,,ii #aacth ,,congress #ast ,session ,s4 #acec ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #bd1 #bjac ,mr4 ,rockefeller 7for himself and ,mr4 ,thune7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to provide for an ongoing1 voluntary public-private partnership to improve cybersecurity1 and to strengthen cybersecurity research and development1 workforce development and education1 and public awareness and preparedness1 and for other purposes4 #a4 ,short title2 table of contents 7a7 ,short title ,this ,act may be cited as the ,cybersecurity ,act of #bjac4 7b7 ,table of contents ,the table of contents of this ,act is as follows3 ,sec4 #a4 ,short title2 table of contents4 ,sec4 #b4 ,definitions4 ,sec4 #c4 ,no regulatory authority4 ,,title ,i--,public-private collaboration on cybersecurity ,sec4 #aja4 ,public-private collaboration on cybersecurity4 ,,title ,,ii--,cybersecurity research and development ,sec4 #bja4 ,federal cybersecurity research and development4 ,sec4 #bjb4 ,computer and network security research centers4 ,,title ,,iii--,education and ,workforce ,development ,sec4 #cja4 ,cybersecurity competitions and challenges4 ,sec4 #cjb4 ,federal cyber scholarship-for-service program4 ,sec4 #cjc4 ,study and analysis of education1 accreditation1 training1 and certification of information infrastructure and cybersecurity professionals4 ,,title ,,iv--,cybersecurity ,awareness and ,preparedness ,sec4 #dja4 ,national cybersecurity awareness and preparedness campaign4 #b4 ,definitions ,in this ,act3 7#a7 ,cybersecurity mission ,the term cybersecurity mission means activities that encompass the full range of threat reduction1 vulnerability reduction1 deterrence1 international engagement1 incident response1 resiliency1 and recovery policies and activities1 including computer network operations1 information assurance1 law enforcement1 diplomacy1 military1 and intelligence missions as such activities relate to the security and stability of cyberspace4 7#b7 ,information infrastructure ,the term information infrastructure means the underlying framework that information systems and assets rely on to process1 transmit1 receive1 or store information electronically1 including programmable electronic devices1 communications networks1 and industrial or supervisory control systems and any associated hardware1 software1 or data4 7#c7 ,information system ,the term information system has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 #c4 ,no regulatory authority ,nothing in this ,act shall be construed to confer any regulatory authority on any ,federal1 ,state1 tribal1 or local department or agency4 ,i ,public-private collaboration on cybersecurity #aja4 ,public-private collaboration on cybersecurity 7a7 ,cybersecurity ,section #b7;c7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7;c77 is amended-- 7#a7 by redesignating paragraphs 7#ae7 through 7#bb7 as paragraphs 7#af7 through 7#bc71 respectively2 and 7#b7 by inserting after paragraph 7#ad7 the following3 7#ae7 on an ongoing basis1 facilitate and support the development of a voluntary1 industry-led set of standards1 guidelines1 best practices1 methodologies1 procedures1 and processes to reduce cyber risks to critical infrastructure 7as defined under subsection 7e772 4 7b7 ,scope and limitations ,section #b of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7 is amended by adding at the end the following3 7e7 ,cyber risks 7#a7 ,in general ,in carrying out the activities under subsection 7c77#ae71 the ,director-- 7,a7 shall-- 7i7 coordinate closely and continuously with relevant private sector personnel and entities1 critical infrastructure owners and operators1 sector coordinating councils1 ,information ,sharing and ,analysis ,centers1 and other relevant industry organizations1 and incorporate industry expertise2 7ii7 consult with the heads of agencies with national security responsibilities1 sector-specific agencies1 ,state and local governments1 the governments of other nations1 and international organizations2 7iii7 identify a prioritized1 flexible1 repeatable1 performance-based1 and cost-effective approach1 including information security measures and controls1 that may be voluntarily adopted by owners and operators of critical infrastructure to help them identify1 assess1 and manage cyber risks2 7iv7 include methodologies-- 7,i7 to identify and mitigate impacts of the cybersecurity measures or controls on business confidentiality2 and 7,,ii7 to protect individual privacy and civil liberties2 7v7 incorporate voluntary consensus standards and industry best practices2 7vi7 align with voluntary international standards to the fullest extent possible2 7vii7 prevent duplication of regulatory processes and prevent conflict with