#aac? ,,congress  #b;d ,session  ,s4    
#acec  ,,an ,,act  ,to provide = an     
ongo+1 volunt>y public-private p>tn]%ip 
to improve cyb]security1 & to /r5g!n    
cyb]security rese>* & developm5t1       
work=ce developm5t & education1 & public
 aw>5ess & prep>$ness1 & = o!r purposes4
  #a4 ,%ort title2 table ( cont5ts  7a7 
,%ort title ,?is ,act may be cit$ z !   
,cyb]security ,enhancem5t ,act ( #bjad4 
7b7 ,table ( cont5ts ,! table ( cont5ts 
( ?is ,act is z foll[s3 ,sec4 #a4 ,%ort 
title2 table ( cont5ts4,sec4 #b4        
,def9itions4,sec4 #c4 ,no regulatory    
au?ority4,sec4 #d4 ,no additional funds 
au?oriz$4,,title ,i--,public-private    
collaboration on cybersecurity,sec4     
#aja4 ,public-private collaboration on  
cyb]security4,,title ,,ii--,cyb]security
 rese>* & development,sec4 #bja4 ,f$]al 
cyb]security rese>* & developm5t4,sec4  
#bjb4 ,comput] & network security rese>*
 c5t]s4,sec4 #bjc4 ,cyb]security        
automation & *eckli/s = gov]nm5t        
sy/ems4,sec4 #bjd4 ,national ,in/itute (

 ,/&>ds & ,te*nology cyb]security rese>*
 & developm5t4,,title ,,iii--,education 
& ,work=ce ,development,sec4 #cja4      
,cyb]security competitions &            
*all5ges4,sec4 #cjb4 ,f$]al cyb]        
s*ol>%ip-=-s]vice program4,,title       
,,iv--,cyb]security ,aw>5ess &          
,preparedness,sec4 #dja4 ,national      
cyb]security aw>5ess & education        
program4,,title ,v--,advancem5t (       
cyb]security te*nical standards,sec4    
#eja4 ,def9itions4,sec4 #ejb4           
,int]national cyb]security te*nical     
/&>ds4,sec4 #ejc4 ,cl\d comput+         
/rategy4,sec4 #ejd4 ,id5tity managem5t  
rese>* & developm5t4  #b4 ,def9itions ,9
 ?is ,act3 7#a7 ,cyb]security mission ,!
 t]m cyb]security mission means         
activities t encompass ! full range (   
?reat r$uction1 vuln]ability r$uction1  
det]r5ce1 int]national engagem5t1       
incid5t response1 resili5cy1 & recov]y  
policies & activities1 includ+ comput]  
network op]ations1 in=mation assurance1 
law en=cem5t1 diplomacy1 milit>y1 &     

intellig5ce missions z su* activities   
relate to ! security & /ability (       
cyb]space4  7#b7 ,in=mation sy/em ,! t]m
 in=mation sy/em has ! mean+ giv5 t t]m 
9 section #cejb ( title #dd1 ,unit$     
,/ates ,code4  #c4 ,no regulatory       
au?ority ,no?+ 9 ?is ,act %all be       
con/ru$ to conf] any regulatory au?ority
 on any ,f$]al1 ,/ate1 tribal1 or local 
dep>tm5t or ag5cy4  #d4 ,no additional  
funds au?oriz$ ,no additional funds are 
au?oriz$ to c>ry out ?is ,act1 & !      
am5dm5ts made by ?is ,act4 ,?is ,act1 & 
! am5dm5ts made by ?is ,act1 %all be    
c>ri$ out us+ am\nts o!rwise au?oriz$ or
 appropriat$4  ,i ,public-private       
collaboration on cyb]security  #aja4    
,public-private collaboration on        
cyb]security  7a7 ,cyb]security ,section
 #b7;c7 ( ! ,national ,in/itute ( ,/&>ds
 & ,te*nology ,act 7#ae ,u4,s4,c4       
#bgb7;c77 is am5d$-- 7#a7 by r$esignat+ 
p>agraphs 7#ae7 ?r\gh 7#bb7 z p>agraphs 
7#af7 ?r\gh 7#bc71 respectively2 &  7#b7
 by ins]t+ aft] p>agraph 7#ad7 ! foll[+3

  7#ae7 on an ongo+ basis1 facilitate & 
support ! developm5t ( a volunt>y1      
cons5sus-bas$1 indu/ry-l$ set ( /&>ds1  
guidel9es1 be/ practices1 me?odologies1 
proc$ures1 & processes to               
co/-effectively r$uce cyb] risks to     
critical infra/ructure 7z def9$ "u      
subsection 7e772  4  7b7 ,scope &       
limitations ,section #b ( ! ,national   
,in/itute ( ,/&>ds & ,te*nology ,act    
7#ae ,u4,s4,c4 #bgb7 is am5d$ by add+ at
 ! end ! foll[+3  7e7 ,cyb] risks  7#a7 
,9 g5]al ,9 c>ry+ out ! activities "u   
subsection 7c77#ae71 ! ,director-- 7,a7 
%all-- 7i7 coord9ate closely & regul>ly 
) relevant private sector p]sonnel &    
entities1 critical infra/ructure own]s &
 op]ators1 & o!r relevant indu/ry       
organizations1 includ+ ,sector          
,coord9at+ ,c\ncils & ,in=mation ,%>+ & 
,analysis ,c5t]s1 & incorporate indu/ry 
exp]tise2  7ii7 consult ) ! heads (     
ag5cies ) national security             
responsibilities1 sector-specific       
ag5cies & o!r appropriate ag5cies1 ,/ate

 & local gov]nm5ts1 ! gov]nm5ts ( o!r   
nations1 & int]national organizations2  
7iii7 id5tify a prioritiz$1 flexible1   
repeatable1 p]=mance-bas$1 &            
co/-effective approa*1 includ+ in=mation
 security measures & controls1 t may be 
volunt>ily adopt$ by own]s & op]ators ( 
critical infra/ructure to help !m       
id5tify1 assess1 & manage cyb] risks2   
7iv7 include me?odologies-- 7,i7 to     
id5tify & mitigate impacts ( !          
cyb]security measures or controls on    
bus9ess confid5tiality2 &  7,,ii7 to    
protect individual privacy & civil      
lib]ties2  7v7 incorporate volunt>y     
cons5sus /&>ds & indu/ry be/ practices2 
7vi7 align ) volunt>y int]national /&>ds
 to ! fulle/ ext5t possible2  7vii7     
prev5t duplication ( regulatory         
processes & prev5t conflict ) or sup]s$+
 ( regulatory requirem5ts1 m&atory      
/&>ds1 & relat$ processes2 &  7viii7    
include su* o!r simil> & consi/5t       
elem5ts z ! ,director consid]s necess>y2
 &  7,b7 %all n prescribe or o!rwise    

