S.Amdt. 2608

1. Replaces the bill's text with a full substitute

   Replaces the full textEverything after the enacting clause

   In S. 3414 · Placed on Calendar Senate

   SECTION 1. SHORT TITLE; TABLE OF CONTENTS.

   (a) Short Title.--This Act may be cited as the "[inserted: Strengthening and Enhancing ]Cybersecurity [inserted: by Using Research, Education, Information, and Technology ]Act of 2012" or [struck: the ][inserted: "SECURE IT]"[struck: CSA2012"].

   (b) Table of Contents.--The table of contents [struck: for][inserted: of] this Act is as follows:

   Sec. 1. Short title; table of contents.

   Inserted: TITLE I--FACILITATING SHARING OF CYBER THREAT INFORMATION

   Sec. [struck: 2][inserted: 101]. Definitions.

   Struck: TITLE I--PUBLIC-PRIVATE PARTNERSHIP TO PROTECT CRITICAL INFRASTRUCTURE

   Struck: Sec. 101. National Cybersecurity Council.

   Struck: Sec. 102. Inventory of critical infrastructure.

   Struck: Sec. 103. Voluntary cybersecurity practices.

   Show 9 more struck paragraphsShow less

   Struck: Sec. 104. Voluntary cybersecurity program for critical infrastructure.

   Struck: Sec. 105. Rules of construction.

   Struck: Sec. 106. Protection of information.

   Struck: Sec. 107. Annual assessment of cybersecurity.

   Struck: Sec. 108. International cooperation.

   Struck: Sec. 109. Effect on other laws.

   Struck: Sec. 110. Definitions.

   Struck: TITLE II--FEDERAL INFORMATION SECURITY MANAGEMENT AND CONSOLIDATING RESOURCES

   Struck: Sec. 201. FISMA Reform.

   Inserted: Sec. 102. Authorization to share cyber threat information.

   Inserted: Sec. 103. Information sharing by the Federal government.

   Inserted: Sec. 104. Construction.

   Inserted: Sec. 105. Report on implementation.

   Inserted: Sec. 106. Inspector General review.

   Inserted: Sec. 107. Technical amendments.

   Inserted: Sec. 108. Access to classified information.

   Inserted: TITLE II--COORDINATION OF FEDERAL INFORMATION SECURITY POLICY

   Inserted: Sec. 201. Coordination of Federal information security policy.

   Sec. 202. Management of information technology.

   Struck: Sec. 203. Savings provisions.

   Struck: Sec. 204. Consolidation of existing departmental cyber resources and authorities.

   Struck: TITLE III--RESEARCH AND DEVELOPMENT

   Struck: Sec. 301. Federal cybersecurity research and development.

   Show 315 more struck paragraphsShow less

   Struck: Sec. 302. Homeland security cybersecurity research and development.

   Struck: Sec. 303. Research centers for cybersecurity.

   Struck: Sec. 304. Centers of excellence.

   Struck: TITLE IV--EDUCATION, WORKFORCE, AND AWARENESS

   Struck: Sec. 401. Definitions.

   Struck: Sec. 402. Education and awareness.

   Struck: Sec. 403. National cybersecurity competition and challenge.

   Struck: Sec. 404. Federal Cyber Scholarship-for-Service program.

   Struck: Sec. 405. Assessment of cybersecurity Federal workforce.

   Struck: Sec. 406. Federal cybersecurity occupation classifications.

   Struck: Sec. 407. Training and education of Federal employees.

   Struck: Sec. 408. National Center for Cybersecurity and Communications acquisition authorities.

   Struck: Sec. 409. Reports on cyber incidents against Government networks.

   Struck: Sec. 410. Reports on prosecution for cybercrime.

   Struck: Sec. 411. Report on research relating to secure domain.

   Struck: Sec. 412. Report on preparedness of Federal courts to promote cybersecurity.

   Struck: Sec. 413. Report on impediments to public awareness.

   Struck: Sec. 414. Report on protecting the electrical grid of the United States.

   Struck: Sec. 415. Marketplace information.

   Struck: TITLE V--FEDERAL ACQUISITION RISK MANAGEMENT STRATEGY

   Struck: Sec. 501. Federal acquisition risk management strategy.

   Struck: Sec. 502. Amendments to Clinger-Cohen provisions to enhance agency planning for information security needs.

   Struck: TITLE VI--INTERNATIONAL COOPERATION

   Struck: Sec. 601. Definitions.

   Struck: Sec. 602. Findings.

   Struck: Sec. 603. Sense of Congress.

   Struck: Sec. 604. Coordination of international cyber issues within the United States Government.

   Struck: Sec. 605. Consideration of cybercrime in foreign policy and foreign assistance programs.

   Struck: TITLE VII--INFORMATION SHARING

   Struck: Sec. 701. Affirmative authority to monitor and defend against cybersecurity threats.

   Struck: Sec. 702. Voluntary disclosure of cybersecurity threat indicators among private entities.

   Struck: Sec. 703. Cybersecurity exchanges.

   Struck: Sec. 704. Voluntary disclosure of cybersecurity threat indicators to a cybersecurity exchange.

   Struck: Sec. 705. Sharing of classified cybersecurity threat indicators.

   Struck: Sec. 706. Limitation on liability and good faith defense for cybersecurity activities.

   Struck: Sec. 707. Construction and federal preemption.

   Struck: Sec. 708. Definitions.

   Struck: SEC. 2. DEFINITIONS.

   Struck: In this Act:

   Struck: (1) Category of critical cyber infrastructure.--The term "category of critical cyber infrastructure" means a category identified by the Council as critical cyber infrastructure in accordance with the procedure established under section 102.

   Struck: (2) Commercial information technology product.--The term "commercial information technology product" means a commercial item that organizes or communicates information electronically.

   Struck: (3) Commercial item.--The term "commercial item" has the meaning given the term in section 103 of title 41, United States Code.

   Struck: (4) Council.--The term "Council" means the National Cybersecurity Council established under section 101.

   Struck: (5) Critical cyber infrastructure.--The term "critical cyber infrastructure" means critical infrastructure identified by the Council under section 102(b)(3)(A).

   Struck: (6) Critical infrastructure.--The term "critical infrastructure" has the meaning given that term in section 1016(e) of the USA PATRIOT Act (42 U.S.C. 5195c(e)).

   Struck: (7) Critical infrastructure partnership advisory council.-- The term "Critical Infrastructure Partnership Advisory Council" means the Critical Infrastructure Partnership Advisory Council established by the Department under section 871 of the Homeland Security Act of 2002 (6 U.S.C. 451) to coordinate critical infrastructure protection activities within the Federal Government and with the private sector and State, local, territorial, and tribal governments.

   Struck: (8) Department.--The term "Department" means the Department of Homeland Security.

   Struck: (9) Federal agency.--The term "Federal agency" has the meaning given the term "agency" in section 3502 of title 44, United States Code.

   Struck: (10) Federal information infrastructure.--The term "Federal information infrastructure"--

   Struck: (A) means information and information systems that are owned, operated, controlled, or licensed for use by, or on behalf of, any Federal agency, including information systems used or operated by another entity on behalf of a Federal agency; and

   Struck: (B) does not include--

   Struck: (i) a national security system; or

   Struck: (ii) information and information systems that are owned, operated, controlled, or licensed solely for use by, or on behalf of, the Department of Defense, a military department, or an element of the intelligence community.

   Struck: (11) Incident.--The term "incident" has the meaning given that term in section 3552 of title 44, United States Code, as added by section 201 of this Act.

   Struck: (12) Information infrastructure.--The term "information infrastructure" means the underlying framework that information systems and assets rely on to process, transmit, receive, or store information electronically, including programmable electronic devices, communications networks, and industrial or supervisory control systems and any associated hardware, software, or data.

   Struck: (13) Information sharing and analysis organization.--The term "Information Sharing and Analysis Organization" has the meaning given that term in section 212 of the Homeland Security Act of 2002 (6 U.S.C. 131).

   Struck: (14) Information system.--The term "information system" has the meaning given that term in section 3502 of title 44, United States Code.

   Struck: (15) Institution of higher education.--The term "institution of higher education" has the meaning given that term in section 102 of the Higher Education Act of 1965 (20 U.S.C. 1002).

   Struck: (16) Intelligence community.--The term "intelligence community" has the meaning given that term under section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4)).

   Struck: (17) Member agency.--The term "member agency" means a Federal agency from which a member of the Council is appointed.

   Struck: (18) National information infrastructure.--The term "national information infrastructure" means information and information systems--

   Struck: (A) that are owned, operated, or controlled, in whole or in part, within or from the United States; and

   Struck: (B) that are not owned, operated, controlled, or licensed for use by a Federal agency.

   Struck: (19) National laboratory.--The term "national laboratory" has the meaning given the term in section 2 of the Energy Policy Act of 2005 (42 U.S.C. 15801).

   Struck: (20) National security system.--The term "national security system" has the meaning given that term in section 3552 of title 44, United States Code, as added by section 201 of this Act.

   Struck: (21) Owner.--The term "owner"--

   Struck: (A) means an entity that owns critical infrastructure; and

   Struck: (B) does not include a company contracted by the owner to manage, run, or operate that critical infrastructure, or to provide a specific information technology product or service that is used or incorporated into that critical infrastructure.

   Struck: (22) Operator.--The term "operator"--

   Struck: (A) means an entity that manages, runs, or operates, in whole or in part, the day-to-day operations of critical infrastructure; and

   Struck: (B) may include the owner of critical infrastructure.

   Struck: (23) Secretary.--The term "Secretary" means the Secretary of Homeland Security.

   Struck: (24) Significant cyber incident.--The term "significant cyber incident" means an incident resulting in, or an attempted to cause an incident that, if successful, would have resulted in--

   Struck: (A) the exfiltration of data that is essential to the operation of critical cyber infrastructure; or

   Struck: (B) the defeat of an operational control or technical control, as those terms are defined in section 708, essential to the security or operation of critical cyber infrastructure.

   Struck: TITLE I--PUBLIC-PRIVATE PARTNERSHIP TO PROTECT CRITICAL INFRASTRUCTURE

   Struck: SEC. 101. NATIONAL CYBERSECURITY COUNCIL.

   Struck: (a) In General.--There is established a National Cybersecurity Council.

