#aacth ,,congress #b;d ,session ,s4 #acec ,,an ,,act ,to provide for an ongoing1 voluntary public-private partnership to improve cybersecurity1 and to strengthen cybersecurity research and development1 workforce development and education1 and public awareness and preparedness1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,cybersecurity ,enhancement ,act of #bjad4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4,sec4 #b4 ,definitions4,sec4 #c4 ,no regulatory authority4,sec4 #d4 ,no additional funds authorized4,,title ,i--,public-private collaboration on cybersecurity,sec4 #aja4 ,public-private collaboration on cybersecurity4,,title ,,ii--,cybersecurity research and development,sec4 #bja4 ,federal cybersecurity research and development4,sec4 #bjb4 ,computer and network security research centers4,sec4 #bjc4 ,cybersecurity automation and checklists for government systems4,sec4 #bjd4 ,national ,institute of ,standards and ,technology cybersecurity research and development4,,title ,,iii--,education and ,workforce ,development,sec4 #cja4 ,cybersecurity competitions and challenges4,sec4 #cjb4 ,federal cyber scholarship-for-service program4,,title ,,iv--,cybersecurity ,awareness and ,preparedness,sec4 #dja4 ,national cybersecurity awareness and education program4,,title ,v--,advancement of cybersecurity technical standards,sec4 #eja4 ,definitions4,sec4 #ejb4 ,international cybersecurity technical standards4,sec4 #ejc4 ,cloud computing strategy4,sec4 #ejd4 ,identity management research and development4 #b4 ,definitions ,in this ,act3 7#a7 ,cybersecurity mission ,the term cybersecurity mission means activities that encompass the full range of threat reduction1 vulnerability reduction1 deterrence1 international engagement1 incident response1 resiliency1 and recovery policies and activities1 including computer network operations1 information assurance1 law enforcement1 diplomacy1 military1 and intelligence missions as such activities relate to the security and stability of cyberspace4 7#b7 ,information system ,the term information system has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 #c4 ,no regulatory authority ,nothing in this ,act shall be construed to confer any regulatory authority on any ,federal1 ,state1 tribal1 or local department or agency4 #d4 ,no additional funds authorized ,no additional funds are authorized to carry out this ,act1 and the amendments made by this ,act4 ,this ,act1 and the amendments made by this ,act1 shall be carried out using amounts otherwise authorized or appropriated4 ,i ,public-private collaboration on cybersecurity #aja4 ,public-private collaboration on cybersecurity 7a7 ,cybersecurity ,section #b7;c7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7;c77 is amended-- 7#a7 by redesignating paragraphs 7#ae7 through 7#bb7 as paragraphs 7#af7 through 7#bc71 respectively2 and 7#b7 by inserting after paragraph 7#ad7 the following3 7#ae7 on an ongoing basis1 facilitate and support the development of a voluntary1 consensus-based1 industry-led set of standards1 guidelines1 best practices1 methodologies1 procedures1 and processes to cost-effectively reduce cyber risks to critical infrastructure 7as defined under subsection 7e772 4 7b7 ,scope and limitations ,section #b of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7 is amended by adding at the end the following3 7e7 ,cyber risks 7#a7 ,in general ,in carrying out the activities under subsection 7c77#ae71 the ,director-- 7,a7 shall-- 7i7 coordinate closely and regularly with relevant private sector personnel and entities1 critical infrastructure owners and operators1 and other relevant industry organizations1 including ,sector ,coordinating ,councils and ,information ,sharing and ,analysis ,centers1 and incorporate industry expertise2 7ii7 consult with the heads of agencies with national security responsibilities1 sector-specific agencies and other appropriate agencies1 ,state and local governments1 the governments of other nations1 and international organizations2 7iii7 identify a prioritized1 flexible1 repeatable1 performance-based1 and cost-effective approach1 including information security measures and controls1 that may be voluntarily adopted by owners and operators of critical infrastructure to help them identify1 assess1 and manage cyber risks2 7iv7 include methodologies-- 7,i7 to identify and mitigate impacts of the cybersecurity measures or controls on business confidentiality2 and 7,,ii7 to protect individual privacy and civil liberties2 7v7 incorporate voluntary consensus standards and industry best practices2 7vi7 align with voluntary international standards to the fullest extent possible2 7vii7 prevent duplication of regulatory processes and prevent conflict with or superseding of regulatory requirements1 mandatory standards1 and related processes2 and 7viii7 include such other similar and consistent elements as the ,director considers necessary2 and 7,b7 shall not prescribe or otherwise require-- 7i7 the use of specific solutions2 7ii7 the use of specific information or communications technology products or services2 or 7iii7 that information or communications technology products or services be designed1 developed1 or manufactured in a particular manner4 7#b7 ,limitation ,information shared with or provided to the ,institute for the purpose of the activities described under subsection 7c77#ae7 shall not be used by any ,federal1 ,state1 tribal1 or local department or agency to regulate the activity of any entity4 ,nothing in this paragraph shall be construed to modify