require-- 7i7 ! use ( specific          
solutions2  7ii7 ! use ( specific       
in=mation or communications te*nology   
products or s]vices2 or  7iii7 t        
in=mation or communications te*nology   
products or s]vices be design$1         
develop$1 or manufactur$ 9 a p>ticul>   
mann]4  7#b7 ,limitation ,in=mation %>$ 
) or provid$ to ! ,in/itute = ! purpose 
( ! activities describ$ "u subsection   
7c77#ae7 %all n be us$ by any ,f$]al1   
,/ate1 tribal1 or local dep>tm5t or     
ag5cy to regulate ! activity ( any      
entity4 ,no?+ 9 ?is p>agraph %all be    
con/ru$ to modify any regulatory        
requirem5t to report or submit in=mation
 to a ,f$]al1 ,/ate1 tribal1 or local   
dep>tm5t or ag5cy4  7#c7 ,def9itions ,9 
?is subsection3 7,a7 ,critical          
infra/ructure ,! t]m critical           
infra/ructure has ! mean+ giv5 ! t]m 9  
section #ajaf7;e7 ( ! ,,usa ,,patriot   
,act ( #bjja 7#db ,u4,s4,c4 #eaie;c7e774
  7,b7 ,sector-specific ag5cy ,! t]m    
sector-specific ag5cy means ! ,f$]al    

dep>tm5t or ag5cy responsible = provid+ 
in/itutional k & specializ$ exp]tise z  
well z lead+1 facilitat+1 or support+ ! 
security & resili5ce programs &         
associat$ activities ( its designat$    
critical infra/ructure sector 9 !       
all-haz>ds environm5t4  4  7c7 ,/udy &  
reports  7#a7 ,/udy ,! ,comptroll]      
,g5]al ( ! ,unit$ ,/ates %all conduct a 
/udy t assesses-- 7,a7 ! progress made  
by ! ,director ( ! ,national ,in/itute (
 ,/&>ds & ,te*nology 9 facilitat+ !     
developm5t ( /&>ds & proc$ures to r$uce 
cyb] risks to critical infra/ructure 9  
accordance ) section #b7;c77#ae7 ( !    
,national ,in/itute ( ,/&>ds &          
,te*nology ,act1 z add$ by ?is section2 
7,b7 ! ext5t to :i* ! ,director's       
facilitation ef=ts are consi/5t ) !     
directive 9 su* section t ! developm5t (
 su* /&>ds & proc$ures be volunt>y & l$ 
by indu/ry repres5tatives2  7,c7 ! ext5t
 to :i* o!r ,f$]al ag5cies h promot$ &  
sectors ( critical infra/ructure 7z     
def9$ 9 section #ajaf7;e7 ( ! ,,usa     

,,patriot ,act ( #bjja 7#db ,u4,s4,c4   
#eaie;c7e777 h adopt$ a volunt>y1       
indu/ry-l$ set ( /&>ds1 guidel9es1 be/  
practices1 me?odologies1 proc$ures1 &   
processes to r$uce cyb] risks to        
critical infra/ructure 9 accordance )   
su* section #b7;c77#ae72  7,d7 ! reasons
 beh9d ! decisions ( sectors ( critical 
infra/ructure 7z def9$ 9 subp>agraph    
7,c77 to adopt or to n adopt ! volunt>y 
/&>ds describ$ 9 subp>agraph 7,c72 &    
7,e7 ! ext5t to :i* su* volunt>y /&>ds h
 prov$ successful 9 protect+ critical   
infra/ructure f cyb] ?reats4  7#b7      
,reports ,n lat] ?an #a ye> aft] ! date 
( ! enactm5t ( ?is ,act1 & e #b ye>s    
!reaft] = ! foll[+ #f ye>s1 !           
,comptroll] ,g5]al %all submit a report1
 :i* summ>izes ! f9d+s ( ! /udy conduct$
 "u p>agraph 7#a71 to ! ,committee on   
,comm]ce1 ,sci5ce1 & ,transportation ( !
 ,s5ate & ! ,committee on ,sci5ce1      
,space1 & ,te*nology ( ! ,h\se (        
,repres5tatives4  ,,ii ,cyb]security    
rese>* & developm5t  #bja4 ,f$]al       

cyb]security rese>* & developm5t  7a7   
,fundam5tal cyb]security rese>*  7#a7   
,f$]al cyb]security rese>* & developm5t 
/rategic plan ,! heads ( ! applicable   
ag5cies & dep>tm5ts1 work+ ?r\gh !      
,national ,sci5ce & ,te*nology ,c\ncil &
 ! ,network+ & ,in=mation ,te*nology    
,rese>* & ,developm5t ,program1 %all    
develop & update e #d ye>s a ,f$]al     
cyb]security rese>* & developm5t        
/rategic plan 7ref]r$ to 9 ?is          
subsection z ! /rategic plan7 bas$ on an
 assessm5t ( cyb]security risk to guide 
! ov]all direction ( ,f$]al cyb]security
 & in=mation assurance rese>* &         
developm5t = in=mation te*nology &      
network+ sy/ems4 ,! heads ( ! applicable
 ag5cies & dep>tm5ts %all build ^u exi/+
 programs & plans to develop ! /rategic 
plan to meet objectives 9 cyb]security1 
su* z-- 7,a7 h[ to design & build       
complex s(tw>e-int5sive sy/ems t are    
secure & reliable :5 fir/ deploy$2  7,b7
 h[ to te/ & v]ify t s(tw>e & h>dw>e1   
:e!r develop$ locally or obta9$ f a ?ird

 p>ty1 is free ( significant kn[n       
security flaws2  7,c7 h[ to te/ & v]ify 
t s(tw>e & h>dw>e obta9$ f a ?ird p>ty  
correctly implem5ts /at$ functionality1 
& only t functionality2  7,d7 h[ to     
gu>antee ! privacy ( an individual1     
includ+ t individual's id5tity1         
in=mation1 & lawful transactions :5 /or$
 9 di/ribut$ sy/ems or transmitt$ ov]   
networks2  7,e7 h[ to build new         
protocols to enable ! ,int]net to h     
robu/ security z "o ( ! key capabilities
 ( ! ,int]net2  7,f7 h[ to det]m9e !    
orig9 ( a message transmitt$ ov] !      
,int]net2  7,g7 h[ to support privacy 9 
conjunction ) improv$ security2  7,h7 h[
 to address ! problem ( insid] ?reats2  
7,i7 h[ improv$ consum] education &     
digital lit]acy initiatives c address   
human factors t contribute to           
cyb]security2  7,j7 h[ to protect       
in=mation process$1 transmitt$1 or /or$ 
us+ cl\d comput+ or transmitt$ ?r\gh    
wireless s]vices2 &  7,k7 any additional
 objectives ! heads ( ! applicable      

ag5cies & dep>tm5ts1 9 coord9ation ) !  
head ( any relevant ,f$]al ag5cy & )    
input f /akehold]s1 includ+ appropriate 
national laboratories1 indu/ry1 &       
academia1 det]m9e appropriate4  7#b7    
,requirem5ts  7,a7 ,cont5ts ( plan ,!   
/rategic plan %all-- 7i7 specify &      
prioritize ne>-t]m1 mid-t]m1 & long-t]m 
rese>* objectives1 includ+ objectives   
associat$ ) ! rese>* id5tifi$ 9 section 
#d7;a77#a7 ( ! ,cyb] ,security ,rese>* &
 ,developm5t ,act 7#ae ,u4,s4,c4        
#gdjc7;a77#a772  7ii7 specify h[ !      
ne>-t]m objectives describ$ 9 clause 7i7
 complem5t rese>* & developm5t areas 9  
:i* ! private sector is actively engag$2
  7iii7 describe h[ ! heads ( !         
applicable ag5cies & dep>tm5ts w focus  
on innovative1 trans=mational           
te*nologies ) ! pot5tial to enhance !   
security1 reliability1 resili5ce1 &     
tru/wor?9ess ( ! digital infra/ructure1 
& to protect consum] privacy2  7iv7     
describe h[ ! heads ( ! applicable      
ag5cies & dep>tm5ts w fo/] ! rapid      

