An amendment en bloc consisting of amendments numbered 9, 10, 16, 24, 36, 63, and 70 printed in House Report 111-498.

1. 1

   Change 1: Adds SEC. 244. REPORT ON REGIONAL ADVANCED TECHNOLOGY CLUSTERS on page 79, line 6

   Adds a sectionPrinted page

   Inserted: SEC. 244. REPORT ON REGIONAL ADVANCED TECHNOLOGY CLUSTERS.

   Inserted: (a) Report.--Not later than March 1, 2011, the Secretary of Defense shall submit to the appropriate congressional committees a report on regional advanced technology clusters.

   Inserted: (b) Matters Included.--The report under subsection (a) shall include the following:

   Inserted: (1) An analysis of regional advanced technology clusters throughout the United States, including--

   Inserted: (A) an estimate of the amount of public and private funding activities within each cluster;

   Inserted: (B) an assessment of the technical competencies of each of these regional advanced technology clusters;

   Inserted: (C) a comparison of the technical competencies of each regional advanced technology cluster with the technology needs of the Department of Defense; and

   Inserted: (D) a review of current Department of Defense interaction, cooperation, or investment in regional advanced technology clusters.

   Inserted: (2) A strategic plan for encouraging the development of innovative, advanced technologies, such as robotics and autonomous systems, to address national security, homeland security, and first responder challenges by--

   Inserted: (A) enhancing regional advanced technology clusters that support the technology needs of the Department of Defense; and

   Inserted: (B) identifying and assisting the expansion of additional new regional advanced technology clusters to foster research and development into emerging, disruptive technologies identified through strategic planning documents of the Department of Defense.

   Inserted: (3) An identification of the resources needed to establish, sustain, or grow regional advanced technology clusters.

   Show 7 more inserted paragraphsShow less

   Inserted: (4) An identification of mechanisms for collaborating and cost sharing with other state, local, and Federal agencies with respect to regional advanced technology clusters, including any legal impediments that may inhibit collaboration or cost sharing.

   Inserted: (c) Definitions.--In this section:

   Inserted: (1) The term "appropriate congressional committees" means the following:

   Inserted: (A) The Committees on Armed Services, Appropriations, and Small Business of the House of Representatives.

   Inserted: (B) The Committees on Armed Services, Appropriations, and Small Business and Entrepreneurship of the Senate.

   Inserted: (2) The term "regional advanced technology cluster" means geographic centers focused on building science and technology-based innovation capacity in areas of local and regional strength to foster economic growth and improve quality of life.

   Inserted: Amendment No. 16 Offered by Mr. Sessions of Texas

   Original wording

   Page 79, after line 6, insert the following:

2. 2

   Change 2: Adds SEC. 7__. PILOT PROGRAM ON PAYMENT FOR TREATMENT OF MEMBERS OF THE ARMED FORCES AND VETERANS FOR TRAUMATIC BRAIN INJURY AND POST-TRAUMATIC STRESS DISORDER at the end of subtitle C of title VII

   Adds a section

   Inserted: SEC. 7__. PILOT PROGRAM ON PAYMENT FOR TREATMENT OF MEMBERS OF THE ARMED FORCES AND VETERANS FOR TRAUMATIC BRAIN INJURY AND POST-TRAUMATIC STRESS DISORDER.

   Inserted: (a) Payment Process.--The Secretary of Defense and the Secretary of Veterans Affairs shall carry out a five-year pilot program under which each such Secretary shall establish a process through which each Secretary shall provide payment for treatments (including diagnostic testing) of traumatic brain injury or post-traumatic stress disorder received by members of the Armed Forces and veterans in health care facilities other than military treatment facilities or Department of Veterans Affairs medical facilities. Such process shall provide that payment be made directly to the health care facility furnishing the treatment.

   Inserted: (b) Conditions for Payment.--The approval by a Secretary for payment for a treatment pursuant to subsection (a) shall be subject to the following conditions:

   Inserted: (1) Any drug or device used in the treatment must be approved or cleared by the Food and Drug Administration for any purpose.

   Inserted: (2) The treatment or study protocol used in treating the member or veteran must have been approved by an institutional review board operating in accordance with regulations issued by the Secretary of Health and Human Services.

   Inserted: (3) The approved treatment or study protocol (including any patient disclosure requirements) must be used by the health care provider delivering the treatment.

   Inserted: (4) The patient receiving the treatment or study protocol must demonstrate an improvement as a result of the treatment on one or more of the following:

   Inserted: (A) Standardized independent pre-treatment and post-treatment neuropsychological testing.

   Inserted: (B) Accepted survey instruments.

   Inserted: (C) Neurological imaging.

   Inserted: (D) Clinical examination.

   Inserted: (5) The patient receiving the treatment or study protocol must be receiving the treatment voluntarily.

   Show 30 more inserted paragraphsShow less

   Inserted: (6) The patient receiving the treatment may not be a retired member of the uniformed services or of the Armed Forces who is entitled to benefits under part A, or eligible to enroll under part B, of title XVIII of the Social Security Act.

   Inserted: (c) Additional Restrictions Prohibited.--Except as provided in this subsection (b), no restriction or condition for reimbursement may be placed on any health care provider that is operating lawfully under the laws of the State in which the provider is located with respect to the receipt of payment under this Act.

   Inserted: (d) Payment Deadline.--The Secretary of Defense and the Secretary of Veterans Affairs shall make a payment for a treatment or study protocol pursuant to subsection (a) not later than 30 days after a member of the Armed Forces or veteran (or health care provider on behalf of such member or veteran) submits to the Secretary documentation regarding the treatment or study protocol. The Secretary of Defense and the Secretary of Veterans Affairs shall ensure that the documentation required under this subsection may not be an undue burden on the member of the Armed Forces or veteran or on the health care provider.

   Inserted: (e) Payment Source.--Subsection (c)(1) of section 1074 of title 10, United States Code, shall apply with respect to the payment by the Secretary of Defense for treatment or study protocols pursuant to subsection (a) of traumatic brain injury and post-traumatic stress disorder received by members of the Armed Forces.

   Inserted: (f) Payment Amount.--A payment under this Act shall be made at the equivalent Centers for Medicare and Medicaid Services reimbursement rate in effect for appropriate treatment codes for the State or territory in which the treatment or study protocol is received. If no such rate is in effect, payment shall be made at a fair market rate, as determined by the Secretary of Defense, in consultation with the Secretary of Health and Human Services, with respect to a patient who is a member of the Armed Forces or the Secretary of Veterans Affairs with respect to a patient who is a veteran.

   Inserted: (g) Data Collection and Availability.--

   Inserted: (1) In general.--The Secretary of Defense and the Secretary of Veterans Affairs shall jointly develop and maintain a database containing data from each patient case involving the use of a treatment under this section. The Secretaries shall ensure that the database preserves confidentiality and be made available only--

   Inserted: (A) for third-party payer examination;

   Inserted: (B) to the appropriate congressional committees and employees of the Department of Defense, the Department of Veterans Affairs, the Department of Health and Human Services, and appropriate State agencies; and

   Inserted: (C) to the primary investigator of the institutional review board that approved the treatment or study protocol, in the case of data relating to a patient case involving the use of such treatment or study protocol.

   Inserted: (2) Enrollment in institutional review board study.--In the case of a patient enrolled in a registered institutional review board study, results may be publically distributable in accordance with the regulations prescribed pursuant to the Health Insurance Portability and Accountability Act of 1996 (Public Law 104-191) and other regulations and practices in effect as of the date of the enactment of this Act.

   Inserted: (3) Qualified institutional review boards.--The Secretary of Defense and the Secretary of Veterans Affairs shall each ensure that the Internet website of their respective departments includes a list of all civilian institutional review board studies that have received a payment under this Act.

