,,ii ,calendar ,no4 #eae #aafth ,,congress #b;d ,session ,s4 #bgge ,report ,no4 #aaf-bed ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,november #e1 #bjai,mr4 ,wicker 7for himself1 ,ms4 ,cantwell1 ,mr4 ,thune1 and ,ms4 ,rosen7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,august #ab1 #bjbj,reported by ,mr4 ,wicker1 with amendments,omit the part struck through and insert the part printed in italic ,a ,,bill ,to improve the cyber workforce of the ,united ,states1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,harvesting ,american ,cybersecurity ,knowledge through ,education ,act of #bjai or the ,,hacked ,act of #bjai4 #b4 ,improving ,national ,initiative for ,cybersecurity ,education 7a7 ,program improvements generally ,subsection 7a7 of section #dja of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gdea7 is amended-- 7#a7 in paragraph 7#e71 by striking 2 and and inserting a semicolon2 7#b7 by redesignating paragraph 7#f7 as paragraph 7#aa72 and 7#c7 by inserting after paragraph 7#e7 the following3 7#f7 identifying cybersecurity workforce skill gaps in public and private sectors2 7#g7 leading interagency efforts to facilitate coordination of ,federal programs to advance cybersecurity education1 training1 and workforce1 such as-- 7,a7 the ,federal ,cyber ,scholarship for ,service program of the ,national ,science ,foundation2 7,b7 the ,national ,centers of ,academic ,excellence in ,cybersecurity program of the ,national ,security ,agency and the ,department of ,homeland ,security2 7,c7 the ,gen,cyber ,program of the ,national ,science ,foundation and the ,national ,security ,agency2 7,d7 the apprenticeship program of the ,department of ,labor2 7,e7 the ,cybersecurity ,education and ,training ,assistance ,program of the ,department of ,homeland ,security2 7,f7 the ,cyber ,center of ,excellence of the ,army2 7,g7 the ,information ,operations ,command program of the ,navy2 and 7,h7 such others as the ,director considers appropriate2 7#h7 promoting higher education and expertise in cybersecurity through designation by the ,national ,security ,agency and the ,department of ,homeland ,security of institutions of higher education as ,national ,centers of ,academic ,excellence in ,cybersecurity if such institutions have robust degree programs that align to specific cybersecurity-related knowledge units that are aligned to the knowledge1 skills1 abilities1 and tasks from the ,national ,initiative for ,cybersecurity ,education 7,,nice7 ,cybersecurity ,workforce ,framework 7,,nist ,special ,publication #hjj-aha71 or successor framework2 7#i7 consideration of any specific needs of the cybersecurity workforce of critical infrastructure2 7#aj7 developing metrics to measure the effectiveness and effect of programs and initiatives to advance the cybersecurity workforce2 and 4 7b7 ,strategic plan ,subsection 7c7 of such section is amended-- 7#a7 by striking ,the ,director and inserting the following3 7#a7 ,in general ,the ,director 2 and 7#b7 by adding at the end the following3 7#b7 ,requirement ,the strategic plan developed and implemented under paragraph 7#a7 shall include an indication of how the ,director will carry out this section4 4 7c7 ,cybersecurity career pathways 7#a7 ,identification of multiple cybersecurity career pathways ,in carrying out subsection 7a7 of such section and not later than #edj days after the date of the enactment of this ,act1 the ,director of the ,national ,institute of ,standards and ,technology shall use a consultative process with other ,federal agencies1 academia1 and industry to identify multiple career pathways for cybersecurity work roles that can be used in the private and public sectors4 7#b7 ,requirements ,the ,director shall ensure that the multiple cybersecurity career pathways identified under paragraph 7#a7 indicate the knowledge1 skills1 and abilities1 including relevant education1 training1 apprenticeships1 certifications1 and other experiences1 that-- 7,a7 align with employers' cybersecurity skill needs1 including proficiency level requirements1 for its workforce2 and 7,b7 prepare an individual to be successful in entering or advancing in a cybersecurity career4 7#c7 ,federal careers ,the ,director1 in coordination with the ,director of the ,office of ,personnel ,management1 shall ensure the cybersecurity career pathways identified under paragraph 7#a7 identify career opportunities in the ,federal ,government1 including noncompetitive hiring pathways1 including for individuals who participate in ,federal cybersecurity workforce training programs referred to in section #dja7;a77#g7 of the ,cybersecurity ,enhancement ,act of #bjad1 as added by subsection 7a77#c74 7#d7 ,exchange program ,the ,director of the ,national ,institute of ,standards and ,technology1 in coordination with the ,director of the ,office of ,personnel ,management1 shall establish a voluntary program for the exchange of employees engaged in one of the cybersecurity work roles identified in the ,national ,initiative for ,cybersecurity ,education 7,,nice7 ,cybersecurity ,workforce ,framework 7,,nist ,special ,publication #hjj-aha71 or successor framework1 between the ,national ,institute of ,standards and ,technology and private sector institutions1 including a nonpublic or commercial business1 a research institution1 or an institution of higher education1 as the ,director of the ,national ,institute of ,standards and ,technology considers feasible4 7d7 ,proficiency ,to perform cybersecurity tasks ,not later than #edj days after the date of the enactment of this ,act1 the ,director of the ,national ,institute of ,standards and ,technology shall-- 7#a7 in carrying out subsection 7a7 of such section1 assess the scope and sufficiency of efforts to measure a learner's capability to perform specific tasks found in the ,national ,initiative for ,cybersecurity ,education 7,,nice7 ,cybersecurity ,workforce ,framework 7,,nist ,special ,publication #hjj-aha7 at all proficiency levels2 and 7#b7 submit to ,congress a report-- 7,a7 on the findings of the ,director with respect to the assessment carried out under paragraph 7#a72 and 7,b7 with recommendations for effective methods for measuring the cybersecurity proficiency of learners4 7e7 ,cybersecurity metrics ,such section is further amended by adding at the end the following3 7e7 ,cybersecurity metrics ,in carrying out subsection 7a71 the ,director1 in coordination with such agencies as the ,director considers relevant1 shall develop repeatable measures and reliable metrics for measuring and evaluating ,federally funded cybersecurity workforce programs and initiatives based on the outcomes of such programs and initiatives4 4 7f7 ,regional alliances and multistakeholder partnerships ,such section is further amended by adding at the end the following3 7f7 ,regional alliances and multistakeholder partnerships 7#a7 ,in general ,pursuant to section #b7;b77#d7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7;b77#d771 the ,director shall establish cooperative agreements between the ,national ,initiative for ,cybersecurity ,education 7,,nice7 of the ,institute and regional alliances or partnerships for cybersecurity education and workforce4 7#b7 ,agreements ,the cooperative agreements established under paragraph 7#a7 shall advance the goals of the ,national ,initiative for ,cybersecurity ,education ,cybersecurity ,workforce ,framework 7,,nist ,special ,publication #hjj-aha71 or successor framework1 by facilitating local and regional partnerships-- 7,a7 to identify the workforce needs of the local economy and classify such workforce in accordance with such framework2 7,b7 to identify the education1 training1 apprenticeship1 and other opportunities available in the local economy2 and 7,c7 to support opportunities to meet the needs of the local economy4 7#c7 ,financial assistance 7,a7 ,financial assistance authorized ,the ,director may award financial assistance to a regional alliance or partnership with whom the ,director enters into a cooperative agreement under paragraph 7#a7 in order to assist the regional alliance or partnership in carrying out the term of the cooperative agreement4 7,b7 ,amount of assistance ,the aggregate amount of financial assistance awarded under subparagraph 7,a7 per cooperative agreement shall not exceed #bjj1jjj4 7,c7 ,matching requirement ,the ,director may not award financial assistance to a regional alliance or partnership under subparagraph 7,a7 unless the regional alliance or partnership agrees that1 with respect to the costs to be incurred by the regional alliance or partnership in carrying out the cooperative agreement for which the assistance was awarded1 the regional alliance or partnership will make available 7directly or through donations from public or private entities7 non-,federal contributions in an amount equal to #ej percent of ,federal funds provided under the award4 7#d7 ,application 7,a7 ,in general ,a regional alliance or partnership seeking to enter into a cooperative agreement under paragraph 7#a7 and receive financial assistance under paragraph 7#c7 shall submit to the ,director an application therefor at such time1 in such manner1 and