transf] ( rese>* & developm5t results   
into new cyb]security te*nologies &     
applications = ! timely b5efit ( society
 & ! national int]e/1 includ+ ?r\gh !   
dissem9ation ( be/ practices & o!r      
outrea* activities2  7v7 describe h[ !  
heads ( ! applicable ag5cies & dep>tm5ts
 w e/abli% & ma9ta9 a national rese>*   
infra/ructure = creat+1 te/+1 & evaluat+
 ! next g5]ation ( secure network+ &    
in=mation te*nology sy/ems2 &  7vi7     
describe h[ ! heads ( ! applicable      
ag5cies & dep>tm5ts w facilitate access 
by academic rese>*]s to ! infra/ructure 
describ$ 9 clause 7v71 z well z to      
relevant data1 includ+ ev5t data4  7,b7 
,private sector ef=ts ,9 develop+1      
implem5t+1 & updat+ ! /rategic plan1 !  
heads ( ! applicable ag5cies &          
dep>tm5ts1 work+ ?r\gh ! ,national      
,sci5ce & ,te*nology ,c\ncil & ,network+
 & ,in=mation ,te*nology ,rese>* &      
,developm5t ,program1 %all "w 9 close   
coop]ation ) indu/ry1 academia1 & o!r   
int]e/$ /akehold]s to ensure1 to ! ext5t

 possible1 t ,f$]al cyb]security rese>* 
& developm5t is n duplicative ( private 
sector ef=ts4  7,c7 ,recomm5dations ,9  
develop+ & updat+ ! /rategic plan !     
heads ( ! applicable ag5cies & dep>tm5ts
 %all solicit recomm5dations & advice   
f-- 7i7 ! advisory committee e/abli%$ "u
 section #aja7;b77#a7 ( !               
,high-,p]=mance ,comput+ ,act ( #aiia   
7#ae ,u4,s4,c4 #eeaa7;b77#a772 &  7ii7 a
 wide range ( /akehold]s1 includ+       
indu/ry1 academia1 includ+              
repres5tatives ( m9ority s]v+           
in/itutions & community colleges1       
,national ,laboratories1 & o!r relevant 
organizations & in/itutions4  7,d7      
,implem5tation roadmap ,! heads ( !     
applicable ag5cies & dep>tm5ts1 work+   
?r\gh ! ,national ,sci5ce & ,te*nology  
,c\ncil & ,network+ & ,in=mation        
,te*nology ,rese>* & ,developm5t        
,program1 %all develop & annually update
 an implem5tation roadmap = ! /rategic  
plan4 ,! implem5tation roadmap %all--   
7i7 specify ! role ( ea* ,f$]al ag5cy 9 

c>ry+ out or sponsor+ rese>* &          
developm5t to meet ! rese>* objectives (
 ! /rategic plan1 includ+ a description 
( h[ progress t[>d ! rese>* objectives w
 be evaluat$2  7ii7 specify ! fund+     
allocat$ to ea* major rese>* objective (
 ! /rategic plan & ! s\rce ( fund+ by   
ag5cy = ! curr5t fiscal ye>2  7iii7     
e/imate ! fund+ requir$ = ea* major     
rese>* objective ( ! /rategic plan = !  
foll[+ #c fiscal ye>s2 &  7iv7 track    
ongo+ & complet$ ,f$]al cyb]security    
rese>* & developm5t projects4  7#c7     
,reports to ,congress ,! heads ( !      
applicable ag5cies & dep>tm5ts1 work+   
?r\gh ! ,national ,sci5ce & ,te*nology  
,c\ncil & ,network+ & ,in=mation        
,te*nology ,rese>* & ,developm5t        
,program1 %all submit to ! ,committee on
 ,comm]ce1 ,sci5ce1 & ,transportation ( 
! ,s5ate & ! ,committee on ,sci5ce1     
,space1 & ,te*nology ( ! ,h\se (        
,repres5tatives-- 7,a7 ! /rategic plan n
 lat] ?an #a ye> aft] ! date ( enactm5t 
( ?is ,act2  7,b7 ea* quadr5nial update 

to ! /rategic plan2 &  7,c7 !           
implem5tation roadmap "u subp>agraph    
7,d71 & its annual updates1 :i* %all be 
app5d$ to ! annual report requir$ "u    
section #aja7;a77#b77;,d7 ( !           
,high-,p]=mance ,comput+ ,act ( #aiia   
7#ae ,u4,s4,c4 #eeaa7;a77#b77;,d774     
7#d7 ,def9ition ( applicable ag5cies &  
dep>tm5ts ,9 ?is subsection1 ! t]m      
applicable ag5cies & dep>tm5ts means !  
ag5cies & dep>tm5ts id5tifi$ 9 clauses  
7i7 ?r\gh 7x7 ( section                 
#aja7;a77#c77;,b7 ( ! ,high-,p]=mance   
,comput+ ,act ( #aiia 7#ae ,u4,s4,c4    
#eeaa7;a77#c77;,b77 or designat$ "u     
clause 7xi7 ( t section4  7b7           
,cyb]security practices rese>* ,!       
,director ( ! ,national ,sci5ce         
,f\ndation %all support rese>* t-- 7#a7 
develops1 evaluates1 dissem9ates1 &     
integrates new cyb]security practices & 
concepts into ! core curriculum (       
comput] sci5ce programs & ( o!r programs
 :]e graduates ( su* programs h a       
sub/antial probability ( develop+ s(tw>e

 aft] graduation1 includ+ new practices 
& concepts relat+ to secure cod+        
education & improvem5t programs2 &  7#b7
 develops new models = pr(essional      
developm5t ( faculty 9 cyb]security     
education1 includ+ secure cod+          
developm5t4  7c7 ,cyb]security model+ & 
te/ b$s  7#a7 ,review ,n lat] ?an #a ye>
 aft] ! date ( enactm5t ( ?is ,act1 !   
,director ( ! ,national ,sci5ce         
,f\ndation1 9 coord9ation ) ! ,director 
( ! ,(fice ( ,sci5ce & ,te*nology       
,policy1 %all conduct a review (        
cyb]security te/ b$s 9 exi/5ce on ! date
 ( enactm5t ( ?is ,act to in=m ! grants 
"u p>agraph 7#b74 ,! review %all include
 an assessm5t ( :e!r a suffici5t numb] (
 cyb]security te/ b$s are available to  
meet ! rese>* ne$s "u ! ,f$]al          
cyb]security rese>* & developm5t        
/rategic plan4 ,^u completion1 !        
,director %all submit ! review to !     
,committee on ,comm]ce1 ,sci5ce1 &      
,transportation ( ! ,s5ate & !          
,committee on ,sci5ce1 ,space1 &        