   Inserted: (h) Assistance for Members To Obtain Treatment.--

   Inserted: (1) Assignment to temporary duty.--The Secretary of a military department may assign a member of the Armed Forces under the jurisdiction of the Secretary to temporary duty or allow the member a permissive temporary duty in order to permit the member to receive treatment or study protocol for traumatic brain injury or post-traumatic stress disorder, for which payments shall be made under subsection (a), at a location beyond reasonable commuting distance of the member's permanent duty station.

   Inserted: (2) Payment of per diem.--A member who is away from the member's permanent station may be paid a per diem in lieu of subsistence in an amount not more than the amount to which the member would be entitled if the member were performing travel in connection with a temporary duty assignment.

   Inserted: (3) Gift rule waiver.--Notwithstanding any rule of any department or agency with respect to ethics or the receipt of gifts, any assistance provided to a member of the Armed Forces with a service-connected injury or disability for travel, meals, or entertainment incidental to receiving treatment or study protocol under this Act, or for the provision of such treatment or study protocol, shall not be subject to or covered by any such rule.

   Inserted: (i) Retaliation Prohibited.--No retaliation may be made against any member of the Armed Forces or veteran who receives treatment or study protocol as part of registered institutional review board study carried out by a civilian health care practitioner.

   Inserted: (j) Treatment of University and Nationally Accredited Institutional Review Boards.--For purposes of this Act, a university-affiliated or nationally accredited institutional review board shall be treated in the same manner as a Government institutional review board.

   Inserted: (k) Memoranda of Understanding.--The Secretary of Defense and the Secretary of Veterans Affairs shall seek to expeditiously enter into memoranda of understandings with civilian institutional review boards described in subsection (j) for the purpose of providing for members of the Armed Forces and veterans to receive treatment carried out by civilian health care practitioners under a treatment or study protocol approved by and under the oversight of civilian institutional review boards that would qualify for payment under this Act.

   Inserted: (l) Outreach Required.--

   Inserted: (1) Outreach to veterans.--The Secretary of Veterans Affairs shall notify each veteran with a service-connected injury or disability of the opportunity to receive treatment or study protocol pursuant to this Act.

   Inserted: (2) Outreach to members of the armed forces.--The Secretary of Defense shall notify each member of the Armed Forces with a service-connected injury or disability of the opportunity to receive treatment or study protocol pursuant to this Act.

   Inserted: (m) Report to Congress.--Not later than 30 days after the last day of each fiscal year during which the Secretary of Defense and the Secretary of Veterans Affairs are authorized to make payments under this Act, the Secretaries shall jointly submit to Congress an annual report on the implementation of this Act. Such report shall include each of the following for that fiscal year:

   Inserted: (1) The number of individuals for whom the Secretary has provided payments under this Act.

   Inserted: (2) The condition for which each such individual receives treatment for which payment is provided under this Act and the success rate of each such treatment.

   Inserted: (3) Treatment methods that are used by entities receiving payment provided under this Act and the respective rate of success of each such method.

   Inserted: (4) The recommendations of the Secretaries with respect to the integration of treatment methods for which payment is provided under this Act into facilities of the Department of Defense and Department of Veterans Affairs.

   Inserted: (n) Termination.--The authority to make a payment under this Act shall terminate on the date that is five years after the date of the enactment of this Act.

   Inserted: (o) Authorization of Appropriations.--There is authorized to be appropriated to carry out this Act $10,000,000 for each fiscal year during which the Secretary of Veterans Affairs and the Secretary of Defense are authorized to make payments under this Act.

   Inserted: Amendment No. 24 Offered by Ms. Jackson Lee of Texas

   Original wording

   At the end of subtitle C of title VII, insert the following:

3. 3

   Change 3: Adds SEC. 839. REPORT RELATED TO MINORITY-OWNED, WOMEN-OWNED, AND DISADVANTAGED-OWNED SMALL BUSINESSES at the end of title VIII

   Adds a section

   Inserted: SEC. 839. REPORT RELATED TO MINORITY-OWNED, WOMEN-OWNED, AND DISADVANTAGED-OWNED SMALL BUSINESSES.

   Inserted: Not later than December 1, 2010, the Secretary of Defense shall provide to the Congressional Black Caucus a report that includes a list of minority-owned, women-owned, and disadvantaged-owned small businesses that receive contracts resulting from authorized funding to the Department of Defense. The list shall cover the 10 calendar years preceding the date of the enactment of this Act and shall include, for each listed business, the name of the business and the business owner and the amount of the contract award.

   Inserted: Amendment No. 36 Offered by Ms. Watson of California

   Original wording

   At the end of title VIII, add the following new section:

4. 4

   Change 4: Adds TITLE XVII--FEDERAL INFORMATION SECURITY at the end of division A

   Adds a title

   Inserted: TITLE XVII--FEDERAL INFORMATION SECURITY

   Inserted: Subtitle A--Federal Information Security Amendments SEC. 1701. COORDINATION OF FEDERAL INFORMATION POLICY.

   Inserted: Chapter 35 of title 44, United States Code, is amended by striking subchapters II and III and inserting the following:

   Inserted: "SUBCHAPTER II--INFORMATION SECURITY

   Inserted: "Sec. 3551. Purposes "The purposes of this subchapter are to--

   Inserted: "(1) provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets;

   Inserted: "(2) recognize the highly networked nature of the current Federal computing environment and provide effective Governmentwide management and oversight of the related information security risks, including coordination of information security efforts throughout the civilian, national security, and law enforcement communities;

   Inserted: "(3) provide for development and maintenance of minimum controls required to protect Federal information and information infrastructure;

   Inserted: "(4) provide a mechanism for improved oversight of Federal agency information security programs;

   Inserted: "(5) acknowledge that commercially developed information security products offer advanced, dynamic, robust, and effective information security solutions, reflecting market solutions for the protection of critical information infrastructures important to the national defense and economic security of the Nation that are designed, built, and operated by the private sector; and

   Inserted: "(6) recognize that the selection of specific technical hardware and software information security solutions should be left to individual agencies from among commercially developed products.

   Inserted: "Sec. 3552. Definitions

   Show 327 more inserted paragraphsShow less

   Inserted: "(a) Section 3502 Definitions.--Except as provided under subsection (b), the definitions under section 3502 shall apply to this subchapter.

   Inserted: "(b) Additional Definitions.--In this subchapter:

   Inserted: "(1) The term 'adequate security' means security that complies with the regulations promulgated under section 3554 and the standards promulgated under section 3558.

   Inserted: "(2) The term 'incident' means an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system, information infrastructure, or the information the system processes, stores, or transmits or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies.

   Inserted: "(3) The term 'information infrastructure' means the underlying framework that information systems and assets rely on in processing, storing, or transmitting information electronically.

   Inserted: "(4) The term 'information security' means protecting information and information infrastructure from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide--

   Inserted: "(A) integrity, which means guarding against improper information modification or destruction, and includes ensuring information nonrepudiation and authenticity;

   Inserted: "(B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information;

   Inserted: "(C) availability, which means ensuring timely and reliable access to and use of information; and

   Inserted: "(D) authentication, which means using digital credentials to assure the identity of users and validate access of such users.

   Inserted: "(5) The term 'information technology' has the meaning given that term in section 11101 of title 40.

