5511(b)) is amended—</text>
<paragraph id="H27247A74B208413AA33E41662EA188A6"><enum>(1)</enum><text>in paragraph
(1)—</text>
<subparagraph id="HAE54E742A9DA4AA290E7087A134D2637"><enum>(A)</enum><text>by inserting after
the first sentence the following: <quote>The co-chairs of the advisory
committee shall meet the qualifications of committee members and may be members
of the President’s Council of Advisors on Science and Technology.</quote>;
and</text>
</subparagraph><subparagraph id="HACA9050EEABD45E4A956C31B28E90436"><enum>(B)</enum><text>by striking
<quote>high-performance</quote> in subparagraph (D) and inserting
<quote>high-end</quote>; and</text>
</subparagraph></paragraph><paragraph id="H33D4C790ABA043659A196AE63C8F34E6"><enum>(2)</enum><text>by amending
paragraph (2) to read as follows:</text>
<quoted-block display-inline="no-display-inline" id="HE952F259C1E941B48CED0A906B9EEEBB" style="OLC">
<paragraph id="H0DC21B12226C4098A3D871871D32C3AA" indent="up1"><enum>(2)</enum><text>In addition to the duties under
paragraph (1), the advisory committee shall conduct periodic evaluations of the
funding, management, coordination, implementation, and activities of the
Program. The advisory committee shall report its findings and recommendations
not less frequently than once every 3 fiscal years to the Committee on
Commerce, Science, and Transportation of the Senate and the Committee on
Science, Space, and Technology of the House of Representatives. The report
shall be submitted in conjunction with the update of the strategic
plan.</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="HD30CAF8778AD4DD1B85B9F7DEAFD17DB"><enum>(f)</enum><header>Report</header><text>Section
101(a)(3) of the High-Performance Computing Act of 1991 (15 U.S.C. 5511(a)(3))
is amended—</text>
<paragraph id="H629C007991794F44957E2577D3DF0987"><enum>(1)</enum><text>in subparagraph
(C)—</text>
<subparagraph id="HD5C033A6A1504935A0AFC56D888E5E40"><enum>(A)</enum><text>by striking
<quote>is submitted,</quote> and inserting <quote>is submitted, the levels for
the previous fiscal year,</quote>; and</text>
</subparagraph><subparagraph id="HF0F67D31B4FF4BCE8608D2BDC23BDE9E"><enum>(B)</enum><text>by striking
<quote>each Program Component Area</quote> and inserting <quote>each Program
Component Area and each research area supported in accordance with section
104</quote>;</text>
</subparagraph></paragraph><paragraph id="HA8932CCA241B4EBEAA1401B7759E0F99"><enum>(2)</enum><text>in subparagraph
(D)—</text>
<subparagraph id="HB5C89DF449E14015BB76F168BDFA2855"><enum>(A)</enum><text>by striking
<quote>each Program Component Area,</quote> and inserting <quote>each Program
Component Area and each research area supported in accordance with section
104,</quote>;</text>
</subparagraph><subparagraph id="H4B512579BF7A4C8D96807C8A71E8C97B"><enum>(B)</enum><text>by striking
<quote>is submitted,</quote> and inserting <quote>is submitted, the levels for
the previous fiscal year,</quote>; and</text>
</subparagraph><subparagraph id="H5DFCEB2C40354E08B9389CA7E2ADAF15"><enum>(C)</enum><text>by striking
<quote>and</quote> after the semicolon;</text>
</subparagraph></paragraph><paragraph id="H8EE6CCAFAF6A402387B91D95A25B8620"><enum>(3)</enum><text>by redesignating
subparagraph (E) as subparagraph (G); and</text>
</paragraph><paragraph id="HD21EB47C32B644FFA3DE082029DAF40A"><enum>(4)</enum><text>by inserting after
subparagraph (D) the following:</text>
<quoted-block display-inline="no-display-inline" id="H40720E598CF34871AFBADC11C33CAC1A" style="OLC">
<subparagraph id="HBBF3F6ECE50D4F70BE28CB4DE480410E" indent="up1"><enum>(E)</enum><text>include a description of how the
objectives for each Program Component Area, and the objectives for activities
that involve multiple Program Component Areas, relate to the objectives of the
Program identified in the strategic plan under subsection (e);</text>
</subparagraph><subparagraph id="H00EC422E94CE4D1DBA818F64DD3A52B4" indent="up1"><enum>(F)</enum><text>include—</text>
<clause id="H158CD8B24329426F98A367D9F440797D"><enum>(i)</enum><text>a description of the funding
required by the Office of Science and Technology Policy to perform the
functions under section 102(b) for the next fiscal year by category of
activity;</text>
</clause><clause id="HCABFB92046804B5DA297381E925E8CA0"><enum>(ii)</enum><text>a description of the funding
required by the Office of Science and Technology Policy to perform the
functions under section 102(b) for the current fiscal year by category of
activity; and</text>
</clause><clause id="H6119CBE34785460CA0BB8D7D9ED316E2"><enum>(iii)</enum><text>the amount of funding provided
for the Office of Science and Technology Policy for the current fiscal year by
each agency participating in the Program;
and</text>
</clause></subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="HBF055F4D31444D118C01D94CC6C5406F"><enum>(g)</enum><header>Definitions</header><text>Section
4 of the High-Performance Computing Act of 1991 (15 U.S.C. 5503) is
amended—</text>
<paragraph id="H7CF6894E56944F5F87D28D8D7BA94221"><enum>(1)</enum><text>by redesignating
paragraphs (6) and (7) as paragraphs (7) and (8), respectively;</text>
</paragraph><paragraph id="H4778FBD0D9584D1FB9D18F79A85B4706"><enum>(2)</enum><text>by redesignating
paragraph (3) as paragraph (6);</text>
</paragraph><paragraph id="HD788EA0FD2584423824D8B2790C68195"><enum>(3)</enum><text>by redesignating
paragraphs (1) and (2) as paragraphs (2) and (3), respectively;</text>
</paragraph><paragraph id="HC6D1B0973219494C96C8367FEE4C5B16"><enum>(4)</enum><text>by inserting
before paragraph (2), as redesignated, the following:</text>
<quoted-block display-inline="no-display-inline" id="H376B18A738BB40F69AB11CCE66353FB9" style="OLC">
<paragraph id="HA44804428C024EB181D5CCDB3539169D"><enum>(1)</enum><text><term>cyber-physical
systems</term> means physical or engineered systems whose networking and
information technology functions and physical elements are deeply integrated
and are actively connected to the physical world through sensors, actuators, or
other means to perform monitoring and control
functions;</text>
</paragraph><after-quoted-block>;</after-quoted-block></quoted-block>
</paragraph><paragraph id="HBB49D455CC8B4004BE350D4BD2CC4337"><enum>(5)</enum><text>in paragraph (3),
as redesignated, by striking <quote>high-performance computing</quote> and
inserting <quote>networking and information technology</quote>;</text>
</paragraph><paragraph id="H950AC2D9EBAF42B386BBC7B16C41CF42"><enum>(6)</enum><text>in paragraph (6),
as redesignated—</text>
<subparagraph id="HF6BA1D436ED34E48A85BBC50DDA77865"><enum>(A)</enum><text>by striking
<quote>high-performance computing</quote> and inserting <quote>networking and
information technology</quote>; and</text>
</subparagraph><subparagraph id="H6BC82C044CB94EC0A81EC1BCA1175CB1"><enum>(B)</enum><text>by striking
<quote>supercomputer</quote> and inserting <quote>high-end
computing</quote>;</text>
</subparagraph></paragraph><paragraph id="H6546805E44304C21BE32EC861183392C"><enum>(7)</enum><text>in paragraph (5),
by striking <quote>network referred to as</quote> and all that follows through
<quote>section 102</quote> and inserting <quote>network, including advanced
computer networks of Federal agencies and departments</quote>; and</text>
</paragraph><paragraph id="H6AFE401516F6474EBACCDAD67217B881"><enum>(8)</enum><text>in paragraph (7),
as redesignated, by striking <quote>National High-Performance Computing
Program</quote> and inserting <quote>networking and information technology
research and development program</quote>.</text>
</paragraph></subsection></section><section id="H12AAE1D438DF48FE9D8C9A549778426F"><enum>402.</enum><header>Research in
areas of national importance</header>
<subsection id="HC2038B25BCBC48D094CAB696722EB5BA"><enum>(a)</enum><header>Research in
areas of national importance</header><text>Title I of the High-Performance
Computing Act of 1991 (15 U.S.C. 5511 et seq.) is amended by adding at the end
the following:</text>
<quoted-block display-inline="no-display-inline" id="HAE77344763C74A3BB7DD54BD875211C7" style="OLC">
<section id="H49B4DA09E5F24EF89208C8985833734E"><enum>104.</enum><header>Research in
areas of national importance</header>
<subsection id="H660DB1F22D554FAF924BCB3F277B7C09"><enum>(a)</enum><header>In
general</header><text>The Program shall encourage agencies under section
101(a)(3)(B) to support, maintain, and improve national, multi-agency,
multi-faceted, research and development activities in networking and
information technology directed toward application areas that have the
potential for significant contributions to national economic competitiveness
and for other significant societal benefits.</text>
</subsection><subsection id="HB2887E318F4C4AC590809B3064C46FC3"><enum>(b)</enum><header>Recommendations</header><text>The
advisory committee under section 101(b) shall make recommendations to the
Program for candidate research and development areas for support under this
section.</text>
</subsection><subsection id="HB96DDD0B421543A8B3A00E19DA4F5812"><enum>(c)</enum><header>Characteristics</header>
<paragraph id="HB357784C5E794EE6BE1AE0BCC03CAC67"><enum>(1)</enum><header>In
general</header><text>Research and development activities under this
section—</text>
<subparagraph id="HE3DB22B0ADD54E738A5BAF5BA96A2F3D"><enum>(A)</enum><text>shall include
projects selected on the basis of applications for support through a
competitive, merit-based process;</text>
</subparagraph><subparagraph id="HE85B12FE61B34172B10F8341DAC4988E"><enum>(B)</enum><text>shall leverage,
when possible, Federal investments through collaboration with related State
initiatives;</text>
</subparagraph><subparagraph id="HFE42060467DF439A9B8137EDB36B7A08"><enum>(C)</enum><text>shall include a
plan for fostering the transfer of research discoveries and the results of
technology demonstration activities, including from institutions of higher
education and Federal laboratories, to industry for commercial
development;</text>
</subparagraph><subparagraph id="H5D23FC80B1A64F13954934E3096017F1"><enum>(D)</enum><text>shall involve
collaborations among researchers in institutions of higher education and
industry; and</text>
</subparagraph><subparagraph id="HCA28116DE80844A989E5C9A7EA99CE37"><enum>(E)</enum><text>may involve
collaborations among nonprofit research institutions and Federal laboratories,
as appropriate.</text>
</subparagraph></paragraph><paragraph id="HE13C2E17745E4151B969480E86595793"><enum>(2)</enum><header>Cost-sharing</header><text>In
selecting applications for support, the agencies under section 101(a)(3)(B)
shall give special consideration to projects that include cost sharing from
non-Federal sources.</text>
</paragraph><paragraph id="H31C2A400DBA3438B8B2283C7904D4F48"><enum>(3)</enum><header>Agency
collaboration</header><text>If 2 or more agencies identified in section
101(a)(3)(B), or other appropriate agencies, are working on large-scale
research and development activities in the same area of national importance,
then such agencies shall strive to collaborate through joint solicitation and
selection of applications for support and subsequent funding of
projects.</text>
</paragraph><paragraph commented="no" id="H1FDB5D882AE24D48B3BB235B192E6277"><enum>(4)</enum><header>Multidisciplinary
research centers</header><text>Research and development activities under this
section shall be supported through multidisciplinary research centers,
including Federal laboratories, that are organized to investigate basic
research questions and carry out technology demonstration activities in areas
described in subsection (a). Research may be carried out through existing
multidisciplinary centers, including those authorized under section 7024(b)(2)
of the America COMPETES Act (42 U.S.C.