or superseding of regulatory requirements1 mandatory standards1 and related processes2 and 7viii7 include such other similar and consistent elements as the ,director considers necessary2 and 7,b7 shall not prescribe or otherwise require-- 7i7 the use of specific solutions2 7ii7 the use of specific information or communications technology products or services2 or 7iii7 that information or communications technology products or services be designed1 developed1 or manufactured in a particular manner4 7#b7 ,limitation ,information shared with or provided to the ,institute for the purpose of the activities described under subsection 7c77#ae7 shall not be used by any ,federal1 ,state1 tribal1 or local department or agency to regulate the activity of any entity4 7#c7 ,definitions ,in this subsection3 7,a7 ,critical infrastructure ,the term critical infrastructure has the meaning given the term in section #ajaf7;e7 of the ,,usa ,,patriot ,act of #bjja 7#db ,u4,s4,c4 #eaie;c7e774 7,b7 ,sector-specific agency ,the term sector-specific agency means the ,federal department or agency responsible for providing institutional knowledge and specialized expertise as well as leading1 facilitating1 or supporting the security and resilience programs and associated activities of its designated critical infrastructure sector in the all-hazards environment4 4 ,,ii ,cybersecurity research and development #bja4 ,federal cybersecurity research and development 7a7 ,fundamental cybersecurity research 7#a7 ,in general ,the ,director of the ,office of ,science and ,technology ,policy1 in coordination with the head of any relevant ,federal agency1 shall build upon programs and plans in effect as of the date of enactment of this ,act to develop a ,federal cybersecurity research and development plan to meet objectives in cybersecurity1 such as-- 7,a7 how to design and build complex software-intensive systems that are secure and reliable when first deployed2 7,b7 how to test and verify that software and hardware1 whether developed locally or obtained from a third party1 is free of significant known security flaws2 7,c7 how to test and verify that software and hardware obtained from a third party correctly implements stated functionality1 and only that functionality2 7,d7 how to guarantee the privacy of an individual1 including that individual's identity1 information1 and lawful transactions when stored in distributed systems or transmitted over networks2 7,e7 how to build new protocols to enable the ,internet to have robust security as one of the key capabilities of the ,internet2 7,f7 how to determine the origin of a message transmitted over the ,internet2 7,g7 how to support privacy in conjunction with improved security2 7,h7 how to address the growing problem of insider threats2 7,i7 how improved consumer education and digital literacy initiatives can address human factors that contribute to cybersecurity2 7,j7 how to protect information processed1 transmitted1 or stored using cloud computing or transmitted through wireless services2 and 7,k7 any additional objectives the ,director of the ,office of ,science and ,technology ,policy1 in coordination with the head of any relevant ,federal agency and with input from stakeholders1 including industry and academia1 determines appropriate4 7#b7 ,requirements 7,a7 ,in general ,the ,federal cybersecurity research and development plan shall identify and prioritize near-term1 mid-term1 and long-term research in computer and information science and engineering to meet the objectives under paragraph 7#a71 including research in the areas described in section #d7;a77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a774 7,b7 ,private sector efforts ,in developing1 implementing1 and updating the ,federal cybersecurity research and development plan1 the ,director of the ,office of ,science and ,technology ,policy shall work in close cooperation with industry1 academia1 and other interested stakeholders to ensure1 to the extent possible1 that ,federal cybersecurity research and development is not duplicative of private sector efforts4 7#c7 ,triennial updates 7,a7 ,in general ,the ,federal cybersecurity research and development plan shall be updated triennially4 7,b7 ,report to ,congress ,the ,director of the ,office of ,science and ,technology ,policy shall submit the plan1 not later than #a year after the date of enactment of this ,act1 and each updated plan under this section to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives4 7b7 ,cybersecurity practices research ,the ,director of the ,national ,science ,foundation shall support research that-- 7#a7 develops1 evaluates1 disseminates1 and integrates new cybersecurity practices and concepts into the core curriculum