[Congressional Record Volume 166, Number 117 (Thursday, June 25, 2020)]
[Senate]
[Pages S3569-S3572]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]
SA 2178. Mr. WICKER (for himself, Ms. Cantwell, and Ms. Rosen)
submitted an amendment intended to be proposed by him to the bill S.
4049, to authorize appropriations for fiscal year 2021 for military
activities of the Department of Defense, for military construction, and
for defense activities of the Department of Energy, to prescribe
military personnel strengths for such fiscal year, and for other
purposes; which was ordered to lie on the table; as follows:
At the appropriate place, insert the following:
TITLE __--CYBER WORKFORCE MATTERS
SEC. __. IMPROVING NATIONAL INITIATIVE FOR CYBERSECURITY
EDUCATION.
(a) Program Improvements Generally.--Subsection (a) of
section 401 of the Cybersecurity Enhancement Act of 2014 (15
U.S.C. 7451) is amended--
(1) in paragraph (5), by striking ``; and'' and inserting a
semicolon;
(2) by redesignating paragraph (6) as paragraph (10); and
(3) by inserting after paragraph (5) the following:
``(6) supporting efforts to identify cybersecurity
workforce skill gaps in public and private sectors;
``(7) facilitating Federal programs to advance
cybersecurity education, training, and workforce;
``(8) in coordination with the Department of Defense and
the Department of Homeland Security, considering any specific
needs of the cybersecurity workforce of critical
infrastructure, to include cyber physical systems and control
systems;
``(9) advising the Director of the Office of Management and
Budget, as needed in, developing metrics to measure the
effectiveness and effect of programs and initiatives to
advance the cybersecurity workforce; and''.
(b) Strategic Plan.--Subsection (c) of such section is
amended--
(1) by striking ``The Director'' and inserting the
following:
``(1) In general.--The Director''; and
(2) by adding at the end the following:
``(2) Requirement.--The strategic plan developed and
implemented under paragraph (1) shall include an indication
of how the Director will carry out this section.''.
(c) Cybersecurity Career Pathways.--
(1) Identification of multiple cybersecurity career
pathways.--In carrying out subsection (a) of such section and
not later than 540 days after the date of the enactment of
this Act, the Director of the National Institute of Standards
and Technology shall, in coordination with the Secretary of
Defense, the Secretary of Homeland Security, and the Director
of the Office of Personnel Management, use a consultative
process with other Federal agencies, academia, and industry
to identify multiple career pathways for cybersecurity work
roles that can be used in the private and public sectors.
(2) Requirements.--The Director shall ensure that the
multiple cybersecurity career pathways identified under
paragraph (1) indicate the knowledge, skills, and abilities,
including relevant education, training, apprenticeships,
certifications, and other experiences, that--
(A) align with employers' cybersecurity skill needs,
including proficiency level requirements, for its workforce;
and
(B) prepare an individual to be successful in entering or
advancing in a cybersecurity career.
[[Page S3570]]
(3) Exchange program.--Consistent with requirements under
chapter 37 of title 5, United States Code, the Director of
the National Institute of Standards and Technology, in
coordination with the Director of the Office of Personnel
Management, may establish a voluntary program for the
exchange of employees engaged in one of the cybersecurity
work roles identified in the National Initiative for
Cybersecurity Education (NICE) Cybersecurity Workforce
Framework (NIST Special Publication 800-181), or successor
framework, between the National Institute of Standards and
Technology and private sector institutions, including a
nonpublic or commercial business, a research institution, or
an institution of higher education, as the Director of the
National Institute of Standards and Technology considers
feasible.
(d) Proficiency To Perform Cybersecurity Tasks.--Not later
than 540 days after the date of the enactment of this Act,
the Director of the National Institute of Standards and
Technology shall, in coordination with the Secretary of
Defense and the Secretary of Homeland Security--
(1) in carrying out subsection (a) of such section, assess
the scope and sufficiency of efforts to measure a learner's
capability to perform specific tasks found in the National
Initiative for Cybersecurity Education (NICE) Cybersecurity
Workforce Framework (NIST Special Publication 800-181) at all
proficiency levels; and
(2) submit to Congress a report--
(A) on the findings of the Director with respect to the
assessment carried out under paragraph (1); and
(B) with recommendations for effective methods for
measuring the cybersecurity proficiency of learners.