   Struck: (b) Responsibilities.--The Council shall--

   Struck: (1) conduct sector-by-sector risk assessments in partnership with owners and operators, private sector entities, relevant Federal agencies, and appropriate non-governmental entities and institutions of higher education;

   Struck: (2) identify categories of critical cyber infrastructure, in partnership with relevant Federal agencies, owners and operators, other appropriate private sector entities, and appropriate non-governmental entities and institutions of higher education;

   Struck: (3) coordinate the adoption of private-sector recommended voluntary outcome-based cybersecurity practices with owners and operators, private sector entities, relevant Federal agencies, the Critical Infrastructure Partnership Advisory Council, institutions of higher education, and appropriate non- governmental cybersecurity experts, in accordance with this title;

   Struck: (4) establish an incentives-based voluntary cybersecurity program for critical infrastructure to encourage owners to adopt voluntary outcome-based cybersecurity practices under section 103;

   Struck: (5) develop procedures to inform owners and operators of cyber threats, vulnerabilities, and consequences; and

   Struck: (6) upon request and to the maximum extent possible, provide any technical guidance or assistance to owners and operators consistent with this title.

   Struck: (c) Procedures.--The President shall establish procedures, consistent with this section, for the operation of the Council, which shall include procedures that--

   Struck: (1) prescribe the responsibilities of the Council and the member agencies;

   Struck: (2) ensure the timely implementation of decisions of the Council;

   Struck: (3) delegate authority to the Chairperson to take action to fulfill the responsibilities of the Council if--

   Struck: (A) the Council is not fulfilling the responsibilities of the Council in a timely fashion; or

   Struck: (B) necessary to prevent or mitigate an imminent cybersecurity threat.

   Struck: (d) Membership.--The Council shall be comprised of appropriate representatives appointed by the President from--

   Struck: (1) the Department of Commerce;

   Struck: (2) the Department of Defense;

   Struck: (3) the Department of Justice;

   Struck: (4) the intelligence community;

   Struck: (5) sector-specific Federal agencies, as appropriate;

   Struck: (6) Federal agencies with responsibility for regulating the security of critical cyber infrastructure, as appropriate; and

   Struck: (7) the Department.

   Struck: (e) Coordination.--The Council shall coordinate the activities of the Council with--

   Struck: (1) appropriate representatives of the private sector; and

   Struck: (2) owners and operators.

   Struck: (f) Chairperson.--

   Struck: (1) In general.--The Secretary shall serve as Chairperson of the Council (referred to in this section as the "Chairperson").

   Struck: (2) Responsibilities of the chairperson.--The Chairperson shall--

   Struck: (A) ensure the responsibilities of the Council are expeditiously fulfilled;

   Struck: (B) provide expertise and support to the Council; and

   Struck: (C) provide recommendations to the Council.

   Struck: (g) Participation of Sector-specific Federal Agencies and Federal Regulatory Agencies.--A sector-specific Federal agency and a Federal agency with responsibility for regulating the security of critical cyber infrastructure shall participate on the Council on matters directly relating to the sector of critical infrastructure for which the Federal agency has responsibility to ensure that any cybersecurity practice adopted by the Council under section 103--

   Struck: (1) does not contradict any regulation or compulsory standard in effect before the adoption of the cybersecurity practice; and

   Struck: (2) to the extent possible, complements or otherwise improves the regulation or compulsory standard described in paragraph (1).

   Struck: SEC. 102. INVENTORY OF CRITICAL INFRASTRUCTURE.

   Struck: (a) Risk Assessments.--

   Struck: (1) In general.--

   Struck: (A) Designation of member agency.--The Council shall designate a member agency to conduct top-level cybersecurity assessments of cyber risks to critical infrastructure with voluntary participation from private sector entities.

   Struck: (B) Rule of construction.--Nothing in this subsection shall be construed to give new authority to a Federal agency to require owners or operators to provide information to the Federal Government.

   Struck: (2) Responsibility.--The member agency designated under paragraph (1), in consultation with owners and operators, the Critical Infrastructure Partnership Advisory Council, and appropriate Information Sharing and Analysis Organizations, and in coordination with other member agencies, the intelligence community, and the Department of Commerce, shall--

   Struck: (A) not later than 180 days after the date of enactment of this Act, conduct a top-level assessment of the cybersecurity threats, vulnerabilities, and consequences and the probability of a catastrophic incident and associated risk across all critical infrastructure sectors to determine which sectors pose the greatest immediate risk, in order to guide the allocation of resources for the implementation of this Act; and

   Struck: (B) beginning with the highest priority sectors identified under subparagraph (A), conduct, on an ongoing, sector-by-sector basis, cyber risk assessments of the threats to, vulnerabilities of, and consequences of a cyber attack on critical infrastructure.

   Struck: (3) Voluntary input of owners and operators.--The member agency designated under paragraph (1) shall--

   Struck: (A) establish a process under which owners and operators and other relevant private sector experts may provide input into the risk assessments conducted under this section; and

   Struck: (B) seek and incorporate private sector expertise available through established public-private partnerships, including the Critical Infrastructure Partnership Advisory Council and appropriate Information Sharing and Analysis Organizations.

   Struck: (4) Protection of information.--Any information submitted as part of the process established under paragraph (3) shall be protected in accordance with section 106.

   Struck: (5) Submission of risk assessments.--The Council shall submit each risk assessment conducted under this section, in a classified or unclassified form as necessary, to--

   Struck: (A) the President;

   Struck: (B) appropriate Federal agencies; and

   Struck: (C) appropriate congressional committees.

   Struck: (b) Identification of Critical Cyber Infrastructure Categories.--

   Struck: (1) In general.--The Council, in consultation with owners and operators, the Critical Infrastructure Partnership Advisory Council, appropriate Information Sharing and Analysis Organizations, and other appropriate representatives of State and local governments, shall establish procedures to identify categories of critical cyber infrastructure within each sector of critical infrastructure for the purposes of this Act.

   Struck: (2) Duties.--In establishing the procedure under paragraph (1), the Council shall--

   Struck: (A) prioritize efforts based on the prioritization established under subsection (a);

   Struck: (B) incorporate, to the extent practicable, the input of owners and operators, the Critical Infrastructure Partnership Advisory Council, appropriate Information Sharing and Analysis Organizations, and other appropriate representatives of the private sector and State and local governments;

   Struck: (C) develop a voluntary mechanism for owners to submit information to assist the Council in making determinations under this section;

   Struck: (D) inform owners and operators of the criteria used to identify categories of critical cyber infrastructure;

   Struck: (E) establish procedures for an owner of critical infrastructure identified as critical cyber infrastructure to challenge the identification;

   Struck: (F) select a member agency to make recommendations to the Council on the identification of categories of critical cyber infrastructure; and

   Struck: (G) periodically review and update identifications under this subsection.

   Struck: (3) Identification requirements.--The Council shall--

   Struck: (A) identify categories of critical cyber infrastructure within each sector of critical infrastructure and identify owners of critical infrastructure within each category of critical cyber infrastructure;

   Struck: (B) only identify a category of critical infrastructure as critical cyber infrastructure if damage to or unauthorized access to such critical infrastructure could reasonably result in--

   Struck: (i) the interruption of life-sustaining services, including energy, water, transportation, emergency services, or food, sufficient to cause--

   Struck: (I) a mass casualty event; or

   Struck: (II) mass evacuations;

   Struck: (ii) catastrophic economic damage to the United States including--

   Struck: (I) failure or substantial disruption of a financial market of the United States;

   Struck: (II) incapacitation or sustained disruption of a transportation system; or

   Struck: (III) other systemic, long-term damage to the economy of the United States; or

   Struck: (iii) severe degradation of national security or national security capabilities, including intelligence and defense functions; and

   Struck: (C) consider the sector-by-sector risk assessments developed in accordance with subsection (a).

   Struck: (4) Incident reporting.--The Council shall establish procedures under which each owner of critical cyber infrastructure shall report significant cyber incidents affecting critical cyber infrastructure.

   Struck: (5) Limitations.--The Council may not identify as a category of critical cyber infrastructure under this section--

   Struck: (A) critical infrastructure based solely on activities protected by the first amendment to the Constitution of the United States;

   Struck: (B) an information technology product based solely on a finding that the product is capable of, or is actually, being used in critical cyber infrastructure; or

   Struck: (C) a commercial item that organizes or communicates information electronically.

   Struck: (6) Notification of identification of category of critical cyber infrastructure.--Not later than 10 days after the Council identifies a category of critical cyber infrastructure under this section, the Council shall notify the relevant owners of the identified critical cyber infrastructure.

   Struck: (7) Definition.--In this subsection, the term "damage" has the meaning given that term in section 1030(e) of title 18, United States Code.

   Struck: (c) Congressional Notice and Opportunity for Disapproval.--

   Struck: (1) Notification.--Not later than 10 days after the date on which the Council identifies a category of critical infrastructure as critical cyber infrastructure under this section, the Council shall--

   Struck: (A) notify Congress of the identification; and

   Struck: (B) submit to Congress a report explaining the basis for the identification.

   Struck: (2) Opportunity for congressional review.--The identification of a category of critical infrastructure as critical cyber infrastructure shall not take effect for purposes of this title until the date that is 60 days after the date on which the Council notifies Congress under paragraph (1).

   Struck: SEC. 103. VOLUNTARY CYBERSECURITY PRACTICES.

   Struck: (a) Private Sector Development of Cybersecurity Practices.--Not later than 180 days after the date of enactment of this Act, each sector coordinating council shall propose to the Council voluntary outcome-based cybersecurity practices (referred to in this section as "cybersecurity practices") sufficient to effectively remediate or mitigate cyber risks identified through an assessment conducted under section 102(a) comprised of--

   Struck: (1) industry best practices, standards, and guidelines; or

   Struck: (2) practices developed by the sector coordinating council in coordination with owners and operators, voluntary consensus standards development organizations, representatives of State and local governments, the private sector, and appropriate information sharing and analysis organizations.

   Struck: (b) Review of Cybersecurity Practices.--

   Struck: (1) In general.--The Council shall, in consultation with owners and operators, the Critical Infrastructure Partnership Advisory Council, and appropriate information sharing and analysis organizations, and in coordination with appropriate representatives from State and local governments--

   Struck: (A) consult with relevant security experts and institutions of higher education, including university information security centers, appropriate nongovernmental cybersecurity experts, and representatives from national laboratories;

   Struck: (B) review relevant regulations or compulsory standards or guidelines;

   Struck: (C) review cybersecurity practices proposed under subsection (a); and

   Struck: (D) consider any amendments to the cybersecurity practices and any additional cybersecurity practices necessary to ensure adequate remediation or mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Struck: (2) Adoption.--

   Struck: (A) In general.--Not later than 1 year after the date of enactment of this Act, the Council shall--

   Struck: (i) adopt any cybersecurity practices proposed under subsection (a) that adequately remediate or mitigate identified cyber risks and any associated consequences identified through an assessment conducted under section 102(a); and

   Struck: (ii) adopt any amended or additional cybersecurity practices necessary to ensure the adequate remediation or mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Struck: (B) No submission by sector coordinating council.-- If a sector coordinating council fails to propose to the Council cybersecurity practices under subsection (a) within 180 days of the date of enactment of this Act, not later than 1 year after the date of enactment of this Act the Council shall adopt cybersecurity practices that adequately remediate or mitigate identified cyber risks and associated consequences identified through an assessment conducted under section 102(a) for the sector.