containing such information as the ,director may require4 7,b7 ,requirements ,each application submitted under subparagraph 7,a7 shall include the following3 7i7 7,i7 ,a plan to establish 7or identification of1 if it already exists7 a multistakeholder workforce partnership that includes-- 7aa7 at least one institution of higher education or nonprofit training organization2 and 7bb7 at least one local employer or owner or operator of critical infrastructure4 7,,ii7 ,participation from ,federal ,cyber ,scholarships for ,service organizations1 ,national ,centers of ,academic ,excellence in ,cybersecurity1 advanced technological education programs1 elementary and secondary schools1 training and certification providers1 ,state and local governments1 economic development organizations1 or other community organizations is encouraged4 7ii7 ,a description of how the workforce partnership would identify the workforce needs of the local economy4 7iii7 ,a description of how the multistakeholder workforce partnership would leverage the programs and objectives of the ,national ,initiative for ,cybersecurity ,education1 such as the ,cybersecurity ,workforce ,framework and the strategic plan of such initiative4 7iv7 ,a description of how employers in the community will be recruited to support internships1 apprenticeships1 or cooperative education programs in conjunction with providers of education and training4 ,inclusion of programs that seek to include women1 minorities1 or veterans is encouraged4 7v7 ,a definition of the metrics that will be used to measure the success of the efforts of the regional alliance or partnership under the agreement4 7,c7 ,priority consideration ,in awarding financial assistance under subparagraph 7,a7paragraph 7#c77;,a71 the ,director shall give priority consideration to a regional alliance or partnership that includes an institution of higher education that is designated as a ,national ,center of ,academic ,excellence in ,cybersecurity or which receives an award under the ,federal ,cyber ,scholarship for ,service program located in the ,state or region of the regional alliance or partnership4 7#e7 ,audits ,each cooperative agreement for which financial assistance is awarded under paragraph 7#c7 shall be subject to audit requirements under part #bjj of title #b1 ,code of ,federal ,regulations 7relating to uniform administrative requirements1 cost principles1 and audit requirements for ,federal awards71 or successor regulation4 7#f7 ,reports 7,a7 ,in general ,upon completion of a cooperative agreement under paragraph 7#a71 the regional alliance or partnership that participated in the agreement shall submit to the ,director a report on the activities of the regional alliance or partnership under the agreement1 which may include training and education outcomes4 7,b7 ,contents ,each report submitted under subparagraph 7,a7 by a regional alliance or partnership shall include the following3 7i7 ,an assessment of efforts made by the regional alliance or partnership to carry out paragraph 7#b74 7ii7 ,the metrics used by the regional alliance or partnership to measure the success of the efforts of the regional alliance or partnership under the cooperative agreement4 4 7g7 ,transfer of section 7#a7 ,transfer ,such section is transferred to the end of title ,,iii of such ,act and redesignated as section #cjc4 7#b7 ,repeal ,title ,,iv of such ,act is repealed4 7#c7 ,clerical ,the table of contents in section #a7;b7 of such ,act is amended-- 7,a7 by striking the items relating to title ,,iv and section #dja2 and 7,b7 by inserting after the item relating to section #cjb the following3 ,sec4 #cjc4 ,national cybersecurity awareness and education program4 4 7#d7 ,conforming amendments 7,a7 ,section #cjb7c7 of the ,federal ,cybersecurity ,workforce ,assessment ,act of #bjae 7,public ,law #aad-aac7 is amended by striking under section #dja of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gdea7 and inserting under section #cjc of the ,cybersecurity ,enhancement ,act of #bjad 7,public ,law #aac-bgd74 7,b7 ,section #b7;c77#c7 of the ,,nist ,small ,business ,cybersecurity ,act 7,public ,law #aae-bcf7 is amended by striking under section #dja of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gdea7 and inserting under section #cjc of the ,cybersecurity ,enhancement ,act of #bjad 7,public ,law #aac-bgd74 7,c7 ,section #cjb7;f7 of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gddb7;f77 is amended by striking under section #dja and inserting under section #cjc4 #c4 ,development of standards and guidelines for improving