of computer science programs and of other programs where graduates of such programs have a substantial probability of developing software after graduation1 including new practices and concepts relating to secure coding education and improvement programs2 and 7#b7 develops new models for professional development of faculty in cybersecurity education1 including secure coding development4 7c7 ,cybersecurity modeling and test beds 7#a7 ,review ,not later than #a year after the date of enactment of this ,act1 the ,director the ,national ,science ,foundation1 in coordination with the ,director of the ,office of ,science and ,technology ,policy1 shall conduct a review of cybersecurity test beds in existence on the date of enactment of this ,act to inform the grants under paragraph 7#b74 ,the review shall include an assessment of whether a sufficient number of cybersecurity test beds are available to meet the research needs under the ,federal cybersecurity research and development plan4 7#b7 ,additional cybersecurity modeling and test beds 7,a7 ,in general ,if the ,director of the ,national ,science ,foundation1 after the review under paragraph 7#a71 determines that the research needs under the ,federal cybersecurity research and development plan require the establishment of additional cybersecurity test beds1 the ,director of the ,national ,science ,foundation1 in coordination with the ,secretary of ,commerce and the ,secretary of ,homeland ,security1 may award grants to institutions of higher education or research and development non-profit institutions to establish cybersecurity test beds4 7,b7 ,requirement ,the cybersecurity test beds under subparagraph 7,a7 shall be sufficiently large in order to model the scale and complexity of real-time cyber attacks and defenses on real world networks and environments4 7,c7 ,assessment required ,the ,director of the ,national ,science ,foundation1 in coordination with the ,secretary of ,commerce and the ,secretary of ,homeland ,security1 shall evaluate the effectiveness of any grants awarded under this subsection in meeting the objectives of the ,federal cybersecurity research and development plan under subsection 7a7 no later than #b years after the review under paragraph 7#a7 of this subsection1 and periodically thereafter4 7d7 ,coordination ,with ,other ,research ,initiatives ,in accordance with the responsibilities under section #aja of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa71 the ,director the ,office of ,science and ,technology ,policy shall coordinate1 to the extent practicable1 ,federal research and development activities under this section with other ongoing research and development security-related initiatives1 including research being conducted by-- 7#a7 the ,national ,science ,foundation2 7#b7 the ,national ,institute of ,standards and ,technology2 7#c7 the ,department of ,homeland ,security2 7#d7 other ,federal agencies2 7#e7 other ,federal and private research laboratories1 research entities1 and universities2 7#f7 institutions of higher education2 7#g7 relevant nonprofit organizations2 and 7#h7 international partners of the ,united ,states4 7e7 ,national ,science ,foundation ,computer and ,network ,security ,research ,grant ,areas ,section #d7;a77#a7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;a77#a77 is amended-- 7#a7 in subparagraph 7,h71 by striking and at the end2 7#b7 in subparagraph 7,i71 by striking the period at the end and inserting a semicolon2 and 7#c7 by adding at the end the following3 7,j7 secure fundamental protocols that are integral to inter-network communications and data exchange2 7,k7 secure software engineering and software assurance1 including-- 7i7 programming languages and systems that include fundamental security features2 7ii7 portable or reusable code that remains secure when deployed in various environments2 7iii7 verification and validation technologies to ensure that requirements and specifications have been implemented2 and 7iv7 models for comparison and metrics to assure that required standards have been met2 7,l7 holistic system security that-- 7i7 addresses the building of secure systems from trusted and untrusted components2 7ii7 proactively reduces vulnerabilities2 7iii7 addresses insider threats2 and 7iv7 supports privacy in conjunction with improved security2 7,m7 monitoring and detection2 7,n7 mitigation and rapid recovery methods2 7,o7 security of wireless networks and mobile devices2 and 7,p7 security of cloud infrastructure and services4 4 7f7 ,research on the science of cybersecurity ,the head of each agency and department identified under section #aja7;a77#c77;,b7 of the ,high-,performance ,computing ,act of #aiia 7#ae ,u4,s4,c4 #eeaa7;a77#c77;,b771 through