   Struck: (c) Flexibility of Cybersecurity Practices.--Each sector coordinating council and the Council shall periodically assess cybersecurity practices, but not less frequently than once every 3 years, and update or modify cybersecurity practices as necessary to ensure adequate remediation and mitigation of the cyber risks identified through an assessment conducted under section 102(a).

   Struck: (d) Prioritization.--Based on the risk assessments performed under section 102(a), the Council shall prioritize the development of cybersecurity practices to ensure the reduction or mitigation of the greatest cyber risks.

   Struck: (e) Private Sector Recommended Measures.--Each sector coordinating council shall develop voluntary recommended cybersecurity measures that provide owners reasonable and cost-effective methods of meeting any cybersecurity practice.

   Struck: (f) Technology Neutrality.--No cybersecurity practice shall require--

   Struck: (1) the use of a specific commercial information technology product; or

   Struck: (2) that a particular commercial information technology product be designed, developed, or manufactured in a particular manner.

   Struck: (g) Relationship to Existing Regulations.--

   Struck: (1) Inclusion in regulatory regimes.--

   Struck: (A) In general.--A Federal agency with responsibilities for regulating the security of critical infrastructure may adopt the cybersecurity practices as mandatory requirements.

   Struck: (B) Reports.--If, as of the date that is 1 year after the date of enactment of this Act, a Federal agency with responsibilities for regulating the security of critical infrastructure has not adopted the cybersecurity practices as mandatory requirements, the agency shall submit to the appropriate congressional committees a report on the reasons the agency did not do so, including a description of whether the critical cyber infrastructure for which the Federal agency has responsibility is maintaining practices sufficient to effectively remediate or mitigate cyber risks identified through an assessment conducted under section 102(a).

   Struck: (C) Rule of construction.--Nothing in this subsection shall be construed to provide a Federal agency with authority for regulating the security of critical cyber infrastructure in addition or to a greater extent than the authority the Federal agency has under other law.

   Struck: (2) Avoidance of conflict.--No cybersecurity practice shall--

   Struck: (A) prevent an owner (including a certified owner) from complying with any law or regulation; or

   Struck: (B) require an owner (including a certified owner) to implement cybersecurity measures that prevent the owner from complying with any law or regulation.

   Struck: (3) Avoidance of duplication.--Where regulations or compulsory standards regulate the security of critical cyber infrastructure, a cybersecurity practice shall, to the greatest extent possible, complement or otherwise improve the regulations or compulsory standards.

   Struck: (h) Independent Review.--

   Struck: (1) In general.--Each cybersecurity practice shall be publicly reviewed by the relevant sector coordinating council and the Critical Infrastructure Partnership Advisory Council, which may include input from relevant institutions of higher education, including university information security centers, national laboratories, and appropriate non-governmental cybersecurity experts.

   Struck: (2) Consideration by council.--The Council shall consider any review conducted under paragraph (1).

   Struck: (i) Voluntary Technical Assistance.--At the request of an owner or operator of critical infrastructure, the Council shall provide guidance on the application of cybersecurity practices to the critical infrastructure.

   Struck: SEC. 104. VOLUNTARY CYBERSECURITY PROGRAM FOR CRITICAL INFRASTRUCTURE.

   Struck: (a) Voluntary Cybersecurity Program for Critical Infrastructure.--

   Struck: (1) In general.--Not later than 1 year after the date of enactment of this Act, the Council, in consultation with owners and operators and the Critical Infrastructure Partnership Advisory Council, shall establish the Voluntary Cybersecurity Program for Critical Infrastructure in accordance with this section.

   Struck: (2) Eligibility.--

   Struck: (A) In general.--An owner of critical cyber infrastructure may apply for certification under the Voluntary Cybersecurity Program for Critical Infrastructure.

   Struck: (B) Criteria.--The Council shall establish criteria for owners of critical infrastructure that is not critical cyber infrastructure to be eligible to apply for certification in the Voluntary Cybersecurity Program for Critical Infrastructure.

   Struck: (3) Application for certification.--An owner of critical cyber infrastructure or an owner of critical infrastructure that meets the criteria established under paragraph (2)(B) that applies for certification under this subsection shall--

   Struck: (A) select and implement cybersecurity measures of their choosing that satisfy the outcome-based cybersecurity practices established under section 103; and

   Struck: (B)(i) certify in writing and under penalty of perjury to the Council that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103; or

   Struck: (ii) submit to the Council an assessment verifying that the owner has developed and effectively implemented cybersecurity measures sufficient to satisfy the outcome-based cybersecurity practices established under section 103.

   Struck: (4) Certification.--Upon receipt of a self-certification under paragraph (3)(B)(i) or an assessment under paragraph (3)(B)(ii) the Council shall certify an owner.

   Struck: (5) Nonperformance.--If the Council determines that a certified owner is not in compliance with the cybersecurity practices established under section 103, the Council shall--

   Struck: (A) notify the certified owner of such determination; and

   Struck: (B) work with the certified owner to remediate promptly any deficiencies.

   Struck: (6) Revocation.--If a certified owner fails to remediate promptly any deficiencies identified by the Council, the Council shall revoke the certification of the certified owner.

   Struck: (7) Redress.--

   Struck: (A) In general.--If the Council revokes a certification under paragraph (6), the Council shall--

   Struck: (i) notify the owner of such revocation; and

   Struck: (ii) provide the owner with specific cybersecurity measures that, if implemented, would remediate any deficiencies.

   Struck: (B) Recertification.--If the Council determines that an owner has remedied any deficiencies and is in compliance with the cybersecurity practices, the Council may recertify the owner.

   Struck: (b) Assessments.--

   Struck: (1) Third-party assessments.--The Council, in consultation with owners and operators and the Critical Infrastructure Protection Advisory Council, shall enter into agreements with qualified third-party private entities, to conduct assessments that use reliable, repeatable, performance-based evaluations and metrics to assess whether an owner certified under subsection (a)(3)(B)(ii) is in compliance with all applicable cybersecurity practices.

   Struck: (2) Training.--The Council shall ensure that third party assessors described in paragraph (1) undergo regular training and accreditation.

   Struck: (3) Other assessments.--Using the procedures developed under this section, the Council may perform cybersecurity assessments of a certified owner based on actual knowledge or a reasonable suspicion that the certified owner is not in compliance with the cybersecurity practices or any other risk- based factors as identified by the Council.

   Struck: (4) Notification.--The Council shall provide copies of any assessments by the Federal Government to the certified owner.

   Struck: (5) Access to information.--

   Struck: (A) In general.--For the purposes of an assessment conducted under this subsection, a certified owner shall provide the Council, or a third party assessor, any reasonable access necessary to complete an assessment.

   Struck: (B) Protection of information.--Information provided to the Council, the Council's designee, or any assessor during the course of an assessment under this section shall be protected from disclosure in accordance with section 106.

   Struck: (c) Benefits of Certification.--

   Struck: (1) Limitations on civil liability.--

   Struck: (A) In general.--In any civil action for damages directly caused by an incident related to a cyber risk identified through an assessment conducted under section 102(a), a certified owner shall not be liable for any punitive damages intended to punish or deter if the certified owner is in substantial compliance with the appropriate cybersecurity practices at the time of the incident related to that cyber risk.

   Struck: (B) Limitation.--Subaragraph (A) shall only apply to harm directly caused by the incident related to the cyber risk and shall not apply to damages caused by any additional or intervening acts or omissions by the owner.

   Struck: (2) Expedited security clearance process.--The Council, in coordination with the Office of the Director of National Intelligence, shall establish a procedure to expedite the provision of security clearances to appropriate personnel employed by a certified owner.

   Struck: (3) Prioritized technical assistance.--The Council shall ensure that certified owners are eligible to receive prioritized technical assistance.

   Struck: (4) Provision of cyber threat information.--The Council shall develop, in coordination with certified owners, a procedure for ensuring that certified owners are, to the maximum extent practicable and consistent with the protection of sources and methods, informed of relevant real-time cyber threat information.

   Struck: (5) Public recognition.--With the approval of a certified owner, the Council may publicly recognize the certified owner if the Council determines such recognition does not pose a risk to the security of critical cyber infrastructure.

   Struck: (6) Study to examine benefits of procurement preference.--

   Struck: (A) In general.--The Federal Acquisition Regulatory Council, in coordination with the Council and with input from relevant private sector individuals and entities, shall conduct a study examining the potential benefits of establishing a procurement preference for the Federal Government for certified owners.

   Struck: (B) Areas.--The study under subparagraph (A) shall include a review of--

   Struck: (i) potential persons and related property and services that could be eligible for preferential consideration in the procurement process;

   Struck: (ii) development and management of an approved list of categories of property and services that could be eligible for preferential consideration in the procurement process;

   Struck: (iii) appropriate mechanisms to implement preferential consideration in the procurement process, including--

   Struck: (I) establishing a policy encouraging Federal agencies to conduct market research and industry outreach to identify property and services that adhere to relevant cybersecurity practices;

   Struck: (II) authorizing the use of a mark for the Voluntary Cybersecurity Program for Critical Infrastructure to be used for marketing property or services to the Federal Government;

   Struck: (III) establishing a policy of encouraging procurement of certain property and services from an approved list;

   Struck: (IV) authorizing the use of a preference by Federal agencies in the evaluation process; and

   Struck: (V) authorizing a requirement in certain solicitations that the person providing the property or services be a certified owner; and

   Struck: (iv) benefits of and impact on the economy and efficiency of the Federal procurement system, if preferential consideration were given in the procurement process to encourage the procurement of property and services that adhere to relevant baseline performance goals establishing under the Voluntary Cybersecurity Program for Critical Infrastructure.

   Struck: SEC. 105. RULES OF CONSTRUCTION.

   Struck: Nothing in this title shall be construed to--

   Struck: (1) limit the ability of a Federal agency with responsibilities for regulating the security of critical infrastructure from requiring that the cybersecurity practices developed under section 103 be met;

   Struck: (2) provide additional authority for any sector-specific agency or any Federal agency that is not a sector-specific agency with responsibilities for regulating the security of critical infrastructure to establish standards or other cybersecurity measures that are applicable to the security of critical infrastructure not otherwise authorized by law;

   Struck: (3) limit or restrict the authority of the Department, or any other Federal agency, under any other provision of law; or

   Struck: (4) permit any owner (including a certified owner) to fail to comply with any other law or regulation, unless specifically authorized.

   Struck: SEC. 106. PROTECTION OF INFORMATION.