cybersecurity workforce of ,federal agencies 7a7 ,in general ,section #bj7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c7;a77 is amended-- 7#a7 in paragraph 7#c71 by striking 2 and and inserting a semicolon2 7#b7 in paragraph 7#d71 by striking the period at the end and inserting 2 and2 and 7#c7 by adding at the end the following3 7#e7 identify and develop standards and guidelines for improving the cybersecurity workforce for an agency as part of the ,national ,initiative for ,cybersecurity ,education 7,,nice7 ,cybersecurity ,workforce ,framework 7,,nist ,special ,publication #hjj-aha71 or successor framework4 4 7b7 ,publication of standards and guidelines on cybersecurity awareness ,not later than #c years after the date of the enactment of this ,act and pursuant to section #bj of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgh;g-#c71 the ,director of the ,national ,institute of ,standards and ,technology shall publish standards and guidelines for improving cybersecurity awareness of employees and contractors of ,federal agencies4 #d4 ,modifications to ,federal cyber scholarship-for-service program ,section #cjb of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gddb7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#b71 by striking information technology and inserting information technology and cybersecurity2 7,b7 by amending paragraph 7#c7 to read as follows3 7#c7 prioritize the placement of scholarship recipients fulfilling the post-award employment obligation under this section to ensure that-- 7,a7 not less than #gj percent of such recipients are placed in an executive agency 7as defined in section #aje of title #e1 ,united ,states ,code72 7,b7 not more than #aj percent of such recipients are placed as educators in the field of cybersecurity at qualified institutions of higher education that provide scholarships under this section2 and 7,c7 not more than #bj percent of such recipients are placed in positions described in paragraphs 7#b7 through 7#e7 of subsection 7d72 and 2 and 7,c7 in paragraph 7#d71 in the matter preceding subparagraph 7,a71 by inserting 1 including by seeking to provide awards in coordination with other relevant agencies for summer cybersecurity camp or other experiences1 including teacher training1 in each of the #ej ,states1 after cybersecurity education2 7#b7 in subsection 7d7-- 7,a7 in paragraph 7#d71 by striking or at the end2 7,b7 in paragraph 7#e71 by striking the period at the end and inserting 2 or2 and 7,c7 by adding at the end the following3 7#f7 as provided by subsection 7b77#c77;,b71 a qualified institution of higher education4 2 and 7#c7 in subsection 7m7-- 7,a7 in paragraph 7#a71 in the matter preceding subparagraph 7,a71 by striking cyber and inserting cybersecurity2 and 7,b7 in paragraph 7#b71 by striking cyber and inserting cybersecurity4 #e4 ,cybersecurity in programs of the ,national ,science ,foundation 7a7 ,computer science and cybersecurity education research ,section #caj of the ,american ,innovation and ,competitiveness ,act 7#db ,u4,s4,c4 #ahfbs-#g7 is amended-- 7#a7 in subsection 7b7-- 7,a7 in paragraph 7#a71 by inserting and cybersecurity after computer science2 and 7,b7 in paragraph 7#b7-- 7i7 in subparagraph 7,c71 by striking 2 and and inserting a semicolon2 7ii7 in subparagraph 7,d71 by striking the period at the end and inserting 2 and2 and 7iii7 by adding at the end the following3 7,e7 tools and models for the integration of cybersecurity and other interdisciplinary efforts into computer science education and computational thinking at secondary and postsecondary levels of education4 2 and 7#b7 in subsection 7c71 by inserting 1 cybersecurity1 after computing4 7b7 ,scientific and technical education ,section #c7;j77#i7 of the ,scientific and ,advanced-,technology ,act of #aiib 7#db ,u4,s4,c4 #ahfb;i7j77#i77 is amended by inserting and cybersecurity after computer science4 7c7 ,low-,income scholarship program ,section #dad7;d7 of the ,american ,competitiveness and ,workforce ,improvement ,act of #aiih 7#db ,u4,s4,c4 #ahfi;c7 is amended-- 7#a7 in paragraph 7#a71 by striking or computer science and inserting computer science1 or cybersecurity2 and 7#b7 in paragraph 7#b77;,a77iii71 by inserting cybersecurity1 after computer science14 7d7 ,scholarships and graduate fellowships ,the ,director of the ,national ,science ,foundation shall ensure that students pursuing master's degrees and doctoral degrees in fields relating to cybersecurity are considered as applicants for scholarships and graduate fellowships under the ,graduate ,research ,fellowship ,program