    [United States Statutes at Large, Volume 128, 113th Congress, 2nd Session]
    [From the U.S. Government Publishing Office, www.gpo.gov]

    Public Law 113-274
    113th Congress

    An Act

    To provide for an ongoing, voluntary public-private partnership to
    improve cybersecurity, and to strengthen cybersecurity research and
    development, workforce development and education, and public awareness
    and preparedness, and for other purposes. <>

    Be it enacted by the Senate and House of Representatives of the
    United States of America in Congress assembled, <>
    SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

    (a) <>  Short Title.--This Act may be cited
    as the ``Cybersecurity Enhancement Act of 2014''.

    (b) Table of Contents.--The table of contents of this Act is as
    follows:

    Sec. 1. Short title; table of contents.
    Sec. 2. Definitions.
    Sec. 3. No regulatory authority.
    Sec. 4. No additional funds authorized.

    TITLE I--PUBLIC-PRIVATE COLLABORATION ON CYBERSECURITY

    Sec. 101. Public-private collaboration on cybersecurity.

    TITLE II--CYBERSECURITY RESEARCH AND DEVELOPMENT

    Sec. 201. Federal cybersecurity research and development.
    Sec. 202. Computer and network security research centers.
    Sec. 203. Cybersecurity automation and checklists for government
    systems.
    Sec. 204. National Institute of Standards and Technology cybersecurity
    research and development.

    TITLE III--EDUCATION AND WORKFORCE DEVELOPMENT

    Sec. 301. Cybersecurity competitions and challenges.
    Sec. 302. Federal cyber scholarship-for-service program.

    TITLE IV--CYBERSECURITY AWARENESS AND PREPAREDNESS

    Sec. 401. National cybersecurity awareness and education program.

    TITLE V--ADVANCEMENT OF CYBERSECURITY TECHNICAL STANDARDS

    Sec. 501. Definitions.
    Sec. 502. International cybersecurity technical standards.
    Sec. 503. Cloud computing strategy.
    Sec. 504. Identity management research and development.

    SEC. 2. <>  DEFINITIONS.

    In this Act:
    (1) Cybersecurity mission.--The term ``cybersecurity
    mission'' means activities that encompass the full range of
    threat reduction, vulnerability reduction, deterrence,
    international engagement, incident response, resiliency, and
    recovery policies

    [[Page 2972]]

    and activities, including computer network operations,
    information assurance, law enforcement, diplomacy, military, and
    intelligence missions as such activities relate to the security
    and stability of cyberspace.
    (2) Information system.--The term ``information system'' has
    the meaning given that term in section 3502 of title 44, United
    States Code.
    SEC. 3. <>  NO REGULATORY AUTHORITY.

    Nothing in this Act shall be construed to confer any regulatory
    authority on any Federal, State, tribal, or local department or agency.
    SEC. 4. <>  NO ADDITIONAL FUNDS AUTHORIZED.

    No additional funds are authorized to carry out this Act, and the
    amendments made by this Act. This Act, and the amendments made by this
    Act, shall be carried out using amounts otherwise authorized or
    appropriated.

    TITLE I--PUBLIC-PRIVATE COLLABORATION ON CYBERSECURITY

    SEC. 101. PUBLIC-PRIVATE COLLABORATION ON CYBERSECURITY.

    (a) Cybersecurity.--Section 2(c) of the National Institute of
    Standards and Technology Act (15 U.S.C. 272(c)) is amended--
    (1) by redesignating paragraphs (15) through (22) as
    paragraphs (16) through (23), respectively; and
    (2) by inserting after paragraph (14) the following:
    ``(15) on an ongoing basis, facilitate and support the
    development of a voluntary, consensus-based, industry-led set of
    standards, guidelines, best practices, methodologies,
    procedures, and processes to cost-effectively reduce cyber risks
    to critical infrastructure (as defined under subsection (e));''.

    (b) Scope and Limitations.--Section 2 of the National Institute of
    Standards and Technology Act (15 U.S.C. 272) is amended by adding at the
    end the following:
    ``(e) Cyber Risks.--
    ``(1) In general.--In carrying out the activities under
    subsection (c)(15), the Director--
    ``(A) shall--
    ``(i) <>  coordinate
    closely and regularly with relevant private sector
    personnel and entities, critical infrastructure
    owners and operators, and other relevant industry
    organizations, including Sector Coordinating
    Councils and Information Sharing and Analysis
    Centers, and incorporate industry expertise;
    ``(ii) <>  consult with
    the heads of agencies with national security
    responsibilities, sector-specific agencies and
    other appropriate agencies, State and local
    governments, the governments of other nations, and
    international organizations;
    ``(iii) identify a prioritized, flexible,
    repeatable, performance-based, and cost-effective
    approach, including information security measures
    and controls,