   Inserted: "(6)(A) The term 'national security system' means any information infrastructure (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency--

   Inserted: "(i) the function, operation, or use of which--

   Inserted: "(I) involves intelligence activities;

   Inserted: "(II) involves cryptologic activities related to national security;

   Inserted: "(III) involves command and control of military forces;

   Inserted: "(IV) involves equipment that is an integral part of a weapon or weapons system; or

   Inserted: "(V) subject to subparagraph (B), is critical to the direct fulfillment of military or intelligence missions; or

   Inserted: "(ii) is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive order or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

   Inserted: "(B) Subparagraph (A)(i)(V) does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

   Inserted: "Sec. 3553. National Office for Cyberspace

   Inserted: "(a) Establishment.--There is established within the Executive Office of the President an office to be known as the National Office for Cyberspace.

   Inserted: "(b) Director.--

   Inserted: "(1) In general.--There shall be at the head of the Office a Director, who shall be appointed by the President by and with the advice and consent of the Senate. The Director of the National Office for Cyberspace shall administer all functions under this subchapter and collaborate to the extent practicable with the heads of appropriate agencies, the private sector, and international partners. The Office shall serve as the principal office for coordinating issues relating to achieving an assured, reliable, secure, and survivable information infrastructure and related capabilities for the Federal Government.

   Inserted: "(2) Basic pay.--The Director shall be paid at the rate of basic pay for level III of the Executive Schedule.

   Inserted: "(c) Staff.--The Director may appoint and fix the pay of additional personnel as the Director considers appropriate.

   Inserted: "(d) Experts and Consultants.--The Director may procure temporary and intermittent services under section 3109(b) of title 5.

   Inserted: "Sec. 3554. Federal Cybersecurity Practice Board

   Inserted: "(a) Establishment.--Within the National Office for Cyberspace, there shall be established a board to be known as the 'Federal Cybersecurity Practice Board' (in this section referred to as the 'Board').

   Inserted: "(b) Members.--The Board shall be chaired by the Director of the National Office for Cyberspace and consist of not more than 10 members, with at least one representative from--

   Inserted: "(1) the Office of Management and Budget;

   Inserted: "(2) civilian agencies;

   Inserted: "(3) the Department of Defense;

   Inserted: "(4) the Federal law enforcement community;

   Inserted: "(5) the Federal Chief Technology Office; and

   Inserted: "(6) such additional military and civilian agencies as the Director considers appropriate.

   Inserted: "(c) Responsibilities.--

   Inserted: "(1) Development of policies and procedures.--Subject to the authority, direction, and control of the Director of the National Office for Cyberspace, the Board shall be responsible for developing and periodically updating information security policies and procedures relating to the matters described in paragraph (2). In developing such policies and procedures, the Board shall require that all matters addressed in the policies and procedures are consistent, to the maximum extent practicable and in accordance with applicable law, among the civilian, military, intelligence, and law enforcement communities.

   Inserted: "(2) Specific matters covered in policies and procedures.--

   Inserted: "(A) Minimum security controls.--The Board shall be responsible for developing and periodically updating information security policies and procedures relating to minimum security controls for information technology, in order to--

   Inserted: "(i) provide Governmentwide protection of Government-networked computers against common attacks; and

   Inserted: "(ii) provide agencywide protection against threats, vulnerabilities, and other risks to the information infrastructure within individual agencies.

   Inserted: "(B) Measures of effectiveness.--The Board shall be responsible for developing and periodically updating information security policies and procedures relating to measurements needed to assess the effectiveness of the minimum security controls referred to in subparagraph (A). Such measurements shall include a risk scoring system to evaluate risk to information security both Governmentwide and within contractors of the Federal Government.

   Inserted: "(C) Products and services.--The Board shall be responsible for developing and periodically updating information security policies, procedures, and minimum security standards relating to criteria for products and services to be used in agency information systems and information infrastructure that will meet the minimum security controls referred to in subparagraph (A). In carrying out this subparagraph, the Board shall act in consultation with the Office of Management and Budget and the General Services Administration.

   Inserted: "(D) Remedies.--The Board shall be responsible for developing and periodically updating information security policies and procedures relating to methods for providing remedies for security deficiencies identified in agency information infrastructure.

   Inserted: "(3) Additional considerations.--The Board shall also consider--

   Inserted: "(A) opportunities to engage with the international community to set policies, principles, training, standards, or guidelines for information security;

   Inserted: "(B) opportunities to work with agencies and industry partners to increase information sharing and policy coordination efforts in order to reduce vulnerabilities in the national information infrastructure; and

   Inserted: "(C) options necessary to encourage and maintain accountability of any agency, or senior agency official, for efforts to secure the information infrastructure of such agency.

   Inserted: "(4) Relationship to other standards.--The policies and procedures developed under paragraph (1) are supplemental to the standards promulgated by the Director of the National Office for Cyberspace under section 3558.

   Inserted: "(5) Recommendations for regulations.--The Board shall be responsible for making recommendations to the Director of the National Office for Cyberspace on regulations to carry out the policies and procedures developed by the Board under paragraph (1).

   Inserted: "(d) Regulations.--The Director of the National Office for Cyberspace, in consultation with the Director of the Office of Management and the Administrator of General Services shall promulgate and periodically update regulations to carry out the policies and procedures developed by the Board under subsection (c).

   Inserted: "(e) Annual Report.--The Director of the National Office for Cyberspace shall provide to Congress a report containing a summary of agency progress in implementing the regulations promulgated under this section as part of the annual report to Congress required under section 3555(a)(8).

   Inserted: "(f) No Disclosure by Board Required.--The Board is not required to disclose under section 552 of title 5 information submitted by agencies to the Board regarding threats, vulnerabilities, and risks.

   Inserted: "Sec. 3555. Authority and functions of the Director of the National Office for Cyberspace

   Inserted: "(a) In General.--The Director of the National Office for Cyberspace shall oversee agency information security policies and practices, including--

   Inserted: "(1) developing and overseeing the implementation of policies, principles, standards, and guidelines on information security, including through ensuring timely agency adoption of and compliance with standards promulgated under section 3558;

   Inserted: "(2) requiring agencies, consistent with the standards promulgated under section 3558 and other requirements of this subchapter, to identify and provide information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of--

   Inserted: "(A) information collected or maintained by or on behalf of an agency; or

   Inserted: "(B) information infrastructure used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;

   Inserted: "(3) coordinating the development of standards and guidelines under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) with agencies and offices operating or exercising control of national security systems (including the National Security Agency) to assure, to the maximum extent feasible, that such standards and guidelines are complementary with standards and guidelines developed for national security systems;

   Inserted: "(4) overseeing agency compliance with the requirements of this subchapter, including through any authorized action under section 11303 of title 40, to enforce accountability for compliance with such requirements;

   Inserted: "(5) reviewing at least annually, and approving or disapproving, agency information security programs required under section 3556(b);

   Inserted: "(6) coordinating information security policies and procedures with related information resources management policies and procedures;

   Inserted: "(7) overseeing the operation of the Federal information security incident center required under section 3559;

   Inserted: "(8) reporting to Congress no later than March 1 of each year on agency compliance with the requirements of this subchapter, including--

   Inserted: "(A) a summary of the findings of audits required by section 3557;

   Inserted: "(B) an assessment of the development, promulgation, and adoption of, and compliance with, standards developed under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) and promulgated under section 3558;

   Inserted: "(C) significant deficiencies in agency information security practices;

   Inserted: "(D) planned remedial action to address such deficiencies; and

   Inserted: "(E) a summary of, and the views of the Director of the National Office for Cyberspace on, the report prepared by the National Institute of Standards and Technology under section 20(d)(10) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3);

   Inserted: "(9) coordinating the defense of information infrastructure operated by agencies in the case of a large-scale attack on information infrastructure, as determined by the Director;

   Inserted: "(10) establishing a national strategy, in consultation with the Department of State, the United States Trade Representative, and the National Institute of Standards and Technology, to engage with the international community to set the policies, principles, standards, or guidelines for information security; and

   Inserted: "(11) coordinating information security training for Federal employees with the Office of Personnel Management.