   Struck: (a) Definitions.--In this section--

   Struck: (1) the term "covered information" means any information--

   Struck: (A) submitted as part of the process established under section 102(a)(3);

   Struck: (B) submitted under section 102(b)(2)(C);

   Struck: (C) required to be submitted by owners under section 102(b)(4);

   Struck: (D) provided to the Secretary, the Secretary's designee, or any assessor during the course of an assessment under section 104; or

   Struck: (E) provided to the Secretary or the Inspector General of the Department through the tip line or another secure channel established under subsection (c); and

   Struck: (2) the term "Inspector General" means an Inspector General described in subparagraph (A), (B), or (I) of section 11(b)(1) of the Inspector General Act of 1978 (5 U.S.C. App.), the Inspector General of the United States Postal Service, the Inspector General of the Central Intelligence Agency, and the Inspector General of the Intelligence Community.

   Struck: (b) Critical Infrastructure Information.--

   Struck: (1) In general.--Covered information shall be treated as voluntarily shared critical infrastructure information under section 214 of the Homeland Security Act of 2002 (6 U.S.C. 133), except that the requirement of such section 214 that the information be voluntarily submitted shall not be required for protection of information under this section to apply.

   Struck: (2) Savings clause for existing whistleblower protections.--With respect to covered information, the rights and protections relating to disclosure by individuals of voluntarily shared critical infrastructure information submitted under subtitle B of title II of the Homeland Security Act of 2002 (6 U.S.C. 131 et seq.) shall apply with respect to disclosure of the covered information by individuals.

   Struck: (c) Critical Infrastructure Cyber Security Tip Line.--

   Struck: (1) In general.--The Secretary shall establish and publicize the availability of a Critical Infrastructure Cyber Security Tip Line (and any other secure means the Secretary determines would be desirable to establish), by which individuals may report--

   Struck: (A) concerns involving the security of covered critical infrastructure against cyber risks; and

   Struck: (B) concerns (in addition to any concerns described under subparagraph (A)) with respect to programs and functions authorized or funded under this title involving--

   Struck: (i) a possible violation of any law, rule, regulation or guideline;

   Struck: (ii) mismanagement;

   Struck: (iii) risk to public health, safety, security, or privacy; or

   Struck: (iv) other misfeasance or nonfeasance.

   Struck: (2) Designation of employees.--The Secretary and the Inspector General of the Department shall each designate employees authorized to receive concerns reported under this subsection that include--

   Struck: (A) disclosure of covered information; or

   Struck: (B) any other disclosure of information that is specifically prohibited by law or is specifically required by Executive order to be kept secret in the interest of national defense or the conduct of foreign affairs.

   Struck: (3) Handling of certain concerns.--A concern described in paragraph (1)(B)--

   Struck: (A) shall be received initially to the Inspector General of the Department;

   Struck: (B) shall not be provided initially to the Secretary; and

   Struck: (C) may be provided to the Secretary if determined appropriate by the Inspector General of the Department.

   Struck: (d) Rules of Construction.--Nothing in this section shall be construed to--

   Struck: (1) limit or otherwise affect the right, ability, duty, or obligation of any entity to use or disclose any information of that entity, including in the conduct of any judicial or other proceeding;

   Struck: (2) prevent the classification of information submitted under this section if that information meets the standards for classification under Executive Order 12958, or any successor thereto, or affect measures and controls relating to the protection of classified information as prescribed by Federal statute or under Executive Order 12958, or any successor thereto;

   Struck: (3) limit or otherwise affect the ability of an entity, agency, or authority of a State, a local government, or the Federal Government or any other individual or entity under applicable law to obtain information that is not covered information (including any information lawfully and properly disclosed generally or broadly to the public) and to use such information in any manner permitted by law, including the disclosure of such information under--

   Struck: (A) section 552 or 2302(b)(8) of title 5, United States Code;

   Struck: (B) section 2409 of title 10, United States Code; or

   Struck: (C) any other Federal, State, or local law, ordinance, or regulation that protects against retaliation an individual who discloses information that the individual reasonably believes evidences a violation of any law, rule, or regulation, gross mismanagement, substantial and specific danger to public health, safety, or security, or other misfeasance or nonfeasance;

   Struck: (4) prevent the Secretary from using information required to be submitted under this Act for enforcement of this title, including enforcement proceedings subject to appropriate safeguards;

   Struck: (5) authorize information to be withheld from any committee of Congress, the Comptroller General, or any Inspector General;

   Struck: (6) affect protections afforded to trade secrets under any other provision of law; or

   Struck: (7) create a private right of action for enforcement of any provision of this section.

   Struck: (e) Audit.--

   Struck: (1) In general.--Not later than 1 year after the date of enactment of this Act, the Inspector General of the Department shall conduct an audit of the management of covered information under this title and report the findings to appropriate congressional committees.

   Struck: (2) Contents.--The audit under paragraph (1) shall include assessments of--

   Struck: (A) whether the covered information is adequately safeguarded against inappropriate disclosure;

   Struck: (B) the processes for marking and disseminating the covered information and resolving any disputes;

   Struck: (C) how the covered information is used for the purposes of this title, and whether that use is effective;

   Struck: (D) whether sharing of covered information has been effective to fulfill the purposes of this title;

   Struck: (E) whether the kinds of covered information submitted have been appropriate and useful, or overbroad or overnarrow;

   Struck: (F) whether the protections of covered information allow for adequate accountability and transparency of the regulatory, enforcement, and other aspects of implementing this title; and

   Struck: (G) any other factors at the discretion of the Inspector General of the Department.

   Struck: SEC. 107. ANNUAL ASSESSMENT OF CYBERSECURITY.

   Struck: (a) In General.--Not later than 1 year after the date of enactment of this Act, and every year thereafter, the Council shall submit to the appropriate congressional committees a report on the effectiveness of this title in reducing the risk of cyber attack to critical infrastructure.

   Struck: (b) Contents.--Each report submitted under subsection (a) shall include--

   Struck: (1) a discussion of cyber risks and associated consequences and whether the cybersecurity practices developed under section 103 are sufficient to effectively remediate and mitigate cyber risks and associated consequences; and

   Struck: (2) an analysis of--

   Struck: (A) whether owners of critical cyber infrastructure are successfully implementing the cybersecurity practices adopted under section 103;

   Struck: (B) whether the critical infrastructure of the United States is effectively secured from cybersecurity threats, vulnerabilities, and consequences;

   Struck: (C) whether Federal agencies with responsibilities for regulating the security of critical infrastructure are adequately adopting and enforcing the cybersecurity practices adopted under section 103; and

   Struck: (D) whether additional legislative authority or other actions are needed to effectively remediate or mitigate cyber risks and associated consequences.

   Struck: (c) Form of Report.--A report submitted under this subsection shall be submitted in an unclassified form, but may include a classified annex, if necessary.

   Struck: SEC. 108. INTERNATIONAL COOPERATION.

   Struck: (a) In General.--The Secretary, in coordination with the Secretary of State, the heads of appropriate sector-specific agencies, and the heads of any appropriate Federal agency with responsibilities for regulating the security of covered critical infrastructure, shall--

   Struck: (1) consistent with the protection of intelligence sources and methods and other sensitive matters, inform the owner or operator of information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage within the United States and the government of the country in which the information infrastructure is located of any cyber risks to such information infrastructure; and

   Struck: (2) coordinate with the government of the country in which such information infrastructure is located and, as appropriate, the owner or operator of the information infrastructure regarding the implementation of cybersecurity measures or other measures to the information infrastructure to mitigate or remediate cyber risks.

   Struck: (b) International Agreements.--The Secretary, in coordination with the Secretary of State, including in particular with the interpretation of international agreements, shall perform the functions prescribed by this section consistent with applicable international agreements.

   Struck: SEC. 109. EFFECT ON OTHER LAWS.

   Struck: Except as expressly provided in section 104(c)(1) and section 106, nothing in this Act shall be construed to preempt the applicability of any State law or requirement.

   Struck: SEC. 110. DEFINITIONS.

   Inserted: Sec. 203. No new funding.

   Inserted: Sec. 204. Technical and conforming amendments.

   Inserted: Sec. 205. Clarification of authorities.

   Inserted: TITLE III--CRIMINAL PENALTIES

   Inserted: Sec. 301. Penalties for fraud and related activity in connection with computers.

   Inserted: Sec. 302. Trafficking in passwords.

   Inserted: Sec. 303. Conspiracy and attempted computer fraud offenses.

   Inserted: Sec. 304. Criminal and civil forfeiture for fraud and related activity in connection with computers.

   Inserted: Sec. 305. Damage to critical infrastructure computers.

   Inserted: Sec. 306. Limitation on actions involving unauthorized use.

   Inserted: Sec. 307. No new funding.

   Inserted: TITLE IV--CYBERSECURITY RESEARCH AND DEVELOPMENT

   Show 12 more inserted paragraphsShow less

   Inserted: Sec. 401. National High-Performance Computing Program planning and coordination.

   Inserted: Sec. 402. Research in areas of national importance.

   Inserted: Sec. 403. Program improvements.

   Inserted: Sec. 404. Improving education of networking and information technology, including high performance computing.

   Inserted: Sec. 405. Conforming and technical amendments to the High-Performance Computing Act of 1991.

   Inserted: Sec. 406. Federal cyber scholarship-for-service program.

   Inserted: Sec. 407. Study and analysis of certification and training of information infrastructure professionals.

   Inserted: Sec. 408. International cybersecurity technical standards.

   Inserted: Sec. 409. Identity management research and development.

   Inserted: Sec. 410. Federal cybersecurity research and development.

   Inserted: TITLE I--FACILITATING SHARING OF CYBER THREAT INFORMATION

   Inserted: SEC. 101. DEFINITIONS.

   In this title:

   Struck: (1) Certified owner.--The term "certified owner" means an owner of critical cyber infrastructure or an owner of critical infrastructure that is certified by the Council under section 104(a)(4).

   Struck: (2) Cyber risk.--The term "cyber risk" means any risk to information infrastructure, including physical or personnel risks and security vulnerabilities, that, if exploited or not mitigated, could pose a significant risk of disruption to the operation of information infrastructure essential to the reliable operation of critical infrastructure.

   Struck: (3) Sector coordinating council.--The term "sector coordinating council" means a private sector coordinating council comprised of representatives of owners and operators within a particular sector of critical infrastructure established by the National Infrastructure Protection Plan.

   Struck: (4) Sector-specific agency.--The term "sector-specific agency" means the relevant Federal agency responsible for infrastructure protection activities in a designated critical infrastructure sector or key resources category under the National Infrastructure Protection Plan, or any other appropriate Federal agency identified by the President after the date of enactment of this Act.