1862o–10(2)).</text>
</paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H5D3FE8547EFB4A8F803213707A60FDCC"><enum>(b)</enum><header>Cyber-Physical
systems</header><text>Section 101(a)(1) of the High-Performance Computing Act
of 1991 (15 U.S.C. 5511(a)(1)) is amended—</text>
<paragraph id="HC034F094C688463F8DFCC513CBB4D86C"><enum>(1)</enum><text>in subparagraph
(H), by striking <quote>and</quote> after the semicolon;</text>
</paragraph><paragraph id="H99D9235610944D418CABA260DE4D931D"><enum>(2)</enum><text>in subparagraph
(I), by striking the period at the end and inserting a semicolon; and</text>
</paragraph><paragraph id="H87C9B79880554B8E9EA497CE97B4B642"><enum>(3)</enum><text>by adding at the
end the following:</text>
<quoted-block display-inline="no-display-inline" id="HE08106611F014DD2B106D56F865D1619" style="OLC">
<subparagraph id="H587D8976AE18436297097E3F8FCFA5FA" indent="up1"><enum>(J)</enum><text>provide for increased understanding of
the scientific principles of cyber-physical systems and improve the methods
available for the design, development, and operation of cyber-physical systems
that are characterized by high reliability, safety, and security; and</text>
</subparagraph><subparagraph id="H02C5AFA218B64CF5A3A5CB9EE5D9D5A4" indent="up1"><enum>(K)</enum><text>provide for research and development
on human-computer interactions, visualization, and big
data.</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="H8FE5DF6394D64D178AB730789E66874E"><enum>(c)</enum><header>Task
force</header><text>Title I of the High-Performance Computing Act of 1991 (15
U.S.C. 5511 et seq.) is further amended by adding at the end the
following:</text>
<quoted-block display-inline="no-display-inline" id="H7FC8112917F14468B38F06A5A4A1E695" style="OLC">
<section id="H36DC3D6BBCA34F42BEE8AC5CF9CE913C"><enum>105.</enum><header>Cyber-physical
systems university-industry task force</header>
<subsection id="H7D959118FDDA43D2A311FEBEF3CA72BC"><enum>(a)</enum><header>Establishment</header><text>Not
later than 180 days after the date of enactment of the
<short-title>Strengthening and Enhancing Cybersecurity by
Using Research, Education, Information, and Technology Act of
2012</short-title>, the Director of the National Coordination Office under
section 102 shall convene a task force to explore mechanisms for carrying out
collaborative research and development activities for cyber-physical systems
(including the related technologies required to enable these systems) through a
consortium or other appropriate entity with participants from institutions of
higher education, Federal laboratories, and industry.</text>
</subsection><subsection id="HA2A019FA510B49A894FFF716606549BB"><enum>(b)</enum><header>Functions</header><text>The
task force shall—</text>
<paragraph id="HC227FB689B924F3D8C3DD40B989191D5"><enum>(1)</enum><text>develop options
for a collaborative model and an organizational structure for such entity under
which the joint research and development activities could be planned, managed,
and conducted effectively, including mechanisms for the allocation of resources
among the participants in such entity for support of such activities;</text>
</paragraph><paragraph id="H581BF79113324C2BBE39949D293E08BF"><enum>(2)</enum><text>propose a process
for developing a research and development agenda for such entity, including
guidelines to ensure an appropriate scope of work focused on nationally
significant challenges and requiring collaboration and to ensure the
development of related scientific and technological milestones;</text>
</paragraph><paragraph id="H65A3DD627FD749E984AE4EC077ED2AFA"><enum>(3)</enum><text>define the roles
and responsibilities for the participants from institutions of higher
education, Federal laboratories, and industry in such entity;</text>
</paragraph><paragraph id="HA39409DE7A944797A862F24A38067A43"><enum>(4)</enum><text>propose guidelines
for assigning intellectual property rights and for transferring research
results to the private sector; and</text>
</paragraph><paragraph id="HEBBC25F8198642099D9E1441735114AF"><enum>(5)</enum><text>make
recommendations for how such entity could be funded from Federal, State, and
non-governmental sources.</text>
</paragraph></subsection><subsection id="H609AF99946FB4345AEBBFAC96E8A87B6"><enum>(c)</enum><header>Composition</header><text>In
establishing the task force under subsection (a), the Director of the National
Coordination Office shall appoint an equal number of individuals from
institutions of higher education and from industry with knowledge and expertise
in cyber-physical systems, and may appoint not more than 2 individuals from
Federal laboratories.</text>
</subsection><subsection id="H91D873D921AD480CACB8531E94F6DBE5"><enum>(d)</enum><header>Report</header><text>Not
later than 1 year after the date of enactment of the
<short-title>Strengthening and Enhancing Cybersecurity by
Using Research, Education, Information, and Technology Act of
2012</short-title>, the Director of the National Coordination Office shall
transmit to the Committee on Commerce, Science, and Transportation of the
Senate and the Committee on Science, Space, and Technology of the House of
Representatives a report describing the findings and recommendations of the
task force.</text>
</subsection><subsection id="H02452B20302349F29E004B36C7F0B55F"><enum>(e)</enum><header>Termination</header><text>The
task force shall terminate upon transmittal of the report required under
subsection (d).</text>
</subsection><subsection id="HA2C3045CE8C04AC790EC8981A4525FF4"><enum>(f)</enum><header>Compensation and
expenses</header><text>Members of the task force shall serve without
compensation.</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection></section><section id="HB024D448581B46CA9397523C71BCF0EA"><enum>403.</enum><header>Program
improvements</header><text display-inline="no-display-inline">Section 102 of
the High-Performance Computing Act of 1991 (15 U.S.C. 5512) is amended to read
as follows:</text>
<quoted-block display-inline="no-display-inline" id="H2277591022244932A2922A0B6C749DE2" style="OLC">
<section id="HD7F5B68C04AE454C86FA04CF6425235A"><enum>102.</enum><header>National
Coordination Office</header>
<subsection id="H027861E6B1CA40E88C3B6AA4CAFE2D91"><enum>(a)</enum><header>Office</header><text display-inline="yes-display-inline">The Director shall continue a National
Coordination Office with a Director and full-time staff.</text>
</subsection><subsection id="HC795711143444BC8A4776842AB429104"><enum>(b)</enum><header>Functions</header><text>The
National Coordination Office shall—</text>
<paragraph id="HF06DC5B07F1D4D16946F34CB1F0EDAF9"><enum>(1)</enum><text>provide technical
and administrative support to—</text>
<subparagraph id="HCD7E2D53D73947CEB8B0D888C59C0A4B"><enum>(A)</enum><text>the agencies
participating in planning and implementing the Program, including such support
as needed in the development of the strategic plan under section 101(e);
and</text>
</subparagraph><subparagraph id="HD07C69B9CA5048A29991CCC33386A277"><enum>(B)</enum><text>the advisory
committee established under section 101(b);</text>
</subparagraph></paragraph><paragraph id="H5E327BEF18404CE8A476C37024A42F61"><enum>(2)</enum><text>serve as the
primary point of contact on Federal networking and information technology
activities for government organizations, academia, industry, professional
societies, State computing and networking technology programs, interested
citizen groups, and others to exchange technical and programmatic
information;</text>
</paragraph><paragraph id="H4711CD8180BB4525B2031328E2930DCB"><enum>(3)</enum><text>solicit input and
recommendations from a wide range of stakeholders during the development of
each strategic plan required under section 101(e) through the convening of at
least 1 workshop with invitees from academia, industry, Federal laboratories,
and other relevant organizations and institutions;</text>
</paragraph><paragraph id="H9EE57DDFCC1948E1B18CF32689E283A2"><enum>(4)</enum><text>conduct public
outreach, including the dissemination of findings and recommendations of the
advisory committee, as appropriate; and</text>
</paragraph><paragraph id="HB136B9E1E42F4B44BCCB7A9B834E98A7"><enum>(5)</enum><text>promote access to
and early application of the technologies, innovations, and expertise derived
from Program activities to agency missions and systems across the Federal
Government and to United States industry.</text>
</paragraph></subsection><subsection id="HCE7A0FEC6D624443B6DE412E2E69E45E"><enum>(c)</enum><header>Source of
funding</header>
<paragraph id="H937EED4E4EA043C999B4D1C8AF15FB07"><enum>(1)</enum><header>In
general</header><text>The operation of the National Coordination Office shall
be supported by funds from each agency participating in the Program.</text>
</paragraph><paragraph id="H78BEC97128B14063BA4E650BB16C1788"><enum>(2)</enum><header>Specifications</header><text>The
portion of the total budget of such Office that is provided by each agency for
each fiscal year shall be in the same proportion as each such agency’s share of
the total budget for the Program for the previous fiscal year, as specified in
the report required under section
101(a)(3).</text>
</paragraph></subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section id="H4CCCC3E4B231496384A4B91F2A486682"><enum>404.</enum><header>Cloud computing
services for research</header><text display-inline="no-display-inline">Title I
of the High-Performance Computing Act of 1991 (15 U.S.C. 5511) is further
amended by adding at the end the following:</text>
<quoted-block display-inline="no-display-inline" id="H76F84C406880474CB1CE79B7B12CB5F0" style="OLC">
<section id="HA9D338AE80E6484CA86E7D4B6472CCD5"><enum>106.</enum><header>Cloud computing
services for research</header>
<subsection id="H9455D710145849DE96C3D5B968F3B253"><enum>(a)</enum><header>Interagency
working group</header><text display-inline="yes-display-inline">Not later than