   Inserted: "(b) National Security Systems.--Except for the authorities described in paragraphs (4) and (8) of subsection (a), the authorities of the Director of the National Office for Cyberspace under this section shall not apply to national security systems.

   Inserted: "(c) Department of Defense and Central Intelligence Agency Systems.--(1) The authorities of the Director of the National Office for Cyberspace described in paragraphs (1) and (2) of subsection (a) shall be delegated to the Secretary of Defense in the case of systems described in paragraph (2) and to the Director of Central Intelligence in the case of systems described in paragraph (3).

   Inserted: "(2) The systems described in this paragraph are systems that are operated by the Department of Defense, a contractor of the Department of Defense, or another entity on behalf of the Department of Defense that processes any information the unauthorized access, use, disclosure, disruption, modification, or destruction of which would have a debilitating impact on the mission of the Department of Defense.

   Inserted: "(3) The systems described in this paragraph are systems that are operated by the Central Intelligence Agency, a contractor of the Central Intelligence Agency, or another entity on behalf of the Central Intelligence Agency that processes any information the unauthorized access, use, disclosure, disruption, modification, or destruction of which would have a debilitating impact on the mission of the Central Intelligence Agency.

   Inserted: "(d) Budget Oversight and Reporting.--(1) The head of each agency shall submit to the Director of the National Office for Cyberspace a budget each year for the following fiscal year relating to the protection of information infrastructure for such agency, by a date determined by the Director that is before the submission of such budget by the head of the agency to the Office of Management and Budget.

   Inserted: "(2) The Director shall review and offer a non-binding approval or disapproval of each agency's annual budget to each agency before the submission of such budget by the head of the agency to the Office of Management and Budget.

   Inserted: "(3) If the Director offers a non-binding disapproval of an agency's, budget, the Director shall transmit recommendations to the head of such agency for strengthening its proposed budget with regard to the protection of such agency's information infrastructure.

   Inserted: "(4) Each budget submitted by the head of an agency pursuant to paragraph (1) shall include--

   Inserted: "(A) a review of any threats to information technology for such agency;

   Inserted: "(B) a plan to secure the information infrastructure for such agency based on threats to information technology, using the National Institute of Standards and Technology guidelines and recommendations;

   Inserted: "(C) a review of compliance by such agency with any previous year plan described in subparagraph (B); and

   Inserted: "(D) a report on the development of the credentialing process to enable secure authentication of identity and authorization for access to the information infrastructure of such agency.

   Inserted: "(5) The Director of the National Office for Cyberspace may recommend to the President monetary penalties or incentives necessary to encourage and maintain accountability of any agency, or senior agency official, for efforts to secure the information infrastructure of such agency.

   Inserted: "Sec. 3556. Agency responsibilities

   Inserted: "(a) In General.--The head of each agency shall--

   Inserted: "(1) be responsible for--

   Inserted: "(A) providing information security protections commensurate with the risk and magnitude of the harm resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of--

   Inserted: "(i) information collected or maintained by or on behalf of the agency; and

   Inserted: "(ii) information infrastructure used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency;

   Inserted: "(B) complying with the requirements of this subchapter and related policies, procedures, standards, and guidelines, including--

   Inserted: "(i) the regulations promulgated under section 3554 and the information security standards promulgated under section 3558;

   Inserted: "(ii) information security standards and guidelines for national security systems issued in accordance with law and as directed by the President; "(iii) and ensuring the standards implemented for information infrastructure and national security systems under the agency head are complementary and uniform, to the extent practicable; and

   Inserted: "(C) ensuring that information security management processes are integrated with agency strategic and operational planning processes;

   Inserted: "(2) ensure that senior agency officials provide information security for the information and information infrastructure that support the operations and assets under their control, including through--

   Inserted: "(A) assessing the risk and magnitude of the harm that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of such information or information infrastructure;

   Inserted: "(B) determining the levels of information security appropriate to protect such information and information infrastructure in accordance with regulations promulgated under section 3554 and standards promulgated under section 3558, for information security classifications and related requirements;

   Inserted: "(C) implementing policies and procedures to cost effectively reduce risks to an acceptable level; and

   Inserted: "(D) continuously testing and evaluating information security controls and techniques to ensure that they are effectively implemented;

   Inserted: "(3) delegate to an agency official, designated as the 'Chief Information Security Officer', under the authority of the agency Chief Information Officer the responsibility to oversee agency information security and the authority to ensure and enforce compliance with the requirements imposed on the agency under this subchapter, including--

   Inserted: "(A) overseeing the establishment and maintenance of a security operations capability on an automated and continuous basis that can--

   Inserted: "(i) assess the state of compliance of all networks and systems with prescribed controls issued pursuant to section 3558 and report immediately any variance therefrom and, where appropriate and with the approval of the agency Chief Information Officer, shut down systems that are found to be non-compliant;

   Inserted: "(ii) detect, report, respond to, contain, and mitigate incidents that impair adequate security of the information and information infrastructure, in accordance with policy provided by the Director of the National Office for Cyberspace, in consultation with the Chief Information Officers Council, and guidance from the National Institute of Standards and Technology;

   Inserted: "(iii) collaborate with the National Office for Cyberspace and appropriate public and private sector security operations centers to address incidents that impact the security of information and information infrastructure that extend beyond the control of the agency; and

   Inserted: "(iv) not later than 24 hours after discovery of any incident described under subparagraph (A)(ii), unless otherwise directed by policy of the National Office for Cyberspace, provide notice to the appropriate security operations center, the National Cyber Investigative Joint Task Force, and the Inspector General of the agency;

   Inserted: "(B) developing, maintaining, and overseeing an agency wide information security program as required by subsection (b);

   Inserted: "(C) developing, maintaining, and overseeing information security policies, procedures, and control techniques to address all applicable requirements, including those issued under sections 3555 and 3558;

   Inserted: "(D) training and overseeing personnel with significant responsibilities for information security with respect to such responsibilities; and

   Inserted: "(E) assisting senior agency officials concerning their responsibilities under paragraph (2);

   Inserted: "(4) ensure that the agency has trained and cleared personnel sufficient to assist the agency in complying with the requirements of this subchapter and related policies, procedures, standards, and guidelines;

   Inserted: "(5) ensure that the Chief Information Security Officer, in coordination with other senior agency officials, reports biannually to the agency head on the effectiveness of the agency information security program, including progress of remedial actions; and

   Inserted: "(6) ensure that the Chief Information Security Officer possesses necessary qualifications, including education, professional certifications, training, experience and the security clearance required to administer the functions described under this subchapter; and has information security duties as the primary duty of that official. "(b) Agency Program.--Each agency shall develop, document, and implement an agencywide information security program, approved by the Director of the National Office for Cyberspace under section 3555(a)(5), to provide information security for the information and information infrastructure that support the operations and assets of the agency, including those provided or managed by another agency, contractor, or other source, that includes--

   Inserted: "(1) continuous automated technical monitoring of information infrastructure used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency to assure conformance with regulations promulgated under section 3554 and standards promulgated under section 3558;

   Inserted: "(2) testing of the effectiveness of security controls that are commensurate with risk (as defined by the National Institute of Standards and Technology and the National Office for Cyberspace) for agency information infrastructure;

   Inserted: "(3) policies and procedures that--

   Inserted: "(A) mitigate and remediate, to the extent practicable, information security vulnerabilities based on the risk posed to the agency;

   Inserted: "(B) cost effectively reduce information security risks to an acceptable level;