   Show 2 more struck paragraphsShow less

   Struck: TITLE II--FEDERAL INFORMATION SECURITY MANAGEMENT AND CONSOLIDATING RESOURCES

   Struck: SEC. 201. FISMA REFORM.

   Inserted: (1) Agency.--The term "agency" has the meaning given the term in section 3502 of title 44, United States Code.

   Inserted: (2) Antitrust laws.--The term "antitrust laws"--

   Inserted: (A) has the meaning given the term in section 1(a) of the Clayton Act (15 U.S.C. 12(a));

   Inserted: (B) includes section 5 of the Federal Trade Commission Act (15 U.S.C. 45) to the extent that section 5 of that Act applies to unfair methods of competition; and

   Inserted: (C) includes any State law that has the same intent and effect as the laws under subparagraphs (A) and (B).

   Inserted: (3) Countermeasure.--The term "countermeasure" means an automated or a manual action with defensive intent to mitigate cyber threats.

   Inserted: (4) Cyber threat information.--The term "cyber threat information" means information that indicates or describes--

   Inserted: (A) a technical or operation vulnerability or a cyber threat mitigation measure;

   Inserted: (B) an action or operation to mitigate a cyber threat;

   Inserted: (C) malicious reconnaissance, including anomalous patterns of network activity that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat;

   Inserted: (D) a method of defeating a technical control;

   Inserted: (E) a method of defeating an operational control;

   Show 151 more inserted paragraphsShow less

   Inserted: (F) network activity or protocols known to be associated with a malicious cyber actor or that signify malicious cyber intent;

   Inserted: (G) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to inadvertently enable the defeat of a technical or operational control;

   Inserted: (H) any other attribute of a cybersecurity threat or cyber defense information that would foster situational awareness of the United States cybersecurity posture, if disclosure of such attribute or information is not otherwise prohibited by law;

   Inserted: (I) the actual or potential harm caused by a cyber incident, including information exfiltrated when it is necessary in order to identify or describe a cybersecurity threat; or

   Inserted: (J) any combination of subparagraphs (A) through (I).

   Inserted: (5) Cybersecurity center.--The term "cybersecurity center" means the Department of Defense Cyber Crime Center, the Intelligence Community Incident Response Center, the United States Cyber Command Joint Operations Center, the National Cyber Investigative Joint Task Force, the National Security Agency/Central Security Service Threat Operations Center, the National Cybersecurity and Communications Integration Center, and any successor center.

   Inserted: (6) Cybersecurity system.--The term "cybersecurity system" means a system designed or employed to ensure the integrity, confidentiality, or availability of, or to safeguard, a system or network, including measures intended to protect a system or network from--

   Inserted: (A) efforts to degrade, disrupt, or destroy such system or network; or

   Inserted: (B) theft or misappropriations of private or government information, intellectual property, or personally identifiable information.

   Inserted: (7) Entity.--

   Inserted: (A) In general.--The term "entity" means any private entity, non-Federal government agency or department, or State, tribal, or local government agency or department (including an officer, employee, or agent thereof).

   Inserted: (B) Inclusions.--The term "entity" includes a government agency or department (including an officer, employee, or agent thereof) of the District of Columbia, the Commonwealth of Puerto Rico, the Virgin Islands, Guam, American Samoa, the Northern Mariana Islands, and any other territory or possession of the United States.

   Inserted: (8) Federal information system.--The term "Federal information system" means an information system of a Federal department or agency used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.

   Inserted: (9) Information security.--The term "information security" means protecting information and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction in order to provide--

   Inserted: (A) integrity, by guarding against improper information modification or destruction, including by ensuring information nonrepudiation and authenticity;

   Inserted: (B) confidentiality, by preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; or

   Inserted: (C) availability, by ensuring timely and reliable access to and use of information.

   Inserted: (10) Information system.--The term "information system" has the meaning given the term in section 3502 of title 44, United States Code.

   Inserted: (11) Local government.--The term "local government" means any borough, city, county, parish, town, township, village, or other general purpose political subdivision of a State.

   Inserted: (12) Malicious reconnaissance.--The term "malicious reconnaissance" means a method for actively probing or passively monitoring an information system for the purpose of discerning technical vulnerabilities of the information system, if such method is associated with a known or suspected cybersecurity threat.

   Inserted: (13) Operational control.--The term "operational control" means a security control for an information system that primarily is implemented and executed by people.

   Inserted: (14) Operational vulnerability.--The term "operational vulnerability" means any attribute of policy, process, or procedure that could enable or facilitate the defeat of an operational control.

   Inserted: (15) Private entity.--The term "private entity" means any individual or any private group, organization, or corporation, including an officer, employee, or agent thereof.

   Inserted: (16) Significant cyber incident.--The term "significant cyber incident" means a cyber incident resulting in, or an attempted cyber incident that, if successful, would have resulted in--

   Inserted: (A) the exfiltration from a Federal information system of data that is essential to the operation of the Federal information system; or

   Inserted: (B) an incident in which an operational or technical control essential to the security or

   Inserted: operation of a Federal information system was defeated.

   Inserted: (17) Technical control.--The term "technical control" means a hardware or software restriction on, or audit of, access or use of an information system or information that is stored on, processed by, or transiting an information system that is intended to ensure the confidentiality, integrity, or availability of that system.

   Inserted: (18) Technical vulnerability.--The term "technical vulnerability" means any attribute of hardware or software that could enable or facilitate the defeat of a technical control.

   Inserted: (19) Tribal.--The term "tribal" has the meaning given the term "Indian tribe" in section 4 of the Indian Self-Determination and Education Assistance Act (25 U.S.C. 450b).

   Inserted: SEC. 102. AUTHORIZATION TO SHARE CYBER THREAT INFORMATION.

   Inserted: (a) Voluntary Disclosure.--

   Inserted: (1) Private entities.--Notwithstanding any other provision of law, a private entity may, for the purpose of preventing, investigating, or otherwise mitigating threats to information security, on its own networks, or as authorized by another entity, on such entity's networks, employ countermeasures and use cybersecurity systems in order to obtain, identify, or otherwise possess cyber threat information.

   Inserted: (2) Entities.--Notwithstanding any other provision of law, an entity may disclose cyber threat information to--

   Inserted: (A) a cybersecurity center; or

   Inserted: (B) any other entity in order to assist with preventing, investigating, or otherwise mitigating threats to information security.

   Inserted: (3) Information security providers.--If the cyber threat information described in paragraph (1) is obtained, identified, or otherwise possessed in the course of providing information security products or services under contract to another entity, that entity shall be given, at any time prior to disclosure of such information, a reasonable opportunity to authorize or prevent such disclosure, to request anonymization of such information, or to request that reasonable efforts be made to safeguard such information that identifies specific persons from unauthorized access or disclosure.

   Inserted: (b) Significant Cyber Incidents Involving Federal Information Systems.--

   Inserted: (1) In general.--An entity providing electronic communication services, remote computing services, or information security services to a Federal department or agency shall inform the Federal department or agency of a significant cyber incident involving the Federal information system of that Federal department or agency that--

   Inserted: (A) is directly known to the entity as a result of providing such services;

   Inserted: (B) is directly related to the provision of such services by the entity; and

   Inserted: (C) as determined by the entity, has impeded or will impede the performance of a critical mission of the Federal department or agency.

   Inserted: (2) Advance coordination.--A Federal department or agency receiving the services described in paragraph (1) shall coordinate in advance with an entity described in paragraph (1) to develop the parameters of any information that may be provided under paragraph (1), including clarification of the type of significant cyber incident that will impede the performance of a critical mission of the Federal department or agency.

   Inserted: (3) Report.--A Federal department or agency shall report information provided under this subsection to a cybersecurity center.

   Inserted: (4) Construction.--Any information provided to a cybersecurity center under paragraph (3) shall be treated in the same manner as information provided to a cybersecurity center under subsection (a).

   Inserted: (c) Information Shared With or Provided to a Cybersecurity Center.--Cyber threat information provided to a cybersecurity center under this section--

   Inserted: (1) may be disclosed to, retained by, and used by, consistent with otherwise applicable Federal law, any Federal agency or department, component, officer, employee, or agent of the Federal government for a cybersecurity purpose, a national security purpose, or in order to prevent, investigate, or prosecute any of the offenses listed in section 2516 of title 18, United States Code, and such information shall not be disclosed to, retained by, or used by any Federal agency or department for any use not permitted under this paragraph;

   Inserted: (2) may, with the prior written consent of the entity submitting such information, be disclosed to and used by a State, tribal, or local government or government agency for the purpose of protecting information systems, or in furtherance of preventing, investigating, or prosecuting a criminal act, except that if the need for immediate disclosure prevents obtaining written consent, such consent may be provided orally with subsequent documentation of such consent;

   Inserted: (3) shall be considered the commercial, financial, or proprietary information of the entity providing such information to the Federal government and any disclosure outside the Federal government may only be made upon the prior written consent by such entity and shall not constitute a waiver of any applicable privilege or protection provided by law, except that if the need for immediate disclosure prevents obtaining written consent, such consent may be provided orally with subsequent documentation of such consent;

   Inserted: (4) shall be deemed voluntarily shared information and exempt from disclosure under section 552 of title 5, United States Code, and any State, tribal, or local law requiring disclosure of information or records;

   Inserted: (5) shall be, without discretion, withheld from the public under section 552(b)(3)(B) of title 5, United States Code, and any State, tribal, or local law requiring disclosure of information or records;

   Inserted: (6) shall not be subject to the rules of any Federal agency or department or any judicial doctrine regarding ex parte communications with a decision-making official;

   Inserted: (7) shall not, if subsequently provided to a State, tribal, or local government or government agency, otherwise be disclosed or distributed to any entity by such State, tribal, or local government or government agency without the prior written consent of the entity submitting such information, notwithstanding any State, tribal, or local law requiring disclosure of information or records, except that if the need for immediate disclosure prevents obtaining written consent, such consent may be provided orally with subsequent documentation of such consent; and

   Inserted: (8) shall not be directly used by any Federal, State, tribal, or local department or agency to regulate the lawful activities of an entity, including activities relating to obtaining, identifying, or otherwise possessing cyber threat information, except that the procedures required to be developed and implemented under this title shall not be considered regulations within the meaning of this paragraph.