180 days after the date of enactment of the <short-title>Strengthening and Enhancing Cybersecurity by Using
Research, Education, Information, and Technology Act of 2012</short-title>, the
Director of the National Coordination Office, working through the National
Science and Technology Council, shall convene an interagency working group to
examine—</text>
<paragraph id="HC4B0A96A78B54751BCA0F2143BAAA6C7"><enum>(1)</enum><text display-inline="yes-display-inline">the research and development needed—</text>
<subparagraph id="H3ACE3B7EBB23435A805EE072F1A1A64D"><enum>(A)</enum><text>to enhance the
effectiveness and efficiency of cloud computing environments;</text>
</subparagraph><subparagraph id="HC36C2FD85997458AAD5E745F4512CD66"><enum>(B)</enum><text>to increase the
trustworthiness of cloud applications and infrastructure; and</text>
</subparagraph><subparagraph id="HA0F8A5515784491D82E8D14464C2D9F3"><enum>(C)</enum><text>to enhance the
foundations of cloud architectures, programming models, and interoperability;
and</text>
</subparagraph></paragraph><paragraph id="H71A3ACE8EDD040D4B5219E5CACC43A98"><enum>(2)</enum><text>the potential use
of cloud computing for federally funded science and engineering research,
including issues around funding mechanisms and policies for the use of cloud
computing services for such research.</text>
</paragraph></subsection><subsection id="H5AD08047839541C88664B188412DC582"><enum>(b)</enum><header>Consultation</header><text>In
carrying out the tasks in paragraphs (1) and (2) of subsection (a), the working
group shall consult with academia, industry, Federal laboratories, and other
relevant organizations and institutions, as appropriate.</text>
</subsection><subsection id="H5D315AC7BEAE415786F98CD439E01885"><enum>(c)</enum><header>Report</header><text>Not
later than 1 year after the date of enactment of the
<short-title>Strengthening and Enhancing Cybersecurity by
Using Research, Education, Information, and Technology Act of
2012</short-title>, the Director of the National Coordination Office shall
transmit to the Committee on Science, Space, and Technology of the House of
Representatives and the Committee on Commerce, Science, and Transportation of
the Senate a report describing the findings and any recommendations of the
working group.</text>
</subsection><subsection id="HAE5ADDCD2FF14A30AC7C080465D4DDFB"><enum>(d)</enum><header>Termination</header><text>The
interagency working group shall terminate upon transmittal of the report
required under subsection
(c).</text>
</subsection></section><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section display-inline="no-display-inline" id="H1BD656A25214494D8E5396C725FA7370"><enum>405.</enum><header>Cybersecurity
university-industry task force</header>
<subsection id="HCDCF01AB43004F598C95BDC43D29DEEA"><enum>(a)</enum><header>Establishment of
university-Industry task force</header><text>Not later than 180 days after the
date of enactment of this Act, the Director of the Office of Science and
Technology Policy shall convene a task force to explore mechanisms for carrying
out collaborative research, development, education, and training activities for
cybersecurity through a consortium or other appropriate entity with
participants from institutions of higher education and industry.</text>
</subsection><subsection id="HD9E50320233C4DE7B8A16552E48EB876"><enum>(b)</enum><header>Functions</header><text>The
task force shall—</text>
<paragraph id="HC5DB07D4624E4F71AEFDAD891168AD1D"><enum>(1)</enum><text>develop options
for a collaborative model and an organizational structure for such entity under
which the joint research and development activities could be planned, managed,
and conducted effectively, including mechanisms for the allocation of resources
among the participants in such entity for support of such activities;</text>
</paragraph><paragraph id="HE60A424EC1FE4721BD71AECC4FD8A3A7"><enum>(2)</enum><text display-inline="yes-display-inline">propose a process for developing a research
and development agenda for such entity, including guidelines to ensure an
appropriate scope of work focused on nationally significant challenges and
requiring collaboration;</text>
</paragraph><paragraph id="HC32E581F5D8040218398E638A8FA3A95"><enum>(3)</enum><text>define the roles
and responsibilities for the participants from institutions of higher education
and industry in such entity;</text>
</paragraph><paragraph id="H75DA62480C1540E68A1327C0F697F931"><enum>(4)</enum><text display-inline="yes-display-inline">propose guidelines for assigning
intellectual property rights, for the transfer of research and development
results to the private sector; and</text>
</paragraph><paragraph id="HD35A21DB451743FF8072A04F23E04169"><enum>(5)</enum><text>make
recommendations for how such entity could be funded from Federal, State, and
nongovernmental sources.</text>
</paragraph></subsection><subsection id="H0549C15840334391A7D2A83DA42A3044"><enum>(c)</enum><header>Composition</header><text display-inline="yes-display-inline">In establishing the task force under
subsection (a), the Director of the Office of Science and Technology Policy
shall appoint an equal number of individuals from institutions of higher
education, including minority-serving institutions and community colleges, and
from industry with knowledge and expertise in cybersecurity.</text>
</subsection><subsection id="H2EA8D6CBA84C4B57A2E35190C5761B71"><enum>(d)</enum><header>Report</header><text display-inline="yes-display-inline">Not later than 12 months after the date of
enactment of this Act, the Director of the Office of Science and Technology
Policy shall transmit to the Congress a report describing the findings and
recommendations of the task force.</text>
</subsection><subsection id="HCC51913FE691414385FAF104BEC445B7"><enum>(e)</enum><header>Termination</header><text display-inline="yes-display-inline">The task force shall terminate upon
transmittal of the report required under subsection (d).</text>
</subsection><subsection id="H6A826A471B0B4D97A292D83FA0EFD88F"><enum>(f)</enum><header>Compensation and
Expenses</header><text>Members of the task force shall serve without
compensation.</text>
</subsection></section><section id="H0F0A9F4C1316452C9A3F355FF3843081"><enum>406.</enum><header>Improving
education of networking and information technology, including high-performance
computing</header><text display-inline="no-display-inline">Section 201(a) of
the High-Performance Computing Act of 1991 (15 U.S.C. 5521(a)) is
amended—</text>
<paragraph id="H1F20D42789BA4A808BE07D42888FAD42"><enum>(1)</enum><text>by redesignating
paragraphs (2) through (4) as paragraphs (3) through (5), respectively;
and</text>
</paragraph><paragraph id="H0A475A8259914F7DA7155747C505A4CF"><enum>(2)</enum><text>by inserting after
paragraph (1) the following new paragraph:</text>
<quoted-block display-inline="no-display-inline" id="H047B411F4BFA48838BB405A5DBEFF1F7" style="OLC">
<paragraph id="H2C1C36E7274040F08BEFF8137A751487"><enum>(2)</enum><text>the National
Science Foundation shall use its existing programs, in collaboration with other
agencies, as appropriate, to improve the teaching and learning of networking
and information technology at all levels of education and to increase
participation in networking and information technology
fields;</text>
</paragraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></section><section id="H7FE72DCD41D948B789498CBB020F5363"><enum>407.</enum><header>Conforming and
technical amendments to the High-Performance Computing Act of 1991</header>
<subsection id="HD9404E5AAD8E4213A59FE4D579AA9306"><enum>(a)</enum><header>Section
3</header><text>Section 3 of the High-Performance Computing Act of 1991 (15
U.S.C. 5502) is amended—</text>
<paragraph id="HC8003BECEC3F4B76AB8AA59A9B80EABB"><enum>(1)</enum><text>in the matter
preceding paragraph (1), by striking <quote>high-performance computing</quote>
and inserting <quote>networking and information technology</quote>;</text>
</paragraph><paragraph id="H87C49243E3314B7EADF043545FC758C4"><enum>(2)</enum><text>in paragraph
(1)—</text>
<subparagraph id="H51B41655F9184262884BE61CAC4479D7"><enum>(A)</enum><text>in the matter
preceding subparagraph (A), by striking <quote>high-performance
computing</quote> and inserting <quote>networking and information
technology</quote>;</text>
</subparagraph><subparagraph id="H3155A8647A9343918970128DCF673276"><enum>(B)</enum><text>in subparagraphs
(A), (F), and (G), by striking <quote>high-performance computing</quote> each
place it appears and inserting <quote>networking and information
technology</quote>; and</text>
</subparagraph><subparagraph id="H6E385724288849968E5AA2F67D4B1604"><enum>(C)</enum><text>in subparagraph
(H), by striking <quote>high-performance</quote> and inserting
<quote>high-end</quote>; and</text>
</subparagraph></paragraph><paragraph id="HA35C529CC590441B8584A8A407A27B63"><enum>(3)</enum><text>in paragraph
(2)—</text>
<subparagraph id="H5D06A10BB27F4B6993DC00704DE8E6F4"><enum>(A)</enum><text>by striking
<quote>high-performance computing and</quote> and inserting <quote>networking
and information technology, and</quote>; and</text>
</subparagraph><subparagraph id="HED2F9ECF00A743D0B9C5F6D4A52872B2"><enum>(B)</enum><text>by striking
<quote>high-performance computing network</quote> and inserting
<quote>networking and information technology</quote>.</text>
</subparagraph></paragraph></subsection><subsection id="HF394C60A98504B44AB50CCECB9303827"><enum>(b)</enum><header>Title
heading</header><text>The heading of title I of the High-Performance Computing
Act of 1991 (105 Stat. 1595) is amended by striking <quote><header-in-text level="title" style="OLC">High-performance computing</header-in-text></quote>
and inserting <quote><header-in-text level="title" style="OLC">Networking and
information technology</header-in-text></quote>.</text>
</subsection><subsection id="H6CE1A97B72C3452088EB1220FFB77089"><enum>(c)</enum><header>Section
101</header><text>Section 101 of the High-Performance Computing Act of 1991 (15