   Inserted: "(C) ensure that information security is addressed throughout the life cycle of each agency information system and information infrastructure;

   Inserted: "(D) ensure compliance with--

   Inserted: "(i) the requirements of this subchapter;

   Inserted: "(ii) policies and procedures as may be prescribed by the Director of the National Office for Cyberspace, and information security standards promulgated under section 3558;

   Inserted: "(iii) minimally acceptable system configuration requirements, as determined by the Director of the National Office for Cyberspace; and

   Inserted: "(iv) any other applicable requirements, including--

   Inserted: "(I) standards and guidelines for national security systems issued in accordance with law and as directed by the President;

   Inserted: "(II) the policy of the Director of the National Office for Cyberspace;

   Inserted: "(III) the National Institute of Standards and Technology guidance; and

   Inserted: "(IV) the Chief Information Officers Council recommended approaches;

   Inserted: "(E) develop, maintain, and oversee information security policies, procedures, and control techniques to address all applicable requirements, including those issued under sections 3555 and 3558; and

   Inserted: "(F) ensure the oversight and training of personnel with significant responsibilities for information security with respect to such responsibilities;

   Inserted: "(4) ensuring that the agency has trained and cleared personnel sufficient to assist the agency in complying with the requirements of this subchapter and related policies, procedures, standards, and guidelines;

   Inserted: "(5) to the extent practicable, automated and continuous technical monitoring for testing, and evaluation of the effectiveness and compliance of information security policies, procedures, and practices, including--

   Inserted: "(A) management, operational, and technical controls of every information infrastructure identified in the inventory required under section 3505(b); and

   Inserted: "(B) management, operational, and technical controls relied on for an evaluation under section 3556;

   Inserted: "(6) a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency;

   Inserted: "(7) to the extent practicable, continuous automated technical monitoring for detecting, reporting, and responding to security incidents, consistent with standards and guidelines issued by the Director of the National Office for Cyberspace, including--

   Inserted: "(A) mitigating risks associated with such incidents before substantial damage is done;

   Inserted: "(B) notifying and consulting with the appropriate security operations response center; and

   Inserted: "(C) notifying and consulting with, as appropriate--

   Inserted: "(i) law enforcement agencies and relevant Offices of Inspectors General;

   Inserted: "(ii) the National Office for Cyberspace; and

   Inserted: "(iii) any other agency or office, in accordance with law or as directed by the President; and

   Inserted: "(8) plans and procedures to ensure continuity of operations for information infrastructure that support the operations and assets of the agency. "(c) Agency Reporting.--Each agency shall--

   Inserted: "(1) submit an annual report on the adequacy and effectiveness of information security policies, procedures, and practices, and compliance with the requirements of this subchapter, including compliance with each requirement of subsection (b) to--

   Inserted: "(A) the National Office for Cyberspace;

   Inserted: "(B) the Committee on Homeland Security and Governmental Affairs of the Senate;

   Inserted: "(C) the Committee on Oversight and Government Reform of the House of Representatives;

   Inserted: "(D) other appropriate authorization and appropriations committees of Congress; and

   Inserted: "(E) the Comptroller General;

   Inserted: "(2) address the adequacy and effectiveness of information security policies, procedures, and practices in plans and reports relating to--

   Inserted: "(A) annual agency budgets;

   Inserted: "(B) information resources management of this subchapter;

   Inserted: "(C) information technology management under this chapter;

   Inserted: "(D) program performance under sections 1105 and 1115 through 1119 of title 31, and sections 2801 and 2805 of title 39;

   Inserted: "(E) financial management under chapter 9 of title 31, and the Chief Financial Officers Act of 1990 (31 U.S.C. 501 note; Public Law 101-576) (and the amendments made by that Act);

   Inserted: "(F) financial management systems under the Federal Financial Management Improvement Act (31 U.S.C. 3512 note); and

   Inserted: "(G) internal accounting and administrative controls under section 3512 of title 31; and

   Inserted: "(3) report any significant deficiency in a policy, procedure, or practice identified under paragraph (1) or (2)--

   Inserted: "(A) as a material weakness in reporting under section 3512 of title 31; and

   Inserted: "(B) if relating to financial management systems, as an instance of a lack of substantial compliance under the Federal Financial Management Improvement Act (31 U.S.C. 3512 note).

   Inserted: "(d) Performance Plan.--(1) In addition to the requirements of subsection (c), each agency, in consultation with the National Office for Cyberspace, shall include as part of the performance plan required under section 1115 of title 31 a description of the resources, including budget, staffing, and training, that are necessary to implement the program required under subsection (b).

   Inserted: "(2) The description under paragraph (1) shall be based on the risk assessments required under subsection (a)(2).

   Inserted: "(e) Public Notice and Comment.--Each agency shall provide the public with timely notice and opportunities for comment on proposed information security policies and procedures to the extent that such policies and procedures affect communication with the public.

   Inserted: "Sec. 3557. Annual independent audit

   Inserted: "(a) In General.--(1) Each year each agency shall have performed an independent audit of the information security program and practices of that agency to determine the effectiveness of such program and practices.

   Inserted: "(2) Each audit under this section shall include--

   Inserted: "(A) testing of the effectiveness of the information infrastructure of the agency for automated, continuous monitoring of the state of compliance of its information infrastructure with regulations promulgated under section 3554 and standards promulgated under section 3558 in a representative subset of--

   Inserted: "(i) the information infrastructure used or operated by the agency; and

   Inserted: "(ii) the information infrastructure used, operated, or supported on behalf of the agency by a contractor of the agency, a subcontractor (at any tier) of such contractor, or any other entity;

   Inserted: "(B) an assessment (made on the basis of the results of the testing) of compliance with--

   Inserted: "(i) the requirements of this subchapter; and

   Inserted: "(ii) related information security policies, procedures, standards, and guidelines;

   Inserted: "(C) separate assessments, as appropriate, regarding information security relating to national security systems; and

   Inserted: "(D) a conclusion regarding whether the information security controls of the agency are effective, including an identification of any significant deficiencies in such controls.

   Inserted: "(3) Each audit under this section shall be performed in accordance with applicable generally accepted Government auditing standards.

   Inserted: "(b) Independent Auditor.--Subject to subsection (c)--

   Inserted: "(1) for each agency with an Inspector General appointed under the Inspector General Act of 1978 or any other law, the annual audit required by this section shall be performed by the Inspector General or by an independent external auditor, as determined by the Inspector General of the agency; and

   Inserted: "(2) for each agency to which paragraph (1) does not apply, the head of the agency shall engage an independent external auditor to perform the audit.

   Inserted: "(c) National Security Systems.--For each agency operating or exercising control of a national security system, that portion of the audit required by this section directly relating to a national security system shall be performed--

   Inserted: "(1) only by an entity designated head; and

   Inserted: "(2) in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws.

   Inserted: "(d) Existing Audits.--The audit required by this section may be based in whole or in part on another audit relating to programs or practices of the applicable agency.

   Inserted: "(e) Agency Reporting.--(1) Each year, not later than such date established by the Director of the National Office for Cyberspace, the head of each agency shall submit to the Director the results of the audit required under this section.

   Inserted: "(2) To the extent an audit required under this section directly relates to a national security system, the results of the audit submitted to the Director of the National Office for Cyberspace shall contain only a summary and assessment of that portion of the audit directly relating to a national security system.

   Inserted: "(f) Protection of Information.--Agencies and auditors shall take appropriate steps to ensure the protection of information which, if disclosed, may adversely affect information security. Such protections shall be commensurate with the risk and comply with all applicable laws and regulations.