   Inserted: (d) Procedures Relating to Information Sharing With a Cybersecurity Center.--Not later than 60 days after the date of enactment of this Act, the heads of each department or agency containing a cybersecurity center shall jointly develop, promulgate, and submit to Congress procedures to ensure that cyber threat information shared with or provided to--

   Inserted: (1) a cybersecurity center under this section--

   Inserted: (A) may be submitted to a cybersecurity center by an entity, to the greatest extent possible, through a uniform, publicly available process or format that is easily accessible on the website of such cybersecurity center, and that includes the ability to provide relevant details about the cyber threat information and written consent to any subsequent disclosures authorized by this paragraph;

   Inserted: (B) shall immediately be further shared with each cybersecurity center in order to prevent, investigate, or otherwise mitigate threats to information security across the Federal government;

   Inserted: (C) is handled by the Federal government in a reasonable manner, including consideration of the need to protect the privacy and civil liberties of individuals through anonymization or other appropriate methods, while fully accomplishing the objectives of this title, and the Federal government may undertake efforts consistent with this subparagraph to limit the impact on privacy and civil liberties of the sharing of cyber threat information with the Federal government; and

   Inserted: (D) except as provided in this section, shall only be used, disclosed, or handled in accordance with the provisions of subsection (c); and

   Inserted: (2) a Federal agency or department under subsection (b) is provided immediately to a cybersecurity center in order to prevent, investigate, or otherwise mitigate threats to information security across the Federal government.

   Inserted: (e) Information Shared Between Entities.--

   Inserted: (1) In general.--An entity sharing cyber threat information with another entity under this title may restrict the use or sharing of such information by such other entity.

   Inserted: (2) Further sharing.--Cyber threat information shared by any entity with another entity under this title--

   Inserted: (A) shall only be further shared in accordance with any restrictions placed on the sharing of such information by the entity authorizing such sharing, such as appropriate anonymization of such information; and

   Inserted: (B) may not be used by any entity to gain an unfair competitive advantage to the detriment of the entity authorizing the sharing of such information, except that the conduct described in paragraph (3) shall not constitute unfair competitive conduct.

   Inserted: (3) Information shared with state, tribal, or local government or government agency.--Cyber threat information shared with a State, tribal, or local government or government agency under this title--

   Inserted: (A) may, with the prior written consent of the entity sharing such information, be disclosed to and used by a State, tribal, or local government or government agency for the purpose of protecting information systems, or in furtherance of preventing, investigating, or prosecuting a criminal act, except if the need for immediate disclosure prevents obtaining written consent, consent may be provided orally with subsequent documentation of the consent;

   Inserted: (B) shall be deemed voluntarily shared information and exempt from disclosure under any State, tribal, or local law requiring disclosure of information or records;

   Inserted: (C) shall not be disclosed or distributed to any entity by the State, tribal, or local government or government agency without the prior written consent of the entity submitting such information, notwithstanding any State, tribal, or local law requiring disclosure of information or records, except if the need for immediate disclosure prevents obtaining written consent, consent may be provided orally with subsequent documentation of the consent; and

   Inserted: (D) shall not be directly used by any State, tribal, or local department or agency to regulate the lawful activities of an entity, including activities relating to obtaining, identifying, or otherwise possessing cyber threat information, except that the procedures required to be developed and implemented under this title shall not be considered regulations within the meaning of this subparagraph.

   Inserted: (4) Antitrust exemption.--The exchange or provision of cyber threat information or assistance between 2 or more private entities under this title shall not be considered a violation of any provision of antitrust laws if exchanged or provided in order to assist with--

   Inserted: (A) facilitating the prevention, investigation, or mitigation of threats to information security; or

   Inserted: (B) communicating or disclosing of cyber threat information to help prevent, investigate or otherwise mitigate the effects of a threat to information security.

   Inserted: (5) No right or benefit.--The provision of cyber threat information to an entity under this section shall not create a right or a benefit to similar information by such entity or any other entity.

   Inserted: (f) Federal Preemption.--

   Inserted: (1) In general.--This section supersedes any statute or other law of a State or political subdivision of a State that restricts or otherwise expressly regulates an activity authorized under this section.

   Inserted: (2) State law enforcement.--Nothing in this section shall be construed to supersede any statute or other law of a State or political subdivision of a State concerning the use of authorized law enforcement techniques.

   Inserted: (3) Public disclosure.--No information shared with or provided to a State, tribal, or local government or government agency pursuant to this section shall be made publicly available pursuant to any State, tribal, or local law requiring disclosure of information or records.

   Inserted: (g) Civil and Criminal Liability.--

   Inserted: (1) General protections.--

   Inserted: (A) Private entities.--No cause of action shall lie or be maintained in any court against any private entity for--

   Inserted: (i) the use of countermeasures and cybersecurity systems as authorized by this title;

   Inserted: (ii) the use, receipt, or disclosure of any cyber threat information as authorized by this title; or

   Inserted: (iii) the subsequent actions or inactions of any lawful recipient of cyber threat information provided by such private entity.

   Inserted: (B) Entities.--No cause of action shall lie or be maintained in any court against any entity for--

   Inserted: (i) the use, receipt, or disclosure of any cyber threat information as authorized by this title; or

   Inserted: (ii) the subsequent actions or inactions of any lawful recipient of cyber threat information provided by such entity.

   Inserted: (2) Construction.--Nothing in this subsection shall be construed as creating any immunity against, or otherwise affecting, any action brought by the Federal government, or any agency or department thereof, to enforce any law, executive order, or procedure governing the appropriate handling, disclosure, and use of classified information.

   Inserted: (h) Otherwise Lawful Disclosures.--Nothing in this section shall be construed to limit or prohibit otherwise lawful disclosures of communications, records, or other information by a private entity to any other governmental or private entity not covered under this section.

   Inserted: (i) Whistleblower Protection.--Nothing in this Act shall be construed to preempt or preclude any employee from exercising rights currently provided under any whistleblower law, rule, or regulation.

   Inserted: (j) Relationship to Other Laws.--The submission of cyber threat information under this section to a cybersecurity center shall not affect any requirement under any other provision of law for an entity to provide information to the Federal government.

   Inserted: SEC. 103. INFORMATION SHARING BY THE FEDERAL GOVERNMENT.

   Inserted: (a) Classified Information.--

   Inserted: (1) Procedures.--Consistent with the protection of intelligence sources and methods, and as otherwise determined appropriate, the Director of National Intelligence and the Secretary of Defense, in consultation with the heads of the appropriate Federal departments or agencies, shall develop and promulgate procedures to facilitate and promote--

   Inserted: (A) the immediate sharing, through the cybersecurity centers, of classified cyber threat information in the possession of the Federal government with appropriately cleared representatives of any appropriate entity; and

   Inserted: (B) the declassification and immediate sharing, through the cybersecurity centers, with any entity or, if appropriate, public availability of cyber threat information in the possession of the Federal government;

   Inserted: (2) Handling of classified information.--The procedures developed under paragraph (1) shall ensure that each entity receiving classified cyber threat information pursuant to this section has acknowledged in writing the ongoing obligation to comply with all laws, executive orders, and procedures concerning the appropriate handling, disclosure, or use of classified information.

   Inserted: (b) Unclassified Cyber Threat Information.--The heads of each department or agency containing a cybersecurity center shall jointly develop and promulgate procedures that ensure that, consistent with the provisions of this section, unclassified, including controlled unclassified, cyber threat information in the possession of the Federal government--

   Inserted: (1) is shared, through the cybersecurity centers, in an immediate and adequate manner with appropriate entities; and

   Inserted: (2) if appropriate, is made publicly available.

   Inserted: (c) Development of Procedures.--

   Inserted: (1) In general.--The procedures developed under this section shall incorporate, to the greatest extent possible, existing processes utilized by sector specific information sharing and analysis centers.

   Inserted: (2) Coordination with entities.--In developing the procedures required under this section, the Director of National Intelligence and the heads of each department or agency containing a cybersecurity center shall coordinate with appropriate entities to ensure that protocols are implemented that will facilitate and promote the sharing of cyber threat information by the Federal government.

   Inserted: (d) Additional Responsibilities of Cybersecurity Centers.--Consistent with section 102, a cybersecurity center shall--

   Inserted: (1) facilitate information sharing, interaction, and collaboration among and between cybersecurity centers and--

   Inserted: (A) other Federal entities;

   Inserted: (B) any entity; and

   Inserted: (C) international partners, in consultation with the Secretary of State;

   Inserted: (2) disseminate timely and actionable cybersecurity threat, vulnerability, mitigation, and warning information, including alerts, advisories, indicators, signatures, and mitigation and response measures, to improve the security and protection of information systems; and

   Inserted: (3) coordinate with other Federal entities, as appropriate, to integrate information from across the Federal government to provide situational awareness of the cybersecurity posture of the United States.

   Inserted: (e) Sharing Within the Federal Government.--The heads of appropriate Federal departments and agencies shall ensure that cyber threat information in the possession of such Federal departments or agencies that relates to the prevention, investigation, or mitigation of threats to information security across the Federal government is shared effectively with the cybersecurity centers.

   Inserted: (f) Submission to Congress.--Not later than 60 days after the date of enactment of this Act, the Director of National Intelligence, in coordination with the appropriate head of a department or an agency containing a cybersecurity center, shall submit the procedures required by this section to Congress.

   Inserted: SEC. 104. CONSTRUCTION.

   Inserted: (a) Information Sharing Relationships.--Nothing in this title shall be construed--

   Inserted: (1) to limit or modify an existing information sharing relationship;

   Inserted: (2) to prohibit a new information sharing relationship;

   Inserted: (3) to require a new information sharing relationship between any entity and the Federal government, except as specified under section 102(b); or

   Inserted: (4) to modify the authority of a department or agency of the Federal government to protect sources and methods and the national security of the United States.

   Inserted: (b) Anti-tasking Restriction.--Nothing in this title shall be construed to permit the Federal government--

   Inserted: (1) to require an entity to share information with the Federal government, except as expressly provided under section 102(b); or

   Inserted: (2) to condition the sharing of cyber threat information with an entity on such entity's provision of cyber threat information to the Federal government.

   Inserted: (c) No Liability for Non-participation.--Nothing in this title shall be construed to subject any entity to liability for choosing not to engage in the voluntary activities authorized under this title.

   Inserted: (d) Use and Retention of Information.--Nothing in this title shall be construed to authorize, or to modify any existing authority of, a department or agency of the Federal government to retain or use any information shared under section 102 for any use other than a use permitted under subsection 102(c)(1).

   Inserted: (e) No New Funding.--An applicable Federal agency shall carry out the provisions of this title with existing facilities and funds otherwise available, through such means as the head of the agency considers appropriate.

   Inserted: SEC. 105. REPORT ON IMPLEMENTATION.

   Inserted: (a) Content of Report.--Not later than 1 year after the date of enactment of this Act, and biennially thereafter, the heads of each department or agency containing a cybersecurity center shall jointly submit, in coordination with the privacy and civil liberties officials of such departments or agencies and the Privacy and Civil Liberties Oversight Board, a detailed report to Congress concerning the implementation of this title, including--

   Inserted: (1) an assessment of the sufficiency of the procedures developed under section 103 of this Act in ensuring that cyber threat information in the possession of the Federal government is provided in an immediate and adequate manner to appropriate entities or, if appropriate, is made publicly available;

   Inserted: (2) an assessment of whether information has been appropriately classified and an accounting of the number of security clearances authorized by the Federal government for purposes of this title;

   Inserted: (3) a review of the type of cyber threat information shared with a cybersecurity center under section 102 of this Act, including whether such information meets the definition of cyber threat information under section 101, the degree to which such information may impact the privacy and civil liberties of individuals, any appropriate metrics to determine any impact of the sharing of such information with the Federal government on privacy and civil liberties, and the adequacy of any steps taken to reduce such impact;

   Inserted: (4) a review of actions taken by the Federal government based on information provided to a cybersecurity center under section 102 of this Act, including the appropriateness of any subsequent use under section 102(c)(1) of this Act and whether there was inappropriate stovepiping within the Federal government of any such information;

   Inserted: (5) a description of any violations of the requirements of this title by the Federal government;

   Inserted: (6) a classified list of entities that received classified information from the Federal government under section 103 of this Act and a description of any indication that such information may not have been appropriately handled;

   Inserted: (7) a summary of any breach of information security, if known, attributable to a specific failure by any entity or the Federal government to act on cyber threat information in the possession of such entity or the Federal government that resulted in substantial economic harm or injury to a specific entity or the Federal government; and

   Inserted: (8) any recommendation for improvements or modifications to the authorities under this title.

   Inserted: (b) Form of Report.--The report under subsection (a) shall be submitted in unclassified form, but shall include a classified annex.

   Inserted: SEC. 106. INSPECTOR GENERAL REVIEW.

   Inserted: (a) In General.--The Council of the Inspectors General on Integrity and Efficiency are authorized to review compliance by the cybersecurity centers, and by any Federal department or agency receiving cyber threat information from such cybersecurity centers, with the procedures required under section 102 of this Act.

   Inserted: (b) Scope of Review.--The review under subsection (a) shall consider whether the Federal government has handled such cyber threat information in a reasonable manner, including consideration of the need to protect the privacy and civil liberties of individuals through anonymization or other appropriate methods, while fully accomplishing the objectives of this title.

   Inserted: (c) Report to Congress.--Each review conducted under this section shall be provided to Congress not later than 30 days after the date of completion of the review.

   Inserted: SEC. 107. TECHNICAL AMENDMENTS.

   Inserted: Section 552(b) of title 5, United States Code, is amended--

   Inserted: (1) in paragraph (8), by striking "or";

   Inserted: (2) in paragraph (9), by striking "wells." and inserting "wells; or"; and

   Inserted: (3) by adding at the end the following:

   Inserted: "(10) information shared with or provided to a cybersecurity center under section 102 of title I of the Strengthening and Enhancing Cybersecurity by Using Research, Education, Information, and Technology Act of 2012.".

   Inserted: SEC. 108. ACCESS TO CLASSIFIED INFORMATION.

   Inserted: (a) Authorization Required.--No person shall be provided with access to classified information (as defined in section 6.1 of Executive Order 13526 (50 U.S.C. 435 note; relating to classified national security information)) relating to cyber security threats or cyber security vulnerabilities under this title without the appropriate security clearances.

   Inserted: (b) Security Clearances.--The appropriate Federal agencies or departments shall, consistent with applicable procedures and requirements, and if otherwise deemed appropriate, assist an individual in timely obtaining an appropriate security clearance where such individual has been determined to be eligible for such clearance and has a need-to-know (as defined in section 6.1 of that Executive Order) classified information to carry out this title.

   Inserted: TITLE II--COORDINATION OF FEDERAL INFORMATION SECURITY POLICY

   Inserted: SEC. 201. COORDINATION OF FEDERAL INFORMATION SECURITY POLICY.

   (a) In General.--Chapter 35 of title 44, United States Code, is amended by striking subchapters II and III and inserting the following:

   "SUBCHAPTER II--INFORMATION SECURITY

   "Sec. 3551. Purposes "The purposes of this subchapter are[struck: to]--

   "(1) [inserted: to ]provide a comprehensive framework for ensuring the effectiveness of information security controls over information resources that support Federal operations and assets;

   "(2) [inserted: to ]recognize the highly networked nature of the [inserted: current ]Federal computing environment and provide effective [struck: governmentwide][inserted: government-wide] management of policies, directives, standards, and guidelines, as well as effective and nimble oversight of and response to information security risks, including coordination of information security efforts throughout the Federal civilian, national security, and law enforcement communities;

   "(3) [inserted: to ]provide for development and maintenance of controls required to protect agency information and information systems and contribute to the overall improvement of agency information security posture;[struck: and]

   Inserted: "(4) to provide for the development of tools and methods to assess and respond to real-time situational risk for Federal information system operations and assets; and

   "([struck: 4][inserted: 5]) [inserted: to ]provide a mechanism [struck: to improve and continuously monitor the security of ][inserted: for improving ]agency information security programs [struck: and systems ]through [struck: a focus on ]continuous monitoring of agency information systems and streamlined reporting requirements rather than overly prescriptive manual reporting.

   "Sec. 3552. Definitions[inserted: "In this subchapter:]

   Struck: "(a) In General.--Except as provided under subsection (b), the definitions under section 3502 (including the definitions of the terms 'agency' and 'information system') shall apply to this subchapter.

   Struck: "(b) Other Terms.--In this subchapter:

   "(1) Adequate security.--The term 'adequate security' means security commensurate with the risk and [struck: impact ][inserted: magnitude of the harm ]resulting from the unauthorized access to or loss, misuse, destruction, or modification of information.

   Struck: "(2) Continuous monitoring.--The term 'continuous monitoring' means the ongoing real time or near real-time process used to determine if the complete set of planned, required, and deployed security controls within an information system continue to be effective over time in light of rapidly changing information technology and threat development. To the maximum extent possible, this also requires automation of that process to enable cost effective, efficient, and consistent monitoring and provide a more dynamic view of the security state of those deployed controls.

   Struck: "(3) Countermeasure.--The term 'countermeasure' means automated or manual actions with defensive intent to modify or block data packets associated with electronic or wire communications, Internet traffic, program code, or other system traffic transiting to or from or stored on an information system for the purpose of protecting the information system from cybersecurity threats, conducted on an information system owned or operated by or on behalf of the party to be protected or operated by a private entity acting as a provider of electronic communication services, remote computing services, or cybersecurity services to the party to be protected.

   Struck: "(4) Incident.--The term 'incident' means an occurrence that--

   Struck: "(A) actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information or an information system; or

   Show 5 more struck paragraphsShow less

   Struck: "(B) constitutes a violation or imminent threat of violation of law, security policies, security procedures, or acceptable use policies.

   Struck: "(5) Information security.--The term 'information security' means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction in order to provide--

   Struck: "(A) integrity, which means guarding against improper information modification or destruction, and includes ensuring nonrepudiation and authenticity;

   Struck: "(B) confidentiality, which means preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; and

   Struck: "(C) availability, which means ensuring timely and reliable access to and use of information.

   "([struck: 6][inserted: 2]) [struck: Information technology][inserted: Agency].--The term '[struck: information technology][inserted: agency]' has the meaning given [struck: that][inserted: the] term in section [struck: 11101][inserted: 3502] of title [struck: 40][inserted: 44].

   Struck: "(7) National security system.--

   Inserted: "(3) Cybersecurity center.--The term 'cybersecurity center' means the Department of Defense Cyber Crime Center, the Intelligence Community Incident Response Center, the United States Cyber Command Joint Operations Center, the National Cyber Investigative Joint Task Force, the National Security Agency/Central Security Service Threat Operations Center, the National Cybersecurity and Communications Integration Center, and any successor center.

   Inserted: "(4) Cyber threat information.--The term 'cyber threat information' means information that indicates or describes--

   Inserted: "(A) a technical or operation vulnerability or a cyber threat mitigation measure;

   Inserted: "(B) an action or operation to mitigate a cyber threat;

   Inserted: "(C) malicious reconnaissance, including anomalous patterns of network activity that appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat;

   Inserted: "(D) a method of defeating a technical control;

   Inserted: "(E) a method of defeating an operational control;

   Inserted: "(F) network activity or protocols known to be associated with a malicious cyber actor or that signify malicious cyber intent;

   Inserted: "(G) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to inadvertently enable the defeat of a technical or operational control;

   Inserted: "(H) any other attribute of a cybersecurity threat or cyber defense information that would foster situational awareness of the United States cybersecurity posture, if disclosure of such attribute or information is not otherwise prohibited by law;

   Inserted: "(I) the actual or potential harm caused by a cyber incident, including information exfiltrated when it is necessary in order to identify or describe a cybersecurity threat; or

   Inserted: "(J) any combination of subparagraphs (A) through (I).

   Show 15 more inserted paragraphsShow less

   Inserted: "(5) Director.--The term 'Director' means the Director of the Office of Management and Budget unless otherwise specified.

   Inserted: "(6) Environment of operation.--The term 'environment of operation' means the information system and environment in which those systems operate, including changing threats, vulnerabilities, technologies, and missions and business practices.

   Inserted: "(7) Federal information system.--The term 'Federal information system' means an information system used or operated by an executive agency, by a contractor of an executive agency, or by another organization on behalf of an executive agency.

   Inserted: "(8) Incident.--The term 'incident' means an occurrence that--

   Inserted: "(A) actually or imminently jeopardizes the integrity, confidentiality, or availability of an information system or the information that system controls, processes, stores, or transmits; or

   Inserted: "(B) constitutes a violation of law or an imminent threat of violation of a law, a security policy, a security procedure, or an acceptable use policy.

   Inserted: "(9) Information resources.--The term 'information resources' has the meaning given the term in section 3502 of title 44.

   Inserted: "(10) Information security.--The term 'information security' means protecting information and information systems from disruption or unauthorized access, use, disclosure, modification, or destruction in order to provide--

   Inserted: "(A) integrity, by guarding against improper information modification or destruction, including by ensuring information nonrepudiation and authenticity;

   Inserted: "(B) confidentiality, by preserving authorized restrictions on access and disclosure, including means for protecting personal privacy and proprietary information; or

   Inserted: "(C) availability, by ensuring timely and reliable access to and use of information.

   Inserted: "(11) Information system.--The term 'information system' has the meaning given the term in section 3502 of title 44.

   Inserted: "(12) Information technology.--The term 'information technology' has the meaning given the term in section 11101 of title 40.

   Inserted: "(13) Malicious reconnaissance.--The term 'malicious reconnaissance' means a method for actively probing or passively monitoring an information system for the purpose of discerning technical vulnerabilities of the information system, if such method is associated with a known or suspected cybersecurity threat.

