S.Amdt. 2592

1. Strikes title IV

   Strikes

   In S. 3414 · Placed on Calendar Senate

   Struck: TITLE IV--EDUCATION, WORKFORCE, AND AWARENESS

   Struck: SEC. 401. DEFINITIONS.

   Struck: In this title:

   Struck: (1) Cybersecurity mission.--The term "cybersecurity mission" means activities that encompass the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as such activities relate to the security and stability of cyberspace.

   Show 250 more struck paragraphsShow less

   Struck: (2) Cybersecurity mission of a federal agency.--The term "cybersecurity mission of a Federal agency" means the portion of a cybersecurity mission that is the responsibility of a Federal agency.

   Struck: SEC. 402. EDUCATION AND AWARENESS.

   Struck: (a) Assessment of Cybersecurity Education in Colleges and Universities.--

   Struck: (1) Report.--Not later than 1 year after the date of enactment of this Act, the Director of the National Science Foundation shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives a report on the state of cybersecurity education in institutions of higher education in the United States.

   Struck: (2) Contents of report.--The report required under paragraph (1) shall include baseline data on--

   Struck: (A) the state of cybersecurity education in the United States;

   Struck: (B) the extent of professional development opportunities for faculty in cybersecurity principles and practices;

   Struck: (C) descriptions of the content of cybersecurity courses in undergraduate computer science curriculum;

   Struck: (D) the extent of the partnerships and collaborative cybersecurity curriculum development activities that leverage industry and government needs, resources, and tools; and

   Struck: (E) proposed metrics to assess progress toward improving cybersecurity education.

   Struck: (b) Enrichment Programs.--The Director of the National Science Foundation shall--

   Struck: (1) encourage and support programming, including summer enrichment programs, to be provided by nonprofit organizations, in math, computer programming, science, technology, and engineering, with a goal of increasing cybersecurity skills in students enrolled in kindergarten through grade 12; and

   Struck: (2) when appropriate, provide opportunities for top- achieving students to participate in the programs described in paragraph (1) at no cost.

   Struck: (c) National Education and Awareness Campaign.--The Secretary, in consultation with appropriate Federal agencies shall develop and implement outreach and awareness programs on cybersecurity, including--

   Struck: (1) in consultation with the Director of the National Institute of Standards and Technology--

   Struck: (A) a public education campaign to increase the awareness of cybersecurity, cyber safety, and cyber ethics, which shall include the use of the Internet, social media, entertainment, and other media to reach the public; and

   Struck: (B) an education campaign to increase the understanding of State and local governments and private sector entities of the benefits of ensuring effective risk management of the information infrastructure versus the costs of failure to do so and methods to mitigate and remediate vulnerabilities;

   Struck: (2) in coordination with the Secretary of Commerce, development of a program to publicly recognize or identify products, services, and companies, including owners and operators, that meet the highest standards of cybersecurity; and

   Struck: (3) in accordance with subsection (d), a program for carrying out collaborative education and training activities for cybersecurity through a consortium or other appropriate entity.

   Struck: (d) Collaborative Education and Training.--

   Struck: (1) In general.--The consortium or other entity established under subsection (c)(3) shall--

   Struck: (A) provide training to State and local first responders and officials specifically for preparing and responding to cyber attacks;

   Struck: (B) develop and update a curriculum and training models for State and local first responders and officials;

   Struck: (C) provide technical assistance services to build and sustain capabilities in support of cybersecurity preparedness and response; and

   Struck: (D) conduct cybersecurity training and simulation exercises to defend from and respond to cyber attacks.

   Struck: (2) Members.--The Consortium or other entity established under subsection (c)(3) shall consist of academic, nonprofit, Federal Government, and State and local government partners that develop, update, and deliver cybersecurity training in support of homeland security.

   Struck: (e) Considerations.--In carrying out the authority described in subsection (c), the Secretary of Commerce, the Secretary, and the Director of the National Institute of Standards and Technology shall leverage existing programs designed to inform the public of safety and security of products or services, including self-certifications and independently-verified assessments regarding the quantification and valuation of information security risk.

   Struck: SEC. 403. NATIONAL CYBERSECURITY COMPETITION AND CHALLENGE.