   Inserted: "(g) National Office for Cyberspace Reports to Congress.--(1) The Director of the National Office for Cyberspace shall summarize the results of the audits conducted under this section in the annual report to Congress required under section 3555(a)(8).

   Inserted: "(2) The Director's report to Congress under this subsection shall summarize information regarding information security relating to national security systems in such a manner as to ensure appropriate protection for information associated with any information security vulnerability in such system commensurate with the risk and in accordance with all applicable laws.

   Inserted: "(3) Audits and any other descriptions of information infrastructure under the authority and control of the Director of Central Intelligence or of National Foreign Intelligence Programs systems under the authority and control of the Secretary of Defense shall be made available to Congress only through the appropriate oversight committees of Congress, in accordance with applicable laws.

   Inserted: "(h) Comptroller General.--The Comptroller General shall periodically evaluate and report to Congress on--

   Inserted: "(1) the adequacy and effectiveness of agency information security policies and practices; and

   Inserted: "(2) implementation of the requirements of this subchapter.

   Inserted: "(i) Contractor Audits.--Each year each contractor that operates, uses, or supports an information system or information infrastructure on behalf of an agency and each subcontractor of such contractor--

   Inserted: "(1) shall conduct an audit using an independent external auditor in accordance with subsection (a), including an assessment of compliance with the applicable requirements of this subchapter; and

   Inserted: "(2) shall submit the results of such audit to such agency not later than such date established by the Agency.

   Inserted: "Sec. 3558. Responsibilities for Federal information systems standards

   Inserted: "(a) Requirement To Prescribe Standards.--

   Inserted: "(1) In general.--

   Inserted: "(A) Requirement.--Except as provided under paragraph (2), the Secretary of Commerce shall, on the basis of proposed standards developed by the National Institute of Standards and Technology pursuant to paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3(a)) and in consultation with the Secretary of Homeland Security, promulgate information security standards pertaining to Federal information systems.

   Inserted: "(B) Required standards.--Standards promulgated under subparagraph (A) shall include--

   Inserted: "(i) standards that provide minimum information security requirements as determined under section 20(b) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3(b)); and

   Inserted: "(ii) such standards that are otherwise necessary to improve the efficiency of operation or security of Federal information systems.

   Inserted: "(C) Required standards binding.--Information security standards described under subparagraph (B) shall be compulsory and binding.

   Inserted: "(2) Standards and guidelines for national security systems.--Standards and guidelines for national security systems, as defined under section 3552(b), shall be developed, promulgated, enforced, and overseen as otherwise authorized by law and as directed by the President.

   Inserted: "(b) Application of More Stringent Standards.--The head of an agency may employ standards for the cost-effective information security for all operations and assets within or under the supervision of that agency that are more stringent than the standards promulgated by the Secretary of Commerce under this section, if such standards--

   Inserted: "(1) contain, at a minimum, the provisions of those applicable standards made compulsory and binding by the Secretary; and

   Inserted: "(2) are otherwise consistent with policies and guidelines issued under section 3555.

   Inserted: "(c) Requirements Regarding Decisions by the Secretary.--"(1) Deadline.--The decision regarding the promulgation of any standard by the Secretary of Commerce under subsection (b) shall occur not later than 6 months after the submission of the proposed standard to the Secretary by the National Institute of Standards and Technology, as provided under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3).

   Inserted: "(2) Notice and comment.--A decision by the Secretary of Commerce to significantly modify, or not promulgate, a proposed standard submitted to the Secretary by the National Institute of Standards and Technology, as provided under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3), shall be made after the public is given an opportunity to comment on the Secretary's proposed decision.

   Inserted: "Sec. 3559. Federal information security incident center

   Inserted: "(a) In General.--The Director of the National Office for Cyberspace shall ensure the operation of a central Federal information security incident center to--

   Inserted: "(1) provide timely technical assistance to operators of agency information systems and information infrastructure regarding security incidents, including guidance on detecting and handling information security incidents;

   Inserted: "(2) compile and analyze information about incidents that threaten information security;

   Inserted: "(3) inform operators of agency information systems and information infrastructure about current and potential information security threats, and vulnerabilities; and

   Inserted: "(4) consult with the National Institute of Standards and Technology, agencies or offices operating or exercising control of national security systems (including the National Security Agency), and such other agencies or offices in accordance with law and as directed by the President regarding information security incidents and related matters.

   Inserted: "(b) National Security Systems.--Each agency operating or exercising control of a national security system shall share information about information security incidents, threats, and vulnerabilities with the Federal information security incident center to the extent consistent with standards and guidelines for national security systems, issued in accordance with law and as directed by the President.

   Inserted: (c) Review and Approval.--In coordination with the Administrator for Electronic Government and Information Technology, the Director of the National Office for Cyberspace shall review and approve the policies, procedures, and guidance established in this subchapter to ensure that the incident center has the capability to effectively and efficiently detect, correlate, respond to, contain, mitigate, and remediate incidents that impair the adequate security of the information systems and information infrastructure of more than one agency. To the extent practicable, the capability shall be continuous and technically automated.

   Inserted: "Sec. 3560. National security systems "The head of each agency operating or exercising control of a national security system shall be responsible for ensuring that the agency--

   Inserted: "(1) provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information contained in such system;

   Inserted: "(2) implements information security policies and practices as required by standards and guidelines for national security systems, issued in accordance with law and as directed by the President; and

   Inserted: "(3) complies with the requirements of this subchapter.".

   Inserted: SEC. 1702. INFORMATION SECURITY ACQUISITION REQUIREMENTS.

   Inserted: (a) In General.--Chapter 113 of title 40, United States Code, is amended by adding at the end of subchapter II the following new section:

   Inserted: "Sec. 11319. Information security acquisition requirements.

   Inserted: "(a) Prohibition.--Notwithstanding any other provision of law, beginning one year after the date of the enactment of the Federal Information Security Amendments Act of 2010, no agency may enter into a contract, an order under a contract, or an interagency agreement for--

   Inserted: "(1) the collection, use, management, storage, or dissemination of information on behalf of the agency;

   Inserted: "(2) the use or operation of an information system or information infrastructure on behalf of the agency; or

   Inserted: "(3) information technology;

   Inserted: unless such contract, order, or agreement includes requirements to provide effective information security that supports the operations and assets under the control of the agency, in compliance with the policies, standards, and guidance developed under subsection (b), and otherwise ensures compliance with this section.

   Inserted: "(b) Coordination of Secure Acquisition Policies.--

   Inserted: "(1) In general.--The Director, in consultation with the Director of the National Institute of Standards and Technology, the Director of the National Office for Cyberspace, and the Administrator of General Services, shall oversee the development and implementation of policies, standards, and guidance, including through revisions to the Federal Acquisition Regulation and the Department of Defense supplement to the Federal Acquisition Regulation, to cost effectively enhance agency-information security, including--

   Inserted: "(A) minimum information security requirements for agency procurement of information technology products and services; and

   Inserted: "(B) approaches for evaluating and mitigating significant supply chain security risks associated with products or services to be acquired by agencies.

   Inserted: "(2) Report.--Not later than two years after the date of the enactment of the Federal Information Security Amendments Act of 2010, the Director shall submit to Congress a report describing--

   Inserted: "(A) actions taken to improve the information security associated with the procurement of products and services by the Federal Government; and

   Inserted: "(B) plans for overseeing and coordinating efforts of agencies to use best practice approaches for cost-effectively purchasing more secure products and services.