any regulatory requirement to report or submit information to a ,federal1 ,state1 tribal1 or local department or agency4 7#c7 ,definitions ,in this subsection3 7,a7 ,critical infrastructure ,the term critical infrastructure has the meaning given the term in section #ajaf7;e7 of the ,,usa ,,patriot ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7,b7 ,sector-specific agency ,the term sector-specific agency means the ,federal department or agency responsible for providing institutional knowledge and specialized expertise as well as leading1 facilitating1 or supporting the security and resilience programs and associated activities of its designated critical infrastructure sector in the all-hazards environment4 4 7c7 ,study and reports 7#a7 ,study ,the ,comptroller ,general of the ,united ,states shall conduct a study that assesses-- 7,a7 the progress made by the ,director of the ,national ,institute of ,standards and ,technology in facilitating the development of standards and procedures to reduce cyber risks to critical infrastructure in accordance with section #b7;c77#ae7 of the ,national ,institute of ,standards and ,technology ,act1 as added by this section2 7,b7 the extent to which the ,director's facilitation efforts are consistent with the directive in such section that the development of such standards and procedures be voluntary and led by industry representatives2 7,c7 the extent to which other ,federal agencies have promoted and sectors of critical infrastructure 7as defined in section #ajaf7;e7 of the ,,usa ,,patriot ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e777 have adopted a voluntary1 industry-led set of standards1 guidelines1 best practices1 methodologies1 procedures1 and processes to reduce cyber risks to critical infrastructure in accordance with such section #b7;c77#ae72 7,d7 the reasons behind the decisions of sectors of critical infrastructure 7as defined in subparagraph 7,c77 to adopt or to not adopt the voluntary standards described in subparagraph 7,c72 and 7,e7 the extent to which such voluntary standards have proved successful in protecting critical infrastructure from cyber threats4 7#b7 ,reports ,not later than #a year after the date of the enactment of this ,act1 and every #b years thereafter for the following #f years1 the ,comptroller ,general shall submit a report1 which summarizes the findings of the study conducted under paragraph 7#a71 to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives4 ,,ii ,cybersecurity research and development #bja4 ,federal cybersecurity research and development 7a7 ,fundamental cybersecurity research 7#a7 ,federal cybersecurity research and development strategic plan ,the heads of the applicable agencies and departments1 working through the ,national ,science and ,technology ,council and the ,networking and ,information ,technology ,research and ,development ,program1 shall develop and update every #d years a ,federal cybersecurity research and development strategic plan 7referred to in this subsection as the strategic plan7 based on an assessment of cybersecurity risk to guide the overall direction of ,federal cybersecurity and information assurance research and development for information technology and networking systems4 ,the heads of the applicable agencies and departments shall build upon existing programs and plans to develop the strategic plan to meet objectives in cybersecurity1 such as-- 7,a7 how to design and build complex software-intensive systems that are secure and reliable when first deployed2 7,b7 how to test and verify that software and hardware1 whether developed locally or obtained from a third party1 is free of significant known security flaws2 7,c7 how to test and verify that software and hardware obtained from a third party correctly implements stated functionality1 and only that functionality2 7,d7 how to guarantee the privacy of an individual1 including that individual's identity1 information1 and lawful transactions when stored in distributed systems or transmitted over networks2 7,e7 how to build new protocols to enable the ,internet to have robust security as one of the key capabilities of the ,internet2 7,f7 how to determine the origin of a message transmitted over the ,internet2 7,g7 how to support privacy in conjunction with improved security2 7,h7 how to address the problem of insider threats2 7,i7 how improved consumer education and digital literacy initiatives can address human factors that contribute to cybersecurity2 7,j7 how to protect information processed1 transmitted1 or stored using cloud computing or transmitted through wireless services2 and 7,k7 any additional objectives the heads of the applicable agencies and departments1 in coordination with the head of any relevant ,federal agency and with input from stakeholders1 including appropriate national laboratories1 industry1 and academia1 determine appropriate4 7#b7 ,requirements 7,a7 ,contents of plan ,the strategic plan shall-- 7i7 specify and prioritize near-term1 mid-term1 and long-term research objectives1 including objectives associated with the research identified in section #d7;a77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a772 7ii7 specify how the near-term objectives described in clause 7i7 complement research and development areas in which the private sector is actively engaged2 7iii7 describe how the heads of the applicable agencies and departments will focus on innovative1 transformational technologies with the potential to enhance the security1 reliability1 resilience1 and trustworthiness