   Struck: (a) Talent Competition and Challenge.--

   Struck: (1) In general.--The Secretary and the Secretary of Commerce shall establish a program to conduct competitions and challenges and ensure the effective operation of national and statewide competitions and challenges that seek to identify, develop, and recruit talented individuals to work in Federal agencies, State and local government agencies, and the private sector to perform duties relating to the security of the Federal information infrastructure or the national information infrastructure.

   Struck: (2) Participation.--Participants in the competitions and challenges of the program established under paragraph (1) shall include--

   Struck: (A) students enrolled in grades 9 through 12;

   Struck: (B) students enrolled in a postsecondary program of study leading to a baccalaureate degree at an institution of higher education;

   Struck: (C) students enrolled in a postbaccalaureate program of study at an institution of higher education;

   Struck: (D) institutions of higher education and research institutions;

   Struck: (E) veterans; and

   Struck: (F) other groups or individuals as the Secretary and the Secretary of Commerce determine appropriate.

   Struck: (3) Support of other competitions and challenges.--The program established under paragraph (1) may support other competitions and challenges not established under this subsection through affiliation and cooperative agreements with--

   Struck: (A) Federal agencies;

   Struck: (B) regional, State, or school programs supporting the development of cyber professionals;

   Struck: (C) State, local, and tribal governments; or

   Struck: (D) other private sector organizations.

   Struck: (4) Areas of talent.--The program established under paragraph (1) shall seek to identify, develop, and recruit exceptional talent relating to--

   Struck: (A) ethical hacking;

   Struck: (B) penetration testing;

   Struck: (C) vulnerability assessment;

   Struck: (D) continuity of system operations;

   Struck: (E) cyber forensics;

   Struck: (F) offensive and defensive cyber operations; and

   Struck: (G) other areas to fulfill the cybersecurity mission as the Secretary determines appropriate.

   Struck: (5) Internships.--The Director of the Office of Personnel Management shall establish, in coordination with the Director of the National Center for Cybersecurity and Communications, a program to provide, where appropriate, internships or other work experience in the Federal government to the winners of the competitions and challenges.

   Struck: (b) National Research and Development Competition and Challenge.--

   Struck: (1) In general.--The Director of the National Science Foundation, in consultation with appropriate Federal agencies, shall establish a program of cybersecurity competitions and challenges to stimulate innovation in basic and applied cybersecurity research, technology development, and prototype demonstration that has the potential for application to the information technology activities of the Federal Government.

   Struck: (2) Participation.--Participants in the competitions and challenges of the program established under paragraph (1) shall include--

   Struck: (A) students enrolled in grades 9 through 12;

   Struck: (B) students enrolled in a postsecondary program of study leading to a baccalaureate degree at an institution of higher education;

   Struck: (C) students enrolled in a postbaccalaureate program of study at an institution of higher education;

   Struck: (D) institutions of higher education and research institutions;

   Struck: (E) veterans; and

   Struck: (F) other groups or individuals as the Director of the National Science Foundation determines appropriate.

   Struck: (3) Topics.--In selecting topics for competitions and challenges held as part of the program established under paragraph (1), the Director--

   Struck: (A) shall consult widely both within and outside the Federal Government; and

   Struck: (B) may empanel advisory committees.

   Struck: (4) Internships.--The Director of the Office of Personnel Management shall establish, in coordination with the Director of the National Science Foundation, a program to provide, where appropriate, internships or other work experience in the Federal government to the winners of the competitions and challenges held as part of the program established under paragraph (1).

   Struck: SEC. 404. FEDERAL CYBER SCHOLARSHIP-FOR-SERVICE PROGRAM.

   Struck: (a) In General.--The Director of the National Science Foundation, in coordination with the Secretary, shall establish a Federal Cyber Scholarship-for-Service program to recruit and train the next generation of information technology professionals, industrial control system security professionals, and security managers to meet the needs of the cybersecurity mission for the Federal Government and State, local, and tribal governments.