under section #aj of the ,national ,science ,foundation ,act of #aiej 7#db ,u4,s4,c4 #ahfi74 7e7 ,presidential awards for teaching excellence ,the ,director of the ,national ,science ,foundation shall ensure that educators and mentors in fields relating to cybersecurity can be considered for-- 7#a7 ,presidential ,awards for ,excellence in ,mathematics and ,science ,teaching made under section #aag of the ,national ,science ,foundation ,authorization ,act of #aihh 7#db ,u4,s4,c4 #ahha;b72 and 7#b7 ,presidential ,awards for ,excellence in ,,stem mentoring,mentoring administered under section #cjg of the ,american ,innovation and ,competitiveness ,act 7#db ,u4,s4,c4 #ahfbs-#f74 #f4 ,cybersecurity in ,,stem programs of the ,national ,aeronautics and ,space ,administration ,in carrying out any ,,stem education program of the ,national ,aeronautics and ,space ,administration 7referred to in this section as ,,nasa71 including a program of the ,office of ,,stem ,engagement1 the ,administrator of ,,nasa shall1 to the maximum extent practicable1 encourage the inclusion of cybersecurity education opportunities in such program4 #g4 ,cybersecurity in ,department of ,transportation programs 7a7 ,university transportation centers program ,section #eeje of title #di1 ,united ,states ,code1 is amended-- 7#a7 in subsection 7a77#b77;,c71 by inserting in the matters described in subparagraphs 7,a7 through 7,g7 of section #fejc7;c77#a7 after transportation leaders2 and 7#b7 in subsection 7c77#c77;,e7-- 7,a7 by inserting 1 including the cybersecurity implications of technologies relating to connected vehicles1 connected infrastructure1 and autonomous vehicles after autonomous vehicles2 and 7,b7 by striking ,the ,secretary and inserting the following3 7#a7 ,in general ,a regional university transportation center receiving a grant under this paragraph shall carry out research focusing on #a or more of the matters described in subparagraphs 7,a7 through 7,g7 of section #fejc7;c77#a74 7#b7 ,focused objectives ,the ,secretary 4 87i7 ,in general ,a regional university transportation center receiving a grant under this paragraph shall carry out research focusing on #a or more of the matters described in subparagraphs 7,a7 through 7,g7 of section #fejc7;c77#a74 87ii7 ,focused objectives ,the ,secretary04 7b7 ,transportation research and development #e-,year strategic plan ,section #fejc7;c77#a7 of title #di1 ,united ,states ,code1 is amended-- 7#a7 in subparagraph 7,e71 by striking and at the end2 7#b7 in subparagraph 7,f71 by inserting and after the semicolon at the end2 and 7#c7 by adding at the end the following3 7,g7 reducing transportation cybersecurity risks2 4 #h4 ,coordination of ,federal cybersecurity workforce 7a7 ,coordination of ,federal ,,stem programs and activities ,section #aja7;a7 of the ,america ,,competes ,reauthorization ,act of #bjaj 7#db ,u4,s4,c4 #ffba7;a77 is amended by inserting the ,national ,institute of ,standards and ,technology1 after the ,national ,aeronautics and ,space ,administration14 7b7 ,subcommittees and working groups ,section #aja of the ,america ,,competes ,reauthorization ,act of #bjaj 7#db ,u4,s4,c4 #ffba7 is amended-- 7#a7 by redesignating subsection 7d7 as subsection 7e72 7#b7 by inserting after subsection 7c7 the following3 7d7 ,subcommittees and working groups 7#a7 ,subcommittees and working groups authorized 7,a7 ,in general ,the committee established under subsection 7a7 may establish #a or more subcommittees or working groups to address specific issues in ,,stem education1 as the committee considers appropriate4 7,b7 ,composition ,a member of the committee established under subsection 7a7 may serve on a subcommittee or working group established under subparagraph 7,a74 7#b7 ,subcommittee on cybersecurity workforce required 7,a7 ,in general ,the committee established under subsection 7a7 shall establish or designate a subcommittee to coordinate cybersecurity education and workforce activities and programs of the ,federal agencies4 7,b7 ,chairpersons ,the chairpersons of the subcommittee established or designated under subsection 7a7 shall be-- 7i7 the ,director2 7ii7 the ,director of the ,national ,institute of ,standards and ,technology2 and 7iii7 the head of any ,federal agency1 as the ,director and the ,director of the ,national ,institute of ,standards and ,technology consider appropriate4 2 and 7#c7 by adding at the end the following3 7f7 ,,stem education defined ,for purposes of this section1 the term ,,stem education includes cybersecurity education4 4 ,august #ab1 #bjbj,reported with amendments