(e) Cybersecurity Metrics.--Such section is further amended
by adding at the end the following:
``(e) Cybersecurity Metrics.--In carrying out subsection
(a), the Director of the Office of Management and Budget may
seek input from the Director of the National Institute of
Standards and Technology, in coordination with the Department
of Homeland Security, the Office of Personnel Management, and
such agencies as the Director of the National Institute of
Standards and Technology considers relevant, shall develop
repeatable measures and reliable metrics for measuring and
evaluating Federally funded cybersecurity workforce programs
and initiatives based on the outcomes of such programs and
initiatives.''.
(f) Regional Alliances and Multistakeholder Partnerships.--
Such section is further amended by adding at the end the
following:
``(f) Regional Alliances and Multistakeholder
Partnerships.--
``(1) In general.--Pursuant to section 2(b)(4) of the
National Institute of Standards and Technology Act (15 U.S.C.
272(b)(4)), the Director shall establish cooperative
agreements between the National Initiative for Cybersecurity
Education (NICE) of the Institute and regional alliances or
partnerships for cybersecurity education and workforce.
``(2) Agreements.--The cooperative agreements established
under paragraph (1) shall advance the goals of the National
Initiative for Cybersecurity Education Cybersecurity
Workforce Framework (NIST Special Publication 800-181), or
successor framework, by facilitating local and regional
partnerships--
``(A) to identify the workforce needs of the local economy
and classify such workforce in accordance with such
framework;
``(B) to identify the education, training, apprenticeship,
and other opportunities available in the local economy; and
``(C) to support opportunities to meet the needs of the
local economy.
``(3) Financial assistance.--
``(A) Financial assistance authorized.--The Director may
award financial assistance to a regional alliance or
partnership with whom the Director enters into a cooperative
agreement under paragraph (1) in order to assist the regional
alliance or partnership in carrying out the term of the
cooperative agreement.
``(B) Amount of assistance.--The aggregate amount of
financial assistance awarded under subparagraph (A) per
cooperative agreement shall not exceed $200,000.
``(C) Matching requirement.--The Director may not award
financial assistance to a regional alliance or partnership
under subparagraph (A) unless the regional alliance or
partnership agrees that, with respect to the costs to be
incurred by the regional alliance or partnership in carrying
out the cooperative agreement for which the assistance was
awarded, the regional alliance or partnership will make
available (directly or through donations from public or
private entities) non-Federal contributions in an amount
equal to 50 percent of Federal funds provided under the
award.
``(4) Application.--
``(A) In general.--A regional alliance or partnership
seeking to enter into a cooperative agreement under paragraph
(1) and receive financial assistance under paragraph (3)
shall submit to the Director an application therefor at such
time, in such manner, and containing such information as the
Director may require.
``(B) Requirements.--Each application submitted under
subparagraph (A) shall include the following:
``(i)(I) A plan to establish (or identification of, if it
already exists) a multistakeholder workforce partnership that
includes--
``(aa) at least one institution of higher education or
nonprofit training organization; and
``(bb) at least one local employer or owner or operator of
critical infrastructure.
``(II) Participation from Federal Cyber Scholarships for
Service organizations, advanced technological education
programs, elementary and secondary schools, training and
certification providers, State and local governments,
economic development organizations, or other community
organizations is encouraged.
``(ii) A description of how the workforce partnership would
identify the workforce needs of the local economy.
``(iii) A description of how the multistakeholder workforce
partnership would leverage the programs and objectives of the
National Initiative for Cybersecurity Education, such as the
Cybersecurity Workforce Framework and the strategic plan of
such initiative.
``(iv) A description of how employers in the community will
be recruited to support internships, externships,
apprenticeships, or cooperative education programs in
conjunction with providers of education and training.
Inclusion of programs that seek to include women, minorities,
or veterans is encouraged.
``(v) A definition of the metrics that will be used to
measure the success of the efforts of the regional alliance
or partnership under the agreement.
``(C) Priority consideration.--In awarding financial
assistance under paragraph (3)(A), the Director shall give
priority consideration to a regional alliance or partnership
that includes an institution of higher education which
receives an award under the Federal Cyber Scholarship for
Service program located in the State or region of the
regional alliance or partnership.
``(5) Audits.--Each cooperative agreement for which
financial assistance is awarded under paragraph (3) shall be
subject to audit requirements under part 200 of title 2, Code
of Federal Regulations (relating to uniform administrative
requirements, cost principles, and audit requirements for
Federal awards), or successor regulation.
``(6) Reports.--
``(A) In general.--Upon completion of a cooperative
agreement under paragraph (1), the regional alliance or
partnership that participated in the agreement shall submit
to the Director a report on the activities of the regional
alliance or partnership under the agreement, which may
include training and education outcomes.
``(B) Contents.--Each report submitted under subparagraph
(A) by a regional alliance or partnership shall include the
following:
``(i) An assessment of efforts made by the regional
alliance or partnership to carry out paragraph (2).
``(ii) The metrics used by the regional alliance or
partnership to measure the success of the efforts of the
regional alliance or partnership under the cooperative
agreement.''.
(g) Transfer of Section.--
(1) Transfer.--Such section is transferred to the end of
title III of such Act and redesignated as section 303.
(2) Repeal.--Title IV of such Act is repealed.
(3) Clerical.--The table of contents in section 1(b) of
such Act is amended--
(A) by striking the items relating to title IV and section
401; and
(B) by inserting after the item relating to section 302 the
following:
``Sec. 303. National cybersecurity awareness and education program.''.
(4) Conforming amendments.--
(A) Section 302(3) of the Federal Cybersecurity Workforce
Assessment Act of 2015 (Public Law 114-113) is amended by
striking ``under section 401 of the Cybersecurity Enhancement
Act of 2014 (15 U.S.C. 7451)'' and inserting ``under section
303 of the Cybersecurity Enhancement Act of 2014 (Public Law
113-274)''.
(B) Section 2(c)(3) of the NIST Small Business
Cybersecurity Act (Public Law 115-236) is amended by striking
``under section 401 of the Cybersecurity Enhancement Act of
2014 (15 U.S.C. 7451)'' and inserting ``under section 303 of
the Cybersecurity Enhancement Act of 2014 (Public Law 113-
274)''.
(C) Section 302(f) of the Cybersecurity Enhancement Act of
2014 (15 U.S.C. 7442(f)) is amended by striking ``under
section 401'' and inserting ``under section 303''.
SEC. __. DEVELOPMENT OF STANDARDS AND GUIDELINES FOR
IMPROVING CYBERSECURITY WORKFORCE OF FEDERAL
AGENCIES.
(a) In General.--Section 20(a) of the National Institute of
Standards and Technology Act (15 U.S.C. 278g-3(a)) is
amended--
(1) in paragraph (3), by striking ``; and'' and inserting a
semicolon;
(2) in paragraph (4), by striking the period at the end and
inserting ``; and''; and
(3) by adding at the end the following:
``(5) identify and develop standards and guidelines for
improving the cybersecurity workforce for an agency as part
of the National Initiative for Cybersecurity Education (NICE)
Cybersecurity Workforce Framework (NIST Special Publication
800-181), or successor framework.''.
(b) Publication of Standards and Guidelines on
Cybersecurity Awareness.--Not later than 3 years after the
date of the enactment of this Act and pursuant to section 20
of the National Institute of Standards and Technology Act (15
U.S.C. 278g-3), the Director of the National Institute of
Standards and Technology shall publish standards and
guidelines for improving cybersecurity
[[Page S3571]]
awareness of employees and contractors of Federal agencies.
SEC. __. MODIFICATIONS TO FEDERAL CYBER SCHOLARSHIP-FOR-
SERVICE PROGRAM.
Section 302 of the Cybersecurity Enhancement Act of 2014
(15 U.S.C. 7442) is amended--
(1) in subsection (b)--
(A) in paragraph (2), by striking ``information
technology'' and inserting ``information technology and
cybersecurity'';
(B) by amending paragraph (3) to read as follows:
``(3) prioritize the placement of scholarship recipients
fulfilling the post-award employment obligation under this
section to ensure that--
``(A) not less than 70 percent of such recipients are
placed in an executive agency (as defined in section 105 of
title 5, United States Code);
``(B) not more than 10 percent of such recipients are
placed as educators in the field of cybersecurity at
qualified institutions of higher education that provide
scholarships under this section; and
``(C) not more than 20 percent of such recipients are
placed in positions described in paragraphs (2) through (5)
of subsection (d); and''; and
(C) in paragraph (4), in the matter preceding subparagraph
(A), by inserting ``, including by seeking to provide awards
in coordination with other relevant agencies for summer
cybersecurity camp or other experiences, including teacher
training, in each of the 50 States,'' after ``cybersecurity
education'';
(2) in subsection (d)--
(A) in paragraph (4), by striking ``or'' at the end;
(B) in paragraph (5), by striking the period at the end and
inserting ``; or''; and
(C) by adding at the end the following:
``(6) as provided by subsection (b)(3)(B), a qualified
institution of higher education.''; and
(3) in subsection (m)--
(A) in paragraph (1), in the matter preceding subparagraph
(A), by striking ``cyber'' and inserting ``cybersecurity'';
and
(B) in paragraph (2), by striking ``cyber'' and inserting
``cybersecurity''.
SEC. __. MODIFICATIONS TO FEDERAL CYBER SCHOLARSHIP-FOR-
SERVICE PROGRAM.
Section 302 of the Cybersecurity Enhancement Act of 2014
(15 U.S.C. 7442) is amended--
(1) in subsection (f)--
(A) in paragraph (4), by striking ``; and'' and inserting a
semicolon; and
(B) by striking paragraph (5) and inserting the following:
``(5) enter into an agreement accepting and acknowledging
the post award employment obligations, pursuant to section
(d);
``(6) accept and acknowledge the conditions of support
under section (g); and
``(7) accept all terms and conditions of a scholarship
under this section.'';
(2) in subsection (g)--
(A) in paragraph (1), by inserting ``the Office of
Personnel Management, in coordination with the National
Science Foundation, and'' before ``the qualified
institution'';
(B) in paragraph (2)--
(i) in subparagraph (D), by striking ``; or'' and inserting
a semicolon; and
(ii) by striking subparagraph (E) and inserting the
following:
``(E) fails to maintain or fulfill any of the post-
graduation or post-award obligations or requirements of the
individual; or
``(F) fails to fulfill the requirements of paragraph
(1).'';
(3) in subsection (h)(2), by inserting ``and the Director
of the Office of Personnel Management'' after ``Foundation'';
(4) in subsection (k)(1)(A), by striking ``and the
Director'' and all that follows and inserting ``, the
Director of the National Science Foundation, and the Director
of the Office of Personnel Management of the amounts owed;
and''; and
(5) in subsection (m)(2), by striking ``once every 3
years'' and all that follows and inserting ``once every 2
years, to the Committee on Commerce, Science, and
Transportation and the Committee on Homeland Security and
Governmental Affairs of the Senate and the Committee on
Science, Space, and Technology and the Committee on Oversight
and Reform of the House of Representatives a report,
including--''
(A) ``the results of the evaluation under paragraph (1);''
(B) ``the disparity in any reporting between scholarship
recipients and their respective institutions of higher
education; and''
(C) ``any recent statistics regarding the size,
composition, and educational requirements of the Federal
cyber workforce.''
SEC. __. CYBERSECURITY IN PROGRAMS OF THE NATIONAL SCIENCE
FOUNDATION.
(a) Computer Science and Cybersecurity Education
Research.--Section 310 of the American Innovation and
Competitiveness Act (42 U.S.C. 1862s-7) is amended--
(1) in subsection (b)--
(A) in paragraph (1), by inserting ``and cybersecurity''
after ``computer science''; and
(B) in paragraph (2)--
(i) in subparagraph (C), by striking ``; and'' and
inserting a semicolon;
(ii) in subparagraph (D), by striking the period at the end
and inserting ``; and''; and
(iii) by adding at the end the following:
``(E) tools and models for the integration of cybersecurity
and other interdisciplinary efforts into computer science
education and computational thinking at secondary and
postsecondary levels of education.''; and
(2) in subsection (c), by inserting ``, cybersecurity,''
after ``computing''.