    [[Page 2973]]

    that may be voluntarily adopted by owners and
    operators of critical infrastructure to help them
    identify, assess, and manage cyber risks;
    ``(iv) include methodologies--
    ``(I) to identify and mitigate
    impacts of the cybersecurity measures or
    controls on business confidentiality;
    and
    ``(II) to protect individual privacy
    and civil liberties;
    ``(v) incorporate voluntary consensus
    standards and industry best practices;
    ``(vi) align with voluntary international
    standards to the fullest extent possible;
    ``(vii) prevent duplication of regulatory
    processes and prevent conflict with or superseding
    of regulatory requirements, mandatory standards,
    and related processes; and
    ``(viii) include such other similar and
    consistent elements as the Director considers
    necessary; and
    ``(B) shall not prescribe or otherwise require--
    ``(i) the use of specific solutions;
    ``(ii) the use of specific information or
    communications technology products or services; or
    ``(iii) that information or communications
    technology products or services be designed,
    developed, or manufactured in a particular manner.
    ``(2) Limitation.--Information shared with or provided to
    the Institute for the purpose of the activities described under
    subsection (c)(15) shall not be used by any Federal, State,
    tribal, or local department or agency to regulate the activity
    of any entity. Nothing in this paragraph shall be construed to
    modify any regulatory requirement to report or submit
    information to a Federal, State, tribal, or local department or
    agency.
    ``(3) Definitions.--In this subsection:
    ``(A) Critical infrastructure.--The term `critical
    infrastructure' has the meaning given the term in
    section 1016(e) of the USA PATRIOT Act of 2001 (42
    U.S.C. 5195c(e)).
    ``(B) Sector-specific agency.--The term `sector-
    specific agency' means the Federal department or agency
    responsible for providing institutional knowledge and
    specialized expertise as well as leading, facilitating,
    or supporting the security and resilience programs and
    associated activities of its designated critical
    infrastructure sector in the all-hazards environment.''.

    (c) Study and Reports.--
    (1) Study.--The Comptroller General of the United States
    shall conduct a study that assesses--
    (A) the progress made by the Director of the
    National Institute of Standards and Technology in
    facilitating the development of standards and procedures
    to reduce cyber risks to critical infrastructure in
    accordance with section 2(c)(15) of the National
    Institute of Standards and Technology Act, as added by
    this section;
    (B) the extent to which the Director's facilitation
    efforts are consistent with the directive in such
    section that the

    [[Page 2974]]

    development of such standards and procedures be
    voluntary and led by industry representatives;
    (C) the extent to which other Federal agencies have
    promoted and sectors of critical infrastructure (as
    defined in section 1016(e) of the USA PATRIOT Act of
    2001 (42 U.S.C. 5195c(e))) have adopted a voluntary,
    industry-led set of standards, guidelines, best
    practices, methodologies, procedures, and processes to
    reduce cyber risks to critical infrastructure in
    accordance with such section 2(c)(15);
    (D) the reasons behind the decisions of sectors of
    critical infrastructure (as defined in subparagraph (C))
    to adopt or to not adopt the voluntary standards
    described in subparagraph (C); and
    (E) the extent to which such voluntary standards
    have proved successful in protecting critical
    infrastructure from cyber threats.
    (2) Reports.--Not later than 1 year after the date of the
    enactment of this Act, and every 2 years thereafter for the
    following 6 years, the Comptroller General shall submit a
    report, which summarizes the findings of the study conducted
    under paragraph (1), to the Committee on Commerce, Science, and
    Transportation of the Senate and the Committee on Science,
    Space, and Technology of the House of Representatives.

    TITLE <>  II--CYBERSECURITY RESEARCH AND
    DEVELOPMENT
    SEC. 201. <>  FEDERAL CYBERSECURITY RESEARCH
    AND DEVELOPMENT.

    (a) Fundamental Cybersecurity Research.--
    (1) Federal cybersecurity research and development strategic
    plan.--The heads <>  of the applicable agencies
    and departments, working through the National Science and
    Technology Council and the Networking and Information Technology
    Research and Development Program, shall develop and update every
    4 years a Federal cybersecurity research and development
    strategic plan (referred to in this subsection as the
    ``strategic plan'') based on an assessment of cybersecurity risk
    to guide the overall direction of Federal cybersecurity and
    information assurance research and development for information
    technology and networking systems. The heads of the applicable
    agencies and departments shall build upon existing programs and
    plans to develop the strategic plan to meet objectives in
    cybersecurity, such as--
    (A) how to design and build complex software-
    intensive systems that are secure and reliable when
    first deployed;
    (B) how to test and verify that software and
    hardware, whether developed locally or obtained from a
    third party, is free of significant known security
    flaws;
    (C) how to test and verify that software and
    hardware obtained from a third party correctly
    implements stated functionality, and only that
    functionality;
    (D) how to guarantee the privacy of an individual,
    including that individual's identity, information, and
    lawful transactions when stored in distributed systems
    or transmitted over networks;

    [[Page 2975]]