   Inserted: "(c) Vulnerability Assessments of Major Systems.--

   Inserted: "(1) Requirement for initial vulnerability assessments.--The Director shall require each agency to conduct an initial vulnerability assessment for any major system and its significant items of supply prior to the development of the system. The initial vulnerability assessment of a major system and its significant items of supply shall include use of an analysis-based approach to--

   Inserted: "(A) identify vulnerabilities;

   Inserted: "(B) define exploitation potential;

   Inserted: "(C) examine the system's potential effectiveness;

   Inserted: "(D) determine overall vulnerability; and

   Inserted: "(E) make recommendations for risk reduction.

   Inserted: "(2) Subsequent vulnerability assessments.--

   Inserted: "(A) The Director shall require a subsequent vulnerability assessment of each major system and its significant items of supply within a program if the Director determines that circumstances warrant the issuance of an additional vulnerability assessment.

   Inserted: "(B) Upon the request of a congressional committee, the Director may require a subsequent vulnerability assessment of a particular major system and its significant items of supply within the program.

   Inserted: "(C) Any subsequent vulnerability assessment of a major system and its significant items of supply shall include use of an analysis-based approach and, if applicable, a testing-based approach, to monitor the exploitation potential of such system and reexamine the factors described in subparagraphs (A) through (E) of paragraph (1).

   Inserted: "(3) Congressional oversight.--The Director shall provide to the appropriate congressional committees a copy of each vulnerability assessment conducted under paragraph (1) or (2) not later than 10 days after the date of the completion of such assessment.

   Inserted: "(d) Definitions.--In this section:

   Inserted: "(1) Item of supply.--The term 'item of supply'--

   Inserted: "(A) means any individual part, component, subassembly, assembly, or subsystem integral to a major system, and other property which may be replaced during the service life of the major system, including a spare part or replenishment part; and

   Inserted: "(B) does not include packaging or labeling associated with shipment or identification of an item.

   Inserted: "(2) Vulnerability assessment.--The term 'vulnerability assessment' means the process of identifying and quantifying vulnerabilities in a major system and its significant items of supply.

   Inserted: "(3) Major system.--The term 'major system' has the meaning given that term in section 4 of the Office of Federal Procurement Policy Act (41 U.S.C. 403).".

   Inserted: SEC. 1703. TECHNICAL AND CONFORMING AMENDMENTS.

   Inserted: (a) Table of Sections in Title 44.--The table of sections for chapter 35 of title 44, United States Code, is amended by striking the matter relating to subchapters II and III and inserting the following:

   Inserted: "SUBCHAPTER II--INFORMATION SECURITY

   Inserted: "3551. Purposes.

   Inserted: "3552. Definitions.

   Inserted: "3553. National Office for Cyberspace.

   Inserted: "3554. Federal Cybersecurity Practice Board.

   Inserted: "3555. Authority and functions of the Director of the National Office for Cyberspace.

   Inserted: "3556. Agency responsibilities.

   Inserted: "3557. Annual independent audit.

   Inserted: "3558. Responsibilities for Federal information systems standards.

   Inserted: "3559. Federal information security incident center.

   Inserted: "3560. National security systems.".

   Inserted: (b) Table of Sections in Title 40.--The table of sections for chapter 113 of title 40, United States Code, is amended by inserting after the item relating to section 11318 the following new item:

   Inserted: "Sec. 11319. Information security acquisition requirements.".

   Inserted: (c) Other References.--

   Inserted: (1) Section 1001(c)(1)(A) of the Homeland Security Act of 2002 (6 U.S.C. 511(c)(1)(A)) is amended by striking "section 3532(3)" and inserting "section 3552(b)".

   Inserted: (2) Section 2222(j)(6) of title 10, United States Code, is amended by striking "section 3542(b)(2))" and inserting "section 3552(b)".

   Inserted: (3) Section 2223(c)(3) of title 10, United States Code, is amended, by striking "section 3542(b)(2))" and inserting "section 3552(b)".

   Inserted: (4) Section 2315 of title 10, United States Code, is amended by striking "section 3542(b)(2))" and inserting "section 3552(b)".

   Inserted: (5) Section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) is amended--

   Inserted: (A) in subsections (a)(2) and (e)(5), by striking "section 3532(b)(2)" and inserting "section 3552(b)";

   Inserted: (B) in subsection (e)(2), by striking "section 3532(1)" and inserting "section 3552(b)"; and

   Inserted: (C) in subsections (c)(3) and (d)(1), by striking "section 11331 of title 40" and inserting "section 3558 of title 44".

   Inserted: (6) Section 8(d)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7406(d)(1)) is amended by striking "section 3534(b)" and inserting "section 3556(b)".

   Inserted: (d) Repeal.--

   Inserted: (1) Subchapter III of chapter 113 of title 40, United States Code, is repealed.

   Inserted: (2) The table of sections for chapter 113 of such title is amended by striking the matter relating to subchapter III.

   Inserted: (e) Executive Schedule Pay Rate.--Section 5314 of title 5, United States Code, is amended by adding at the end the following:

   Inserted: "Director of the National Office for Cyberspace.".

   Inserted: (f) Membership on the National Security Council.--Section 101(a) of the National Security Act of 1947 (50 U.S.C. 402(a)) is amended--

   Inserted: (1) by redesignating paragraphs (7) and (8) as paragraphs (8) and (9), respectively; and

   Inserted: (2) by inserting after paragraph (6) the following:

   Inserted: "(7) the Director of the National Office for Cyberspace;".

   Inserted: SEC. 1704. EFFECTIVE DATE.

   Inserted: (a) In General.--Unless otherwise specified in this section, this subtitle (including the amendments made by this subtitle) shall take effect 30 days after the date of enactment of this Act.

   Inserted: (b) National Office for Cyberspace.--Section 3553 of title 44, United States Code, as added by section 1701 of this division, shall take effect 180 days after the date of enactment of this Act.

   Inserted: (c) Federal Cybersecurity Practice Board.--Section 3554 of title 44, United States Code, as added by section 1701 of this division, shall take effect one year after the date of enactment of this Act.

   Inserted: Subtitle B--Federal Chief Technology Officer SEC. 1711. OFFICE OF THE CHIEF TECHNOLOGY OFFICER.

   Inserted: (a) Establishment and Staff.--

   Inserted: (1) Establishment.--

   Inserted: (A) In general.--There is established in the Executive Office of the President an Office of the Federal Chief Technology Officer (in this section referred to as the "Office").

   Inserted: (B) Head of the office.--

   Inserted: (i) Federal chief technology officer.--The President shall appoint a Federal Chief Technology Officer (in this section referred to as the "Federal CTO") who shall be the head of the Office.

   Inserted: (ii) Compensation.--Section 5314 of title 5, United States Code, is amended by adding at the end the following: "Federal Chief Technology Officer.".

   Inserted: (2) Staff of the office.--The President may appoint additional staff members to the Office.

   Inserted: (b) Duties of the Office.--The functions of the Federal CTO are the following:

   Inserted: (1) Undertake fact-gathering, analysis, and assessment of the Federal Government's information technology infrastructures, information technology strategy, and use of information technology, and provide advice on such matters to the President, heads of Federal departments and agencies, and government chief information officers and chief technology officers.

   Inserted: (2) Lead an interagency effort, working with the chief technology and chief information officers of each of the Federal departments and agencies, to develop and implement a planning process to ensure that they use best-in-class technologies, share best practices, and improve the use of technology in support of Federal Government requirements.

   Inserted: (3) Advise the President on information technology considerations with regard to Federal budgets and with regard to general coordination of the research and development programs of the Federal Government for information technology-related matters.

   Inserted: (4) Promote technological innovation in the Federal Government, and encourage and oversee the adoption of robust cross-governmental architectures and standards-based information technologies, in support of effective operational and management policies, practices, and services across Federal departments and agencies and with the public and external entities.