U.S.C. 5511) is amended—</text>
<paragraph id="H3FF3F07902704411BA3F2A33A44197D9"><enum>(1)</enum><text>in the section
heading, by striking <quote><header-in-text level="section" style="OLC">high-performance computing</header-in-text></quote> and inserting
<quote><header-in-text level="section" style="OLC">networking and information
technology research and development</header-in-text></quote>;</text>
</paragraph><paragraph id="H60120354F9054DF1A26A11FE4AACFF02"><enum>(2)</enum><text>in subsection
(a)—</text>
<subparagraph id="HADD6D8546D76445188B586D9B738BF48"><enum>(A)</enum><text>in the subsection
heading, by striking <quote><header-in-text level="subsection" style="OLC">National High-Performance Computing</header-in-text></quote> and
inserting <quote><header-in-text level="subsection" style="OLC">Networking and
Information Technology Research and
Development</header-in-text></quote>;</text>
</subparagraph><subparagraph id="H50AD789B80954747A0919908CB25CAF0"><enum>(B)</enum><text>in paragraph
(1)—</text>
<clause id="HC31FBD20B227461BA74FD793C9706E12"><enum>(i)</enum><text>by
striking <quote>National High-Performance Computing Program</quote> and
inserting <quote>networking and information technology research and development
program</quote>;</text>
</clause><clause id="HA07D6CE20DF94E609AF73EED1C5D439F"><enum>(ii)</enum><text>in
subparagraph (A), by striking <quote>high-performance computing, including
networking</quote> and inserting <quote>networking and information
technology</quote>;</text>
</clause><clause id="H7669452666934A25B0867013C1F9185C"><enum>(iii)</enum><text>in
subparagraphs (B) and (G), by striking <quote>high-performance</quote> each
place it appears and inserting <quote>high-end</quote>; and</text>
</clause><clause id="H7AD79970CFDF4F37B32F45DFD64316B4"><enum>(iv)</enum><text>in
subparagraph (C), by striking <quote>high-performance computing and
networking</quote> and inserting <quote>high-end computing, distributed, and
networking</quote>; and</text>
</clause></subparagraph><subparagraph id="H7BBC370F1EB942C2AFE64D14595D0710"><enum>(C)</enum><text>in paragraph
(2)—</text>
<clause id="H6343F5AFE1AA432C9316636664A7185C"><enum>(i)</enum><text>in
subparagraphs (A) and (C)—</text>
<subclause id="HE1247E0A472543D68BD74EF2C01B2597"><enum>(I)</enum><text>by striking
<quote>high-performance computing</quote> each place it appears and inserting
<quote>networking and information technology</quote>; and</text>
</subclause><subclause id="H4CEF64BA3B764534900BB214C06387E4"><enum>(II)</enum><text>by striking
<quote>development, networking,</quote> each place it appears and inserting
<quote>development,</quote>; and</text>
</subclause></clause><clause id="H36848E97149E42B8874363D98E61BC96"><enum>(ii)</enum><text>in
subparagraphs (G) and (H), as redesignated by section 401(d) of this Act, by
striking <quote>high-performance</quote> each place it appears and inserting
<quote>high-end</quote>;</text>
</clause></subparagraph></paragraph><paragraph id="H707044E6A9F04BE7984EDB022BDF66EC"><enum>(3)</enum><text>in subsection
(b)(1), in the matter preceding subparagraph (A), by striking
<quote>high-performance computing</quote> each place it appears and inserting
<quote>networking and information technology</quote>; and</text>
</paragraph><paragraph id="H463A159198344D1D81DC48723023896A"><enum>(4)</enum><text>in subsection
(c)(1)(A), by striking <quote>high-performance computing</quote> and inserting
<quote>networking and information technology</quote>.</text>
</paragraph></subsection><subsection id="H23BCCAB1A1F2490BA7D56769CCA5F24C"><enum>(d)</enum><header>Section
201</header><text>Section 201(a)(1) of the High-Performance Computing Act of
1991 (15 U.S.C. 5521(a)(1)) is amended by striking <quote>high-performance
computing and advanced high-speed computer networking</quote> and inserting
<quote>networking and information technology research and
development</quote>.</text>
</subsection><subsection id="H26F36A2EFA6F4993BCE6F6E163252E6E"><enum>(e)</enum><header>Section
202</header><text>Section 202(a) of the High-Performance Computing Act of 1991
(15 U.S.C. 5522(a)) is amended by striking <quote>high-performance
computing</quote> and inserting <quote>networking and information
technology</quote>.</text>
</subsection><subsection id="H8D7ADBE8181C4308BB95748B3755B47F"><enum>(f)</enum><header>Section
203</header><text>Section 203(a) of the High-Performance Computing Act of 1991
(15 U.S.C. 5523(a)) is amended—</text>
<paragraph id="HF82A0BB1E7544B68B19E008BF84F239E"><enum>(1)</enum><text>in paragraph (1),
by striking <quote>high-performance computing and networking</quote> and
inserting <quote>networking and information technology</quote>; and</text>
</paragraph><paragraph id="HAC29429F01CD455094DCB61BC8E06B87"><enum>(2)</enum><text>in paragraph
(2)(A), by striking <quote>high-performance</quote> and inserting
<quote>high-end</quote>.</text>
</paragraph></subsection><subsection id="HF34BF75798854575A7EF1ADC75D02482"><enum>(g)</enum><header>Section
204</header><text>Section 204 of the High-Performance Computing Act of 1991 (15
U.S.C. 5524) is amended—</text>
<paragraph id="H03CDDA5EC35A47E88B7C73F06E4AC8C8"><enum>(1)</enum><text>in subsection
(a)(1)—</text>
<subparagraph id="HD277DC4F9AD74D908341BA91673DAD52"><enum>(A)</enum><text>in subparagraph
(A), by striking <quote>high-performance computing systems and networks</quote>
and inserting <quote>networking and information technology systems and
capabilities</quote>;</text>
</subparagraph><subparagraph id="H0CC16D8F7E574E32A65A417A70A61C7E"><enum>(B)</enum><text>in subparagraph
(B), by striking <quote>interoperability of high-performance computing systems
in networks and for common user interfaces to systems</quote> and inserting
<quote>interoperability and usability of networking and information technology
systems</quote>; and</text>
</subparagraph><subparagraph id="H1A530E9BBB2A4A37BC52ABB4CC2EE885"><enum>(C)</enum><text>in subparagraph
(C), by striking <quote>high-performance computing</quote> and inserting
<quote>networking and information technology</quote>; and</text>
</subparagraph></paragraph><paragraph id="H3FA909BB60D24234B170EFE7155AA6AF"><enum>(2)</enum><text>in subsection
(b)—</text>
<subparagraph id="HAF873BC1CB814313BE6A226C3D38DB94"><enum>(A)</enum><text>by striking
<quote><header-in-text level="subsection" style="OLC">High-performance
Computing and Network</header-in-text></quote> in the heading and inserting
<quote><header-in-text level="subsection" style="OLC">Networking and
Information Technology</header-in-text></quote>; and</text>
</subparagraph><subparagraph id="H2CF6DA27C9F24737B9189E366D4579E2"><enum>(B)</enum><text>by striking
<quote>sensitive</quote>.</text>
</subparagraph></paragraph></subsection><subsection id="H7A6B90B089C64F3E812701E1B8DF86D6"><enum>(h)</enum><header>Section
205</header><text>Section 205(a) of the High-Performance Computing Act of 1991
(15 U.S.C. 5525(a)) is amended by striking <quote>computational</quote> and
inserting <quote>networking and information technology</quote>.</text>
</subsection><subsection id="HB6735F94F9284644A7FB3623252A2026"><enum>(i)</enum><header>Section
206</header><text>Section 206(a) of the High-Performance Computing Act of 1991
(15 U.S.C. 5526(a)) is amended by striking <quote>computational
research</quote> and inserting <quote>networking and information technology
research</quote>.</text>
</subsection><subsection id="H2E52B0AF924E4F9687100D5D215447DA"><enum>(j)</enum><header>Section
207</header><text>Section 207 of the High-Performance Computing Act of 1991 (15
U.S.C. 5527) is amended by striking <quote>high-performance computing</quote>
and inserting <quote>networking and information technology</quote>.</text>
</subsection><subsection id="H3A51C8C435744FDCA0ADB3CE86DCE0B8"><enum>(k)</enum><header>Section
208</header><text>Section 208 of the High-Performance Computing Act of 1991 (15
U.S.C. 5528) is amended—</text>
<paragraph id="H594AF056B60042B694182B5C921FAD2F"><enum>(1)</enum><text>in the section
heading, by striking <quote><header-in-text level="section" style="OLC">high-performance computing</header-in-text></quote> and inserting
<quote><header-in-text level="section" style="OLC">networking and information
technology</header-in-text></quote>; and</text>
</paragraph><paragraph id="HE30B5082E1D54B639C2E88776C73A082"><enum>(2)</enum><text>in subsection
(a)—</text>
<subparagraph id="H1C0C246DD9EC47D7A047ACA7E31889A5"><enum>(A)</enum><text>in paragraph (1),
by striking <quote>High-performance computing and associated</quote> and
inserting <quote>Networking and information</quote>;</text>
</subparagraph><subparagraph id="H900FB0F75620409498D7AC3F5BBEB58D"><enum>(B)</enum><text>in paragraph (2),
by striking <quote>high-performance computing</quote> and inserting
<quote>networking and information technologies</quote>;</text>
</subparagraph><subparagraph id="HC965318EF7D445FAB8FDE37F3B2204EE"><enum>(C)</enum><text>in paragraph (3),
by striking <quote>high-performance</quote> and inserting
<quote>high-end</quote>;</text>
</subparagraph><subparagraph id="H117197DA7F144B6D96209E09345B73F8"><enum>(D)</enum><text>in paragraph (4),
by striking <quote>high-performance computers and associated</quote> and
inserting <quote>networking and information</quote>; and</text>
</subparagraph><subparagraph id="H1107605604004B82B968C3F306E9806D"><enum>(E)</enum><text>in paragraph (5),
by striking <quote>high-performance computing and associated</quote> and
inserting <quote>networking and information</quote>.</text>
</subparagraph></paragraph></subsection></section><section id="HA217E583B13F4509B20A4A09C684C550"><enum>408.</enum><header>Federal Cyber
Scholarship-for-Service program</header>
<subsection id="HDFC989FC558B4948B2817BEE9EE27AC6"><enum>(a)</enum><header>In
general</header><text>The Director of the National Science Foundation shall
continue a Federal Cyber Scholarship-for-Service program under section 5(a) of
the Cyber Security Research and Development Act (15 U.S.C. 7404(a)) to increase