,te*nology ( ! ,h\se ( ,repres5tatives4 
7#b7 ,additional cyb]security model+ &  
te/ b$s  7,a7 ,9 g5]al ,if ! ,director (
 ! ,national ,sci5ce ,f\ndation1 aft] ! 
review "u p>agraph 7#a71 det]m9es t !   
rese>* ne$s "u ! ,f$]al cyb]security    
rese>* & developm5t /rategic plan       
require ! e/abli%m5t ( additional       
cyb]security te/ b$s1 ! ,director ( !   
,national ,sci5ce ,f\ndation1 9         
coord9ation ) ! ,secret>y ( ,comm]ce & !
 ,secret>y ( ,homel& ,security1 may aw>d
 grants to in/itutions ( high] education
 or rese>* & developm5t non-pr(it       
in/itutions to e/abli% cyb]security te/ 
b$s4  7,b7 ,requirem5t ,! cyb]security  
te/ b$s "u subp>agraph 7,a7 %all be     
suffici5tly robu/ 9 ord] to model !     
scale & complexity ( real-"t cyb]       
attacks & def5ses on real _w networks & 
environm5ts4  7,c7 ,assessm5t requir$ ,!
 ,director ( ! ,national ,sci5ce        
,f\ndation1 9 coord9ation ) ! ,secret>y 
( ,comm]ce & ! ,secret>y ( ,homel&      
,security1 %all evaluate ! effectiv5ess 

( any grants aw>d$ "u ?is subsection 9  
meet+ ! objectives ( ! ,f$]al           
cyb]security rese>* & developm5t        
/rategic plan n lat] ?an #b ye>s aft] ! 
review "u p>agraph 7#a7 ( ?is           
subsection1 & p]iodically !reaft]4  7d7 
,coord9ation ,) ,o!r ,rese>*            
,initiatives ,9 accordance ) !          
responsibilities "u section #aja ( !    
,high-,p]=mance ,comput+ ,act ( #aiia   
7#ae ,u4,s4,c4 #eeaa71 ! ,director ( !  
,(fice ( ,sci5ce & ,te*nology ,policy   
%all coord9ate1 to ! ext5t practicable1 
,f$]al rese>* & developm5t activities "u
 ?is section ) o!r ongo+ rese>* &       
developm5t security-relat$ initiatives1 
includ+ rese>* be+ conduct$ by-- 7#a7 ! 
,national ,sci5ce ,f\ndation2  7#b7 !   
,national ,in/itute ( ,/&>ds &          
,te*nology2  7#c7 ! ,dep>tm5t ( ,homel& 
,security2  7#d7 o!r ,f$]al ag5cies2    
7#e7 o!r ,f$]al & private rese>*        
laboratories1 rese>* entities1 &        
univ]sities2  7#f7 in/itutions ( high]  
education2  7#g7 relevant nonpr(it      

organizations2 &  7#h7 int]national     
p>tn]s ( ! ,unit$ ,/ates4  7e7 ,national
 ,sci5ce ,f\ndation ,comput] & ,network 
,security ,rese>* ,grant ,areas ,section
 #d7;a77#a7 ( ! ,cyb] ,security ,rese>* 
& ,developm5t ,act 7#ae ,u4,s4,c4       
#gdjc7;a77#a77 is am5d$-- 7#a7 9        
subp>agraph 7,h71 by /rik+ & at ! end2  
7#b7 9 subp>agraph 7,i71 by /rik+ !     
p]iod at ! end & ins]t+ a semicolon2 &  
7#c7 by add+ at ! end ! foll[+3  7,j7   
secure fundam5tal protocols t are       
integral to int]-network communications 
& data ex*ange2  7,k7 secure s(tw>e     
eng9e]+ & s(tw>e assurance1 includ+--   
7i7 programm+ languages & sy/ems t      
include fundam5tal security features2   
7ii7 portable or reusable code t rema9s 
secure :5 deploy$ 9 v>i\s environm5ts2  
7iii7 v]ification & validation          
te*nologies to ensure t requirem5ts &   
specifications h be5 implem5t$2 &  7iv7 
models = comp>ison & metrics to assure t
 requir$ /&>ds h be5 met2  7,l7 holi/ic 
sy/em security t-- 7i7 addresses !      

build+ ( secure sy/ems f tru/$ & untru/$
 compon5ts2  7ii7 proactively r$uces    
vuln]abilities2  7iii7 addresses insid] 
?reats2 &  7iv7 supports privacy 9      
conjunction ) improv$ security2  7,m7   
monitor+ & detection2  7,n7 mitigation &
 rapid recov]y me?ods2  7,o7 security ( 
wireless networks & mobile devices2 &   
7,p7 security ( cl\d infra/ructure &    
s]vices4  4  7f7 ,rese>* on ! sci5ce (  
cyb]security ,! head ( ea* ag5cy &      
dep>tm5t id5tifi$ "u section            
#aja7;a77#c77;,b7 ( ! ,high-,p]=mance   
,comput+ ,act ( #aiia 7#ae ,u4,s4,c4    
#eeaa7;a77#c77;,b771 ?r\gh exi/+        
programs & activities1 %all support     
rese>* t w lead to ! developm5t ( a     
sci5tific f\ndation = ! field (         
cyb]security1 includ+ rese>* t increases
 und]/&+ ( ! und]ly+ pr9ciples ( secur+ 
complex network$ sy/ems1 enables        
repeatable exp]im5tation1 & creates     
quantifiable security metrics4  #bjb4   
,comput] & network security rese>* c5t]s
 ,section #d7;b7 ( ! ,cyb] ,security    

,rese>* & ,developm5t ,act 7#ae         
,u4,s4,c4 #gdjc7;b77 is am5d$-- 7#a7 9  
p>agraph 7#c71 by /rik+ ! rese>* areas &
 ins]t+ ! foll[+3 improv+ ! security &  
resili5cy ( in=mation te*nology1 r$uc+  
cyb] vuln]abilities1 & anticipat+ &     
mitigat+ consequ5ces ( cyb] attacks on  
critical infra/ructure1 by conduct+     
rese>* 9 ! areas2  7#b7 by /rik+ ! c5t] 
9 p>agraph 7#d77;,d7 & ins]t+ ! ,c5t]2 &
  7#c7 9 p>agraph 7#e7-- 7,a7 by /rik+ &
 at ! end ( subp>agraph 7,c72  7,b7 by  
/rik+ ! p]iod at ! end ( subp>agraph    
7,d7 & ins]t+ a semicolon2 &  7,c7 by   
add+ at ! end ! foll[+3  7,e7 !         
demon/rat$ capability ( ! applicant to  
conduct high p]=mance computation       
integral to complex comput] & network   
security rese>*1 ?r\gh on-site or       
(f-site comput+2  7,f7 ! applicant's    
affiliation ) private sector entities   
involv$ ) indu/rial rese>* describ$ 9   
subsection 7a77#a72  7,g7 ! capability (
 ! applicant to conduct rese>* 9 a      
secure environm5t2  7,h7 ! applicant's  