(b) Scientific and Technical Education.--Section 3(j)(9) of
the Scientific and Advanced-Technology Act of 1992 (42 U.S.C.
1862i(j)(9)) is amended by inserting ``and cybersecurity''
after ``computer science''.
(c) Low-Income Scholarship Program.--Section 414(d) of the
American Competitiveness and Workforce Improvement Act of
1998 (42 U.S.C. 1869c) is amended--
(1) in paragraph (1), by striking ``or computer science''
and inserting ``computer science, or cybersecurity''; and
(2) in paragraph (2)(A)(iii), by inserting
``cybersecurity,'' after ``computer science,''.
(d) Scholarships and Graduate Fellowships.--The Director of
the National Science Foundation shall ensure that students
pursuing master's degrees and doctoral degrees in fields
relating to cybersecurity are considered as applicants for
scholarships and graduate fellowships under the Graduate
Research Fellowship Program under section 10 of the National
Science Foundation Act of 1950 (42 U.S.C. 1869).
(e) Presidential Awards for Teaching Excellence.--The
Director of the National Science Foundation shall ensure that
educators and mentors in fields relating to cybersecurity can
be considered for--
(1) Presidential Awards for Excellence in Mathematics and
Science Teaching made under section 117 of the National
Science Foundation Authorization Act of 1988 (42 U.S.C.
1881b); and
(2) Presidential Awards for Excellence in STEM Mentoring
administered under section 307 of the American Innovation and
Competitiveness Act (42 U.S.C. 1862s-6).
SEC. __. CYBERSECURITY IN STEM PROGRAMS OF THE NATIONAL
AERONAUTICS AND SPACE ADMINISTRATION.
In carrying out any STEM education program of the National
Aeronautics and Space Administration (referred to in this
section as ``NASA''), including a program of the Office of
STEM Engagement, the Administrator of NASA shall, to the
maximum extent practicable, encourage the inclusion of
cybersecurity education opportunities in such program.
SEC. __. CYBERSECURITY IN DEPARTMENT OF TRANSPORTATION
PROGRAMS.
(a) University Transportation Centers Program.--Section
5505 of title 49, United States Code, is amended--
(1) in subsection (a)(2)(C), by inserting ``in the matters
described in subparagraphs (A) through (G) of section
6503(c)(1)'' after ``transportation leaders''; and
(2) in subsection (c)(3)(E)--
(A) by inserting ``, including the cybersecurity
implications of technologies relating to connected vehicles,
connected infrastructure, and autonomous vehicles'' after
``autonomous vehicles''; and
(B) by striking ``The Secretary'' and inserting the
following:
``(i) In general.--A regional university transportation
center receiving a grant under this paragraph shall carry out
research focusing on 1 or more of the matters described in
subparagraphs (A) through (G) of section 6503(c)(1).
``(ii) Focused objectives.--The Secretary''.
(b) Transportation Research and Development 5-Year
Strategic Plan.--Section 6503(c)(1) of title 49, United
States Code, is amended--
(1) in subparagraph (E), by striking ``and'' at the end;
(2) in subparagraph (F), by inserting ``and'' after the
semicolon at the end; and
(3) by adding at the end the following:
``(G) reducing transportation cybersecurity risks;''.
SEC. __. NATIONAL CYBERSECURITY CHALLENGES.
(a) In General.--Title II of the Cybersecurity Enhancement
Act of 2014 (15 U.S.C. 7431 et seq.) is amended by adding at
the end the following:
``SEC. 205. NATIONAL CYBERSECURITY CHALLENGES.
``(a) Establishment of National Cybersecurity Challenges.--
``(1) In general.--To achieve high-priority breakthroughs
in cybersecurity by 2028, the Secretary of Commerce shall
establish the following national cybersecurity challenges:
``(A) Economics of a cyber attack.--Building more resilient
systems that measurably and exponentially raise adversary
costs of carrying out common cyber attacks.