existing programs and activities1 shall support research that will lead to the development of a scientific foundation for the field of cybersecurity1 including research that increases understanding of the underlying principles of securing complex networked systems1 enables repeatable experimentation1 and creates quantifiable security metrics4 #bjb4 ,computer and network security research centers ,section #d7;b7 of the ,cyber ,security ,research and ,development ,act 7#ae ,u4,s4,c4 #gdjc7;b77 is amended-- 7#a7 by striking the center in paragraph 7#d77;,d7 and inserting the ,center2 and 7#b7 in paragraph 7#e7-- 7,a7 by striking and at the end of subparagraph 7,c72 7,b7 by striking the period at the end of subparagraph 7,d7 and inserting a semicolon2 and 7,c7 by adding at the end the following3 7,e7 the demonstrated capability of the applicant to conduct high performance computation integral to complex computer and network security research1 through on-site or off-site computing2 7,f7 the applicant's affiliation with private sector entities involved with industrial research described in subsection 7a77#a72 7,g7 the capability of the applicant to conduct research in a secure environment2 7,h7 the applicant's affiliation with existing research programs of the ,federal ,government2 7,i7 the applicant's experience managing public-private partnerships to transition new technologies into a commercial setting or the government user community2 and 7,j7 the capability of the applicant to conduct interdisciplinary cybersecurity research1 such as in law1 economics1 or behavioral sciences4 4 ,,iii ,education and ,workforce ,development #cja4 ,cybersecurity competitions and challenges 7a7 ,in general ,the ,secretary of ,commerce1 ,director of the ,national ,science ,foundation1 and ,secretary of ,homeland ,security shall-- 7#a7 support competitions and challenges under section #aje of the ,america ,,competes ,reauthorization ,act of #bjaj 7#abd ,stat4 #cihi7 or any other provision of law1 as appropriate-- 7,a7 to identify1 develop1 and recruit talented individuals to perform duties relating to the security of information infrastructure in ,federal1 ,state1 and local government agencies1 and the private sector2 or 7,b7 to stimulate innovation in basic and applied cybersecurity research1 technology development1 and prototype demonstration that has the potential for application to the information technology activities of the ,federal ,government2 and 7#b7 ensure the effective operation of the competitions and challenges under this section4 7b7 ,participation ,participants in the competitions and challenges under subsection 7a77#a7 may include-- 7#a7 students enrolled in grades #i through #ab2 7#b7 students enrolled in a postsecondary program of study leading to a baccalaureate degree at an institution of higher education2 7#c7 students enrolled in a postbaccalaureate program of study at an institution of higher education2 7#d7 institutions of higher education and research institutions2 7#e7 veterans2 and 7#f7 other groups or individuals that the ,secretary of ,commerce1 ,director of the ,national ,science ,foundation1 and ,secretary of ,homeland ,security determine appropriate4 7c7 ,affiliation and cooperative agreements ,competitions and challenges under this section may be carried out through affiliation and cooperative agreements with-- 7#a7 ,federal agencies2 7#b7 regional1 ,state1 or school programs supporting the development of cyber professionals2 7#c7 ,state1 local1 and tribal governments2 or 7#d7 other private sector organizations4 7d7 ,areas of skill ,competitions and challenges under subsection 7a77#a77;,a7 shall be designed to identify1 develop1 and recruit exceptional talent relating to-- 7#a7 ethical hacking2 7#b7 penetration testing2 7#c7 vulnerability assessment2 7#d7 continuity of system operations2 7#e7 security in design2 7#f7 cyber forensics2 7#g7 offensive and defensive cyber operations2 and 7#h7 other areas the ,secretary of ,commerce1 ,director of the ,national ,science ,foundation1 and ,secretary of ,homeland ,security consider necessary to fulfill the cybersecurity mission4 7e7 ,topics ,in selecting topics for competitions and challenges under subsection 7a77#a71 the ,secretary of ,commerce1 ,director of the ,national ,science ,foundation1 and ,secretary of ,homeland ,security-- 7#a7 shall consult widely both within and outside the ,federal ,government2 and 7#b7 may empanel advisory committees4 7f7 ,internships ,the ,director of the ,office of ,personnel ,management may support1 as appropriate1 internships or other work experience in the ,federal ,government to the winners of the competitions and challenges under this section4 #cjb4 ,federal cyber scholarship-for-service