affiliation ) exi/+ rese>* programs ( ! 
,f$]al ,gov]nm5t2  7,i7 ! applicant's   
exp]i5ce manag+ public-private p>tn]%ips
 to transition new te*nologies into a   
comm]cial sett+ or ! gov]nm5t us]       
community2  7,j7 ! capability ( !       
applicant to conduct int]discipl9>y     
cyb]security rese>*1 basic & appli$1 su*
 z 9 law1 economics1 or behavioral      
sci5ces2 &  7,k7 ! capability ( !       
applicant to conduct rese>* 9 areas su* 
z sy/ems security1 wireless security1   
network+ & protocols1 =mal me?ods &     
high-p]=mance comput+1 nanote*nology1 or
 indu/rial control sy/ems4  4  #bjc4    
,cyb]security automation & *eckli/s =   
gov]nm5t sy/ems ,section #h7;c7 ( !     
,cyb] ,security ,rese>* & ,developm5t   
,act 7#ae ,u4,s4,c4 #gdjf7;c77 is am5d$ 
to read z foll[s3  7c7 ,security        
automation & *eckli/s = gov]nm5t sy/ems 
7#a7 ,9 g5]al ,! ,director ( ! ,national
 ,in/itute ( ,/&>ds & ,te*nology %all1 z
 necess>y1 develop & revise security    
automation /&>ds1 associat$ ref]5ce     

mat]ials 7includ+ protocols71 & *eckli/s
 provid+ sett+s & option selections t   
m9imize ! security risks associat$ ) ea*
 in=mation te*nology h>dw>e or s(tw>e   
sy/em & security tool t is1 or is likely
 to become1 widely us$ )9 ! ,f$]al      
,gov]nm5t1 !reby enabl+ /&>diz$ &       
int]op]able te*nologies1 ar*itectures1 &
 frameworks = cont9u\s monitor+ (       
in=mation security )9 ! ,f$]al          
,gov]nm5t4  7#b7 ,priorities =          
developm5t ,! ,director ( ! ,national   
,in/itute ( ,/&>ds & ,te*nology %all    
e/abli% priorities = ! developm5t (     
/&>ds1 ref]5ce mat]ials1 & *eckli/s "u  
?is subsection on ! basis (-- 7,a7 !    
security risks associat$ ) ! use ( !    
sy/em2  7,b7 ! numb] ( ag5cies t use a  
p>ticul> sy/em or security tool2  7,c7 !
 usefulness ( ! /&>ds1 ref]5ce mat]ials1
 or *eckli/s to ,f$]al ag5cies t are    
us]s or pot5tial us]s ( ! sy/em2  7,d7 !
 effectiv5ess ( ! associat$ /&>d1       
ref]5ce mat]ial1 or *eckli/ 9 creat+ or 
enabl+ cont9u\s monitor+ ( in=mation    

security2 or  7,e7 su* o!r factors z !  
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology det]m9es to be      
appropriate4  7#c7 ,exclud$ sy/ems ,!   
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology may exclude f !     
application ( p>agraph 7#a7 any         
in=mation te*nology h>dw>e or s(tw>e    
sy/em or security tool = :i* su*        
,director det]m9es t ! developm5t ( a   
/&>d1 ref]5ce mat]ial1 or *eckli/ is    
inappropriate because ( ! infrequ5cy (  
use ( ! sy/em1 ! obsolesc5ce ( ! sy/em1 
or ! lack ( utility or impracticability 
( develop+ a /&>d1 ref]5ce mat]ial1 or  
*eckli/ = ! sy/em4  7#d7 ,dissem9ation (
 /&>ds & relat$ mat]ials ,! ,director ( 
! ,national ,in/itute ( ,/&>ds &        
,te*nology %all ensure t ,f$]al ag5cies 
are in=m$ ( ! availability ( any /&>d1  
ref]5ce mat]ial1 *eckli/1 or o!r item   
develop$ "u ?is subsection4  7#e7 ,ag5cy
 use requirem5ts ,! developm5t ( /&>ds1 
ref]5ce mat]ials1 & *eckli/s "u p>agraph
 7#a7 = an in=mation te*nology h>dw>e or

 s(tw>e sy/em or tool does n-- 7,a7     
require any ,f$]al ag5cy to select !    
specific sett+s or options recomm5d$ by 
! /&>d1 ref]5ce mat]ial1 or *eckli/ = ! 
sy/em2  7,b7 e/abli% conditions or      
pr]equisites = ,f$]al ag5cy procurem5t  
or deploym5t ( any su* sy/em2  7,c7     
imply an endorsem5t ( any su* sy/em by !
 ,director ( ! ,national ,in/itute (    
,/&>ds & ,te*nology2 or  7,d7 preclude  
any ,f$]al ag5cy f procur+ or deploy+   
o!r in=mation te*nology h>dw>e or s(tw>e
 sy/ems = :i* no su* /&>d1 ref]5ce      
mat]ial1 or *eckli/ has be5 develop$ or 
id5tifi$ "u p>agraph 7#a74  4  #bjd4    
,national ,in/itute ( ,/&>ds &          
,te*nology cyb]security rese>* &        
developm5t ,section #bj ( ! ,national   
,in/itute ( ,/&>ds & ,te*nology ,act    
7#ae ,u4,s4,c4 #bgh;g-#c7 is am5d$--    
7#a7 by r$esignat+ subsection 7e7 z     
subsection 7f72 &  7#b7 by ins]t+ aft]  
subsection 7d7 ! foll[+3  7e7           
,intramural ,security ,rese>* ,z "p ( ! 
rese>* activities conduct$ 9 accordance 

) subsection 7d77#c71 ! ,in/itute %all1 
to ! ext5t practicable & appropriate--  
7#a7 conduct a rese>* program to develop
 a unify+ & /&>diz$ id5tity1 privilege1 
& access control managem5t framework = !
 execution ( a wide v>iety ( res\rce    
protection policies & t is am5able to   
implem5tation )9 a wide v>iety ( exi/+ &
 em]g+ comput+ environm5ts2  7#b7 c>ry  
out rese>* associat$ ) improv+ !        
security ( in=mation sy/ems & networks2 
7#c7 c>ry out rese>* associat$ ) improv+
 ! te/+1 measurem5t1 usability1 &       
assurance ( in=mation sy/ems & networks2
  7#d7 c>ry out rese>* associat$ )      
improv+ security ( indu/rial control    
sy/ems2  7#e7 c>ry out rese>* associat$ 
) improv+ ! security & integrity ( !    
in=mation te*nology supply *a92 &  7#f7 
c>ry out any additional rese>* !        
,in/itute det]m9es appropriate4  4      
,,iii ,education & ,work=ce ,developm5t 
#cja4 ,cyb]security competitions &      
*all5ges  7a7 ,9 g5]al ,! ,secret>y (   
,comm]ce1 ,director ( ! ,national       

,sci5ce ,f\ndation1 & ,secret>y (       
,homel& ,security1 9 consultation ) !   
,director ( ! ,(fice ( ,p]sonnel        
,managem5t1 %all-- 7#a7 support         
competitions & *all5ges "u section #bd (
 ! ,/ev5son-,wydl] ,te*nology           
,innovation ,act ( #aihj 7#ae ,u4,s4,c4 
#cgai7 7z am5d$ by section #aje ( !     
,am]ica ,,competes ,reau?orization ,act 
( #bjaj 7#abd ,/at4 #cihi77 or any o!r  
provision ( law1 z appropriate-- 7,a7 to
 id5tify1 develop1 & recruit tal5t$     
individuals to p]=m duties relat+ to !  
security ( in=mation te*nology 9 ,f$]al1
 ,/ate1 local1 & tribal gov]nm5t        
ag5cies1 & ! private sector2 or  7,b7 to
 /imulate innovation 9 basic & appli$   
cyb]security rese>*1 te*nology          
developm5t1 & prototype demon/ration t  
has ! pot5tial = application to !       
in=mation te*nology activities ( !      
,f$]al ,gov]nm5t2 &  7#b7 ensure !      
effective op]ation ( ! competitions &   
*all5ges "u ?is section4  7b7           
,p>ticipation ,p>ticipants 9 !          