of the digital infrastructure1 and to protect consumer privacy2 7iv7 describe how the heads of the applicable agencies and departments will foster the rapid transfer of research and development results into new cybersecurity technologies and applications for the timely benefit of society and the national interest1 including through the dissemination of best practices and other outreach activities2 7v7 describe how the heads of the applicable agencies and departments will establish and maintain a national research infrastructure for creating1 testing1 and evaluating the next generation of secure networking and information technology systems2 and 7vi7 describe how the heads of the applicable agencies and departments will facilitate access by academic researchers to the infrastructure described in clause 7v71 as well as to relevant data1 including event data4 7,b7 ,private sector efforts ,in developing1 implementing1 and updating the strategic plan1 the heads of the applicable agencies and departments1 working through the ,national ,science and ,technology ,council and ,networking and ,information ,technology ,research and ,development ,program1 shall work in close cooperation with industry1 academia1 and other interested stakeholders to ensure1 to the extent possible1 that ,federal cybersecurity research and development is not duplicative of private sector efforts4 7,c7 ,recommendations ,in developing and updating the strategic plan the heads of the applicable agencies and departments shall solicit recommendations and advice from-- 7i7 the advisory committee established under section #aja7;b77#a7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;b77#a772 and 7ii7 a wide range of stakeholders1 including industry1 academia1 including representatives of minority serving institutions and community colleges1 ,national ,laboratories1 and other relevant organizations and institutions4 7,d7 ,implementation roadmap ,the heads of the applicable agencies and departments1 working through the ,national ,science and ,technology ,council and ,networking and ,information ,technology ,research and ,development ,program1 shall develop and annually update an implementation roadmap for the strategic plan4 ,the implementation roadmap shall-- 7i7 specify the role of each ,federal agency in carrying out or sponsoring research and development to meet the research objectives of the strategic plan1 including a description of how progress toward the research objectives will be evaluated2 7ii7 specify the funding allocated to each major research objective of the strategic plan and the source of funding by agency for the current fiscal year2 7iii7 estimate the funding required for each major research objective of the strategic plan for the following #c fiscal years2 and 7iv7 track ongoing and completed ,federal cybersecurity research and development projects4 7#c7 ,reports to ,congress ,the heads of the applicable agencies and departments1 working through the ,national ,science and ,technology ,council and ,networking and ,information ,technology ,research and ,development ,program1 shall submit to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives-- 7,a7 the strategic plan not later than #a year after the date of enactment of this ,act2 7,b7 each quadrennial update to the strategic plan2 and 7,c7 the implementation roadmap under subparagraph 7,d71 and its annual updates1 which shall be appended to the annual report required under section #aja7;a77#b77;,d7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#b77;,d774 7#d7 ,definition of applicable agencies and departments ,in this subsection1 the term applicable agencies and departments means the agencies and departments identified in clauses 7i7 through 7x7 of section #aja7;a77#c77;,b7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#c77;,b77 or designated under clause 7xi7 of that section4 7b7 ,cybersecurity practices research ,the ,director of the ,national ,science ,foundation shall support research that-- 7#a7 develops1 evaluates1 disseminates1 and integrates new cybersecurity practices and concepts into the core curriculum of computer science programs and of other programs where graduates of such programs have a substantial probability of developing software after graduation1 including new practices and concepts relating to secure coding education and improvement programs2 and 7#b7 develops new models for professional development of faculty in cybersecurity education1 including secure coding development4 7c7 ,cybersecurity modeling and test beds 7#a7 ,review ,not later than #a year after the date of enactment of this ,act1 the ,director of the ,national ,science ,foundation1 in coordination with the ,director of the ,office of ,science and ,technology ,policy1 shall conduct a review of cybersecurity test beds in existence on the date of enactment of this ,act to inform the grants under paragraph 7#b74 ,the review shall include an assessment of whether a sufficient number of cybersecurity test beds are available to meet the research needs under the ,federal cybersecurity research and development strategic plan4 ,upon completion1 the ,director shall submit the review to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives4 7#b7 ,additional cybersecurity modeling and test beds 7,a7 ,in general ,if the ,director of the ,national ,science ,foundation1 after the review under paragraph 7#a71 determines that the research needs under the ,federal cybersecurity research and development strategic plan require the establishment of additional cybersecurity test beds1 the ,director of the ,national ,science ,foundation1 in coordination with the ,secretary of ,commerce and the ,secretary of ,homeland ,security1 may award grants to institutions of higher education or research and development non-profit institutions to establish cybersecurity test beds4 7,b7 ,requirement ,the cybersecurity test beds under subparagraph 7,a7 shall be sufficiently robust in order to model the scale and complexity of real-time cyber attacks and defenses on real world networks and environments4 7,c7 ,assessment required ,the ,director of the ,national ,science ,foundation1 in coordination with the ,secretary of ,commerce and the ,secretary of ,homeland ,security1 shall evaluate the effectiveness of any grants awarded under this subsection in meeting the objectives of the ,federal cybersecurity research and development strategic plan not later than #b years after the review under paragraph 7#a7 of this subsection1 and periodically thereafter4 7d7 ,coordination ,with ,other ,research ,initiatives ,in accordance with the responsibilities under section #aja of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa71 the ,director of the ,office of ,science and ,technology ,policy shall coordinate1 to the extent practicable1 ,federal research and development activities under this section with other ongoing research and development security-related initiatives1 including research being conducted by-- 7#a7 the ,national ,science ,foundation2 7#b7 the ,national ,institute of ,standards and ,technology2 7#c7 the ,department of ,homeland ,security2 7#d7 other ,federal agencies2 7#e7 other ,federal and private research laboratories1 research entities1 and universities2 7#f7 institutions of higher education2 7#g7 relevant nonprofit organizations2 and 7#h7 international partners of the ,united ,states4 7e7 ,national ,science ,foundation ,computer and ,network ,security ,research ,grant ,areas ,section #d7;a77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a77 is amended-- 7#a7 in subparagraph 7,h71 by striking and at the end2 7#b7 in subparagraph 7,i71 by striking the period at the end and inserting a semicolon2 and 7#c7 by adding at the end the following3 7,j7 secure fundamental protocols that are integral to inter-network communications and data exchange2 7,k7 secure software engineering and software assurance1 including-- 7i7 programming languages and systems that include fundamental security features2 7ii7 portable or reusable code that remains secure when deployed in various environments2 7iii7 verification and validation technologies to ensure that requirements and specifications have been implemented2 and 7iv7 models for comparison and metrics to assure that required standards have been met2 7,l7 holistic system security that-- 7i7 addresses the building of secure systems from trusted and untrusted components2 7ii7 proactively reduces vulnerabilities2 7iii7 addresses insider threats2 and 7iv7 supports privacy in conjunction with improved security2 7,m7 monitoring and detection2 7,n7 mitigation and rapid recovery methods2 7,o7 security of wireless networks and mobile devices2 and 7,p7 security of cloud infrastructure and services4 4 7f7 ,research on the science of cybersecurity ,the head of each agency and department identified under section #aja7;a77#c77;,b7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#c77;,b771 through existing programs and activities1 shall support research that will lead to the development of a scientific foundation for the field of cybersecurity1 including research that increases understanding of the underlying principles of securing complex networked systems1 enables repeatable experimentation1 and creates quantifiable security metrics4 #bjb4 ,computer and network security research centers ,section #d7;b7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;b77 is amended-- 7#a7 in paragraph 7#c71 by striking the research areas and inserting the following3 improving the security and resiliency of information technology1 reducing cyber vulnerabilities1 and anticipating and mitigating consequences of cyber attacks on critical infrastructure1 by conducting research in the areas2 7#b7 by striking the center in paragraph 7#d77;,d7 and inserting the ,center2 and 7#c7 in paragraph 7#e7-- 7,a7 by striking and at the end of subparagraph 7,c72 7,b7 by striking the period at the end of subparagraph 7,d7 and inserting a semicolon2 and 7,c7 by adding at the end the following3 7,e7 the demonstrated capability of the applicant to conduct high performance computation integral to complex computer and network security research1 through on-site or off-site computing2 7,f7 the applicant's affiliation with private sector entities involved with industrial research described in subsection 7a77#a72 7,g7 the capability of the applicant to conduct research in a secure environment2 7,h7 the applicant's affiliation with existing research programs of the ,federal ,government2 7,i7 the applicant's experience managing public-private partnerships to transition new technologies into a commercial setting or the government user community2 7,j7 the capability of the applicant to conduct interdisciplinary cybersecurity research1 basic and applied1 such as in law1 economics1 or behavioral sciences2 and 7,k7 the capability of the applicant to conduct research in areas such as systems security1 wireless security1 networking and protocols1 formal methods and high-performance computing1 nanotechnology1 or industrial control systems4 4 #bjc4 ,cybersecurity automation and checklists for government systems ,section #h7;c7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjf7;c77 is amended to read as follows3 7c7 ,security automation and checklists for government systems 7#a7 ,in general ,the ,director of the ,national ,institute of ,standards and ,technology shall1 as necessary1 develop and revise security automation standards1 associated reference materials 7including protocols71 and checklists providing settings and option selections that minimize the security risks associated with each information technology hardware or software system and security tool that is1 or is likely to become1 widely used within the ,federal ,government1 thereby enabling standardized and interoperable technologies1 architectures1 and frameworks for continuous monitoring of information security within the ,federal ,government4 7#b7 ,priorities for development ,the ,director of the ,national ,institute of ,standards and ,technology shall establish priorities for the development of standards1 reference materials1 and checklists under this subsection on the basis of-- 7,a7 the security risks associated with the use of the system2 7,b7 the number of agencies that use a particular system or security tool2 7,c7 the usefulness of the standards1 reference materials1 or checklists to ,federal agencies that are users or potential users of the system2 7,d7 the effectiveness of the associated standard1 reference material1 or checklist in creating or enabling continuous monitoring of information security2 or 7,e7 such other factors as the ,director of the ,national ,institute of ,standards and ,technology determines to be appropriate4 7#c7 ,excluded systems ,the ,director of the ,national ,institute of ,standards and ,technology may exclude from the application of paragraph 7#a7 any information technology hardware or software system or security tool for which such ,director determines that the development of a standard1 reference material1 or checklist is inappropriate because of the infrequency of use of the system1 the obsolescence of the system1 or the lack of utility or impracticability of developing a standard1 reference material1 or checklist for the system4 7#d7 ,dissemination of standards and related materials ,the ,director of the ,national ,institute of ,standards and ,technology shall ensure that ,federal agencies are informed of the availability of any standard1 reference material1 checklist1 or other item developed under this subsection4 7#e7 ,agency use requirements ,the development of standards1 reference materials1 and checklists under paragraph 7#a7 for an information technology hardware or software system or tool does not-- 7,a7 require any ,federal agency to select the specific settings or options recommended by the standard1 reference material1 or checklist for the system2 7,b7 establish conditions or prerequisites for ,federal agency procurement or deployment of any such system2 7,c7 imply an endorsement of any such system by the ,director of the ,national ,institute of ,standards and ,technology2 or 7,d7 preclude any ,federal agency from procuring or deploying other information technology hardware or software systems for which no such standard1 reference material1 or checklist has been developed or identified under paragraph 7#a74 4 #bjd4 ,national ,institute of ,standards and ,technology cybersecurity research and development ,section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7 is amended-- 7#a7 by redesignating subsection 7e7 as subsection 7f72 and 7#b7 by inserting after subsection 7d7 the following3 7e7 ,intramural ,security ,research ,as part of the research activities conducted in accordance with subsection 7d77#c71 the ,institute shall1 to the extent practicable and appropriate-- 7#a7 conduct a research program to develop a unifying and standardized identity1 privilege1 and access control management framework for the execution of a wide variety of resource protection policies and that is amenable to implementation within a wide variety of existing and emerging computing environments2 7#b7 carry out research associated with improving the security of information systems and networks2 7#c7 carry out research associated with improving the testing1 measurement1 usability1 and assurance of information systems and networks2 7#d7 carry out research associated with improving security of industrial control systems2 7#e7 carry out research associated with improving the security and integrity of the information technology supply chain2 and 7#f7 carry out any additional research the ,institute determines appropriate4 4 ,,iii ,education and ,workforce ,development #cja4 ,cybersecurity competitions and challenges 7a7 ,in general ,the ,secretary of ,commerce1 ,director of the ,national ,science ,foundation1 and ,secretary of ,homeland ,security1 in consultation with the ,director of the ,office of ,personnel ,management1 shall-- 7#a7 support competitions and challenges under section #bd of the ,stevenson-,wydler ,technology ,innovation ,act of #aihj 7#ae ,u4,s4,c4 #cgai7 7as amended by section #aje of the ,america ,,competes ,reauthorization ,act of #bjaj 7#abd ,stat4 #cihi77 or any other provision of law1 as appropriate-- 7,a7 to identify1 develop1 and recruit talented individuals to perform duties relating to the security of information technology in ,federal1 ,state1 local1 and tribal government agencies1 and the private sector2 or 7,b7 to stimulate innovation in basic and applied cybersecurity research1 technology development1 and prototype demonstration that has the potential for application to the information technology activities of the ,federal ,government2 and 7#b7 ensure the effective operation of the competitions and challenges under this section4 7b7 ,participation ,participants in the competitions and challenges under subsection 7a77#a7 may include-- 7#a7 students enrolled in grades #i through #ab2 7#b7 students enrolled in a postsecondary program of study leading to a baccalaureate degree at an institution of higher education2 7#c7 students enrolled in a postbaccalaureate program of study at an institution of higher education2 7#d7 institutions of higher education and research institutions2 7#e7 veterans2 and 7#f7 other groups or individuals that the ,secretary of ,commerce1 ,director of the ,national ,science ,foundation1 and ,secretary of ,homeland ,security determine appropriate4 7c7 ,affiliation and cooperative agreements ,competitions and challenges under this section may be carried out through affiliation and cooperative agreements with-- 7#a7 ,federal agencies2 7#b7 regional1 ,state1 or school programs supporting the development of cyber professionals2 7#c7 ,state1 local1 and tribal governments2 or 7#d7 other private sector organizations4 7d7 ,areas of skill ,competitions and challenges under subsection 7a77#a77;,a7 shall be designed to identify1 develop1 and recruit exceptional talent relating to-- 7#a7 ethical hacking2 7#b7 penetration testing2 7#c7 vulnerability assessment2 7#d7 continuity of system operations2 7#e7 security in design2 7#f7 cyber forensics2 7#g7 offensive and defensive cyber operations2 and 7#h7 other areas the ,secretary of ,commerce1 ,director of the ,national ,science ,foundation1 and ,secretary of ,homeland ,security consider necessary to fulfill the cybersecurity mission4 7e7 ,topics ,in selecting topics for competitions and challenges under subsection 7a77#a71 the ,secretary of ,commerce1 ,director of the ,national ,science ,foundation1 and ,secretary of ,homeland ,security-- 7#a7 shall consult widely both within and outside the ,federal ,government2 and 7#b7 may empanel advisory committees4 7f7 ,internships ,the ,director of the ,office of ,personnel ,management may support1 as appropriate1 internships or other work experience in the ,federal ,government to the winners of the competitions and challenges under this section4 #cjb4 ,federal cyber scholarship-for-service program 7a7 ,in general ,the ,director of the ,national ,science ,foundation1 in coordination with the ,director of the ,office of ,personnel ,management and ,secretary of ,homeland ,security1 shall continue a ,federal cyber scholarship-for-service program to recruit and train the next generation of information technology professionals1 industrial control system security professionals1 and security managers to meet the needs of the cybersecurity mission for ,federal1 ,state1 local1 and tribal governments4 7b7 ,program description and components ,the ,federal ,cyber ,scholarship-for-,service ,program shall-- 7#a7 provide scholarships through qualified institutions of higher education1 including community colleges1 to students who are enrolled in programs of study at institutions of higher education leading to degrees or specialized program certifications in the cybersecurity field2 7#b7 provide the scholarship recipients with summer internship opportunities or other meaningful temporary appointments in the ,federal information technology workforce2 and 7#c7 prioritize the employment placement of scholarship recipients in the ,federal ,government4 7c7 ,scholarship amounts ,each scholarship under subsection 7b7 shall be in an amount that covers the student's tuition and fees at the institution under subsection 7b77#a7 for not more than #c years and provides the student with an additional stipend4 7d7 ,post-award employment obligations ,each scholarship recipient1 as a condition of receiving a scholarship under the program1 shall enter into an agreement under which the recipient agrees to work in the cybersecurity mission of a ,federal1 ,state1 local1 or tribal agency for a period equal to the length of the scholarship following receipt of the student's degree4 7e7 ,hiring authority 7#a7 ,appointment in excepted service ,notwithstanding any provision of chapter #cc of title #e1 ,united ,states ,code1 governing appointments in the competitive service1 an agency shall appoint in the excepted service an individual who has completed the eligible degree program for which a scholarship was awarded4 7#b7 ,noncompetitive conversion ,except as provided in paragraph 7#d71 upon fulfillment of the service term1 an employee appointed under paragraph 7#a7 may be converted noncompetitively to term1 career-conditional or career appointment4 7#c7 ,timing of conversion ,an agency may noncompetitively convert a term employee appointed under paragraph 7#b7 to a career-conditional or career appointment before the term appointment expires4 7#d7 ,authority to decline conversion ,an agency may decline to make the noncompetitive conversion or appointment under paragraph 7#b7 for cause4 7f7 ,eligibility ,to be eligible to receive a scholarship under this section1 an individual shall-- 7#a7 be a citizen or lawful permanent resident of the ,united ,states2 7#b7 demonstrate a commitment to a career in improving the security of information technology2 7#c7 have demonstrated a high level of proficiency in mathematics1 engineering1 or computer sciences2 7#d7 be a full-time student in an eligible degree program at a qualified institution of higher education1 as determined by the ,director of the ,national ,science ,foundation2 and 7#e7 accept the terms of a scholarship under this section4 7g7 ,conditions of support 7#a7 ,in general ,as a condition of receiving a scholarship under this section1 a recipient shall agree to provide the qualified institution of higher education with annual verifiable documentation of post-award employment and up-to-date contact information4 7#b7 ,terms ,a scholarship recipient under this section shall be liable to the ,united ,states as provided in subsection 7i7 if the individual-- 7,a7 fails to maintain an acceptable level of academic standing at the applicable institution of higher education1 as determined by the ,director of the ,national ,science ,foundation2 7,b7 is dismissed from the applicable institution of higher education for disciplinary reasons2 7,c7 withdraws from the eligible degree program before completing the program2 7,d7 declares that the individual does not intend to fulfill the post-award employment obligation under this section2 or 7,e7 fails to fulfill the post-award employment obligation of the individual under this section4 7h7 ,monitoring compliance ,as a condition of participating in the program1 a qualified institution of higher education shall-- 7#a7 enter into an agreement with the ,director of the ,national ,science ,foundation1 to monitor the compliance of scholarship recipients with respect to their post-award employment obligations2 and 7#b7 provide to the ,director of the ,national ,science ,foundation1 on an annual basis1 the post-award employment documentation required under subsection 7g77#a7 for scholarship recipients through the completion of their post-award employment obligations4 7i7 ,amount of repayment 7#a7 ,less than #a year of service ,if a circumstance described in subsection 7g77#b7 occurs before the completion of #a year of a post-award employment obligation under this section1 the total amount of scholarship awards received by the individual under this section shall-- 7,a7 be repaid2 or 7,b7 be treated as a loan to be repaid in accordance with subsection 7j74 7#b7 #a or more years of service ,if a circumstance described in subparagraph 7,d7 or 7,e7 of subsection 7g77#b7 occurs after the completion of #a or more years of a post-award employment obligation under this section1 the total amount of scholarship awards received by the individual under this section1 reduced by the ratio of the number of years of service completed divided by the number of years of service required1 shall-- 7,a7 be repaid2 or 7,b7 be treated as a loan to be repaid in accordance with subsection 7j74 7j7 ,repayments ,a loan described subsection 7i7 shall-- 7#a7 be treated as a ,federal ,direct ,unsubsidized ,stafford ,loan under part ,d of title ,,iv of the ,higher ,education ,act of #aife 7#bj ,u4,s4,c4 #ajhg;a et seq472 and 7#b7 be subject to repayment1 together with interest thereon accruing from the date of the scholarship award1 in accordance with terms and conditions specified by the ,director of the ,national ,science ,foundation 7in consultation with the ,secretary of ,education7 in regulations promulgated to carry out this subsection4 7k7 ,collection of repayment 7#a7 ,in general ,in the event that a scholarship recipient is required to repay the scholarship award under this section1 the qualified institution of higher education providing the scholarship shall-- 7,a7 determine the repayment amounts and notify the recipient and the ,director of the ,national ,science ,foundation of the amounts owed2 and 7,b7 collect the repayment amounts within a period of time as determined by the ,director of the ,national ,science ,foundation1 or the repayment amounts shall be treated as a loan in accordance with subsection 7j74 7#b7 ,returned to ,treasury ,except as provided in paragraph 7#c71 any repayment under this subsection shall be returned to the ,treasury of the ,united ,states4 7#c7 ,retain percentage ,a qualified institution of higher education may retain a percentage of any repayment the institution collects under this subsection to defray administrative costs associated with the collection4 ,the ,director of the ,national ,science ,foundation shall establish a single1 fixed percentage that will apply to all eligible entities4 7l7 ,exceptions ,the ,director of the ,national ,science ,foundation may provide for the partial or total waiver or suspension of any service or payment obligation by an individual under this section whenever compliance by the individual with the obligation is impossible or would involve extreme hardship to the individual1 or if enforcement of such obligation with respect to the individual would be unconscionable4 7m7 ,evaluation and report ,the ,director of the ,national ,science ,foundation shall evaluate and report periodically to ,congress on the success of recruiting individuals for scholarships under this section and on hiring and retaining those individuals in the public sector workforce4 ,,iv ,cybersecurity ,awareness and ,preparedness #dja4 ,national cybersecurity awareness and education program 7a7 ,national cybersecurity awareness and education program ,the ,director of the ,national ,institute of ,standards and ,technology 7referred to in this section as the ,director71 in consultation with appropriate ,federal agencies1 industry1 educational institutions1 ,national ,laboratories1 the ,networking and ,information ,technology ,research and ,development program1 and other organizations shall continue to coordinate a national cybersecurity awareness and education program1 that includes activities such as-- 7#a7 the widespread dissemination of cybersecurity technical standards and best practices identified by the ,director2 7#b7 efforts to make cybersecurity best practices usable by individuals1 small to medium-sized businesses1 educational institutions1 and ,state1 local1 and tribal governments2 7#c7 increasing public awareness of cybersecurity1 cyber safety1 and cyber ethics2 7#d7 increasing the understanding of ,state1 local1 and tribal governments1 institutions of higher education1 and private sector entities of-- 7,a7 the benefits of ensuring effective risk management of information technology versus the costs of failure to do so2 and 7,b7 the methods to mitigate and remediate vulnerabilities2 7#e7 supporting formal cybersecurity education programs at all education levels to prepare and improve a skilled cybersecurity and computer science workforce for the private sector and ,federal1 ,state1 local1 and tribal government2 and 7#f7 promoting initiatives to evaluate and forecast future cybersecurity workforce needs of the ,federal ,government and develop strategies for recruitment1 training1 and retention4 7b7 ,considerations ,in carrying out the authority described in subsection 7a71 the ,director1 in consultation with appropriate ,federal agencies1 shall leverage existing programs designed to inform the public of safety and security of products or services1 including self-certifications and independently verified assessments regarding the quantification and valuation of information security risk4 7c7 ,strategic plan ,the ,director1 in cooperation with relevant ,federal agencies and other stakeholders1 shall build upon programs and plans in effect as of the date of enactment of this ,act to develop and implement a strategic plan to guide ,federal programs and activities in support of the national cybersecurity awareness and education program under subsection 7a74 7d7 ,report ,not later than #a year after the date of enactment of this ,act1 and every #e years thereafter1 the ,director shall transmit the strategic plan under subsection 7c7 to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives4 ,v ,advancement of cybersecurity technical standards #eja4 ,definitions ,in this title3 7#a7 ,director ,the term ,director means the ,director of the ,national ,institute of ,standards and ,technology4 7#b7 ,institute ,the term ,institute means the ,national ,institute of ,standards and ,technology4 #ejb4 ,international cybersecurity technical standards 7a7 ,in general ,the ,director1 in coordination with appropriate ,federal authorities1 shall-- 7#a7 as appropriate1 ensure coordination of ,federal agencies engaged in the development of international technical standards related to information system security2 and 7#b7 not later than #a year after the date of enactment of this ,act1 develop and transmit to ,congress a plan for ensuring such ,federal agency coordination4 7b7 ,consultation with the private sector ,in carrying out the activities specified in subsection 7a77#a71 the ,director shall ensure consultation with appropriate private sector stakeholders4 #ejc4 ,cloud computing strategy 7a7 ,in general ,the ,director1 in coordination with the ,office of ,management and ,budget1 in collaboration with the ,federal ,chief ,information ,officers ,council1 and in consultation with other relevant ,federal agencies and stakeholders from the private sector1 shall continue to develop and encourage the implementation of a comprehensive strategy for the use and adoption of cloud computing services by the ,federal ,government4 7b7 ,activities ,in carrying out the strategy described under subsection 7a71 the ,director shall give consideration to activities that-- 7#a7 accelerate the development1 in collaboration with the private sector1 of standards that address interoperability and portability of cloud computing services2 7#b7 advance the development of conformance testing performed by the private sector in support of cloud computing standardization2 and 7#c7 support1 in coordination with the ,office of ,management and ,budget1 and in consultation with the private sector1 the development of appropriate security frameworks and reference materials1 and the identification of best practices1 for use by ,federal agencies to address security and privacy requirements to enable the use and adoption of cloud computing services1 including activities-- 7,a7 to ensure the physical security of cloud computing data centers and the data stored in such centers2 7,b7 to ensure secure access to the data stored in cloud computing data centers2 7,c7 to develop security standards as required under section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c72 and 7,d7 to support the development of the automation of continuous monitoring systems4 #ejd4 ,identity management research and development ,the ,director shall continue a program to support the development of voluntary and cost-effective technical standards1 metrology1 testbeds1 and conformance criteria1 taking into account appropriate user concerns-- 7#a7 to improve interoperability among identity management technologies2 7#b7 to strengthen authentication methods of identity management systems2 7#c7 to improve privacy protection in identity management systems1 including health information technology systems1 through authentication and security protocols2 and 7#d7 to improve the usability of identity management systems4 ,passed the ,senate ,december #aa1 #bjad4,secretary