program 7a7 ,in general ,the ,director of the ,national ,science ,foundation1 in coordination with the ,director of the ,office of ,personnel ,management and ,secretary of ,homeland ,security1 shall continue a ,federal ,cyber ,scholarship-for-,service program to recruit and train the next generation of information technology professionals1 industrial control system security professionals1 and security managers to meet the needs of the cybersecurity mission for ,federal1 ,state1 local1 and tribal governments4 7b7 ,program description and components ,the ,federal ,cyber ,scholarship-for-,service program shall-- 7#a7 provide scholarships to students who are enrolled in programs of study at institutions of higher education leading to degrees or specialized program certifications in the cybersecurity field2 7#b7 provide the scholarship recipients with summer internship opportunities or other meaningful temporary appointments in the ,federal information technology workforce2 and 7#c7 provide a procedure by which the ,national ,science ,foundation or a ,federal agency1 consistent with regulations of the ,office of ,personnel ,management1 may request and fund security clearances for scholarship recipients1 including providing for clearances during internships or other temporary appointments and after receipt of their degrees4 7c7 ,scholarship amounts ,each scholarship under subsection 7b7 shall be in an amount that covers the student's tuition and fees at the institution under subsection 7b77#a7 and provides the student with an additional stipend4 7d7 ,scholarship ,conditions ,each scholarship recipient1 as a condition of receiving a scholarship under the program1 shall enter into an agreement under which the recipient agrees to work in the cybersecurity mission of a ,federal1 ,state1 local1 or tribal agency for a period equal to the length of the scholarship following receipt of the student's degree4 7e7 ,hiring authority 7#a7 ,appointment in excepted service ,notwithstanding any provision of chapter #cc of title #e1 ,united ,states ,code1 governing appointments in the competitive service1 an agency shall appoint in the excepted service an individual who has completed the academic program for which a scholarship was awarded4 7#b7 ,noncompetitive conversion ,except as provided in paragraph 7#d71 upon fulfillment of the service term1 an employee appointed under paragraph 7#a7 may be converted noncompetitively to term1 career-conditional or career appointment4 7#c7 ,timing of conversion ,an agency may noncompetitively convert a term employee appointed under paragraph 7#b7 to a career-conditional or career appointment before the term appointment expires4 7#d7 ,authority to decline conversion ,an agency may decline to make the noncompetitive conversion or appointment under paragraph 7#b7 for cause4 7f7 ,eligibility ,to be eligible to receive a scholarship under this section1 an individual shall-- 7#a7 be a citizen or lawful permanent resident of the ,united ,states2 7#b7 demonstrate a commitment to a career in improving the security of information infrastructure2 and 7#c7 have demonstrated a high level of proficiency in mathematics1 engineering1 or computer sciences4 7g7 ,repayment ,if a scholarship recipient does not meet the terms of the program under this section1 the recipient shall refund the scholarship payments in accordance with rules established by the ,director of the ,national ,science ,foundation1 in coordination with the ,director of the ,office of ,personnel ,management and ,secretary of ,homeland ,security4 7h7 ,evaluation and report ,the ,director of the ,national ,science ,foundation shall evaluate and report periodically to ,congress on the success of recruiting individuals for scholarships under this section and on hiring and retaining those individuals in the public sector workforce4 #cjc4 ,study and analysis of education1 accreditation1 training1 and certification of information infrastructure and cybersecurity professionals 7a7 ,study ,the ,director of the ,national ,science ,foundation and the ,secretary of ,homeland ,security shall undertake to enter into appropriate arrangements with the ,national ,academy of ,sciences to conduct a comprehensive study of government1 academic1 and private-sector education1 accreditation1 training1 and certification programs for the development of professionals in information infrastructure and cybersecurity4 ,the agreement shall require the ,national ,academy of ,sciences to consult with sector coordinating councils and relevant governmental agencies1 regulatory entities1 and nongovernmental organizations in the course of the study4 7b7 ,scope ,the study shall include-- 7#a7 an evaluation of the body of knowledge and various skills