   Struck: (b) Program Description and Components.--The program established under subsection (a) shall--

   Struck: (1) incorporate findings from the assessment and development of the strategy under section 405;

   Struck: (2) provide not more than 1,000 scholarships per year, to students who are enrolled in a program of study at an institution of higher education leading to a degree or specialized program certification in the cybersecurity field, in an amount that covers each student's tuition and fees at the institution and provides the student with an additional stipend;

   Struck: (3) require each scholarship recipient, as a condition of receiving a scholarship under the program, to enter into an agreement under which the recipient agrees to work in the cybersecurity mission of a Federal, State, local, or tribal agency for a period equal to the length of the scholarship following receipt of the student's degree if offered employment in that field by a Federal, State, local, or tribal agency;

   Struck: (4) provide a procedure by which the National Science Foundation or a Federal agency may, consistent with regulations of the Office of Personnel Management, request and fund security clearances for scholarship recipients, including providing for clearances during summer internships and after the recipient receives the degree; and

   Struck: (5) provide opportunities for students to receive temporary appointments for meaningful employment in the cybersecurity mission of a Federal agency during school vacation periods and for internships.

   Struck: (c) Hiring Authority.--

   Struck: (1) In general.--For purposes of any law or regulation governing the appointment of individuals in the Federal civil service, upon receiving a degree for which an individual received a scholarship under this section, the individual shall be--

   Struck: (A) hired under the authority provided for in section 213.3102(r) of title 5, Code of Federal Regulations; and

   Struck: (B) exempt from competitive service.

   Struck: (2) Competitive service position.--Upon satisfactory fulfillment of the service term of an individual hired under paragraph (1), the individual may be converted to a competitive service position without competition if the individual meets the requirements for that position.

   Struck: (d) Eligibility.--To be eligible to receive a scholarship under this section, an individual shall--

   Struck: (1) be a citizen or lawful permanent resident of the United States;

   Struck: (2) demonstrate a commitment to a career in improving the security of information infrastructure; and

   Struck: (3) have demonstrated a high level of proficiency in mathematics, engineering, or computer sciences.

   Struck: (e) Repayment.--If a recipient of a scholarship under this section does not meet the terms of the scholarship program, the recipient shall refund the scholarship payments in accordance with rules established by the Director of the National Science Foundation, in coordination with the Secretary.

   Struck: (f) Evaluation and Report.--The Director of the National Science Foundation shall evaluate and report periodically to Congress on the success of recruiting individuals for the scholarships and on hiring and retaining those individuals in the public sector workforce.

   Struck: SEC. 405. ASSESSMENT OF CYBERSECURITY FEDERAL WORKFORCE.

   Struck: (a) In General.--The Director of the Office of Personnel Management and the Secretary, in coordination with the Director of National Intelligence, the Secretary of Defense, and the Chief Information Officers Council established under section 3603 of title 44, United States Code, shall assess the readiness and capacity of the Federal workforce to meet the needs of the cybersecurity mission of the Federal Government.

   Struck: (b) Strategy.--

   Struck: (1) In general.--Not later than 180 days after the date of enactment of this Act, the Director of the Office of Personnel Management, in consultation with the Director of the National Center for Cybersecurity and Communications and the Director of the Office of Management and Budget, shall develop a comprehensive workforce strategy that enhances the readiness, capacity, training, and recruitment and retention of cybersecurity personnel of the Federal Government.

   Struck: (2) Contents.--The strategy developed under paragraph (1) shall include--

   Struck: (A) a 5-year plan on recruitment of personnel for the Federal workforce; and

   Struck: (B) a 10-year projections of Federal workforce needs.

   Struck: (c) Updates.--The Director of the Office of Personnel Management, in consultation with the Director of the National Center for Cybersecurity and Communications and the Director of the Office of Management and Budget, shall update the strategy developed under subsection (b) as needed.

   Struck: SEC. 406. FEDERAL CYBERSECURITY OCCUPATION CLASSIFICATIONS.

   Struck: (a) In General.--Not later than 1 year after the date of enactment of this Act, the Director of the Office of Personnel Management, in coordination with the Director of the National Center for Cybersecurity and Communications, shall develop and issue comprehensive occupation classifications for Federal employees engaged in cybersecurity missions.

   Struck: (b) Applicability of Classifications.--The Director of the Office of Personnel Management shall ensure that the comprehensive occupation classifications issued under subsection (a) may be used throughout the Federal Government.

   Struck: SEC. 407. TRAINING AND EDUCATION OF FEDERAL EMPLOYEES.

   Struck: (a) Definition.--In this section, the term "agency information infrastructure" means the Federal information infrastructure of a Federal agency.

   Struck: (b) Training.--

   Struck: (1) Federal government employees and federal contractors.-- The Director of the Office of Personnel Management, in coordination with the Secretary, the Director of National Intelligence, the Secretary of Defense, and the Chief Information Officers Council established under section 3603 of title 44, United States Code, shall establish a cybersecurity awareness and education curriculum that shall be required for all Federal employees and contractors engaged in the design, development, or operation of an agency information infrastructure or the Federal information infrastructure.

   Struck: (2) Contents.--The curriculum established under paragraph (1) shall include, at a minimum--

   Struck: (A) role-based security awareness training;

   Struck: (B) recommended cybersecurity practices;

   Struck: (C) cybersecurity recommendations for traveling abroad;

   Struck: (D) unclassified counterintelligence information;

   Struck: (E) information regarding industrial espionage;

   Struck: (F) information regarding malicious activity online;

   Struck: (G) information regarding cybersecurity and law enforcement;

   Struck: (H) identity management information;

   Struck: (I) information regarding supply chain security;

   Struck: (J) information security risks associated with the activities of Federal employees and contractors; and

   Struck: (K) the responsibilities of Federal employees and contractors in complying with policies and procedures designed to reduce information security risks identified under subparagraph (J).

   Struck: (3) Federal cybersecurity professionals.--The Director of the Office of Personnel Management in conjunction with the Secretary, the Director of National Intelligence, the Secretary of Defense, the Director of the Office of Management and Budget, and, as appropriate, colleges, universities, and nonprofit organizations with cybersecurity training expertise, shall develop a program to provide training to improve and enhance the skills and capabilities of Federal employees engaged in the cybersecurity mission, including training specific to the acquisition workforce.

   Struck: (4) Heads of federal agencies.--Not later than 30 days after the date on which an individual is appointed to a position at level I or II of the Executive Schedule, the Secretary and the Director of National Intelligence shall provide that individual with a cybersecurity threat briefing.

   Struck: (5) Certification.--The head of each Federal agency shall include in the annual report required under section 3554(c) of title 44, United States Code, as amended by this Act, a certification regarding whether all employees and contractors of the Federal agency have completed the training required under this subsection.

   Struck: (c) Recruitment.--The Director of the Office of Personnel Management, in coordination with the Director of the National Center for Cybersecurity and Communications, shall develop strategies and programs to recruit students enrolled in institutions of higher education and students enrolled in career and technical institutions in the United States to serve as Federal employees engaged in cybersecurity missions.

   Struck: (d) Leadership in Cybersecurity.--The head of each Federal agency shall adopt best practices, developed by the Office of Personnel Management, regarding effective ways to educate and motivate employees of the Federal Government to demonstrate leadership in cybersecurity, including--

   Struck: (1) promotions and other nonmonetary awards; and

   Struck: (2) publicizing information sharing accomplishments by individual employees and, if appropriate, the tangible benefits that resulted.

   Struck: SEC. 408. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS ACQUISITION AUTHORITIES.

   Struck: (a) In General.--Subtitle E of title II of the Homeland Security Act of 2002, as added by section 204, is amended by adding at the end the following:

   Struck: "SEC. 245. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS ACQUISITION AUTHORITIES.

   Struck: "(a) In General.--The National Center for Cybersecurity and Communications is authorized to use the authorities under subsections (c)(1) and (d)(1)(B) of section 2304 of title 10, United States Code, instead of the authorities under subsections (a)(1) and (b)(2) of section 3304 of title 41, United States Code, subject to all other requirements of sections 3301 and 3304 of title 41, United States Code.

   Struck: "(b) Guidelines.--Not later than 90 days after the date of enactment of the Cybersecurity Act of 2012, the chief procurement officer of the Department shall issue guidelines for use of the authority under subsection (a).

   Struck: "(c) Termination.--The National Center for Cybersecurity and Communications may not use the authority under subsection (a) on and after the date that is 3 years after the date of enactment of this Act.

   Struck: "(d) Reporting.--

   Struck: "(1) In general.--On a semiannual basis, the Director of the Center shall submit a report on use of the authority granted by subsection (a) to--

   Struck: "(A) the Committee on Homeland Security and Governmental Affairs of the Senate; and

   Struck: "(B) the Committee on Homeland Security of the House of Representatives.

   Struck: "(2) Contents.--Each report submitted under paragraph (1) shall include, at a minimum--

   Struck: "(A) the number of contract actions taken under the authority under subsection (a) during the period covered by the report; and

   Struck: "(B) for each contract action described in subparagraph (A)--

   Struck: "(i) the total dollar value of the contract action;

   Struck: "(ii) a summary of the market research conducted by the National Center for Cybersecurity and Communications, including a list of all offerors who were considered and those who actually submitted bids, in order to determine that use of the authority was appropriate; and

   Struck: "(iii) a copy of the justification and approval documents required by section 3304(e) of title 41, United States Code.

   Struck: "(3) Classified annex.--A report submitted under this subsection shall be submitted in an unclassified form, but may include a classified annex, if necessary.

   Struck: "SEC. 246. RECRUITMENT AND RETENTION PROGRAM FOR THE NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS.

   Struck: "(a) Definitions.--In this section:

   Struck: "(1) Collective bargaining agreement.--The term 'collective bargaining agreement' has the meaning given that term in section 7103(a)(8) of title 5, United States Code.

   Struck: "(2) Qualified employee.--The term 'qualified employee' means an employee who performs functions relating to the security of Federal systems and critical information infrastructure.

   Struck: "(b) General Authority.--

   Struck: "(1) Establish positions, appoint personnel, and fix rates of pay.--The Secretary may exercise with respect to qualified employees of the Department the same authority of that the Secretary of Defense has with respect to civilian intelligence personnel under sections 1601, 1602, and 1603 of title 10, United States Code, to establish as positions in the excepted service, to appoint individuals to those positions, and fix pay. Such authority shall be exercised subject to the same conditions and limitations applicable to the Secretary of Defense with respect to civilian intelligence personnel of the Department of Defense.

   Struck: "(2) Scholarship program.--The Secretary may exercise with respect to qualified employees of the Department the same authority of the Secretary of Defense has with respect to civilian personnel under section 2200a of title 10, United States Code, to the same extent, and subject to the same conditions and limitations, that the Secretary of Defense may exercise such authority with respect to civilian personnel of the Department of Defense.

   Struck: "(3) Plan for execution of authorities.--Not later than 120 days after the date of enactment of this subtitle, the Secretary shall submit a report to the appropriate committees of Congress with a plan for the use of the authorities provided under this subsection.

   Struck: "(4) Collective bargaining agreements.--Nothing in paragraph (1) may be construed to impair the continued effectiveness of a collective bargaining agreement with respect to an office, component, subcomponent, or equivalent of the Department that is a successor to an office, component, subcomponent, or equivalent of the Department covered by the agreement before the succession.

   Struck: "(5) Required regulations.--The Secretary, in coordination with the Director of the Center and the Director of the Office of Personnel Management, shall prescribe regulations for the administration of this section.

   Struck: "(c) Merit System Principles and Civil Service Protections: Applicability.--

   Struck: "(1) Applicability of merit system principles.--The Secretary shall exercise the authority under subsection (b) in a manner consistent with the merit system principles set forth in section 2301 of title 5, United States Code.

   Struck: "(2) Civil service protections.--Section 1221, section 2302, and chapter 75 of title 5, United States Code, shall apply to the positions established under subsection (b)(1).

   Struck: "(d) Requirements.--Before the initial exercise of any authority authorized under subsection (b)(1) the Secretary shall--

   Struck: "(1) seek input from affected employees, and the union representatives of affected employees as applicable, and Federal manager and professional associations into the design and implementation of a fair, credible, and transparent system for exercising any authority under subsection (b)(1);

   Struck: "(2) make a good faith attempt to resolve any employee concerns regarding proposed changes in conditions of employment through discussions with the groups described in paragraph (1);

   Struck: "(3) develop a program to provide training to supervisors of cybersecurity employees at the Department on the use of the new authorities, including actions, options, and strategies a supervisor may use in--

   Struck: "(A) developing and discussing relevant goals and objectives with the employee, communicating and discussing progress relative to performance goals and objectives, and conducting performance appraisals;

   Struck: "(B) mentoring and motivating employees, and improving employee performance and productivity;

   Struck: "(C) fostering a work environment characterized by fairness, respect, equal opportunity, and attention to the quality of work of the employees;

   Struck: "(D) effectively managing employees with unacceptable performance;

   Struck: "(E) addressing reports of a hostile work environment, reprisal, or harassment of or by another supervisor or employee; and

   Struck: "(F) otherwise carrying out the duties and responsibilities of a supervisor;

   Struck: "(4) develop a program to provide training to supervisors of cybersecurity employees at the Department on the prohibited personnel practices under section 2302 of title 5, United States Code, (particularly with respect to the practices described in paragraphs (1) and (8) of section 2302(b) of title 5, United States Code), employee collective bargaining and union participation rights, and the procedures and processes used to enforce employee rights; and

   Struck: "(5) develop a program under which experienced supervisors mentor new supervisors by--

   Struck: "(A) sharing knowledge and advice in areas such as communication, critical thinking, responsibility, flexibility, motivating employees, teamwork, leadership, and professional development; and

   Struck: "(B) pointing out strengths and areas for development.

   Struck: "(e) Supervisor Requirement.--

   Struck: "(1) In general.--Except as provided in paragraph (2), not later than 1 year after the date of enactment of the Cybersecurity Act of 2012 and every 3 years thereafter, every supervisor of cybersecurity employees at the Department shall complete the programs established under paragraphs (3) and (4) of subsection (d).

   Struck: "(2) Exception.--A supervisor of cybersecurity employees at the Department who is appointed after the date of enactment of the Cybersecurity Act of 2012 shall complete the programs established under paragraphs (3) and (4) of subsection (d) not later than 1 year after the date on which the supervisor is appointed to the position, and every 3 years thereafter.

   Struck: "(3) Ongoing participation.--Participation by supervisors of cybersecurity employees at the Department in the program established under subsection (d)(5) shall be ongoing.

   Struck: "(f) Conversion to Competitive Service.--In consultation with the Director of the Center, the Secretary may grant competitive civil service status to a qualified employee appointed to the excepted service under subsection (b) if that employee is employed in the Center or is transferring to the Center.

   Struck: "(g) Annual Report.--Not later than 1 year after the date of enactment of this subtitle, and every year thereafter for 4 years, the Secretary shall submit to the appropriate committees of Congress a detailed report that--

   Struck: "(1) discusses the process used by the Secretary in accepting applications, assessing candidates, ensuring adherence to veterans' preference, and selecting applicants for vacancies to be filled by a qualified employee;

   Struck: "(2) describes--

   Struck: "(A) how the Secretary plans to fulfill the critical need of the Department to recruit and retain qualified employees;

   Struck: "(B) the measures that will be used to measure progress; and

   Struck: "(C) any actions taken during the reporting period to fulfill such critical need;

   Struck: "(3) discusses how the planning and actions taken under paragraph (2) are integrated into the strategic workforce planning of the Department;

   Struck: "(4) provides metrics on actions occurring during the reporting period, including--

   Struck: "(A) the number of qualified employees hired by occupation and grade and level or pay band;

   Struck: "(B) the total number of veterans hired;

   Struck: "(C) the number of separations of qualified employees by occupation and grade and level or pay band;

   Struck: "(D) the number of retirements of qualified employees by occupation and grade and level or pay band; and

   Struck: "(E) the number and amounts of recruitment, relocation, and retention incentives paid to qualified employees by occupation and grade and level or pay band.".

   Struck: (b) Technical and Conforming Amendment.--The table of contents in section 1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.), as amended by section 204, is amended by inserting after the item relating to section 244 the following:

   Struck: "Sec. 245. National Center for Cybersecurity and Communications acquisition authorities.

   Struck: "Sec. 246. Recruitment and retention program for the national center for cybersecurity and communications.".

   Struck: SEC. 409. REPORTS ON CYBER INCIDENTS AGAINST GOVERNMENT NETWORKS.

   Struck: (a) Department of Homeland Security.--Not later than 180 days after the date of enactment of this Act, and annually thereafter, the Secretary shall submit to Congress a report that--

   Struck: (1) summarizes major cyber incidents involving networks of Executive agencies (as defined in section 105 of title 5, United States Code), except for the Department of Defense;

   Struck: (2) provides aggregate statistics on the number of breaches of networks of Executive agencies, the volume of data exfiltrated, and the estimated cost of remedying the breaches; and

   Struck: (3) discusses the risk of cyber sabotage.

   Struck: (b) Department of Defense.--Not later than 180 days after the date of enactment of this Act, and annually thereafter, the Secretary of Defense shall submit to Congress a report that--

   Struck: (1) summarizes major cyber incidents against networks of the Department of Defense and the military departments;

   Struck: (2) provides aggregate statistics on the number of breaches against networks of the Department of Defense and the military departments, the volume of data exfiltrated, and the estimated cost of remedying the breaches; and

   Struck: (3) discusses the risk of cyber sabotage.

   Struck: (c) Form of Reports.--Each report submitted under this section shall be in unclassified form, but may include a classified annex as necessary to protect sources, methods, and national security.

   Struck: (d) Contents of Reports.--Each report submitted under this section may be based in whole or in part on the reporting requirements under section 3553 of chapter 35 of title 44, United States Code, as amended by this Act.

   Struck: SEC. 410. REPORTS ON PROSECUTION FOR CYBERCRIME.

   Struck: (a) In General.--Not later than 180 days after the date of enactment of this Act, the Attorney General and the Directors of the Federal Bureau of Investigation and the United States Secret Service shall submit to Congress reports--

   Struck: (1) describing investigations and prosecutions relating to cyber intrusions or other cybercrimes the preceding year, including--

   Struck: (A) the number of investigations initiated relating to such crimes;

   Struck: (B) the number of arrests relating to such crimes;

   Struck: (C) the number and description of instances in which investigations or prosecutions relating to such crimes have been delayed or prevented because of an inability to extradite a criminal defendant in a timely manner; and

   Struck: (D) the number of prosecutions for such crimes, including--

   Struck: (i) the number of defendants prosecuted;

   Struck: (ii) whether the prosecutions resulted in a conviction;

   Struck: (iii) the sentence imposed and the statutory maximum for each such crime for which a defendant was convicted; and

   Struck: (iv) the average sentence imposed for a conviction of such crimes;

   Struck: (2) identifying the number of employees, financial resources, and other resources (such as technology and training) devoted to the enforcement, investigation, and prosecution of cyber intrusions or other cybercrimes, including the number of investigators, prosecutors, and forensic specialists dedicated to investigating and prosecuting cyber intrusions or other cybercrimes; and

   Struck: (3) discussing any impediments under the laws of the United States or international law to prosecutions for cyber intrusions or other cybercrimes.

   Struck: (b) Updates.--The Attorney General and the Directors of the Federal Bureau of Investigation and the United States Secret Service shall annually submit to Congress reports updating the reports submitted under subsection (a) at the same time the Attorney General and the Directors submit annual reports under section 404 of the Prioritizing Resources and Organization for Intellectual Property Act of 2008 (42 U.S.C. 3713d).

   Struck: SEC. 411. REPORT ON RESEARCH RELATING TO SECURE DOMAIN.

   Struck: (a) In General.--The Secretary shall enter into a contract with the National Research Council, or another federally funded research and development corporation, under which the Council or corporation shall submit to Congress reports on available technical options, consistent with constitutional and statutory privacy rights, for enhancing the security of the information networks of entities that own or manage critical infrastructure through--

   Struck: (1) technical improvements, including developing a secure domain; or

   Struck: (2) increased notice of and consent to the use of technologies to scan for, detect, and defeat cyber security threats, such as technologies used in a secure domain.

   Struck: (b) Timing.--The contract entered into under subsection (a) shall require that the report described in subsection (a) be submitted--

   Struck: (1) not later than 180 days after the date of enactment of this Act;

   Struck: (2) annually, after the first report submitted under subsection (a), for 3 years; and

   Struck: (3) more frequently, as determined appropriate by the Secretary in response to new risks or technologies that emerge.

   Struck: SEC. 412. REPORT ON PREPAREDNESS OF FEDERAL COURTS TO PROMOTE CYBERSECURITY.

   Struck: Not later than 180 days after the date of enactment of this Act, the Attorney General, in coordination with the Administrative Office of the United States Courts, shall submit to Congress a report--

   Struck: (1) on whether Federal courts have granted timely relief in matters relating to botnets and other cybercrime and cyber security threats; and

   Struck: (2) that includes, as appropriate, recommendations on changes or improvements to--

   Struck: (A) the Federal Rules of Civil Procedure or the Federal Rules of Criminal Procedure;

   Struck: (B) the training and other resources available to support the Federal judiciary;

   Struck: (C) the capabilities and specialization of courts to which such cases may be assigned; and

   Struck: (D) Federal civil and criminal laws.

   Struck: SEC. 413. REPORT ON IMPEDIMENTS TO PUBLIC AWARENESS.

   Struck: Not later than 180 days after the date of enactment of this Act, and annually thereafter for 3 years (or more frequently if determined appropriate by the Secretary) the Secretary shall submit to Congress a report on--

   Struck: (1) legal or other impediments to appropriate public awareness of--

   Struck: (A) the nature of, methods of propagation of, and damage caused by common cyber security threats such as computer viruses, phishing techniques, and malware;

   Struck: (B) the minimal standards of computer security necessary for responsible Internet use; and

   Struck: (C) the availability of commercial off the shelf technology that allows consumers to meet such levels of computer security;

   Struck: (2) a summary of the plans of the Secretary to enhance public awareness of common cyber security threats, including a description of the metrics used by the Department for evaluating the efficacy of public awareness campaigns; and

   Struck: (3) recommendations for congressional actions to address these impediments to appropriate public awareness of common cyber security threats.

   Struck: SEC. 414. REPORT ON PROTECTING THE ELECTRICAL GRID OF THE UNITED STATES.

   Struck: Not later than 180 days after the date of enactment of this Act, the Secretary, in consultation with the Secretary of Defense and the Director of National Intelligence, shall submit to Congress a report on--

   Struck: (1) the threat of a cyber attack disrupting the electrical grid of the United States;

   Struck: (2) the implications for the national security of the United States if the electrical grid is disrupted;

   Struck: (3) the options available to the United States and private sector entities to quickly reconstitute electrical service to provide for the national security of the United States, and, within a reasonable time frame, the reconstitution of all electrical service within the United States; and

   Struck: (4) a plan to prevent disruption of the electric grid of the United States caused by a cyber attack.

   Struck: SEC. 415. MARKETPLACE INFORMATION.

   Struck: (a) Sense of Congress.--It is the sense of Congress that--

   Struck: (1) registrants that file reports with the Securities and Exchange Commission have an obligation to disclose material risks to investors; and

   Struck: (2) as with longstanding rules regarding other material risks, information security risks and related events that are material to investors should be disclosed on a regular basis to provide quality information to the marketplace and enable informed investor decisions.

   Struck: (b) Definition of Information Security Risk.--In this section, the term "information security risk and related events" means the risk to a registrant's business operations, assets, financial condition, strategy, competitive positioning, and reputation, due to the potential for unauthorized access, use, disclosure, disruption, modification, or destruction of registrant information, information of third parties collected by the registrant, or information systems of the registrant.

   Struck: (c) Guidance.--Not later than 1 year after the date of enactment of this Act, the Securities and Exchange Commission (referred to in this section as the "Commission") shall evaluate existing guidance to registrants related to disclosures by registrants of information security risks and related events (including Securities and Exchange Commission Division of Corporation Finance, CF Disclosure Guidance: Topic No. 2, Cybersecurity) to determine whether such guidance, in light of the evaluation, should be--

   Struck: (1) updated by the Division of Corporation Finance; or

   Struck: (2) issued as Commission interpretive guidance.

   Struck: (d) Annual Reports.--For 5 years following the evaluation under subsection (b), the Commission shall submit to Congress, on an annual basis, a report that reviews--

   Struck: (1) the types of information security risks and related events that registrants disclosed in the previous year;

   Struck: (2) whether the staff of the Commission has requested registrants to provide additional information on the disclosures under paragraph (1);

   Struck: (3) any awareness or education activities for registrants or investors, on the subject of information security risks and related events disclosure requirements, sponsored by the Commission or attended by a Commissioner or staff of the Commission; and

   Struck: (4) any public actions commenced by the Commission relating to the enforcement of disclosure requirements pertaining to the information security risks and related events.

   Original wording

   Strike title IV.

Read automatically from the Congressional Record. Check the original before relying on it.

As printed