the capacity of the higher education system to produce an information
technology workforce with the skills necessary to enhance the security of the
Nation's communications and information infrastructure and to recruit and train
the next generation of information technology professionals and security
managers to meet the needs of the cybersecurity mission for Federal, State,
local, and tribal governments.</text>
</subsection><subsection id="H3AC31C6688A84C1B905CFBA4D841C7C4"><enum>(b)</enum><header>Program
description and components</header><text>The program shall—</text>
<paragraph id="H6D33C9A346EA4BB5AF830996D11880BB"><enum>(1)</enum><text>provide, through
qualified institutions of higher education, scholarships that provide tuition,
fees, and a competitive stipend for up to 2 years to students pursuing a
bachelor’s or master’s degree and up to 3 years to students pursuing a doctoral
degree in a cybersecurity field;</text>
</paragraph><paragraph id="HB24404E34149424C9906D4B5C59D9648"><enum>(2)</enum><text>provide the
scholarship recipients with summer internship opportunities or other meaningful
temporary appointments in the Federal information technology workforce;</text>
</paragraph><paragraph id="HCB9302CDB5B948D68D6DAC314159B147"><enum>(3)</enum><text>increase the
capacity of institutions of higher education throughout all regions of the
United States to produce highly qualified cybersecurity professionals, through
the award of competitive, merit-reviewed grants that support such activities
as—</text>
<subparagraph id="HF2F5D429CCF944DDAA520CC6B4F5DABC"><enum>(A)</enum><text>faculty
professional development, including technical, hands-on experiences in the
private sector or government, workshops, seminars, conferences, and other
professional development opportunities that will result in improved
instructional capabilities;</text>
</subparagraph><subparagraph id="H1DF5D06BFE9041138BAE831079854477"><enum>(B)</enum><text>institutional
partnerships, including minority serving institutions and community colleges;
and</text>
</subparagraph><subparagraph id="H93A5BE3D81D7404BA248B8B973651BE7"><enum>(C)</enum><text>development of
cybersecurity-related courses and curricula;</text>
</subparagraph></paragraph><paragraph id="H76E87A3098154139815BA1B2174AE170"><enum>(4)</enum><text>provide a
procedure for the hiring Federal agency, consistent with regulations of the
Office of Personnel Management, to request and fund a security clearance for a
scholarship recipient, including providing for clearance during a summer
internship and upon graduation; and</text>
</paragraph><paragraph id="HDD98E177E10B413E88636B0ADDA37449"><enum>(5)</enum><text>provide
opportunities for students to receive temporary appointments for meaningful
employment in the Federal information technology workforce during school
vacation periods and for internships.</text>
</paragraph></subsection><subsection id="H420212FEF52D4901AB596004B97A2AD2"><enum>(c)</enum><header>Hiring
authority</header>
<paragraph id="H0815FCE06CEA463DA4AE90A1E02AE070"><enum>(1)</enum><header>In
general</header><text>For purposes of any law or regulation governing the
appointment of an individual in the Federal civil service, upon the successful
completion of the degree, a student receiving a scholarship under the program
may—</text>
<subparagraph id="HBF8AFFF7A51A47158CC1F8D7AD6A92D1"><enum>(A)</enum><text>be hired under
section 213.3102(r) of title 5, Code of Federal Regulations; and</text>
</subparagraph><subparagraph id="HE5A76161E1C8494793C362CB4486CEB0"><enum>(B)</enum><text>be exempt from
competitive service.</text>
</subparagraph></paragraph><paragraph id="H6624442077894E7A86218F5FF36932F9"><enum>(2)</enum><header>Competitive
service</header><text>Upon satisfactory fulfillment of the service term under
paragraph (1), an individual may be converted to a competitive service position
without competition if the individual meets the requirements for that
position.</text>
</paragraph></subsection><subsection id="H1040F79254794433A1527D3DAB95DB81"><enum>(d)</enum><header>Eligibility</header><text>A
scholarship under this section shall be available only to a student who—</text>
<paragraph id="H73B723ED456345399794C42AB05ABA69"><enum>(1)</enum><text>is a citizen or
permanent resident of the United States;</text>
</paragraph><paragraph id="H78A097FB3685479CB025B4991E4411D5"><enum>(2)</enum><text>is a full-time
student in an eligible degree program, as determined by the Director, that is
focused on computer security or information assurance at an awardee
institution;</text>
</paragraph><paragraph id="H54CFAC253AB74965B3B0CD72E5BAF623"><enum>(3)</enum><text>accepts the terms
of a scholarship under this section;</text>
</paragraph><paragraph id="H3D9A3C1092D649FEBE53197A974DEF6F"><enum>(4)</enum><text>maintains a GPA of
3.0 or above on a 4.0 scale; and</text>
</paragraph><paragraph id="H50328F7416B5407F9AD2BC283C0399CD"><enum>(5)</enum><text>has demonstrated a
level of proficiency in math or computer sciences.</text>
</paragraph></subsection><subsection id="H674C108F0AEF455DB087303C5BB15965"><enum>(e)</enum><header>Service
obligation</header>
<paragraph id="H40CCC84A10814F04B3833498F9C269F2"><enum>(1)</enum><header>In
general</header><text>If an individual receives a scholarship under this
section, as a condition of receiving such scholarship, the individual upon
completion of the degree must serve as a cybersecurity professional within the
Federal workforce for a period of time as provided in subsection (g).</text>
</paragraph><paragraph id="H58DCB2467A884064965BA5A56AEAB829"><enum>(2)</enum><header>Not offered
employment</header><text>If a scholarship recipient is not offered employment
by a Federal agency or a federally funded research and development center, the
service requirement can be satisfied at the Director’s discretion by—</text>
<subparagraph id="H1FA4652A855A4483B901EC577DB27E10"><enum>(A)</enum><text>serving as a
cybersecurity professional in a State, local, or tribal government agency;
or</text>
</subparagraph><subparagraph id="HE8069A8964E744568217279C5F04F67E"><enum>(B)</enum><text>teaching
cybersecurity courses at an institution of higher education.</text>
</subparagraph></paragraph></subsection><subsection id="HBB82DA87F4944BB8B3725FF225FC7B03"><enum>(f)</enum><header>Conditions of
support</header><text>As a condition of acceptance of a scholarship under this
section, a scholarship recipient shall agree to provide the awardee institution
with annual verifiable documentation of employment and up-to-date contact
information.</text>
</subsection><subsection id="H7BF759884E764092A49F1B124FBF2718"><enum>(g)</enum><header>Length of
service</header><text>The length of service required in exchange for a
scholarship under this section shall be 1 year more than the number of years
for which the scholarship was received.</text>
</subsection><subsection id="HF07BDE1F019B42ACACE2825F1F49C97A"><enum>(h)</enum><header>Failure To
complete service obligation</header>
<paragraph id="H6559FF0632154B4D9058CF4659364B2B"><enum>(1)</enum><header>General
rule</header><text>A scholarship recipient under this section shall be liable
to the United States under paragraph (3) if the scholarship recipient—</text>
<subparagraph id="H022333B26B2D444BBED1CD668DE671E8"><enum>(A)</enum><text>fails to maintain
an acceptable level of academic standing in the educational institution in
which the individual is enrolled, as determined by the Director;</text>
</subparagraph><subparagraph id="H1CA1CBE8C7DC4B0EA76C62499ABC1565"><enum>(B)</enum><text>is dismissed from
such educational institution for disciplinary reasons;</text>
</subparagraph><subparagraph id="HB79A79CFF64F4586AB96AA1E21881909"><enum>(C)</enum><text>withdraws from the
program for which the award was made before the completion of such
program;</text>
</subparagraph><subparagraph id="HE9B9042E42B24EDEBB160577B60AB03F"><enum>(D)</enum><text>declares that the
individual does not intend to fulfill the service obligation under this
section; or</text>
</subparagraph><subparagraph id="H093B360B60824F02BEB07F57B28F3140"><enum>(E)</enum><text>fails to fulfill
the service obligation of the individual under this section.</text>
</subparagraph></paragraph><paragraph id="H55F8AA13031C43EB96F0F879FCD75B96"><enum>(2)</enum><header>Monitoring
compliance</header><text>As a condition of participating in the program, a
qualified institution of higher education receiving a grant under this section
shall—</text>
<subparagraph id="H6594FEEAF9DA4AC59EBBE02399D37210"><enum>(A)</enum><text>enter into an
agreement with the Director of the National Science Foundation to monitor the
compliance of scholarship recipients with respect to their service obligations;
and</text>
</subparagraph><subparagraph id="H702BE5A874A84DC5A6C0BA21D3161B79"><enum>(B)</enum><text>provide to the
Director, on an annual basis, post-award employment information for scholarship
recipients through the completion of their service obligations.</text>
</subparagraph></paragraph><paragraph id="HEE543AF008FA4CF399F5A4245A570122"><enum>(3)</enum><header>Repayment
amounts</header>
<subparagraph id="H1E58CE93286841628C3FF04E86C9BEE8"><enum>(A)</enum><header>Less than 1 year
of service</header><text>If a circumstance under paragraph (1) occurs before
the completion of 1 year of a service obligation under this section, the total
amount of awards received by the individual under this section shall be repaid
or such amount shall be treated as a loan to be repaid in accordance with
subparagraph (C).</text>
</subparagraph><subparagraph id="H170C37C7412740B7A96CF950931ED268"><enum>(B)</enum><header>One or more
years of service</header><text>If a circumstance described in subparagraph (D)
or (E) of paragraph (1) occurs after the completion of 1 year of a service
obligation under this section, the total amount of scholarship awards received
by the individual under this section, reduced by the ratio of the number of
years of service completed divided by the number of years of service required,