that specific categories of professionals in information infrastructure and cybersecurity should possess in order to secure information systems2 7#b7 an assessment of whether existing government1 academic1 and private-sector education1 accreditation1 training1 and certification programs provide the body of knowledge and various skills described in paragraph 7#a72 7#c7 an evaluation of-- 7,a7 the state of cybersecurity education at institutions of higher education in the ,united ,states2 7,b7 the extent of professional development opportunities for faculty in cybersecurity principles and practices2 7,c7 the extent of the partnerships and collaborative cybersecurity curriculum development activities that leverage industry and government needs1 resources1 and tools2 7,d7 the proposed metrics to assess progress toward improving cybersecurity education2 and 7,e7 the descriptions of the content of cybersecurity courses in undergraduate computer science curriculum2 7#d7 an analysis of any barriers to the ,federal ,government recruiting and hiring cybersecurity talent1 including barriers relating to compensation1 the hiring process1 job classification1 and hiring flexibility2 and 7#e7 an analysis of the sources and availability of cybersecurity talent1 a comparison of the skills and expertise sought by the ,federal ,government and the private sector1 an examination of the current and future capacity of ,united ,states institutions of higher education1 including community colleges1 to provide current and future cybersecurity professionals1 through education and training activities1 with those skills sought by the ,federal ,government1 ,state and local entities1 and the private sector4 7c7 ,report ,not later than #a year after the date of enactment of this ,act1 the ,national ,academy of ,sciences shall submit to the ,president and ,congress a report on the results of the study4 ,the report shall include-- 7#a7 findings regarding the state of information infrastructure and cybersecurity education1 accreditation1 training1 and certification programs1 including specific areas of deficiency and demonstrable progress2 and 7#b7 recommendations for further research and the improvement of information infrastructure and cybersecurity education1 accreditation1 training1 and certification programs4 ,,iv ,cybersecurity ,awareness and ,preparedness #dja4 ,national cybersecurity awareness and preparedness campaign 7a7 ,national cybersecurity awareness and preparedness campaign ,the ,director of the ,national ,institute of ,standards and ,technology 7referred to in this section as the ,director71 in consultation with appropriate ,federal agencies1 shall continue to coordinate a national cybersecurity awareness and preparedness campaign1 such as-- 7#a7 a campaign to increase public awareness of cybersecurity1 cyber safety1 and cyber ethics1 including the use of the ,internet1 social media1 entertainment1 and other media to reach the public2 7#b7 a campaign to increase the understanding of ,state and local governments and private sector entities of-- 7,a7 the benefits of ensuring effective risk management of the information infrastructure versus the costs of failure to do so2 and 7,b7 the methods to mitigate and remediate vulnerabilities2 7#c7 support for formal cybersecurity education programs at all education levels to prepare skilled cybersecurity and computer science workers for the private sector and ,federal1 ,state1 and local government2 and 7#d7 initiatives to evaluate and forecast future cybersecurity workforce needs of the ,federal government and develop strategies for recruitment1 training1 and retention4 7b7 ,considerations ,in carrying out the authority described in subsection 7a71 the ,director1 in consultation with appropriate ,federal agencies1 shall leverage existing programs designed to inform the public of safety and security of products or services1 including self-certifications and independently verified assessments regarding the quantification and valuation of information security risk4 7c7 ,strategic plan ,the ,director1 in cooperation with relevant ,federal agencies and other stakeholders1 shall build upon programs and plans in effect as of the date of enactment of this ,act to develop and implement a strategic plan to guide ,federal programs and activities in support of the national cybersecurity awareness and preparedness campaign under subsection 7a74 7d7 ,report ,not later than #a year after the date of enactment of this ,act1 and every #e years thereafter1 the ,director shall transmit the strategic plan under subsection 7c7 to the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate and the ,committee on ,science1 ,space1 and ,technology of the ,house of ,representatives4