    (E) how to build new protocols to enable the
    Internet to have robust security as one of the key
    capabilities of the Internet;
    (F) how to determine the origin of a message
    transmitted over the Internet;
    (G) how to support privacy in conjunction with
    improved security;
    (H) how to address the problem of insider threats;
    (I) how improved consumer education and digital
    literacy initiatives can address human factors that
    contribute to cybersecurity;
    (J) how to protect information processed,
    transmitted, or stored using cloud computing or
    transmitted through wireless services; and
    (K) any additional objectives the heads of the
    applicable agencies and departments, in coordination
    with the head of any relevant Federal agency and with
    input from stakeholders, including appropriate national
    laboratories, industry, and academia, determine
    appropriate.
    (2) Requirements.--
    (A) Contents of plan.--The strategic plan shall--
    (i) specify and prioritize near-term, mid-
    term, and long-term research objectives, including
    objectives associated with the research identified
    in section 4(a)(1) of the Cyber Security Research
    and Development Act (15 U.S.C. 7403(a)(1));
    (ii) specify how the near-term objectives
    described in clause (i) complement research and
    development areas in which the private sector is
    actively engaged;
    (iii) describe how the heads of the applicable
    agencies and departments will focus on innovative,
    transformational technologies with the potential
    to enhance the security, reliability, resilience,
    and trustworthiness of the digital infrastructure,
    and to protect consumer privacy;
    (iv) describe how the heads of the applicable
    agencies and departments will foster the rapid
    transfer of research and development results into
    new cybersecurity technologies and applications
    for the timely benefit of society and the national
    interest, including through the dissemination of
    best practices and other outreach activities;
    (v) describe how the heads of the applicable
    agencies and departments will establish and
    maintain a national research infrastructure for
    creating, testing, and evaluating the next
    generation of secure networking and information
    technology systems; and
    (vi) describe how the heads of the applicable
    agencies and departments will facilitate access by
    academic researchers to the infrastructure
    described in clause (v), as well as to relevant
    data, including event data.
    (B) Private sector efforts.--In developing,
    implementing, and updating the strategic plan, the heads
    of the applicable agencies and departments, working
    through the National Science and Technology Council and
    Networking and Information Technology Research and
    Development Program, shall work in close cooperation
    with

    [[Page 2976]]

    industry, academia, and other interested stakeholders to
    ensure, to the extent possible, that Federal
    cybersecurity research and development is not
    duplicative of private sector efforts.
    (C) Recommendations.--In developing and updating the
    strategic plan the heads of the applicable agencies and
    departments shall solicit recommendations and advice
    from--
    (i) the advisory committee established under
    section 101(b)(1) of the High-Performance
    Computing Act of 1991 (15 U.S.C. 5511(b)(1)); and
    (ii) a wide range of stakeholders, including
    industry, academia, including representatives of
    minority serving institutions and community
    colleges, National Laboratories, and other
    relevant organizations and institutions.
    (D) <>  Implementation roadmap.--
    The heads of the applicable agencies and departments,
    working through the National Science and Technology
    Council and Networking and Information Technology
    Research and Development Program, shall develop and
    annually update an implementation roadmap for the
    strategic plan. The implementation roadmap shall--
    (i) specify the role of each Federal agency in
    carrying out or sponsoring research and
    development to meet the research objectives of the
    strategic plan, including a description of how
    progress toward the research objectives will be
    evaluated;
    (ii) specify the funding allocated to each
    major research objective of the strategic plan and
    the source of funding by agency for the current
    fiscal year;
    (iii) <>  estimate the
    funding required for each major research objective
    of the strategic plan for the following 3 fiscal
    years; and
    (iv) track ongoing and completed Federal
    cybersecurity research and development projects.
    (3) Reports to congress.--The heads of the applicable
    agencies and departments, working through the National Science
    and Technology Council and Networking and Information Technology
    Research and Development Program, shall submit to the Committee
    on Commerce, Science, and Transportation of the Senate and the
    Committee on Science, Space, and Technology of the House of
    Representatives--
    (A) the strategic plan not later than 1 year after
    the date of enactment of this Act;
    (B) each quadrennial update to the strategic plan;
    and
    (C) the implementation roadmap under subparagraph
    (D), and its annual updates, which shall be appended to
    the annual report required under section 101(a)(2)(D) of
    the High-Performance Computing Act of 1991 (15 U.S.C.
    5511(a)(2)(D)).
    (4) Definition of applicable agencies and departments.--In
    this subsection, the term ``applicable agencies and
    departments'' means the agencies and departments identified in
    clauses (i) through (x) of section 101(a)(3)(B) of the High-
    Performance Computing Act of 1991 (15 U.S.C. 5511(a)(3)(B)) or
    designated under clause (xi) of that section.

    [[Page 2977]]

    (b) Cybersecurity Practices Research.--The Director of the National
    Science Foundation shall support research that--
    (1) develops, evaluates, disseminates, and integrates new
    cybersecurity practices and concepts into the core curriculum of
    computer science programs and of other programs where graduates
    of such programs have a substantial probability of developing
    software after graduation, including new practices and concepts
    relating to secure coding education and improvement programs;
    and
    (2) develops new models for professional development of
    faculty in cybersecurity education, including secure coding
    development.

    (c) Cybersecurity Modeling and Test Beds.--
    (1) <>  Review.--Not later than 1 year
    after the date of enactment of this Act, the Director of the
    National Science Foundation, in coordination with the Director
    of the Office of Science and Technology Policy, shall conduct a
    review of cybersecurity test beds in existence on the date of
    enactment of this Act to inform the grants under paragraph (2).
    The <>  review shall include an assessment of
    whether a sufficient number of cybersecurity test beds are
    available to meet the research needs under the Federal
    cybersecurity research and development strategic plan. Upon
    completion, the Director shall submit the review to the
    Committee on Commerce, Science, and Transportation of the Senate
    and the Committee on Science, Space, and Technology of the House
    of Representatives.
    (2) <>  Additional cybersecurity modeling and
    test beds.--
    (A) <>  In
    general.--If the Director of the National Science
    Foundation, after the review under paragraph (1),
    determines that the research needs under the Federal
    cybersecurity research and development strategic plan
    require the establishment of additional cybersecurity
    test beds, the Director of the National Science
    Foundation, in coordination with the Secretary of
    Commerce and the Secretary of Homeland Security, may
    award grants to institutions of higher education or
    research and development non-profit institutions to
    establish cybersecurity test beds.
    (B) Requirement.--The cybersecurity test beds under
    subparagraph (A) shall be sufficiently robust in order
    to model the scale and complexity of real-time cyber
    attacks and defenses on real world networks and
    environments.
    (C) <>
    Assessment required.--The Director of the National
    Science Foundation, in coordination with the Secretary
    of Commerce and the Secretary of Homeland Security,
    shall evaluate the effectiveness of any grants awarded
    under this subsection in meeting the objectives of the
    Federal cybersecurity research and development strategic
    plan not later than 2 years after the review under
    paragraph (1) of this subsection, and periodically
    thereafter.

    (d) Coordination With Other Research Initiatives.--In accordance
    with the responsibilities under section 101 of the High-Performance
    Computing Act of 1991 (15 U.S.C. 5511), the Director of the Office of
    Science and Technology Policy shall coordinate, to the extent
    practicable, Federal research and development activities under this
    section with other ongoing research and development security-related
    initiatives, including research being conducted by--

    [[Page 2978]]

    (1) the National Science Foundation;
    (2) the National Institute of Standards and Technology;
    (3) the Department of Homeland Security;
    (4) other Federal agencies;
    (5) other Federal and private research laboratories,
    research entities, and universities;
    (6) institutions of higher education;
    (7) relevant nonprofit organizations; and
    (8) international partners of the United States.

    (e) National Science Foundation Computer and Network Security
    Research Grant Areas.--Section 4(a)(1) of the Cyber Security Research
    and Development Act (15 U.S.C. 7403(a)(1)) is amended--
    (1) in subparagraph (H), by striking ``and'' at the end;
    (2) in subparagraph (I), by striking the period at the end
    and inserting a semicolon; and
    (3) by adding at the end the following:
    ``(J) secure fundamental protocols that are integral
    to inter-network communications and data exchange;
    ``(K) secure software engineering and software
    assurance, including--
    ``(i) programming languages and systems that
    include fundamental security features;
    ``(ii) portable or reusable code that remains
    secure when deployed in various environments;
    ``(iii) verification and validation
    technologies to ensure that requirements and
    specifications have been implemented; and
    ``(iv) models for comparison and metrics to
    assure that required standards have been met;
    ``(L) holistic system security that--
    ``(i) addresses the building of secure systems
    from trusted and untrusted components;
    ``(ii) proactively reduces vulnerabilities;
    ``(iii) addresses insider threats; and
    ``(iv) supports privacy in conjunction with
    improved security;
    ``(M) monitoring and detection;
    ``(N) mitigation and rapid recovery methods;
    ``(O) security of wireless networks and mobile
    devices; and
    ``(P) security of cloud infrastructure and
    services.''.

    (f) Research on the Science of Cybersecurity.--The head of each
    agency and department identified under section 101(a)(3)(B) of the High-
    Performance Computing Act of 1991 (15 U.S.C. 5511(a)(3)(B)), through
    existing programs and activities, shall support research that will lead
    to the development of a scientific foundation for the field of
    cybersecurity, including research that increases understanding of the
    underlying principles of securing complex networked systems, enables
    repeatable experimentation, and creates quantifiable security metrics.
    SEC. 202. COMPUTER AND NETWORK SECURITY RESEARCH CENTERS.

    Section 4(b) of the Cyber Security Research and Development Act (15
    U.S.C. 7403(b)) is amended--
    (1) in paragraph (3), by striking ``the research areas'' and
    inserting the following: ``improving the security and resiliency

    [[Page 2979]]

    of information technology, reducing cyber vulnerabilities, and
    anticipating and mitigating consequences of cyber attacks on
    critical infrastructure, by conducting research in the areas'';
    (2) by striking ``the center'' in paragraph (4)(D) and
    inserting ``the Center''; and
    (3) in paragraph (5)--
    (A) by striking ``and'' at the end of subparagraph
    (C);
    (B) by striking the period at the end of
    subparagraph (D) and inserting a semicolon; and
    (C) by adding at the end the following:
    ``(E) the demonstrated capability of the applicant
    to conduct high performance computation integral to
    complex computer and network security research, through
    on-site or off-site computing;
    ``(F) the applicant's affiliation with private
    sector entities involved with industrial research
    described in subsection (a)(1);
    ``(G) the capability of the applicant to conduct
    research in a secure environment;
    ``(H) the applicant's affiliation with existing
    research programs of the Federal Government;
    ``(I) the applicant's experience managing public-
    private partnerships to transition new technologies into
    a commercial setting or the government user community;
    ``(J) the capability of the applicant to conduct
    interdisciplinary cybersecurity research, basic and
    applied, such as in law, economics, or behavioral
    sciences; and
    ``(K) the capability of the applicant to conduct
    research in areas such as systems security, wireless
    security, networking and protocols, formal methods and
    high-performance computing, nanotechnology, or
    industrial control systems.''.
    SEC. 203. CYBERSECURITY AUTOMATION AND CHECKLISTS FOR GOVERNMENT
    SYSTEMS.

    Section 8(c) of the Cyber Security Research and Development Act (15
    U.S.C. 7406(c)) is amended to read as follows:
    ``(c) Security Automation and Checklists for Government Systems.--
    ``(1) In general.--The Director of the National Institute of
    Standards and Technology shall, as necessary, develop and revise
    security automation standards, associated reference materials
    (including protocols), and checklists providing settings and
    option selections that minimize the security risks associated
    with each information technology hardware or software system and
    security tool that is, or is likely to become, widely used
    within the Federal Government, thereby enabling standardized and
    interoperable technologies, architectures, and frameworks for
    continuous monitoring of information security within the Federal
    Government.
    ``(2) Priorities for development.--The Director of the
    National Institute of Standards and Technology shall establish
    priorities for the development of standards, reference
    materials, and checklists under this subsection on the basis
    of--
    ``(A) the security risks associated with the use of
    the system;

    [[Page 2980]]

    ``(B) the number of agencies that use a particular
    system or security tool;
    ``(C) the usefulness of the standards, reference
    materials, or checklists to Federal agencies that are
    users or potential users of the system;
    ``(D) the effectiveness of the associated standard,
    reference material, or checklist in creating or enabling
    continuous monitoring of information security; or
    ``(E) such other factors as the Director of the
    National Institute of Standards and Technology
    determines to be appropriate.
    ``(3) Excluded systems.--The Director of the National
    Institute of Standards and Technology may exclude from the
    application of paragraph (1) any information technology hardware
    or software system or security tool for which such Director
    determines that the development of a standard, reference
    material, or checklist is inappropriate because of the
    infrequency of use of the system, the obsolescence of the
    system, or the lack of utility or impracticability of developing
    a standard, reference material, or checklist for the system.
    ``(4) Dissemination of standards and related materials.--The
    Director of the National Institute of Standards and Technology
    shall ensure that Federal agencies are informed of the
    availability of any standard, reference material, checklist, or
    other item developed under this subsection.
    ``(5) Agency use requirements.--The development of
    standards, reference materials, and checklists under paragraph
    (1) for an information technology hardware or software system or
    tool does not--
    ``(A) require any Federal agency to select the
    specific settings or options recommended by the
    standard, reference material, or checklist for the
    system;
    ``(B) establish conditions or prerequisites for
    Federal agency procurement or deployment of any such
    system;
    ``(C) imply an endorsement of any such system by the
    Director of the National Institute of Standards and
    Technology; or
    ``(D) preclude any Federal agency from procuring or
    deploying other information technology hardware or
    software systems for which no such standard, reference
    material, or checklist has been developed or identified
    under paragraph (1).''.
    SEC. 204. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY
    CYBERSECURITY RESEARCH AND DEVELOPMENT.

    Section 20 of the National Institute of Standards and Technology Act
    (15 U.S.C. 278g-3) is amended--
    (1) by redesignating subsection (e) as subsection (f); and
    (2) by inserting after subsection (d) the following:

    ``(e) Intramural Security Research.--As part of the research
    activities conducted in accordance with subsection (d)(3), the Institute
    shall, to the extent practicable and appropriate--
    ``(1) conduct a research program to develop a unifying and
    standardized identity, privilege, and access control management
    framework for the execution of a wide variety of resource
    protection policies and that is amenable to implementation
    within

    [[Page 2981]]

    a wide variety of existing and emerging computing environments;
    ``(2) carry out research associated with improving the
    security of information systems and networks;
    ``(3) carry out research associated with improving the
    testing, measurement, usability, and assurance of information
    systems and networks;
    ``(4) carry out research associated with improving security
    of industrial control systems;
    ``(5) carry out research associated with improving the
    security and integrity of the information technology supply
    chain; and
    ``(6) carry out any additional research the Institute
    determines appropriate.''.

    TITLE <>  III--EDUCATION AND WORKFORCE
    DEVELOPMENT
    SEC. 301. <>  CYBERSECURITY COMPETITIONS AND
    CHALLENGES.

    (a) <>  In General.--The Secretary of Commerce,
    Director of the National Science Foundation, and Secretary of Homeland
    Security, in consultation with the Director of the Office of Personnel
    Management, shall--
    (1) support competitions and challenges under section 24 of
    the Stevenson-Wydler Technology Innovation Act of 1980 (15
    U.S.C. 3719) (as amended by section 105 of the America COMPETES
    Reauthorization Act of 2010 (124 Stat. 3989)) or any other
    provision of law, as appropriate--
    (A) to identify, develop, and recruit talented
    individuals to perform duties relating to the security
    of information technology in Federal, State, local, and
    tribal government agencies, and the private sector; or
    (B) to stimulate innovation in basic and applied
    cybersecurity research, technology development, and
    prototype demonstration that has the potential for
    application to the information technology activities of
    the Federal Government; and
    (2) ensure the effective operation of the competitions and
    challenges under this section.

    (b) Participation.--Participants in the competitions and challenges
    under subsection (a)(1) may include--
    (1) students enrolled in grades 9 through 12;
    (2) students enrolled in a postsecondary program of study
    leading to a baccalaureate degree at an institution of higher
    education;
    (3) students enrolled in a postbaccalaureate program of
    study at an institution of higher education;
    (4) institutions of higher education and research
    institutions;
    (5) veterans; and
    (6) other groups or individuals that the Secretary of
    Commerce, Director of the National Science Foundation, and
    Secretary of Homeland Security determine appropriate.

    (c) Affiliation and Cooperative Agreements.--Competitions and
    challenges under this section may be carried out through affiliation and
    cooperative agreements with--

    [[Page 2982]]

    (1) Federal agencies;
    (2) regional, State, or school programs supporting the
    development of cyber professionals;
    (3) State, local, and tribal governments; or
    (4) other private sector organizations.

    (d) Areas of Skill.--Competitions and challenges under subsection
    (a)(1)(A) shall be designed to identify, develop, and recruit
    exceptional talent relating to--
    (1) ethical hacking;
    (2) penetration testing;
    (3) vulnerability assessment;
    (4) continuity of system operations;
    (5) security in design;
    (6) cyber forensics;
    (7) offensive and defensive cyber operations; and
    (8) other areas the Secretary of Commerce, Director of the
    National Science Foundation, and Secretary of Homeland Security
    consider necessary to fulfill the cybersecurity mission.

    (e) Topics.--In selecting topics for competitions and challenges
    under subsection (a)(1), the Secretary of Commerce, Director of the
    National Science Foundation, and Secretary of Homeland Security--
    (1) <>  shall consult widely both
    within and outside the Federal Government; and
    (2) may empanel advisory committees.

    (f) Internships.--The Director of the Office of Personnel Management
    may support, as appropriate, internships or other work experience in the
    Federal Government to the winners of the competitions and challenges
    under this section.
    SEC. 302. <>  FEDERAL CYBER SCHOLARSHIP-FOR-
    SERVICE PROGRAM.

    (a) <>  In General.--The Director of the
    National Science Foundation, in coordination with the Director of the
    Office of Personnel Management and Secretary of Homeland Security, shall
    continue a Federal cyber scholarship-for-service program to recruit and
    train the next generation of information technology professionals,
    industrial control system security professionals, and security managers
    to meet the needs of the cybersecurity mission for Federal, State,
    local, and tribal governments.

    (b) Program Description and Components.--The Federal Cyber
    Scholarship-for-Service Program shall--
    (1) provide scholarships through qualified institutions of
    higher education, including community colleges, to students who
    are enrolled in programs of study at institutions of higher
    education leading to degrees or specialized program
    certifications in the cybersecurity field;
    (2) provide the scholarship recipients with summer
    internship opportunities or other meaningful temporary
    appointments in the Federal information technology workforce;
    and
    (3) prioritize the employment placement of scholarship
    recipients in the Federal Government.

    (c) <>  Scholarship Amounts.--Each scholarship
    under subsection (b) shall be in an amount that covers the student's
    tuition and fees at the institution under subsection (b)(1) for not more
    than 3 years and provides the student with an additional stipend.

    [[Page 2983]]

    (d) Post-award Employment Obligations.--Each scholarship recipient,
    as a condition of receiving a scholarship under the program, shall enter
    into an agreement under which the recipient agrees to work in the
    cybersecurity mission of a Federal, State, local, or tribal agency for a
    period equal to the length of the scholarship following receipt of the
    student's degree.
    (e) Hiring Authority.--
    (1) Appointment in excepted service.--Notwithstanding any
    provision of chapter 33 of title 5, United States Code,
    governing appointments in the competitive service, an agency
    shall appoint in the excepted service an individual who has
    completed the eligible degree program for which a scholarship
    was awarded.
    (2) Noncompetitive conversion.--Except as provided in
    paragraph (4), upon fulfillment of the service term, an employee
    appointed under paragraph (1) may be converted noncompetitively
    to term, career-conditional or career appointment.
    (3) Timing of conversion.--An agency may noncompetitively
    convert a term employee appointed under paragraph (2) to a
    career-conditional or career appointment before the term
    appointment expires.
    (4) Authority to decline conversion.--An agency may decline
    to make the noncompetitive conversion or appointment under
    paragraph (2) for cause.

    (f) Eligibility.--To be eligible to receive a scholarship under this
    section, an individual shall--
    (1) be a citizen or lawful permanent resident of the United
    States;
    (2) demonstrate a commitment to a career in improving the
    security of information technology;
    (3) have demonstrated a high level of proficiency in
    mathematics, engineering, or computer sciences;
    (4) be a full-time student in an eligible degree program at
    a qualified institution of higher education, as determined by
    the Director of the National Science Foundation; and
    (5) accept the terms of a scholarship under this section.

    (g) Conditions of Support.--
    (1) In general.--As a condition of receiving a scholarship
    under this section, a recipient shall agree to provide the
    qualified institution of higher education with annual verifiable
    documentation of post-award employment and up-to-date contact
    information.
    (2) Terms.--A scholarship recipient under this section shall
    be liable to the United States as provided in subsection (i) if
    the individual--
    (A) fails to maintain an acceptable level of
    academic standing at the applicable institution of
    higher education, as determined by the Director of the
    National Science Foundation;
    (B) is dismissed from the applicable institution of
    higher education for disciplinary reasons;
    (C) withdraws from the eligible degree program
    before completing the program;
    (D) declares that the individual does not intend to
    fulfill the post-award employment obligation under this
    section; or

    [[Page 2984]]

    (E) fails to fulfill the post-award employment
    obligation of the individual under this section.

    (h) Monitoring Compliance.--As a condition of participating in the
    program, a qualified institution of higher education shall--
    (1) <>  enter into an agreement with the
    Director of the National Science Foundation, to monitor the
    compliance of scholarship recipients with respect to their post-
    award employment obligations; and
    (2) provide to the Director of the National Science
    Foundation, on an annual basis, the post-award employment
    documentation required under subsection (g)(1) for scholarship
    recipients through the completion of their post-award employment
    obligations.

    (i) Amount of Repayment.--
    (1) Less than 1 year of service.--If a circumstance
    described in subsection (g)(2) occurs before the completion of 1
    year of a post-award employment obligation under this section,
    the total amount of scholarship awards received by the
    individual under this section shall--
    (A) be repaid; or
    (B) be treated as a loan to be repaid in accordance
    with subsection (j).
    (2) 1 or more years of service.--If a circumstance described
    in subparagraph (D) or (E) of subsection (g)(2) occurs after the
    completion of 1 or more years of a post-award employment
    obligation under this section, the total amount of scholarship
    awards received by the individual under this section, reduced by
    the ratio of the number of years of service completed divided by
    the number of years of service required, shall--
    (A) be repaid; or
    (B) be treated as a loan to be repaid in accordance
    with subsection (j).

    (j) Repayments.--A loan described subsection (i) shall--
    (1) be treated as a Federal Direct Unsubsidized Stafford
    Loan under part D of title IV of the Higher Education Act of
    1965 (20 U.S.C. 1087a et seq.); and
    (2) be subject to repayment, together with interest thereon
    accruing from the date of the scholarship award, in accordance
    with terms and conditions specified by the Director of the
    National Science Foundation (in consultation with the Secretary
    of Education) in regulations promulgated to carry out this
    subsection.

    (k) Collection of Repayment.--
    (1) <>  In general.--In the event
    that a scholarship recipient is required to repay the
    scholarship award under this section, the qualified institution
    of higher education providing the scholarship shall--
    (A) <>  determine the repayment
    amounts and notify the recipient and the Director of the
    National Science Foundation of the amounts owed; and
    (B) <>  collect the repayment
    amounts within a period of time as determined by the
    Director of the National Science Foundation, or the
    repayment amounts shall be treated as a loan in
    accordance with subsection (j).
    (2) Returned to treasury.--Except as provided in paragraph
    (3), any repayment under this subsection shall be returned to
    the Treasury of the United States.

    [[Page 2985]]

    (3) Retain percentage.--A qualified institution of higher
    education may retain a percentage of any repayment the
    institution collects under this subsection to defray
    administrative costs associated with the
    collection. <>  The Director of the
    National Science Foundation shall establish a single, fixed
    percentage that will apply to all eligible entities.

    (l) Exceptions.--The Director of the National Science Foundation may
    provide for the partial or total waiver or suspension of any service or
    payment obligation by an individual under this section whenever
    compliance by the individual with the obligation is impossible or would
    involve extreme hardship to the individual, or if enforcement of such
    obligation with respect to the individual would be unconscionable.
    (m) Evaluation and Report.--The Director of the National Science
    Foundation shall evaluate and report periodically to Congress on the
    success of recruiting individuals for scholarships under this section
    and on hiring and retaining those individuals in the public sector
    workforce.

    TITLE <>  IV--CYBERSECURITY AWARENESS AND
    PREPAREDNESS
    SEC. 401. <>  NATIONAL CYBERSECURITY AWARENESS
    AND EDUCATION PROGRAM.

    (a) National Cybersecurity Awareness and Education Program.--The
    Director <>  of the National Institute of Standards
    and Technology (referred to in this section as the ``Director''), in
    consultation with appropriate Federal agencies, industry, educational
    institutions, National Laboratories, the Networking and Information
    Technology Research and Development program, and other organizations
    shall continue to coordinate a national cybersecurity awareness and
    education program, that includes activities such as--
    (1) the widespread dissemination of cybersecurity technical
    standards and best practices identified by the Director;
    (2) efforts to make cybersecurity best practices usable by
    individuals, small to medium-sized businesses, educational
    institutions, and State, local, and tribal governments;
    (3) increasing public awareness of cybersecurity, cyber
    safety, and cyber ethics;
    (4) increasing the understanding of State, local, and tribal
    governments, institutions of higher education, and private
    sector entities of--
    (A) the benefits of ensuring effective risk
    management of information technology versus the costs of
    failure to do so; and
    (B) the methods to mitigate and remediate
    vulnerabilities;
    (5) supporting formal cybersecurity education programs at
    all education levels to prepare and improve a skilled
    cybersecurity and computer science workforce for the private
    sector and Federal, State, local, and tribal government; and
    (6) promoting initiatives to evaluate and forecast future
    cybersecurity workforce needs of the Federal Government and
    develop strategies for recruitment, training, and retention.

    [[Page 2986]]

    (b) <>  Considerations.--In carrying out the
    authority described in subsection (a), the Director, in consultation
    with appropriate Federal agencies, shall leverage existing programs
    designed to inform the public of safety and security of products or
    services, including self-certifications and independently verified
    assessments regarding the quantification and valuation of information
    security risk.

    (c) Strategic Plan.--The Director, in cooperation with relevant
    Federal agencies and other stakeholders, shall build upon programs and
    plans in effect as of the date of enactment of this Act to develop and
    implement a strategic plan to guide Federal programs and activities in
    support of the national cybersecurity awareness and education program
    under subsection (a).
    (d) Report.--Not later than 1 year after the date of enactment of
    this Act, and every 5 years thereafter, the Director shall transmit the
    strategic plan under subsection (c) to the Committee on Commerce,
    Science, and Transportation of the Senate and the Committee on Science,
    Space, and Technology of the House of Representatives.

    TITLE <>  V--ADVANCEMENT OF CYBERSECURITY
    TECHNICAL STANDARDS
    SEC. 501. <>  DEFINITIONS.

    In this title:
    (1) Director.--The term ``Director'' means the Director of
    the National Institute of Standards and Technology.
    (2) Institute.--The term ``Institute'' means the National
    Institute of Standards and Technology.
    SEC. 502. <>  INTERNATIONAL CYBERSECURITY
    TECHNICAL STANDARDS.

    (a) <>  In General.--The Director, in
    coordination with appropriate Federal authorities, shall--
    (1) as appropriate, ensure coordination of Federal agencies
    engaged in the development of international technical standards
    related to information system security; and
    (2) <>  not later than 1 year after
    the date of enactment of this Act, develop and transmit to
    Congress a plan for ensuring such Federal agency coordination.

    (b) Consultation With the Private Sector.--In carrying out the
    activities specified in subsection (a)(1), the Director shall ensure
    consultation with appropriate private sector stakeholders.
    SEC. 503. <>  CLOUD COMPUTING STRATEGY.

    (a) <>  In
    General.--The Director, in coordination with the Office of Management
    and Budget, in collaboration with the Federal Chief Information Officers
    Council, and in consultation with other relevant Federal agencies and
    stakeholders from the private sector, shall continue to develop and
    encourage the implementation of a comprehensive strategy for the use and
    adoption of cloud computing services by the Federal Government.

    (b) Activities.--In carrying out the strategy described under
    subsection (a), the Director shall give consideration to activities
    that--

    [[Page 2987]]

    (1) accelerate the development, in collaboration with the
    private sector, of standards that address interoperability and
    portability of cloud computing services;
    (2) advance the development of conformance testing performed
    by the private sector in support of cloud computing
    standardization; and
    (3) <>  support, in
    coordination with the Office of Management and Budget, and in
    consultation with the private sector, the development of
    appropriate security frameworks and reference materials, and the
    identification of best practices, for use by Federal agencies to
    address security and privacy requirements to enable the use and
    adoption of cloud computing services, including activities--
    (A) to ensure the physical security of cloud
    computing data centers and the data stored in such
    centers;
    (B) to ensure secure access to the data stored in
    cloud computing data centers;
    (C) to develop security standards as required under
    section 20 of the National Institute of Standards and
    Technology Act (15 U.S.C. 278g-3); and
    (D) to support the development of the automation of
    continuous monitoring systems.
    SEC. 504. <>  IDENTITY MANAGEMENT RESEARCH AND
    DEVELOPMENT.

    The Director shall continue a program to support the development of
    voluntary and cost-effective technical standards, metrology, testbeds,
    and conformance criteria, taking into account appropriate user
    concerns--
    (1) to improve interoperability among identity management
    technologies;
    (2) to strengthen authentication methods of identity
    management systems;
    (3) to improve privacy protection in identity management
    systems, including health information technology systems,
    through authentication and security protocols; and
    (4) to improve the usability of identity management systems.

    Approved December 18, 2014.

    LEGISLATIVE HISTORY--S. 1353:
    ---------------------------------------------------------------------------

    SENATE REPORTS: No. 113-270 (Comm. on Commerce, Science, and Transpor-
    tation).
    CONGRESSIONAL RECORD, Vol. 160 (2014):
    Dec. 11, considered and passed Senate and House.