shall be repaid or such amount shall be treated as a loan to be repaid in
accordance with subparagraph (C).</text>
</subparagraph><subparagraph id="H9BA6F62E4F9047299CBA517A97F47160"><enum>(C)</enum><header>Repayments</header><text>A
loan described under subparagraph (A) or (B) shall be treated as a Federal
Direct Unsubsidized Stafford Loan under part D of title IV of the Higher
Education Act of 1965 (20 U.S.C. 1087a et seq.), and shall be subject to
repayment, together with interest thereon accruing from the date of the
scholarship award, in accordance with terms and conditions specified by the
Director (in consultation with the Secretary of Education) in regulations
promulgated to carry out this paragraph.</text>
</subparagraph></paragraph><paragraph id="H208302BF30FB454497DCCADB4AFD032D"><enum>(4)</enum><header>Collection of
repayment</header>
<subparagraph id="HC1E4DB8ACB8F4C998A07482A16FFFD1B"><enum>(A)</enum><header>In
general</header><text>In the event that a scholarship recipient is required to
repay the scholarship under this subsection, the institution providing the
scholarship shall—</text>
<clause id="H4DCD757C64EA447192D471A8D73BDD80"><enum>(i)</enum><text>be
responsible for determining the repayment amounts and for notifying the
scholarship recipient and the Director of the amount owed; and</text>
</clause><clause id="H5CAA9E492737456B9F3A999D81DC3E8D"><enum>(ii)</enum><text>collect such
repayment amount within a period of time as determined under the agreement
under paragraph (2) or the repayment amount shall be treated as a loan in
accordance with paragraph (3)(C).</text>
</clause></subparagraph><subparagraph id="H5440735AC47A4178AFA80325C2DE97E0"><enum>(B)</enum><header>Returned to
Treasury</header><text>Except as provided in subparagraph (C), any such
repayment shall be returned to the Treasury of the United States.</text>
</subparagraph><subparagraph id="H961ED35615A347A9930760BC5C818D46"><enum>(C)</enum><header>Retain
percentage</header><text>An institution of higher education may retain a
percentage of any repayment the institution collects under this paragraph to
defray administrative costs associated with the collection. The Director shall
establish a single, fixed percentage that will apply to all eligible
entities.</text>
</subparagraph></paragraph><paragraph id="HB4F99D14E53540FDAF1B1B247FF4A615"><enum>(5)</enum><header>Exceptions</header><text>The
Director may provide for the partial or total waiver or suspension of any
service or payment obligation by an individual under this section if—</text>
<subparagraph id="H2359D6487C3B45FB898BE8B1CCD88456"><enum>(A)</enum><text>compliance by the
individual with the obligation is impossible;</text>
</subparagraph><subparagraph id="H685EEBD34C5949BB8FDC81808D38E83A"><enum>(B)</enum><text>compliance by the
individual would involve extreme hardship to the individual; or</text>
</subparagraph><subparagraph id="H56908488282248E98CF0CB05240C22E5"><enum>(C)</enum><text>enforcement of
such obligation with respect to the individual would be unconscionable.</text>
</subparagraph></paragraph></subsection><subsection id="HCF489A7D6F914175BF7A19274EE4E0B3"><enum>(i)</enum><header>Evaluation and
report</header><text>The Director of the National Science Foundation
shall—</text>
<paragraph id="H345A7F39008D4BC6B9F0E5D6DFEAD9D8"><enum>(1)</enum><text>evaluate the
success of recruiting individuals for scholarships under this section and of
hiring and retaining those individuals in the public sector workforce,
including the annual cost and an assessment of how the program actually
improves the Federal workforce; and</text>
</paragraph><paragraph id="H826EE8010193401998E903311D67FF4A"><enum>(2)</enum><text>periodically
report the findings under paragraph (1) to Congress.</text>
</paragraph></subsection><subsection id="H84C8361B17B74B52B4A50894835C864D"><enum>(j)</enum><header>Authorization of
appropriations</header><text>From amounts made available under section 503 of
the America COMPETES Reauthorization Act of 2010 (124 Stat. 4005), the
Secretary may use funds to carry out the requirements of this section for
fiscal years 2012 through 2013.</text>
</subsection></section><section id="H46A0A9548A504F3594AA733310E723E1"><enum>409.</enum><header>Study and
analysis of certification and training of information infrastructure
professionals</header>
<subsection id="HC643C4A10C7944DC89402CE9C6EF377C"><enum>(a)</enum><header>Study</header><text>The
President shall enter into an agreement with the National Academies to conduct
a comprehensive study of government, academic, and private-sector
accreditation, training, and certification programs for personnel working in
information infrastructure. The agreement shall require the National Academies
to consult with sector coordinating councils and relevant governmental
agencies, regulatory entities, and nongovernmental organizations in the course
of the study.</text>
</subsection><subsection id="H4475B0BBA2C049188465F7E2C4CC5884"><enum>(b)</enum><header>Scope</header><text>The
study shall include—</text>
<paragraph id="H08CE1D67C2F947B49DEEA0971A00D4AD"><enum>(1)</enum><text>an evaluation of
the body of knowledge and various skills that specific categories of personnel
working in information infrastructure should possess in order to secure
information systems;</text>
</paragraph><paragraph id="H0C99FA8AA6A44E3591F9D8062EFF1D26"><enum>(2)</enum><text>an assessment of
whether existing government, academic, and private-sector accreditation,
training, and certification programs provide the body of knowledge and various
skills described in paragraph (1);</text>
</paragraph><paragraph id="HE7C547022BC74CEA84F6BCEA09536E4C"><enum>(3)</enum><text>an analysis of any
barriers to the Federal Government recruiting and hiring cybersecurity talent,
including barriers relating to compensation, the hiring process, job
classification, and hiring flexibility; and</text>
</paragraph><paragraph id="H800D441EB4E64BA5AD1973B91C0EAF85"><enum>(4)</enum><text>an analysis of the
sources and availability of cybersecurity talent, a comparison of the skills
and expertise sought by the Federal Government and the private sector, and an
examination of the current and future capacity of United States institutions of
higher education, including community colleges, to provide current and future
cybersecurity professionals, through education and training activities, with
those skills sought by the Federal Government, State and local entities, and
the private sector.</text>
</paragraph></subsection><subsection id="H50AC659F0801442DB23E94B53BCCDBF9"><enum>(c)</enum><header>Report</header><text>Not
later than 1 year after the date of enactment of this Act, the National
Academies shall submit to the President and Congress a report on the results of
the study. The report shall include—</text>
<paragraph id="H170E9E6093B14156BDA54029A81A2378"><enum>(1)</enum><text>findings regarding
the state of information infrastructure accreditation, training, and
certification programs, including specific areas of deficiency and demonstrable
progress; and</text>
</paragraph><paragraph id="H5635FD26DE3F4A6F839CF3C089A59827"><enum>(2)</enum><text>recommendations
for the improvement of information infrastructure accreditation, training, and
certification programs.</text>
</paragraph></subsection></section><section id="H83926398CB234BD991130DEDD0D540D0"><enum>410.</enum><header>Cybersecurity
strategic research and development plan</header>
<subsection id="H1165D4E4D43A4943BE95925A65D28094"><enum>(a)</enum><header>In
general</header><text>Not later than 12 months after the date of enactment of
this Act, the agencies designated under section 101(a)(3)(B) (i) through (xi)
of the High-Performance Computing Act of 1991 (15 U.S.C. 5511(a)(3)(B) (i)
through (xi)) (working through the National Science and Technology Council)
shall transmit to Congress a strategic plan based on an assessment of
cybersecurity risk to guide the overall direction of Federal cybersecurity and
information assurance research and development for information technology and
networking systems. Once every 3 years after the initial strategic plan is
transmitted to Congress under this section, the agencies shall prepare and
transmit to Congress an update of the strategic plan.</text>
</subsection><subsection id="H5D89115376DA47E6926F8858F191EDC1"><enum>(b)</enum><header>Contents of
plan</header><text>The strategic plan under subsection (a) shall—</text>
<paragraph id="H2E7718D622034BA68D3FAFDEAE5AE0E4"><enum>(1)</enum><text>specify and
prioritize—</text>
<subparagraph id="H6BD6FAE7D0DF4688A8F76ABB8B8AD483"><enum>(A)</enum><text>near-term,
mid-term, and long-term research objectives, including objectives associated
with the research areas identified in section 4(a)(1) of the Cyber Security
Research and Development Act (15 U.S.C. 7403(a)(1)); and</text>
</subparagraph><subparagraph id="H847537D24D064BE19902EF4491EBD9F1"><enum>(B)</enum><text>how the near-term
objectives complement research and development areas in which the private
sector is actively engaged;</text>
</subparagraph></paragraph><paragraph id="H04B824EBFCA14037B789963F06BE99A6"><enum>(2)</enum><text>describe how the
National Networking and Information Technology Research and Development Program
will focus on innovative, transformational technologies with the potential to
enhance the security, reliability, resilience, and trustworthiness of the
digital infrastructure, and to protect consumer privacy;</text>
</paragraph><paragraph id="HB13DF1BB8FDB46268BB04B3A48C43985"><enum>(3)</enum><text>describe how the
Program will foster the rapid transfer of research and development results into
new cybersecurity technologies and applications for the timely benefit of
society and the national interest, including through the dissemination of best
practices and other outreach activities;</text>
</paragraph><paragraph id="HB46F23A8726F409A8E284446FB6FBF81"><enum>(4)</enum><text>describe how the
Program will establish and maintain a national research infrastructure for
creating, testing, and evaluating the next generation of secure networking and
information technology systems;</text>
</paragraph><paragraph id="H57EE9E379EDB47EEA6718E247408A7DC"><enum>(5)</enum><text>describe how the
Program will facilitate access by academic researchers to the infrastructure
described in paragraph (4), as well as to relevant data, including event data;
and</text>
</paragraph><paragraph id="H8F50B85DB2DF4C1F8D419BCE28A27631"><enum>(6)</enum><text>describe how the
Program will engage females and individuals identified in section 33 or 34 of
the Science and Engineering Equal Opportunities Act (42 U.S.C. 1885a and 1885b)
to foster a more diverse workforce in this area.</text>
</paragraph></subsection><subsection id="H2004664CBCC045EBB102408C15FCBE68"><enum>(c)</enum><header>Development of
implementation roadmap</header><text>The agencies described in subsection (a)
shall develop and annually update an implementation roadmap for the strategic
plan under this section. The implementation roadmap shall—</text>
<paragraph id="HCF980C8047864A81840D57EFA6F691D1"><enum>(1)</enum><text>specify the role
of each Federal agency in carrying out or sponsoring research and development
to meet the research objectives of the strategic plan, including a description
of how progress toward the research objectives will be evaluated;</text>
</paragraph><paragraph id="H84BEF7F36A62451FBF2814917077950D"><enum>(2)</enum><text>specify the
funding allocated to each major research objective of the strategic plan and
the source of funding by agency for the current fiscal year; and</text>
</paragraph><paragraph id="H87225B7DB26E422BA15758E572A83B5B"><enum>(3)</enum><text>estimate the
funding required for each major research objective of the strategic plan for
the following 3 fiscal years.</text>
</paragraph></subsection><subsection id="HE6714F34807343F988606B6F2330796A"><enum>(d)</enum><header>Recommendations</header><text>In
developing and updating the strategic plan under subsection (a), the agencies
involved shall solicit recommendations and advice from—</text>
<paragraph id="H4F940AD983814A0A84A0A61C2925ED06"><enum>(1)</enum><text>the advisory
committee established under section 101(b)(1) of the High-Performance Computing
Act of 1991 (15 U.S.C. 5511(b)(1)); and</text>
</paragraph><paragraph id="H947DCFA9C73E468799B07548DBD7FDE4"><enum>(2)</enum><text>a
wide range of stakeholders, including industry, academia (including
representatives of minority serving institutions and community colleges),
National Laboratories, and other relevant organizations and
institutions.</text>
</paragraph></subsection><subsection id="H57F2C23A70814D2FB56A44463A478D40"><enum>(e)</enum><header>Report
Appendix</header><text>The implementation roadmap under subsection (c), and its
annual updates, shall be appended to the report under section 101(a)(2)(D) of
the High-Performance Computing Act of 1991 (15 U.S.C. 5511(a)(2)(D)).</text>
</subsection><subsection id="H9D35ABE502E644B5A51AA88B8980F21C"><enum>(f)</enum><header>Authorization of
appropriations</header><text>From amounts made available under section 503 of
the America COMPETES Reauthorization Act of 2010 (124 Stat. 4005), the
Secretary may use funds to carry out the requirements of this section for
fiscal years 2012 through 2013.</text>
</subsection></section><section id="H8207A624A8AF4356A3313E5CC7F6385B"><enum>411.</enum><header>International
cybersecurity technical standards</header>
<subsection id="HD79BABA54E1F4BF8836691D54203CAC2"><enum>(a)</enum><header>In
general</header><text display-inline="yes-display-inline">The Director of the
National Institute of Standards and Technology, in coordination with
appropriate Federal authorities, shall—</text>
<paragraph id="H8408A5B429FF4A578007424D7F69022C"><enum>(1)</enum><text display-inline="yes-display-inline">as appropriate, ensure coordination of
Federal agencies engaged in the development of international technical
standards related to information system security; and</text>
</paragraph><paragraph id="H2AA9C3AB674445DAB8AC8AF749B9869E"><enum>(2)</enum><text display-inline="yes-display-inline">not later than 1 year after the date of
enactment of this Act, develop and transmit to Congress a plan for ensuring
such Federal agency coordination.</text>
</paragraph></subsection><subsection id="HA91235A6FF5D4E9A978ABFA998430751"><enum>(b)</enum><header>Consultation
with the private sector</header><text display-inline="yes-display-inline">In
carrying out the activities under subsection (a)(1), the Director shall ensure
consultation with appropriate private sector stakeholders.</text>
</subsection></section><section id="H4FFBE18150C6429BA48365D7B1F9C08D"><enum>412.</enum><header>Identity
management research and development</header><text display-inline="no-display-inline">The Director of the National Institute of
Standards and Technology shall continue a program to support the development of
technical standards, metrology, testbeds, and conformance criteria, taking into
account appropriate user concerns—</text>
<paragraph id="HC128744D58364ADE9ADCC8EA0E3F11E4"><enum>(1)</enum><text display-inline="yes-display-inline">to improve interoperability among identity
management technologies;</text>
</paragraph><paragraph id="H6B7B2260E6994DB4812066AD73C27B75"><enum>(2)</enum><text display-inline="yes-display-inline">to strengthen authentication methods of
identity management systems;</text>
</paragraph><paragraph id="H0A7B9BD53D114172BACA8501055DD65C"><enum>(3)</enum><text display-inline="yes-display-inline">to improve privacy protection in identity
management systems, including health information technology systems, through
authentication and security protocols; and</text>
</paragraph><paragraph id="H6CEB4753F4DD4F5A8471A4CB846BA5AF"><enum>(4)</enum><text display-inline="yes-display-inline">to improve the usability of identity
management systems.</text>
</paragraph></section><section id="H95431DF42C0941919604F903C205A4EE"><enum>413.</enum><header>Federal
cybersecurity research and development programs</header>
<subsection id="H382BF92BCD834C108B246E9564D4C7D1"><enum>(a)</enum><header>Computer and
network security research areas</header><text display-inline="yes-display-inline">Section 4(a)(1) of the Cyber Security
Research and Development Act (<external-xref legal-doc="usc" parsable-cite="usc/15/7403">15 U.S.C. 7403(a)(1)</external-xref>) is
amended—</text>
<paragraph id="H441C9E35C80E40B1B332459D0F0E4E18"><enum>(1)</enum><text>in subparagraph
(A) by inserting <quote>identity management,</quote> after
<quote>cryptography,</quote>; and</text>
</paragraph><paragraph id="H5415FC170582422F907A7666584AE466"><enum>(2)</enum><text>in subparagraph
(I), by inserting <quote>, crimes against children, and organized crime</quote>
after <quote>intellectual property</quote>.</text>
</paragraph></subsection><subsection display-inline="no-display-inline" id="H58AB0D7A414D41B99BAFB30BDED72EF7"><enum>(b)</enum><header>Computer and
network security research grants</header><text>Section 4(a)(3) of such Act (15
U.S.C. 7403(a)(3)) is amended by striking subparagraphs (A) through (E) and
inserting the following new subparagraphs:</text>
<quoted-block committee-id="HSY00" id="H1C5A1756CB4947A79D227C78247F9CC8" style="OLC">
<subparagraph id="H05B8A869A71D4CE08E59EEEB9FCF2145"><enum>(A)</enum><text>$90,000,000 for
fiscal year 2012;</text>
</subparagraph><subparagraph id="H5F9E60342CAC4799A3E0846CFB0FFDA3"><enum>(B)</enum><text>$90,000,000 for
fiscal year 2013; and</text>
</subparagraph><subparagraph id="H4926E67880404403A6FBC5FC42DFEE69"><enum>(C)</enum><text>$90,000,000 for
fiscal year
2014.</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="HBD4EDFB7252E4203905846D6BC08B0FC"><enum>(c)</enum><header>Computer and
network security research centers</header><text>Section 4(b) of such Act (15
U.S.C. 7403(b)) is amended—</text>
<paragraph id="H7CD0C0A6BDB84CA1906FED8E8B0BFC78"><enum>(1)</enum><text>in paragraph
(4)—</text>
<subparagraph id="H6C9037D75E0F4A81B603498D4F68EEA8"><enum>(A)</enum><text>in subparagraph
(C), by striking <quote>and</quote> after the semicolon;</text>
</subparagraph><subparagraph id="HBF874C40FBEB4B529409E87805C408FC"><enum>(B)</enum><text display-inline="yes-display-inline">in subparagraph (D), by striking the period
and inserting <quote>; and</quote>; and</text>
</subparagraph><subparagraph id="H198A0D6CF54B417B8244D71C42A04180"><enum>(C)</enum><text>by adding at the
end the following new subparagraph:</text>
<quoted-block committee-id="HSY00" display-inline="no-display-inline" id="H7CE4664A9D1345309A706297C9ED013D" style="OLC">
<subparagraph id="HB8E7158A627647B3B4FEFC8C78EDC21C"><enum>(E)</enum><text display-inline="yes-display-inline">how the center will partner with government
laboratories, for-profit entities, other institutions of higher education, or
nonprofit research institutions.</text>
</subparagraph><after-quoted-block>;
and</after-quoted-block></quoted-block>
</subparagraph></paragraph><paragraph id="HE765434FACD74FA1A38780835ECC3080"><enum>(2)</enum><text display-inline="yes-display-inline">in paragraph (7) by striking subparagraphs
(A) through (E) and inserting the following new subparagraphs:</text>
<quoted-block committee-id="HSY00" display-inline="no-display-inline" id="H443A56FF0F504F10BB771665279B2E4F" style="OLC">
<subparagraph id="HF12C1F3E66704C18A04D5F5A25D88F9D"><enum>(A)</enum><text display-inline="yes-display-inline">$4,500,000 for fiscal year 2012;</text>
</subparagraph><subparagraph id="H77430FC9A46148718FD18DFEBFB8D46F"><enum>(B)</enum><text>$4,500,000 for
fiscal year 2013; and</text>
</subparagraph><subparagraph id="HEA61B4D4FDCA426C9F764808C8E97AAA"><enum>(C)</enum><text>$4,500,000 for
fiscal year
2014.</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></subsection><subsection id="H3FC65D8D41F44C639FBCAE5DF4943FAD"><enum>(d)</enum><header>Computer and
network security capacity building grants</header><text display-inline="yes-display-inline">Section 5(a)(6) of such Act (15 U.S.C.