   Inserted: (5) Establish cooperative public-private sector partnership initiatives to achieve knowledge of technologies available in the marketplace that can be used for improving governmental operations and information technology research and development activities.

   Inserted: (6) Gather timely and authoritative information concerning significant developments and trends in information technology, and in national priorities, both current and prospective, and analyze and interpret the information for the purpose of determining whether the developments and trends are likely to affect achievement of the priority goals of the Federal Government.

   Inserted: (7) Develop, review, revise, and recommend criteria for determining information technology activities warranting Federal support, and recommend Federal policies designed to advance the development and maintenance of effective and efficient information technology capabilities, including human resources, at all levels of government, academia, and industry, and the effective application of the capabilities to national needs.

   Inserted: (8) Any other functions and activities that the President may assign to the Federal CTO.

   Inserted: (c) Policy Planning; Analysis and Advice.--The Office shall serve as a source of analysis and advice for the President and heads of Federal departments and agencies with respect to major policies, plans, and programs of the Federal Government in accordance with the functions described in subsection (b).

   Inserted: (d) Coordination of the Office With Other Entities.--

   Inserted: (1) Federal cto on domestic policy council.--The Federal CTO shall be a member of the Domestic Policy Council.

   Inserted: (2) Federal cto on cyber security practice board.--The Federal CTO shall be a member of the Federal Cybersecurity Practice Board.

   Inserted: (3) Obtain information from agencies.--The Office may secure, directly from any department or agency of the United States, information necessary to enable the Federal CTO to carry out this section. On request of the Federal CTO, the head of the department or agency shall furnish the information to the Office, subject to any applicable limitations of Federal law.

   Inserted: (4) Staff of federal agencies.--On request of the Federal CTO, to assist the Office in carrying out the duties of the Office, the head of any Federal department or agency may detail personnel, services, or facilities of the department or agency to the Office.

   Inserted: (e) Annual Report.--

   Inserted: (1) Publication and contents.--The Federal CTO shall publish, in the Federal Register and on a public Internet website of the Federal CTO, an annual report that includes the following:

   Inserted: (A) Information on programs to promote the development of technological innovations.

   Inserted: (B) Recommendations for the adoption of policies to encourage the generation of technological innovations.

   Inserted: (C) Information on the activities and accomplishments of the Office in the year covered by the report.

   Inserted: (2) Submission.--The Federal CTO shall submit each report under paragraph (1) to--

   Inserted: (A) the President;

   Inserted: (B) the Committee on Oversight and Government Reform of the House of Representatives;

   Inserted: (C) the Committee on Science and Technology of the House of Representatives; and

   Inserted: (D) the Committee on Commerce, Science, and Transportation of the Senate.

   Inserted: Amendment No. 63 Offered by Mr. McMahon of New York

   Original wording

   At the end of division A, add the following new title:

5. 5

   Change 5: Adds SEC. 1025. EXPRESSING THE SENSE OF CONGRESS REGARDING THE NAMING OF A NAVAL COMBAT VESSEL AFTER FATHER VINCENT CAPODANNO on page 389, line 7

   Adds a sectionPrinted page

   Inserted: SEC. 1025. EXPRESSING THE SENSE OF CONGRESS REGARDING THE NAMING OF A NAVAL COMBAT VESSEL AFTER FATHER VINCENT CAPODANNO.

   Inserted: (a) Findings.--Congress makes the following findings:

   Inserted: (1) Father Vincent Capodanno was born on February 13, 1929, in Staten Island, New York.

   Inserted: (2) After attending Fordham University for a year, he entered the Maryknoll Missionary Seminary in upstate New York in 1949, and was ordained a Catholic priest in June 1957.

   Inserted: (3) Father Capodanno's first assignment as a missionary was working with aboriginal Taiwanese people in the mountains of Taiwan where he served in a parish and later in a school. After several years, Father Capodanno returned to the United States for leave and then was assigned to a Maryknoll school in Hong Kong.

   Inserted: (4) Father Vincent Capodanno volunteered as a Navy Chaplain and was commissioned a Lieutenant in the Chaplain Corps of the United States Naval Reserve in December 28, 1965.

   Inserted: (5) Father Vincent Capodanno selflessly extended his combat tour in Vietnam on the condition he was allowed to remain with the infantry.

   Inserted: (6) On September 4, 1967, during a fierce battle in the Thang Binh District of the Que-Son Valley in Vietnam, Father Capodanno went among the wounded and dying, giving last rites and caring for the injured. He was killed that day while taking care of his Marines.

   Inserted: (7) On January 7, 1969, Father Vincent Capodanno was awarded the Medal of Honor posthumously for comforting the wounded and dying during the Vietnam conflict. For his dedicated service, Father Capodanno was also awarded the Bronze Star, the Purple Heart, the Presidential Unit Citation, the National Defense Service Medal, the Vietnam Service Medal, the Vietnam Gallantry Cross with Palm, and the Vietnam Campaign Medal.

   Inserted: (8) In his memory, the U.S.S. Capodanno was commissioned on September 17, 1973. It is the only Naval vessel to date to have received a Papal blessing by Pope John Paul II in Naples, Italy, on September 4, 1981.

   Inserted: (9) The U.S.S. Capodanno was decommissioned on July 30, 1993.

   Inserted: (b) Sense of Congress.--It is the sense of Congress that the Secretary of the Navy should name a combat vessel of the United States Navy the "U.S.S. Father Vincent Capodanno", in honor of Father Vincent Capodanno, a lieutenant in the Navy Chaplain Corps.

   Show 1 more inserted paragraphShow less

   Inserted: Amendment No. 70 Offered by Mr. Tonko of New York

   Original wording

   Page 389, after line 7, insert the following:

6. 6

   Change 6: Adds SEC. 244. SENSE OF CONGRESS AFFIRMING THE IMPORTANCE OF DEPARTMENT OF DEFENSE PARTICIPATION IN DEVELOPMENT OF NEXT GENERATION SEMICONDUCTOR TECHNOLOGIES on page 79, line 6

   Adds a sectionPrinted page

   Inserted: SEC. 244. SENSE OF CONGRESS AFFIRMING THE IMPORTANCE OF DEPARTMENT OF DEFENSE PARTICIPATION IN DEVELOPMENT OF NEXT GENERATION SEMICONDUCTOR TECHNOLOGIES.

   Inserted: (a) Findings.--Congress makes the following findings:

   Inserted: (1) The next generation of weapons systems, battlefield sensors, and intelligence platforms will need to be lighter, more agile, consume less power, and have greater computational power, which can only be achieved by decreasing the feature size of integrated circuits to the nanometer scale.

   Inserted: (2) There is a growing concern in the Department of Defense and the United States intelligence community over the offshore shift in development and production of high capacity semiconductors. Reliance on providers of semiconductors in the United States high tech industry will mitigate the security risks of such an offshore shift.

   Inserted: (3) The use of extreme-ultraviolet lithography (EUVL) is recognized in the semiconductor industry as critical to the development of the next generation of integrated circuits.

   Inserted: (b) Sense of Congress.--It is the sense of Congress that--

   Inserted: (1) the United States should establish research and development facilities to take the lead in producing the next generation of integrated circuits;

   Inserted: (2) the Department of Defense should support the establishment of a public-private partnership of defense laboratory scientists and engineers, university researchers, integrated circuit designers and fabricators, tool manufacturers, material and chemical suppliers, and metrology and inspection tool fabricators to develop extreme-ultraviolet lithography (EUVL) technologies on 300 micrometer and 450 micrometer wafers; and

   Inserted: (3) the targeted feature size of integrated circuits for EUVL development in the United States should be the 15 nanometer node.

   Original wording

   Page 79, after line 6, insert the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed