#aacth ,,congress #ast ,session ,h4 ,r4 #gef ,,an ,,act ,to advance cybersecurity research1 development1 and technical standards1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,cybersecurity ,enhancement ,act of #bjac4 ,i ,research and ,development #aja4 ,definitions ,in this title3 7#a7 ,national coordination office ,the term ,national ,coordination ,office means the ,national ,coordination ,office for the ,networking and ,information ,technology ,research and ,development program4 7#b7 ,program ,the term ,program means the ,networking and ,information ,technology ,research and ,development program which has been established under section #aja of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa74 #ajb4 ,findings ,section #b of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdja7 is amended-- 7#a7 by amending paragraph 7#a7 to read as follows3 7#a7 ,advancements in information and communications technology have resulted in a globally interconnected network of government1 commercial1 scientific1 and education infrastructures1 including critical infrastructures for electric power1 natural gas and petroleum production and distribution1 telecommunications1 transportation1 water supply1 banking and finance1 and emergency and government services4 2 7#b7 in paragraph 7#b71 by striking ,exponential increases in interconnectivity have facilitated enhanced communications1 economic growth1 and inserting ,these advancements have significantly contributed to the growth of the ,united ,states economy12 7#c7 by amending paragraph 7#c7 to read as follows3 7#c7 ,the ,cyberspace ,policy ,review published by the ,president in ,may1 #bjji1 concluded that our information technology and communications infrastructure is vulnerable and has suffered intrusions that have allowed criminals to steal hundreds of millions of dollars and nation-states and other entities to steal intellectual property and sensitive military information4 2 and 7#d7 by amending paragraph 7#f7 to read as follows3 7#f7 ,while ,african-,americans1 ,hispanics1 and ,native ,americans constitute #cc percent of the college-age population1 members of these minorities comprise less than #bj percent of bachelor degree recipients in the field of computer sciences4 4 #ajc4 ,cybersecurity strategic research and development plan 7a7 ,in general ,not later than #ab months after the date of enactment of this ,act1 the agencies identified in subsection #aja7;a77#c77;,b77i7 through 7x7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#c77;,b77i7 through 7x77 or designated under section #aja7;a77#c77;,b77xi7 of such ,act1 working through the ,national ,science and ,technology ,council and with the assistance of the ,national ,coordination ,office1 shall transmit to ,congress a strategic plan based on an assessment of cybersecurity risk to guide the overall direction of ,federal cybersecurity and information assurance research and development for information technology and networking systems4 ,once every #c years after the initial strategic plan is transmitted to ,congress under this section1 such agencies shall prepare and transmit to ,congress an update of such plan4 7b7 ,contents of plan ,the strategic plan required under subsection 7a7 shall-- 7#a7 specify and prioritize near-term1 mid-term and long-term research objectives1 including objectives associated with the research areas identified in section #d7;a77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a77 and how the near-term objectives complement research and development areas in which the private sector is actively engaged2 7#b7 describe how the ,program will focus on innovative1 transformational technologies with the potential to enhance the security1 reliability1 resilience1 and trustworthiness of the digital infrastructure1 and to protect consumer privacy2 7#c7 describe how the ,program will foster the rapid transfer of research and development results into new cybersecurity technologies and applications for the timely benefit of society and the national interest1 including through the dissemination of best practices and other outreach activities2 7#d7 describe how the ,program will establish and maintain a national research infrastructure for creating1 testing1 and evaluating the next generation of secure networking and information technology systems2 7#e7 describe how the ,program will facilitate access by academic researchers to the infrastructure described in paragraph 7#d71 as well as to relevant data1 including event data2 7#f7 describe how the ,program will engage females and individuals identified in section #cc or #cd of the ,science and ,engineering ,equal ,opportunities ,act 7#db ,u4,s4,c4 #ahhe;a or #ahhe;b7 to foster a more diverse workforce in this area2 and 7#g7 describe how the ,program will help to recruit and prepare veterans for the ,federal cybersecurity workforce4 7c7 ,development of roadmap ,the agencies described in subsection 7a7 shall develop and annually update an implementation roadmap for the strategic plan required in this section4 ,such roadmap shall-- 7#a7 specify the role of each ,federal agency in carrying out or sponsoring research and development to meet the research objectives of the strategic plan1 including a description of how progress toward the research objectives will be evaluated2 7#b7 specify the funding allocated to each major research objective of the strategic plan and the source of funding by agency for the current fiscal year2 and 7#c7 estimate the funding required for each major research objective of the strategic plan for the following #c fiscal years4 7d7 ,recommendations ,in developing and updating the strategic plan under subsection 7a71 the agencies involved shall solicit recommendations and advice from-- 7#a7 the advisory committee established under section #aja7;b77#a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;b77#a772 and 7#b7 a wide range of stakeholders1 including industry1 academia1 including representatives of minority serving institutions and community colleges1 ,national ,laboratories1 and other relevant organizations and institutions4 7e7 ,appending to report ,the implementation roadmap required under subsection 7c71 and its annual updates1 shall be appended to the report required under section #aja7;a77#b77;,d7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#b77;,d774 7f7 ,cybersecurity research database ,the agencies involved in developing and updating the strategic plan under subsection 7a7 shall establish1 in coordination with the ,office of ,management and ,budget1 a mechanism to track ongoing and completed ,federal cybersecurity research and development projects and associated funding1 and shall make such information publically available4 #ajd4 ,social and behavioral research in cybersecurity ,section #d7;a77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a77 is amended-- 7#a7 by inserting and usability after to the structure2 7#b7 in subparagraph 7,h71 by striking and after the semicolon2 7#c7 in subparagraph 7,i71 by striking the period at the end and inserting 2 and2 and 7#d7 by adding at the end the following new subparagraph3 7,j7 social and behavioral factors1 including human-computer interactions1 usability1 and user motivations4 4 #aje4 ,national ,science ,foundation cybersecurity research and development programs 7a7 ,computer and network security research areas ,section #d7;a77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a77 is amended-- 7#a7 in subparagraph 7,a7 by inserting identity management1 after cryptography12 and 7#b7 in subparagraph 7,i71 by inserting 1 crimes against children1 and organized crime after intellectual property4 7b7 ,computer and network security research grants ,section #d7;a77#c7 of such ,act 7#ae ,u4,s4,c4 #gdjc7;a77#c77 is amended by striking subparagraphs 7,a7 through 7,e7 and inserting the following new subparagraphs3 7,a7 #aai1jjj1jjj for fiscal year #bjad2 7,b7 #aai1jjj1jjj for fiscal year #bjae2 and 7,c7 #aai1jjj1jjj for fiscal year #bjaf4 4 7c7 ,computer and network security research centers ,section #d7;b7 of such ,act 7#ae ,u4,s4,c4 #gdjc7;b77 is amended-- 7#a7 in paragraph 7#d7-- 7,a7 in subparagraph 7,c71 by striking and after the semicolon2 7,b7 in subparagraph 7,d71 by striking the period and inserting 2 and2 and 7,c7 by adding at the end the following new subparagraph3 7,e7 how the center will partner with government laboratories1 for-profit entities1 other institutions of higher education1 or nonprofit research institutions4 2 and 7#b7 in paragraph 7#g7 by striking subparagraphs 7,a7 through 7,e7 and inserting the following new subparagraphs3 7,a7 #e1jjj1jjj for fiscal year #bjad2 7,b7 #e1jjj1jjj for fiscal year #bjae2 and 7,c7 #e1jjj1jjj for fiscal year #bjaf4 4 7d7 ,computer and network security capacity building grants ,section #e7;a77#f7 of such ,act 7#ae ,u4,s4,c4 #gdjd7;a77#f77 is amended by striking subparagraphs 7,a7 through 7,e7 and inserting the following new subparagraphs3 7,a7 #be1jjj1jjj for fiscal year #bjad2 7,b7 #be1jjj1jjj for fiscal year #bjae2 and 7,c7 #be1jjj1jjj for fiscal year #bjaf4 4 7e7 ,scientific and advanced technology act grants ,section #e7;b77#b7 of such ,act 7#ae ,u4,s4,c4 #gdjd7;b77#b77 is amended by striking subparagraphs 7,a7 through 7,e7 and inserting the following new subparagraphs3 7,a7 #d1jjj1jjj for fiscal year #bjad2 7,b7 #d1jjj1jjj for fiscal year #bjae2 and 7,c7 #d1jjj1jjj for fiscal year #bjaf4 4 7f7 ,graduate traineeships in computer and network security ,section #e7;c77#g7 of such ,act 7#ae ,u4,s4,c4 #gdjd7;c77#g77 is amended by striking subparagraphs 7,a7 through 7,e7 and inserting the following new subparagraphs3 7,a7 #cb1jjj1jjj for fiscal year #bjad2 7,b7 #cb1jjj1jjj for fiscal year #bjae2 and 7,c7 #cb1jjj1jjj for fiscal year #bjaf4 4 7g7 ,cyber security faculty development traineeship program ,section #e7;e7 of such ,act 7#ae ,u4,s4,c4 #gdjd7;e77 is repealed4 #ajf4 ,federal cyber scholarship for service program 7a7 ,in general ,the ,director of the ,national ,science ,foundation shall continue a ,scholarship for ,service program under section #e7;a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjd7;a77 to recruit and train the next generation of ,federal cybersecurity professionals and to increase the capacity of the higher education system to produce an information technology workforce with the skills necessary to enhance the security of the ,nation's communications and information infrastructure4 7b7 ,characteristics of program ,the program under this section shall-- 7#a7 provide1 through qualified institutions of higher education1 including community colleges1 scholarships that provide tuition1 fees1 and a competitive stipend for up to #b years to students pursing a bachelor's or master's degree and up to #c years to students pursuing a doctoral degree in a cybersecurity field2 7#b7 provide the scholarship recipients with summer internship opportunities or other meaningful temporary appointments in the ,federal information technology workforce2 and 7#c7 increase the capacity of institutions of higher education throughout all regions of the ,united ,states to produce highly qualified cybersecurity professionals1 through the award of competitive1 merit-reviewed grants that support such activities as-- 7,a7 faculty professional development1 including technical1 hands-on experiences in the private sector or government1 workshops1 seminars1 conferences1 and other professional development opportunities that will result in improved instructional capabilities2 7,b7 institutional partnerships1 including minority serving institutions and community colleges2 7,c7 development and evaluation of cybersecurity-related courses and curricula2 and 7,d7 public-private partnerships that will integrate research experiences and hands-on learning into cybersecurity degree programs4 7c7 ,scholarship requirements 7#a7 ,eligibility ,scholarships under this section shall be available only to students who-- 7,a7 are citizens or permanent residents of the ,united ,states2 7,b7 are full-time students in an eligible degree program1 as determined by the ,director1 that is focused on computer security or information assurance at an awardee institution2 and 7,c7 accept the terms of a scholarship pursuant to this section4 7#b7 ,selection ,individuals shall be selected to receive scholarships primarily on the basis of academic merit1 with consideration given to financial need1 to the goal of promoting the participation of females and individuals identified in section #cc or #cd of the ,science and ,engineering ,equal ,opportunities ,act 7#db ,u4,s4,c4 #ahhe;a or #ahhe;b71 and to veterans4 ,for purposes of this paragraph1 the term veteran means a person who-- 7,a7 served on active duty 7other than active duty for training7 in the ,armed ,forces of the ,united ,states for a period of more than #ahj consecutive days1 and who was discharged or released therefrom under conditions other than dishonorable2 or 7,b7 served on active duty 7other than active duty for training7 in the ,armed ,forces of the ,united ,states and was discharged or released from such service for a service-connected disability before serving #ahj consecutive days4 ,for purposes of subparagraph 7,b71 the term service-connected has the meaning given such term under section #aja of title #ch1 ,united ,states ,code4 7#c7 ,service obligation ,if an individual receives a scholarship under this section1 as a condition of receiving such scholarship1 the individual upon completion of their degree must serve as a cybersecurity professional within the ,federal workforce for a period of time as provided in paragraph 7#e74 ,if a scholarship recipient is not offered employment by a ,federal agency or a federally funded research and development center1 the service requirement can be satisfied at the ,director's discretion by-- 7,a7 serving as a cybersecurity professional in a ,state1 local1 or tribal government agency2 or 7,b7 teaching cybersecurity courses at an institution of higher education4 7#d7 ,conditions of support ,as a condition of acceptance of a scholarship under this section1 a recipient shall agree to provide the awardee institution with annual verifiable documentation of employment and up-to-date contact information4 7#e7 ,length of service ,the length of service required in exchange for a scholarship under this subsection shall be #a year more than the number of years for which the scholarship was received4 7d7 ,failure ,to complete service obligation 7#a7 ,general rule ,if an individual who has received a scholarship under this section-- 7,a7 fails to maintain an acceptable level of academic standing in the educational institution in which the individual is enrolled1 as determined by the ,director2 7,b7 is dismissed from such educational institution for disciplinary reasons2 7,c7 withdraws from the program for which the award was made before the completion of such program2 7,d7 declares that the individual does not intend to fulfill the service obligation under this section2 or 7,e7 fails to fulfill the service obligation of the individual under this section1 such individual shall be liable to the ,united ,states as provided in paragraph 7#c74 7#b7 ,monitoring compliance ,as a condition of participating in the program1 a qualified institution of higher education receiving a grant under this section shall-- 7,a7 enter into an agreement with the ,director of the ,national ,science ,foundation to monitor the compliance of scholarship recipients with respect to their service obligation2 and 7,b7 provide to the ,director1 on an annual basis1 post-award employment information required under subsection 7c77#d7 for scholarship recipients through the completion of their service obligation4 7#c7 ,amount of repayment 7,a7 ,less than one year of service ,if a circumstance described in paragraph 7#a7 occurs before the completion of #a year of a service obligation under this section1 the total amount of awards received by the individual under this section shall be repaid or such amount shall be treated as a loan to be repaid in accordance with subparagraph 7,c74 7,b7 ,more than one year of service ,if a circumstance described in subparagraph 7,d7 or 7,e7 of paragraph 7#a7 occurs after the completion of #a year of a service obligation under this section1 the total amount of scholarship awards received by the individual under this section1 reduced by the ratio of the number of years of service completed divided by the number of years of service required1 shall be repaid or such amount shall be treated as a loan to be repaid in accordance with subparagraph 7,c74 7,c7 ,repayments ,a loan described in subparagraph 7,a7 or 7,b7 shall be treated as a ,federal ,direct ,unsubsidized ,stafford ,loan under part ,d of title ,,iv of the ,higher ,education ,act of #aife 7#bj ,u4,s4,c4 #ajhg;a and following71 and shall be subject to repayment1 together with interest thereon accruing from the date of the scholarship award1 in accordance with terms and conditions specified by the ,director 7in consultation with the ,secretary of ,education7 in regulations promulgated to carry out this paragraph4 7#d7 ,collection of repayment 7,a7 ,in general ,in the event that a scholarship recipient is required to repay the scholarship under this subsection1 the institution providing the scholarship shall-- 7i7 be responsible for determining the repayment amounts and for notifying the recipient and the ,director of the amount owed2 and 7ii7 collect such repayment amount within a period of time as determined under the agreement described in paragraph 7#b71 or the repayment amount shall be treated as a loan in accordance with paragraph 7#c77;,c74 7,b7 ,returned to treasury ,except as provided in subparagraph 7,c7 of this paragraph1 any such repayment shall be returned to the ,treasury of the ,united ,states4 7,c7 ,retain percentage ,an institution of higher education may retain a percentage of any repayment the institution collects under this paragraph to defray administrative costs associated with the collection4 ,the ,director shall establish a single1 fixed percentage that will apply to all eligible entities4 7#e7 ,exceptions ,the ,director may provide for the partial or total waiver or suspension of any service or payment obligation by an individual under this section whenever compliance by the individual with the obligation is impossible or would involve extreme hardship to the individual1 or if enforcement of such obligation with respect to the individual would be unconscionable4 7e7 ,hiring ,authority 7#a7 ,appointment in excepted service ,notwithstanding any provision of chapter #cc of title #e1 ,united ,states ,code1 governing appointments in the competitive service1 an agency shall appoint in the excepted service an individual who has completed the academic program for which a scholarship was awarded4 7#b7 ,noncompetitive conversion ,except as provided in paragraph 7#d71 upon fulfillment of the service term1 an employee appointed under paragraph 7#a7 may be converted noncompetitively to term1 career-conditional or career appointment4 7#c7 ,timing of conversion ,an agency may noncompetitively convert a term employee appointed under paragraph 7#b7 to a career-conditional or career appointment before the term appointment expires4 7#d7 ,authority to decline conversion ,an agency may decline to make the noncompetitive conversion or appointment under paragraph 7#b7 for cause4 #ajg4 ,cybersecurity workforce assessment ,not later than #ahj days after the date of enactment of this ,act the ,president shall transmit to the ,congress a report addressing the cybersecurity workforce needs of the ,federal ,government4 ,the report shall include-- 7#a7 an examination of the current state of and the projected needs of the ,federal cybersecurity workforce1 including a comparison of the different agencies and departments1 and an analysis of the capacity of such agencies and departments to meet those needs2 7#b7 an analysis of the sources and availability of cybersecurity talent1 a comparison of the skills and expertise sought by the ,federal ,government and the private sector1 an examination of the current and future capacity of ,united ,states institutions of higher education1 including community colleges1 to provide current and future cybersecurity professionals1 through education and training activities1 with those skills sought by the ,federal ,government1 ,state and local entities1 and the private sector1 and a description of how successful programs are engaging the talents of females and individuals identified in section #cc or #cd of the ,science and ,engineering ,equal ,opportunities ,act 7#db ,u4,s4,c4 #ahhe;a or #ahhe;b72 7#c7 an examination of the effectiveness of the ,national ,centers of ,academic ,excellence in ,information ,assurance ,education1 the ,centers of ,academic ,excellence in ,research1 and the ,federal ,cyber ,scholarship for ,service programs in promoting higher education and research in cybersecurity and information assurance and in producing a growing number of professionals with the necessary cybersecurity and information assurance expertise1 including individuals from ,states or regions in which the unemployment rate exceeds the national average2 7#d7 an analysis of any barriers to the ,federal ,government recruiting and hiring cybersecurity talent1 including barriers relating to compensation1 the hiring process1 job classification1 and hiring flexibilities2 and 7#e7 recommendations for ,federal policies to ensure an adequate1 well-trained ,federal cybersecurity workforce4 #ajh4 ,cybersecurity university-industry task force 7a7 ,establishment of university-,industry task force ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,office of ,science and ,technology ,policy shall convene a task force to explore mechanisms for carrying out collaborative research1 development1 education1 and training activities for cybersecurity through a consortium or other appropriate entity with participants from institutions of higher education and industry4 7b7 ,functions ,the task force shall-- 7#a7 develop options for a collaborative model and an organizational structure for such entity under which the joint research and development activities could be planned1 managed1 and conducted effectively1 including mechanisms for the allocation of resources among the participants in such entity for support of such activities2 7#b7 identify and prioritize at least three cybersecurity grand challenges1 focused on nationally significant problems requiring collaborative and interdisciplinary solutions2 7#c7 propose a process for developing a research and development agenda for such entity to address the grand challenges identified under paragraph 7#b72 7#d7 define the roles and responsibilities for the participants from institutions of higher education and industry in such entity2 7#e7 propose guidelines for assigning intellectual property rights and for the transfer of research and development results to the private sector2 and 7#f7 make recommendations for how such entity could be funded from ,federal1 ,state1 and nongovernmental sources4 7c7 ,composition ,in establishing the task force under subsection 7a71 the ,director of the ,office of ,science and ,technology ,policy shall appoint an equal number of individuals from institutions of higher education1 including minority-serving institutions and community colleges1 and from industry with knowledge and expertise in cybersecurity4 7d7 ,report ,not later than #ab months after the date of enactment of this ,act1 the ,director of the ,office of ,science and ,technology ,policy shall transmit to the ,congress a report describing the findings and recommendations of the task force4 7e7 ,termination ,the task force shall terminate upon transmittal of the report required under subsection 7d74 7f7 ,compensation and expenses ,members of the task force shall serve without compensation4 #aji4 ,cybersecurity automation and checklists for government systems ,section #h7;c7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjf7;c77 is amended to read as follows3 7c7 ,security automation and checklists for government systems 7#a7 ,in general ,the ,director of the ,national ,institute of ,standards and ,technology shall develop1 and revise as necessary1 security automation standards1 associated reference materials 7including protocols71 and checklists providing settings and option selections that minimize the security risks associated with each information technology hardware or software system and security tool that is1 or is likely to become1 widely used within the ,federal ,government in order to enable standardized and interoperable technologies1 architectures1 and frameworks for continuous monitoring of information security within the ,federal ,government4 7#b7 ,priorities for development ,the ,director of the ,national ,institute of ,standards and ,technology shall establish priorities for the development of standards1 reference materials1 and checklists under this subsection on the basis of-- 7,a7 the security risks associated with the use of the system2 7,b7 the number of agencies that use a particular system or security tool2 7,c7 the usefulness of the standards1 reference materials1 or checklists to ,federal agencies that are users or potential users of the system2 7,d7 the effectiveness of the associated standard1 reference material1 or checklist in creating or enabling continuous monitoring of information security2 or 7,e7 such other factors as the ,director of the ,national ,institute of ,standards and ,technology determines to be appropriate4 7#c7 ,excluded systems ,the ,director of the ,national ,institute of ,standards and ,technology may exclude from the application of paragraph 7#a7 any information technology hardware or software system or security tool for which such ,director determines that the development of a standard1 reference material1 or checklist is inappropriate because of the infrequency of use of the system1 the obsolescence of the system1 or the inutility or impracticability of developing a standard1 reference material1 or checklist for the system4 7#d7 ,dissemination of standards and related materials ,the ,director of the ,national ,institute of ,standards and ,technology shall ensure that ,federal agencies are informed of the availability of any standard1 reference material1 checklist1 or other item developed under this subsection4 7#e7 ,agency use requirements ,the development of standards1 reference materials1 and checklists under paragraph 7#a7 for an information technology hardware or software system or tool does not-- 7,a7 require any ,federal agency to select the specific settings or options recommended by the standard1 reference material1 or checklist for the system2 7,b7 establish conditions or prerequisites for ,federal agency procurement or deployment of any such system2 7,c7 imply an endorsement of any such system by the ,director of the ,national ,institute of ,standards and ,technology2 or 7,d7 preclude any ,federal agency from procuring or deploying other information technology hardware or software systems for which no such standard1 reference material1 or checklist has been developed or identified under paragraph 7#a74 4 #aaj4 ,national ,institute of ,standards and ,technology cybersecurity research and development ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended by redesignating subsection 7e7 as subsection 7f71 and by inserting after subsection 7d7 the following3 7e7 ,intramural security research ,as part of the research activities conducted in accordance with subsection 7d77#c71 the ,institute shall-- 7#a7 conduct a research program to develop a unifying and standardized identity1 privilege1 and access control management framework for the execution of a wide variety of resource protection policies and that is amenable to implementation within a wide variety of existing and emerging computing environments2 7#b7 carry out research associated with improving the security of information systems and networks2 7#c7 carry out research associated with improving the testing1 measurement1 usability1 and assurance of information systems and networks2 7#d7 carry out research associated with improving security of industrial control systems2 and 7#e7 carry out research associated with improving the security and integrity of the information technology supply chain4 4 #aaa4 ,research on the science of cybersecurity ,the ,director of the ,national ,science ,foundation and the ,director of the ,national ,institute of ,standards and ,technology shall1 through existing programs and activities1 support research that will lead to the development of a scientific foundation for the field of cybersecurity1 including research that increases understanding of the underlying principles of securing complex networked systems1 enables repeatable experimentation1 and creates quantifiable security metrics4 ,,ii ,advancement of ,cybersecurity ,technical ,standards #bja4 ,definitions ,in this title3 7#a7 ,director ,the term ,director means the ,director of the ,national ,institute of ,standards and ,technology4 7#b7 ,institute ,the term ,institute means the ,national ,institute of ,standards and ,technology4 #bjb4 ,international cybersecurity technical standards 7a7 ,in general ,the ,director1 in coordination with appropriate ,federal authorities1 shall-- 7#a7 as appropriate1 ensure coordination of ,federal agencies engaged in the development of international technical standards related to information system security2 and 7#b7 not later than #a year after the date of enactment of this ,act1 develop and transmit to the ,congress a plan for ensuring such ,federal agency coordination4 7b7 ,consultation with the private sector ,in carrying out the activities specified in subsection 7a77#a71 the ,director shall ensure consultation with appropriate private sector stakeholders4 #bjc4 ,cloud computing strategy 7a7 ,in general ,the ,director1 in collaboration with the ,federal ,,cio ,council1 and in consultation with other relevant ,federal agencies and stakeholders from the private sector1 shall continue to develop and encourage the implementation of a comprehensive strategy for the use and adoption of cloud computing services by the ,federal ,government4 7b7 ,activities ,in carrying out the strategy developed under subsection 7a71 the ,director shall give consideration to activities that-- 7#a7 accelerate the development1 in collaboration with the private sector1 of standards that address interoperability and portability of cloud computing services2 7#b7 advance the development of conformance testing performed by the private sector in support of cloud computing standardization2 and 7#c7 support1 in consultation with the private sector1 the development of appropriate security frameworks and reference materials1 and the identification of best practices1 for use by ,federal agencies to address security and privacy requirements to enable the use and adoption of cloud computing services1 including activities-- 7,a7 to ensure the physical security of cloud computing data centers and the data stored in such centers2 7,b7 to ensure secure access to the data stored in cloud computing data centers2 7,c7 to develop security standards as required under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c72 and 7,d7 to support the development of the automation of continuous monitoring systems4 #bjd4 ,promoting cybersecurity awareness and education 7a7 ,program ,the ,director1 in collaboration with relevant ,federal agencies1 industry1 educational institutions1 ,national ,laboratories1 the ,national ,coordination ,office of the ,networking and ,information ,technology ,research and ,development program1 and other organizations1 shall continue to coordinate a cybersecurity awareness and education program to increase knowledge1 skills1 and awareness of cybersecurity risks1 consequences1 and best practices through-- 7#a7 the widespread dissemination of cybersecurity technical standards and best practices identified by the ,institute2 7#b7 efforts to make cybersecurity best practices usable by individuals1 small to medium-sized businesses1 ,state1 local1 and tribal governments1 and educational institutions2 7#c7 improving the state of cybersecurity education at all educational levels2 7#d7 efforts to attract1 recruit1 and retain qualified professionals to the ,federal cybersecurity workforce2 and 7#e7 improving the skills1 training1 and professional development of the ,federal cybersecurity workforce4 7b7 ,strategic plan ,the ,director shall1 in cooperation with relevant ,federal agencies and other stakeholders1 develop and implement a strategic plan to guide ,federal programs and activities in support of a comprehensive cybersecurity awareness and education program as described under subsection 7a74 7c7 ,report to congress ,not later than #a year after the date of enactment of this ,act and every #e years thereafter1 the ,director shall transmit the strategic plan required under subsection 7b7 to the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives and the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate4 #bje4 ,identity management research and development ,the ,director shall continue a program to support the development of technical standards1 metrology1 testbeds1 and conformance criteria1 taking into account appropriate user concerns1 to-- 7#a7 improve interoperability among identity management technologies2 7#b7 strengthen authentication methods of identity management systems2 7#c7 improve privacy protection in identity management systems1 including health information technology systems1 through authentication and security protocols2 and 7#d7 improve the usability of identity management systems4 #bjf4 ,authorizations ,no additional funds are authorized to carry out this ,act1 and the amendments made by this ,act4 ,this ,act1 and the amendments made by this ,act1 shall be carried out using amounts otherwise authorized or appropriated4 ,passed the ,house of ,representatives ,april #af1 #bjac4;,clerk4