competitions & *all5ges "u subsection   
7a77#a7 may include-- 7#a7 /ud5ts       
enroll$ 9 grades #i ?r\gh #ab2  7#b7    
/ud5ts enroll$ 9 a po/second>y program (
 /udy lead+ to a baccalaureate degree at
 an in/itution ( high] education2  7#c7 
/ud5ts enroll$ 9 a po/baccalaureate     
program ( /udy at an in/itution ( high] 
education2  7#d7 in/itutions ( high]    
education & rese>* in/itutions2  7#e7   
vet]ans2 &  7#f7 o!r gr\ps or           
individuals t ! ,secret>y ( ,comm]ce1   
,director ( ! ,national ,sci5ce         
,f\ndation1 & ,secret>y ( ,homel&       
,security det]m9e appropriate4  7c7     
,affiliation & coop]ative agreem5ts     
,competitions & *all5ges "u ?is section 
may be c>ri$ out ?r\gh affiliation &    
coop]ative agreem5ts )-- 7#a7 ,f$]al    
ag5cies2  7#b7 regional1 ,/ate1 or s*ool
 programs support+ ! developm5t ( cyb]  
pr(essionals2  7#c7 ,/ate1 local1 &     
tribal gov]nm5ts2 or  7#d7 o!r private  
sector organizations4  7d7 ,areas (     
skill ,competitions & *all5ges "u       

subsection 7a77#a77;,a7 %all be design$ 
to id5tify1 develop1 & recruit          
exceptional tal5t relat+ to-- 7#a7      
e?ical hack+2  7#b7 p5etration te/+2    
7#c7 vuln]ability assessm5t2  7#d7      
cont9uity ( sy/em op]ations2  7#e7      
security 9 design2  7#f7 cyb] =5sics2   
7#g7 (f5sive & def5sive cyb] op]ations2 
&  7#h7 o!r areas ! ,secret>y (         
,comm]ce1 ,director ( ! ,national       
,sci5ce ,f\ndation1 & ,secret>y (       
,homel& ,security consid] necess>y to   
fulfill ! cyb]security mission4  7e7    
,topics ,9 select+ topics = competitions
 & *all5ges "u subsection 7a77#a71 !    
,secret>y ( ,comm]ce1 ,director ( !     
,national ,sci5ce ,f\ndation1 &         
,secret>y ( ,homel& ,security-- 7#a7    
%all consult widely bo? )9 & outside !  
,f$]al ,gov]nm5t2 &  7#b7 may empanel   
advisory committees4  7f7 ,int]n%ips ,! 
,director ( ! ,(fice ( ,p]sonnel        
,managem5t may support1 z appropriate1  
int]n%ips or o!r "w exp]i5ce 9 ! ,f$]al 
,gov]nm5t to ! w9n]s ( ! competitions & 

*all5ges "u ?is section4  #cjb4 ,f$]al  
cyb] s*ol>%ip-=-s]vice program  7a7 ,9  
g5]al ,! ,director ( ! ,national ,sci5ce
 ,f\ndation1 9 coord9ation ) ! ,director
 ( ! ,(fice ( ,p]sonnel ,managem5t &    
,secret>y ( ,homel& ,security1 %all     
cont9ue a ,f$]al cyb] s*ol>%ip-=-s]vice 
program to recruit & tra9 ! next        
g5]ation ( in=mation te*nology          
pr(essionals1 indu/rial control sy/em   
security pr(essionals1 & security       
manag]s to meet ! ne$s ( ! cyb]security 
mission = ,f$]al1 ,/ate1 local1 & tribal
 gov]nm5ts4  7b7 ,program description & 
compon5ts ,! ,f$]al ,cyb]               
,s*ol>%ip-=-,s]vice ,program %all-- 7#a7
 provide s*ol>%ips ?r\gh qualifi$       
in/itutions ( high] education1 includ+  
community colleges1 to /ud5ts :o are    
enroll$ 9 programs ( /udy at in/itutions
 ( high] education lead+ to degrees or  
specializ$ program c]tifications 9 !    
cyb]security field2  7#b7 provide !     
s*ol>%ip recipi5ts ) summ] int]n%ip     
opportunities or o!r mean+ful tempor>y  

appo9tm5ts 9 ! ,f$]al in=mation         
te*nology work=ce2 &  7#c7 prioritize ! 
employm5t placem5t ( s*ol>%ip recipi5ts 
9 ! ,f$]al ,gov]nm5t4  7c7 ,s*ol>%ip    
am\nts ,ea* s*ol>%ip "u subsection 7b7  
%all be 9 an am\nt t cov]s ! /ud5t's    
tuition & fees at ! in/itution "u       
subsection 7b77#a7 = n m ?an #c ye>s &  
provides ! /ud5t ) an additional /ip5d4 
7d7 ,po/-aw>d employm5t obligations ,ea*
 s*ol>%ip recipi5t1 z a condition (     
receiv+ a s*ol>%ip "u ! program1 %all   
ent] into an agreem5t "u :i* ! recipi5t 
agrees to "w 9 ! cyb]security mission ( 
a ,f$]al1 ,/ate1 local1 or tribal ag5cy 
= a p]iod equal to ! l5g? ( ! s*ol>%ip  
foll[+ receipt ( ! /ud5t's degree4  7e7 
,hir+ au?ority  7#a7 ,appo9tm5t 9       
except$ s]vice ,not)/&+ any provision ( 
*apt] #cc ( title #e1 ,unit$ ,/ates     
,code1 gov]n+ appo9tm5ts 9 ! competitive
 s]vice1 an ag5cy %all appo9t 9 !       
except$ s]vice an individual :o has     
complet$ ! eligible degree program = :i*
 a s*ol>%ip 0 aw>d$4  7#b7              

,noncompetitive conv]sion ,except z     
provid$ 9 p>agraph 7#d71 ^u fulfillm5t (
 ! s]vice t]m1 an employee appo9t$ "u   
p>agraph 7#a7 may be conv]t$            
noncompetitively to t]m1                
c>e]-conditional or c>e] appo9tm5t4     
7#c7 ,tim+ ( conv]sion ,an ag5cy may    
noncompetitively conv]t a t]m employee  
appo9t$ "u p>agraph 7#b7 to a           
c>e]-conditional or c>e] appo9tm5t be=e 
! t]m appo9tm5t expires4  7#d7 ,au?ority
 to decl9e conv]sion ,an ag5cy may      
decl9e to make ! noncompetitive         
conv]sion or appo9tm5t "u p>agraph 7#b7 
= cause4  7f7 ,eligibility ,to be       
eligible to receive a s*ol>%ip "u ?is   
section1 an individual %all-- 7#a7 be a 
citiz5 or lawful p]man5t resid5t ( !    
,unit$ ,/ates2  7#b7 demon/rate a       
commitm5t to a c>e] 9 improv+ ! security
 ( in=mation te*nology2  7#c7 h         
demon/rat$ a high level ( pr(ici5cy 9   
ma!matics1 eng9e]+1 or comput] sci5ces2 
7#d7 be a full-"t /ud5t 9 an eligible   
degree program at a qualifi$ in/itution 

( high] education1 z det]m9$ by !       
,director ( ! ,national ,sci5ce         
,f\ndation2 &  7#e7 accept ! t]ms ( a   
s*ol>%ip "u ?is section4  7g7           
,conditions ( support  7#a7 ,9 g5]al ,z 
a condition ( receiv+ a s*ol>%ip "u ?is 
section1 a recipi5t %all agree to       
provide ! qualifi$ in/itution ( high]   
education ) annual v]ifiable            
docum5tation ( po/-aw>d employm5t &     
up-to-date contact in=mation4  7#b7     
,t]ms ,a s*ol>%ip recipi5t "u ?is       
section %all be liable to ! ,unit$      
,/ates z provid$ 9 subsection 7i7 if !  
individual-- 7,a7 fails to ma9ta9 an    
acceptable level ( academic /&+ at !    
applicable in/itution ( high] education1
 z det]m9$ by ! ,director ( ! ,national 
,sci5ce ,f\ndation2  7,b7 is dismiss$ f 
! applicable in/itution ( high]         
education = discipl9>y reasons2  7,c7   
)draws f ! eligible degree program be=e 
complet+ ! program2  7,d7 decl>es t !   
individual does n int5d to fulfill !    
po/-aw>d employm5t obligation "u ?is    

section2 or  7,e7 fails to fulfill !    
po/-aw>d employm5t obligation ( !       
individual "u ?is section4  7h7         
,monitor+ compliance ,z a condition (   
p>ticipat+ 9 ! program1 a qualifi$      
in/itution ( high] education %all-- 7#a7
 ent] into an agreem5t ) ! ,director ( !
 ,national ,sci5ce ,f\ndation1 to       
monitor ! compliance ( s*ol>%ip         
recipi5ts ) respect to _! po/-aw>d      
employm5t obligations2 &  7#b7 provide  
to ! ,director ( ! ,national ,sci5ce    
,f\ndation1 on an annual basis1 !       
po/-aw>d employm5t docum5tation requir$ 
"u subsection 7g77#a7 = s*ol>%ip        
recipi5ts ?r\gh ! completion ( _!       
po/-aw>d employm5t obligations4  7i7    
,am\nt ( repaym5t  7#a7 ,less ?an #a ye>
 ( s]vice ,if a circum/ance describ$ 9  
subsection 7g77#b7 occurs be=e !        
completion ( #a ye> ( a po/-aw>d        
employm5t obligation "u ?is section1 !  
total am\nt ( s*ol>%ip aw>ds receiv$ by 
! individual "u ?is section %all-- 7,a7 
be repaid2 or  7,b7 be treat$ z a loan  

to be repaid 9 accordance ) subsection  
7j74  7#b7 #a or m ye>s ( s]vice ,if a  
circum/ance describ$ 9 subp>agraph 7,d7 
or 7,e7 ( subsection 7g77#b7 occurs aft]
 ! completion ( #a or m ye>s ( a        
po/-aw>d employm5t obligation "u ?is    
section1 ! total am\nt ( s*ol>%ip aw>ds 
receiv$ by ! individual "u ?is section1 
r$uc$ by ! ratio ( ! numb] ( ye>s (     
s]vice complet$ divid$ by ! numb] ( ye>s
 ( s]vice requir$1 %all-- 7,a7 be       
repaid2 or  7,b7 be treat$ z a loan to  
be repaid 9 accordance ) subsection 7j74
  7j7 ,repaym5ts ,a loan describ$       
subsection 7i7 %all-- 7#a7 be treat$ z a
 ,f$]al ,direct ,unsubsidiz$ ,/af=d     
,loan "u "p ,d ( title ,,iv ( ! ,high]  
,education ,act ( #aife 7#bj ,u4,s4,c4  
#ajhg;a et seq472 &  7#b7 be subject to 
repaym5t1 toge!r ) int]e/ !reon accru+ f
 ! date ( ! s*ol>%ip aw>d1 9 accordance 
) t]ms & conditions specifi$ by !       
,director ( ! ,national ,sci5ce         
,f\ndation 79 consultation ) ! ,secret>y
 ( ,education7 9 regulations promulgat$ 

to c>ry out ?is subsection4  7k7        
,collection ( repaym5t  7#a7 ,9 g5]al ,9
 ! ev5t t a s*ol>%ip recipi5t is requir$
 to repay ! s*ol>%ip aw>d "u ?is        
section1 ! qualifi$ in/itution ( high]  
education provid+ ! s*ol>%ip %all-- 7,a7
 det]m9e ! repaym5t am\nts & notify !   
recipi5t & ! ,director ( ! ,national    
,sci5ce ,f\ndation ( ! am\nts ow$2 &    
7,b7 collect ! repaym5t am\nts )9 a     
p]iod ( "t z det]m9$ by ! ,director ( ! 
,national ,sci5ce ,f\ndation1 or !      
repaym5t am\nts %all be treat$ z a loan 
9 accordance ) subsection 7j74  7#b7    
,return$ to ,treasury ,except z provid$ 
9 p>agraph 7#c71 any repaym5t "u ?is    
subsection %all be return$ to !         
,treasury ( ! ,unit$ ,/ates4  7#c7      
,reta9 p]c5tage ,a qualifi$ in/itution (
 high] education may reta9 a p]c5tage ( 
any repaym5t ! in/itution collects "u   
?is subsection to defray adm9i/rative   
co/s associat$ ) ! collection4 ,!       
,director ( ! ,national ,sci5ce         
,f\ndation %all e/abli% a s+le1 fix$    

p]c5tage t w apply to all eligible      
entities4  7l7 ,exceptions ,! ,director 
( ! ,national ,sci5ce ,f\ndation may    
provide = ! p>tial or total waiv] or    
susp5sion ( any s]vice or paym5t        
obligation by an individual "u ?is      
section :5ev] compliance by ! individual
 ) ! obligation is impossible or w\ld   
involve extreme h>d%ip to ! individual1 
or if en=cem5t ( su* obligation )       
respect to ! individual w\ld be         
unconscionable4  7m7 ,evaluation &      
report ,! ,director ( ! ,national       
,sci5ce ,f\ndation %all evaluate &      
report p]iodically to ,congress on !    
success ( recruit+ individuals =        
s*ol>%ips "u ?is section & on hir+ &    
reta9+ ^? individuals 9 ! public sector 
work=ce4  ,,iv ,cyb]security ,aw>5ess & 
,prep>$ness  #dja4 ,national            
cyb]security aw>5ess & education program
  7a7 ,national cyb]security aw>5ess &  
education program ,! ,director ( !      
,national ,in/itute ( ,/&>ds &          
,te*nology 7ref]r$ to 9 ?is section z ! 

,director71 9 consultation ) appropriate
 ,f$]al ag5cies1 indu/ry1 educational   
in/itutions1 ,national ,laboratories1 ! 
,network+ & ,in=mation ,te*nology       
,rese>* & ,developm5t program1 & o!r    
organizations %all cont9ue to coord9ate 
a national cyb]security aw>5ess &       
education program1 t includes activities
 su* z-- 7#a7 ! widespread dissem9ation 
( cyb]security te*nical /&>ds & be/     
practices id5tifi$ by ! ,director2  7#b7
 ef=ts to make cyb]security be/         
practices usable by individuals1 small  
to m$ium-siz$ bus9esses1 educational    
in/itutions1 & ,/ate1 local1 & tribal   
gov]nm5ts2  7#c7 increas+ public aw>5ess
 ( cyb]security1 cyb] safety1 & cyb]    
e?ics2  7#d7 increas+ ! und]/&+ ( ,/ate1
 local1 & tribal gov]nm5ts1 in/itutions 
( high] education1 & private sector     
entities (-- 7,a7 ! b5efits ( ensur+    
effective risk managem5t ( in=mation    
te*nology v]sus ! co/s ( failure to d s2
 &  7,b7 ! me?ods to mitigate & rem$iate
 vuln]abilities2  7#e7 support+ =mal    

cyb]security education programs at all  
education levels to prep>e & improve a  
skill$ cyb]security & comput] sci5ce    
work=ce = ! private sector & ,f$]al1    
,/ate1 local1 & tribal gov]nm5t2 &  7#f7
 promot+ initiatives to evaluate & =eca/
 future cyb]security work=ce ne$s ( !   
,f$]al ,gov]nm5t & develop /rategies =  
recruitm5t1 tra9+1 & ret5tion4  7b7     
,consid]ations ,9 c>ry+ out ! au?ority  
describ$ 9 subsection 7a71 ! ,director1 
9 consultation ) appropriate ,f$]al     
ag5cies1 %all lev]age exi/+ programs    
design$ to in=m ! public ( safety &     
security ( products or s]vices1 includ+ 
self-c]tifications & indep5d5tly v]ifi$ 
assessm5ts reg>d+ ! quantification &    
valuation ( in=mation security risk4    
7c7 ,/rategic plan ,! ,director1 9      
coop]ation ) relevant ,f$]al ag5cies &  
o!r /akehold]s1 %all build ^u programs &
 plans 9 effect z ( ! date ( enactm5t ( 
?is ,act to develop & implem5t a        
/rategic plan to guide ,f$]al programs &
 activities 9 support ( ! national      

cyb]security aw>5ess & education program
 "u subsection 7a74  7d7 ,report ,n lat]
 ?an #a ye> aft] ! date ( enactm5t ( ?is
 ,act1 & e #e ye>s !reaft]1 ! ,director 
%all transmit ! /rategic plan "u        
subsection 7c7 to ! ,committee on       
,comm]ce1 ,sci5ce1 & ,transportation ( !
 ,s5ate & ! ,committee on ,sci5ce1      
,space1 & ,te*nology ( ! ,h\se (        
,repres5tatives4  ,v ,advancem5t (      
cyb]security te*nical /&>ds  #eja4      
,def9itions ,9 ?is title3 7#a7 ,director
 ,! t]m ,director means ! ,director ( ! 
,national ,in/itute ( ,/&>ds &          
,te*nology4  7#b7 ,in/itute ,! t]m      
,in/itute means ! ,national ,in/itute ( 
,/&>ds & ,te*nology4  #ejb4             
,int]national cyb]security te*nical     
/&>ds  7a7 ,9 g5]al ,! ,director1 9     
coord9ation ) appropriate ,f$]al        
au?orities1 %all-- 7#a7 z appropriate1  
ensure coord9ation ( ,f$]al ag5cies     
engag$ 9 ! developm5t ( int]national    
te*nical /&>ds relat$ to in=mation sy/em
 security2 &  7#b7 n lat] ?an #a ye>    

aft] ! date ( enactm5t ( ?is ,act1      
develop & transmit to ,congress a plan =
 ensur+ su* ,f$]al ag5cy coord9ation4   
7b7 ,consultation ) ! private sector ,9 
c>ry+ out ! activities specifi$ 9       
subsection 7a77#a71 ! ,director %all    
ensure consultation ) appropriate       
private sector /akehold]s4  #ejc4 ,cl\d 
comput+ /rategy  7a7 ,9 g5]al ,!        
,director1 9 coord9ation ) ! ,(fice (   
,managem5t & ,budget1 9 collaboration ) 
! ,f$]al ,*ief ,in=mation ,(fic]s       
,c\ncil1 & 9 consultation ) o!r relevant
 ,f$]al ag5cies & /akehold]s f ! private
 sector1 %all cont9ue to develop &      
enc\rage ! implem5tation ( a            
compreh5sive /rategy = ! use & adoption 
( cl\d comput+ s]vices by ! ,f$]al      
,gov]nm5t4  7b7 ,activities ,9 c>ry+ out
 ! /rategy describ$ "u subsection 7a71 !
 ,director %all give consid]ation to    
activities t-- 7#a7 accel]ate !         
developm5t1 9 collaboration ) ! private 
sector1 ( /&>ds t address int]op]ability
 & portability ( cl\d comput+ s]vices2  

7#b7 advance ! developm5t ( con=mance   
te/+ p]=m$ by ! private sector 9 support
 ( cl\d comput+ /&>dization2 &  7#c7    
support1 9 coord9ation ) ! ,(fice (     
,managem5t & ,budget1 & 9 consultation )
 ! private sector1 ! developm5t (       
appropriate security frameworks &       
ref]5ce mat]ials1 & ! id5tification (   
be/ practices1 = use by ,f$]al ag5cies  
to address security & privacy           
requirem5ts to enable ! use & adoption (
 cl\d comput+ s]vices1 includ+          
activities-- 7,a7 to ensure ! physical  
security ( cl\d comput+ data c5t]s & !  
data /or$ 9 su* c5t]s2  7,b7 to ensure  
secure access to ! data /or$ 9 cl\d     
comput+ data c5t]s2  7,c7 to develop    
security /&>ds z requir$ "u section #bj 
( ! ,national ,in/itute ( ,/&>ds &      
,te*nology ,act 7#ae ,u4,s4,c4          
#bgh;g-#c72 &  7,d7 to support !        
developm5t ( ! automation ( cont9u\s    
monitor+ sy/ems4  #ejd4 ,id5tity        
managem5t rese>* & developm5t ,!        
,director %all cont9ue a program to     

support ! developm5t ( volunt>y &       
co/-effective te*nical /&>ds1 metrology1
 te/b$s1 & con=mance crit]ia1 tak+ into 
acc\nt appropriate us] conc]ns-- 7#a7 to
 improve int]op]ability among id5tity   
managem5t te*nologies2  7#b7 to /r5g!n  
au!ntication me?ods ( id5tity managem5t 
sy/ems2  7#c7 to improve privacy        
protection 9 id5tity managem5t sy/ems1  
includ+ heal? in=mation te*nology       
sy/ems1 ?r\gh au!ntication & security   
protocols2 &  7#d7 to improve !         
usability ( id5tity managem5t sy/ems4   
,pass$ ! ,s5ate ,decemb] #aa1           
#bjad4,secret>y