``(B) Cyber training.--
``(i) Empowering the people of the United States with an
appropriate and measurably sufficient level of digital
literacy to make safe and secure decisions online.
``(ii) Developing a cybersecurity workforce with measurable
skills to protect and maintain information systems.
``(C) Emerging technology.--Advancing cybersecurity efforts
in response to emerging technology, such as artificial
intelligence, quantum science, and next generation
communications technologies.
``(D) Reimagining digital identity.--Maintaining a high
sense of usability while improving the security and safety of
online activity of individuals in the United States.
``(E) Federal agency resilience.--Reducing cybersecurity
risks to Federal networks and systems, and improving the
response of Federal agencies to cybersecurity incidents on
such networks and systems.
[[Page S3572]]
``(2) Coordination.--In establishing the challenges under
paragraph (1), the Secretary shall coordinate with the
Secretary of Homeland Security on the challenges under
subparagraphs (B) and (E) of such paragraph.
``(b) Pursuit of National Cybersecurity Challenges.--
``(1) In general.--Not later than 180 days after the date
of the enactment of this section, the Secretary, acting
through the Under Secretary of Commerce for Standards and
Technology, shall commence efforts to pursue the national
cybersecurity challenges established under subsection (a).
``(2) Competitions.--The efforts required by paragraph (1)
shall include carrying out programs to award prizes,
including cash and noncash prizes, competitively pursuant to
the authorities and processes established under section 24 of
the Stevenson-Wydler Technology Innovation Act of 1980 (15
U.S.C. 3719) or any other applicable provision of law.
``(3) Additional authorities.--In carrying out paragraph
(1), the Secretary may enter into and perform such other
transactions as the Secretary considers necessary and on such
terms as the Secretary considers appropriate.
``(4) Coordination.--In pursuing national cybersecurity
challenges under paragraph (1), the Secretary shall
coordinate with the following:
``(A) The Director of the National Science Foundation.
``(B) The Secretary of Homeland Security.
``(C) The Director of the Defense Advanced Research
Projects Agency.
``(D) The Director of the Office of Science and Technology
Policy.
``(E) The Director of the Office of Management and Budget.
``(F) The Administrator of the General Services
Administration.
``(G) The Federal Trade Commission.
``(H) The heads of such other Federal agencies as the
Secretary of Commerce considers appropriate for purposes of
this section.
``(5) Solicitation of acceptance of funds.--
``(A) In general.--Pursuant to section 24 of the Stevenson-
Wydler Technology Innovation Act of 1980 (15 U.S.C. 3719),
the Secretary shall request and accept funds from other
Federal agencies, State, United States territory, local, or
tribal government agencies, private sector for-profit
entities, and nonprofit entities to support efforts to pursue
a national cybersecurity challenge under this section.
``(B) Rule of construction.--Nothing in subparagraph (A)
shall be construed to require any person or entity to provide
funds or otherwise participate in an effort or competition
under this section.
``(c) Recommendations.--
``(1) In general.--In carrying out this section, the
Secretary of Commerce shall designate an advisory council to
seek recommendations.
``(2) Elements.--The recommendations required by paragraph
(1) shall include the following:
``(A) A scope for efforts carried out under subsection (b).
``(B) Metrics to assess submissions for prizes under
competitions carried out under subsection (b) as the
submissions pertain to the national cybersecurity challenges
established under subsection (a).
``(3) No additional compensation.--The Secretary may not
provide any additional compensation, except for travel
expenses, to a member of the advisory council designated
under paragraph (1) for participation in the advisory
council.''.
(b) Conforming Amendments.--Section 201(a)(1) of such Act
is amended--
(1) in subparagraph (J), by striking ``; and'' and
inserting a semicolon;
(2) by redesignating subparagraph (K) as subparagraph (L);
and
(3) by inserting after subparagraph (J) the following:
``(K) implementation of section 205 through research and
development on the topics identified under subsection (a) of
such section; and''.
(c) Clerical Amendment.--The table of contents in section
1(b) of such Act is amended by inserting after the item
relating to section 204 the following:
``Sec. 205. National Cybersecurity Challenges.''.
______