7404(a)(6)) is amended by striking subparagraphs (A) through (E) and inserting
the following new subparagraphs:</text>
<quoted-block committee-id="HSY00" display-inline="no-display-inline" id="HE2B679BCF52A4929B233821CB769738C" style="OLC">
<subparagraph id="HE94CA436BE4246C6ACE9CF6EFEAF9202"><enum>(A)</enum><text display-inline="yes-display-inline">$19,000,000 for fiscal year 2012;</text>
</subparagraph><subparagraph id="HC1C018544C7349B0819E45524EBF3AD2"><enum>(B)</enum><text>$19,000,000 for
fiscal year 2013; and</text>
</subparagraph><subparagraph id="H5449E59AEC9C4271BDEEA7BAF8BF24DA"><enum>(C)</enum><text>$19,000,000 for
fiscal year
2014.</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="HD7E4C4343AC24F26B612DBF1CE1A2541"><enum>(e)</enum><header>Scientific and
advanced technology act grants</header><text display-inline="yes-display-inline">Section 5(b)(2) of such Act (15 U.S.C.
7404(b)(2)) is amended by striking subparagraphs (A) through (E) and inserting
the following new subparagraphs:</text>
<quoted-block committee-id="HSY00" display-inline="no-display-inline" id="H339C0C3BCD444BB9B5A11BAC2E927E8D" style="OLC">
<subparagraph id="H5B25629686DF44DE93D00C75D85B3AC2"><enum>(A)</enum><text display-inline="yes-display-inline">$2,500,000 for fiscal year 2012;</text>
</subparagraph><subparagraph id="HE4258F5281AF4A1BB7AB1BC16E3F311B"><enum>(B)</enum><text>$2,500,000 for
fiscal year 2013; and</text>
</subparagraph><subparagraph id="H7CD568CB1B254BB1AE988CC129DACE19"><enum>(C)</enum><text>$2,500,000 for
fiscal year
2014.</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="HB08FA36659DD4C1F8FBB09AAB89282EB"><enum>(f)</enum><header>Graduate
traineeships in computer and network security</header><text display-inline="yes-display-inline">Section 5(c)(7) of such Act (15 U.S.C.
7404(c)(7)) is amended by striking subparagraphs (A) through (E) and inserting
the following new subparagraphs:</text>
<quoted-block committee-id="HSY00" display-inline="no-display-inline" id="HDACBD23CF7374B4DAEDB45E4E8A04946" style="OLC">
<subparagraph id="H8F1B0242D0324B54B4C2EA190DE76208"><enum>(A)</enum><text display-inline="yes-display-inline">$24,000,000 for fiscal year 2012;</text>
</subparagraph><subparagraph id="HA2A8F984A7D545A788968E0C0ABF997C"><enum>(B)</enum><text>$24,000,000 for
fiscal year 2013; and</text>
</subparagraph><subparagraph id="HC4271C9C2E9247D892ED1172C8D0469A"><enum>(C)</enum><text>$24,000,000 for
fiscal year
2014.</text>
</subparagraph><after-quoted-block>.</after-quoted-block></quoted-block>
</subsection><subsection id="H944D169E6615427B8CC0467F8B13BA23"><enum>(g)</enum><header>Cyber security
faculty development traineeship program</header><text>Section 5(e) of such Act
(15 U.S.C. 7404(e)) is repealed.</text>
</subsection></section><section id="H61E2187DB73D417D92289114E9AA36BC"><enum>414.</enum><header>Cybersecurity
automation and checklists for Government systems</header><text display-inline="no-display-inline">Section 8(c) of the Cyber Security Research
and Development Act (<external-xref legal-doc="usc" parsable-cite="usc/15/7406">15 U.S.C. 7406(c)</external-xref>) is amended to
read as follows:</text>
<quoted-block committee-id="HSY00" display-inline="no-display-inline" id="H1F5249DB69EB487BB9AA9401BAE426FF" style="OLC">
<subsection id="H7879FCAADACA440E9E3C0C04312AD072"><enum>(c)</enum><header>Security
automation and checklists for government systems</header>
<paragraph id="H9A4FC3B0F2B34BD3855EA4D5669A9AA9"><enum>(1)</enum><header>In
general</header><text>The Director of the National Institute of Standards and
Technology shall develop, and revise as necessary, security automation
standards, associated reference materials (including protocols), and checklists
providing settings and option selections that minimize the security risks
associated with each information technology hardware or software system and
security tool that is, or is likely to become, widely used within the Federal
Government in order to enable standardized and interoperable technologies,
architectures, and frameworks for continuous monitoring of information security
within the Federal Government.</text>
</paragraph><paragraph id="H399EFC1BEEA344DB9D66C9540F0A7FCA"><enum>(2)</enum><header>Priorities for
development</header><text display-inline="yes-display-inline">The Director of
the National Institute of Standards and Technology shall establish priorities
for the development of standards, reference materials, and checklists under
this subsection on the basis of—</text>
<subparagraph id="H5289DF8EFA2F4C5683AD5A6C7DA5431B"><enum>(A)</enum><text>the security risks
associated with the use of the system;</text>
</subparagraph><subparagraph id="H9F4061FA437D4427B16FFB82B897511A"><enum>(B)</enum><text>the number of
agencies that use a particular system or security tool;</text>
</subparagraph><subparagraph id="H272862495CB9481F8D62BD7A41B5B905"><enum>(C)</enum><text>the usefulness of
the standards, reference materials, or checklists to Federal agencies that are
users or potential users of the system;</text>
</subparagraph><subparagraph id="H2D0043BD66A141EBB1E19ED0074139BE"><enum>(D)</enum><text>the effectiveness
of the associated standard, reference material, or checklist in creating or
enabling continuous monitoring of information security; or</text>
</subparagraph><subparagraph id="HCB512E7AAE804BC59E702F2BCDF80CD2"><enum>(E)</enum><text>such other factors
as the Director of the National Institute of Standards and Technology
determines to be appropriate.</text>
</subparagraph></paragraph><paragraph id="H691824C9CB6C454793E6D487FDDE09BD"><enum>(3)</enum><header>Excluded
systems</header><text display-inline="yes-display-inline">The Director of the
National Institute of Standards and Technology may exclude from the application
of paragraph (1) any information technology hardware or software system or
security tool for which such Director determines that the development of a
standard, reference material, or checklist is inappropriate because of the
infrequency of use of the system, the obsolescence of the system, or the
inutility or impracticability of developing a standard, reference material, or
checklist for the system.</text>
</paragraph><paragraph id="H302055AE1C12483691153B16760ED7A1"><enum>(4)</enum><header>Dissemination of
standards and related materials</header><text display-inline="yes-display-inline">The Director of the National Institute of
Standards and Technology shall ensure that Federal agencies are informed of the
availability of any standard, reference material, checklist, or other item
developed under this subsection.</text>
</paragraph><paragraph id="HDC4D90ABD04B4F7AB1CA74E1865E116C"><enum>(5)</enum><header>Agency use
requirements</header><text>The development of standards, reference materials,
and checklists under paragraph (1) for an information technology hardware or
software system or tool does not—</text>
<subparagraph id="HDDDE0F5A76D84EBA96C8B4648982E89B"><enum>(A)</enum><text>require any
Federal agency to select the specific settings or options recommended by the
standard, reference material, or checklist for the system;</text>
</subparagraph><subparagraph id="HB7B9904381CD4D04863A6F635E6D2319"><enum>(B)</enum><text>establish
conditions or prerequisites for Federal agency procurement or deployment of any
such system;</text>
</subparagraph><subparagraph id="H3E06BB141BBF4E158A5AD6419A53E5F6"><enum>(C)</enum><text display-inline="yes-display-inline">imply an endorsement of any such system by
the Director of the National Institute of Standards and Technology; or</text>
</subparagraph><subparagraph id="H0FBC1CEFBCDC4BD68E2E9F8B7512A33C"><enum>(D)</enum><text>preclude any
Federal agency from procuring or deploying other information technology
hardware or software systems for which no such standard, reference material, or
checklist has been developed or identified under paragraph
(1).</text>
</subparagraph></paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</section><section id="HF9273B2B496141E59EAE7DB6FE584F50"><enum>415.</enum><header>National
Institute of Standards and Technology cybersecurity research and
development</header><text display-inline="no-display-inline">Section 20 of the
National Institute of Standards and Technology Act (<external-xref legal-doc="usc" parsable-cite="usc/15/278g-3">15 U.S.C. 278g–3</external-xref>)
is amended—</text>
<paragraph id="H82E980570B4D48A99B7F791B8B374B31"><enum>(1)</enum><text>by redesignating
subsection (e) as subsection (f); and</text>
</paragraph><paragraph id="H2014F569CD3F4CE9A982398A580E1827"><enum>(2)</enum><text>by inserting after
subsection (d) the following:</text>
<quoted-block committee-id="HSY00" id="H60B20AE6DAB24E1E88D7B07D4106DB68">
<subsection id="H8DE2E802B045469E895FAEEF14D1CBF4"><enum>(e)</enum><header>Intramural
security research</header><text>As part of the research activities conducted in
accordance with subsection (d)(3), the Institute shall—</text>
<paragraph id="HE1519CD48CBD42CE87894FA35700F75E"><enum>(1)</enum><text>conduct a research
program to develop a unifying and standardized identity, privilege, and access
control management framework for the execution of a wide variety of resource
protection policies and that is amenable to implementation within a wide
variety of existing and emerging computing environments;</text>
</paragraph><paragraph id="HF4017A65E5214BE1B7E7EC4654E74B86"><enum>(2)</enum><text>carry out research
associated with improving the security of information systems and
networks;</text>
</paragraph><paragraph id="H4C8DC97DDC7640C38B87CAE9D10D0A9F"><enum>(3)</enum><text>carry out research
associated with improving the testing, measurement, usability, and assurance of
information systems and networks; and</text>
</paragraph><paragraph id="H3BE74F8FD7484B8186DF21C18FDD2C48"><enum>(4)</enum><text>carry out research
associated with improving security of industrial control
systems.</text>
</paragraph></subsection><after-quoted-block>.</after-quoted-block></quoted-block>
</paragraph></section>