   Inserted: "(14) National security system.--

   "(A) In general.--The term 'national security system' means any information system (including any telecommunications system) used or operated by an agency or by a contractor of an agency, or other organization on behalf of an agency--

   "(i) the function, operation, or use of which--

   3 unchanged paragraphsHide unchanged text

   "(I) involves intelligence activities;

   "(II) involves cryptologic activities related to national security;

   "(III) involves command and control of military forces;

   "(IV) involves equipment that is an integral part of a weapon or weapons system; or

   "(V) subject to subparagraph (B), is critical to the direct fulfillment of military or intelligence missions; or

   "(ii) [struck: that ]is protected at all times by procedures established for information that have been specifically authorized under criteria established by an Executive [struck: order][inserted: Order] or an Act of Congress to be kept classified in the interest of national defense or foreign policy.

   "(B) [struck: Exclusion][inserted: Limitation].--Subparagraph (A)(i)(V) does not include a system that is to be used for routine administrative and business applications (including payroll, finance, logistics, and personnel management applications).

   Struck: "(8) Secretary.--The term 'Secretary' means the Secretary of Homeland Security.

   Struck: "Sec. 3553. Federal information security authority and coordination

   Struck: "(a) In General.--Except as provided in subsections (f) and (g), the Secretary shall oversee agency information security policies and practices, including the development and oversight of information security policies and directives and compliance with this subchapter.

   Struck: "(b) Duties.--The Secretary shall--

   Show 63 more struck paragraphsShow less

   Struck: "(1) develop, issue, and oversee the implementation of information security policies and directives, which shall be compulsory and binding on agencies to the extent determined appropriate by the Secretary, including--

   Struck: "(A) policies and directives consistent with the standards promulgated under section 11331 of title 40 to identify and provide information security protections that are commensurate with the risk and impact resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of--

   Struck: "(i) information collected, created, processed, stored, disseminated, or otherwise used or maintained by or on behalf of an agency; or

   Struck: "(ii) information systems used or operated by an agency or by a contractor of an agency or other organization, such as a State government entity, on behalf of an agency;

   Struck: "(B) minimum operational requirements for network operations centers and security operations centers of agencies to facilitate the protection of and provide common situational awareness for all agency information and information systems;

   Struck: "(C) reporting requirements, consistent with relevant law, regarding information security incidents;

   Struck: "(D) requirements for agencywide information security programs, including continuous monitoring of information security;

   Struck: "(E) performance requirements and metrics for the security of agency information systems;

   Struck: "(F) training requirements to ensure that agencies are able to fully and timely comply with directions issued by the Secretary under this subchapter;

   Struck: "(G) training requirements regarding privacy, civil rights, civil liberties, and information oversight for agency information security employees;

   Struck: "(H) requirements for the annual reports to the Secretary under section 3554(c); and

   Struck: "(I) any other information security requirements as determined by the Secretary;

   Struck: "(2) review agency information security programs required to be developed under section 3554(b);

   Struck: "(3) develop and conduct targeted risk assessments and operational evaluations for agency information and information systems in consultation with the heads of other agencies or governmental and private entities that own and operate such systems, that may include threat, vulnerability, and impact assessments and penetration testing;

   Struck: "(4) operate consolidated intrusion detection, prevention, or other protective capabilities and use associated countermeasures for the purpose of protecting agency information and information systems from information security threats;

   Struck: "(5) in conjunction with other agencies and the private sector, assess and foster the development of information security technologies and capabilities for use across multiple agencies;

   Struck: "(6) designate an entity to receive reports and information about information security incidents, threats, and vulnerabilities affecting agency information systems;

   Struck: "(7) provide incident detection, analysis, mitigation, and response information and remote or on-site technical assistance to the heads of agencies;

   Struck: "(8) coordinate with appropriate agencies and officials to ensure, to the maximum extent feasible, that policies and directives issued under paragraph (1) are complementary with--

   Struck: "(A) standards and guidelines developed for national security systems; and

   Struck: "(B) policies and directives issues by the Secretary of Defense, Director of the Central Intelligence Agency, and Director of National Intelligence under subsection (g)(1); and

   Struck: "(9) not later than March 1 of each year, submit to Congress a report on agency compliance with the requirements of this subchapter, which shall include--

   Struck: "(A) a summary of the incidents described by the reports required in section 3554(c);

   Struck: "(B) a summary of the results of assessments required by section 3555;

   Struck: "(C) a summary of the results of evaluations required by section 3556;

   Struck: "(D) significant deficiencies in agency information security practices as identified in the reports, assessments, and evaluations referred to in subparagraphs (A), (B), and (C), or otherwise; and

   Struck: "(E) planned remedial action to address any deficiencies identified under subparagraph (D).

   Struck: "(c) Issuing Policies and Directives.--When issuing policies and directives under subsection (b), the Secretary shall consider any applicable standards or guidelines developed by the National Institute of Standards and Technology and issued by the Secretary of Commerce under section 11331 of title 40. The Secretary shall consult with the Director of the National Institute of Standards and Technology when such policies and directives implement standards or guidelines developed by National Institute of Standards and Technology. To the maximum extent feasible, such standards and guidelines shall be complementary with standards and guidelines developed for national security systems.

   Struck: "(d) Communications and System Traffic.--

   Struck: "(1) In general.--Notwithstanding any other provision of law, in carrying out the responsibilities under paragraphs (3) and (4) of subsection (b), if the Secretary makes a certification described in paragraph (2), the Secretary may acquire, intercept, retain, use, and disclose communications and other system traffic that are transiting to or from or stored on agency information systems and deploy countermeasures with regard to the communications and system traffic.

   Struck: "(2) Certification.--A certification described in this paragraph is a certification by the Secretary that--

   Struck: "(A) the acquisitions, interceptions, and countermeasures are reasonably necessary for the purpose of protecting agency information systems from information security threats;

   Struck: "(B) the content of communications will be collected and retained only when the communication is associated with a known or reasonably suspected information security threat, and communications and system traffic will not be subject to the operation of a countermeasure unless associated with the threats;

   Struck: "(C) information obtained under activities authorized under this subsection will only be retained, used, or disclosed to protect agency information systems from information security threats, mitigate against such threats, or, with the approval of the Attorney General, for law enforcement purposes when--

   Struck: "(i) the information is evidence of a crime that has been, is being, or is about to be committed; and

   Struck: "(ii) disclosure of the information to a law enforcement agency is not otherwise prohibited by law;

   Struck: "(D) notice has been provided to users of agency information systems concerning the potential for acquisition, interception, retention, use, and disclosure of communications and other system traffic; and

   Struck: "(E) the activities are implemented pursuant to policies and procedures governing the acquisition, interception, retention, use, and disclosure of communications and other system traffic that have been reviewed and approved by the Attorney General.

   Struck: "(3) Private entities.--The Secretary may enter into contracts or other agreements, or otherwise request and obtain the assistance of, private entities that provide electronic communication or information security services to acquire, intercept, retain, use, and disclose communications and other system traffic or to deploy countermeasures in accordance with this subsection.

   Struck: "(e) Directions to Agencies.--

   Struck: "(1) Authority.--

   Struck: "(A) In general.--Notwithstanding section 3554, and subject to subparagraph (B), in response to a known or reasonably suspected information security threat, vulnerability, or incident that represents a substantial threat to the information security of an agency, the Secretary may direct other agency heads to take any lawful action with respect to the operation of the information systems, including those owned or operated by another entity on behalf of an agency, that collect, process, store, transmit, disseminate, or otherwise maintain agency information, for the purpose of protecting the information system from or mitigating an information security threat.

   Struck: "(B) Exception.--The authorities of the Secretary under this subsection shall not apply to a system described in paragraph (2), (3), or (4) of subsection (g).

   Struck: "(2) Procedures for use of authority.--The Secretary shall--

   Struck: "(A) in coordination with the Director of the Office of Management and Budget and, as appropriate, in consultation with operators of information systems, establish procedures governing the circumstances under which a directive may be issued under this subsection, which shall include--

   Struck: "(i) thresholds and other criteria;

   Struck: "(ii) privacy and civil liberties protections; and

   Struck: "(iii) providing notice to potentially affected third parties;

   Struck: "(B) specify the reasons for the required action and the duration of the directive;

   Struck: "(C) minimize the impact of directives under this subsection by--

   Struck: "(i) adopting the least intrusive means possible under the circumstances to secure the agency information systems; and

   Struck: "(ii) limiting directives to the shortest period practicable; and

   Struck: "(D) notify the Director of the Office of Management and Budget and head of any affected agency immediately upon the issuance of a directive under this subsection.

   Struck: "(3) Imminent threats.--

   Struck: "(A) In general.--If the Secretary determines that there is an imminent threat to agency information systems and a directive under this subsection is not reasonably likely to result in a timely response to the threat, the Secretary may authorize the use of protective capabilities under the control of the Secretary for communications or other system traffic transiting to or from or stored on an agency information system without prior consultation with the affected agency for the purpose of ensuring the security of the information or information system or other agency information systems.

   Struck: "(B) Limitation on delegation.--The authority under this paragraph may not be delegated to an official in a position lower than Assistant Secretary or Director of the National Cybersecurity and Communications Integration Center.

   Struck: "(C) Notice.--The Secretary or designee of the Secretary shall immediately notify the Director of the Office of Management and Budget and the head and chief information officer (or equivalent official) of each affected agency of--

   Struck: "(i) any action taken under this subsection; and

   Struck: "(ii) the reasons for and duration and nature of the action.

   Struck: "(D) Other law.--The actions of the Secretary under this paragraph shall be consistent with applicable law.

   Struck: "(4) Limitation.--The Secretary may direct or authorize lawful action or protective capability under this subsection only to--

   Struck: "(A) protect agency information from unauthorized access, use, disclosure, disruption, modification, or destruction; or

   Struck: "(B) require the remediation of or protect against identified information security risks with respect to--

   Inserted: "(15) Operational control.--The term 'operational control' means a security control for an information system that primarily is implemented and executed by people.

   Inserted: "(16) Person.--The term 'person' has the meaning given the term in section 3502 of title 44.

   Inserted: "(17) Secretary.--The term 'Secretary' means the Secretary of Commerce unless otherwise specified.

   Inserted: "(18) Security control.--The term 'security control' means the management, operational, and technical controls, including safeguards or countermeasures, prescribed for an information system to protect the confidentiality, integrity, and availability of the system and its information.

   Inserted: "(19) Significant cyber incident.--The term 'significant cyber incident' means a cyber incident resulting in, or an attempted cyber incident that, if successful, would have resulted in--

   Inserted: "(A) the exfiltration from a Federal information system of data that is essential to the operation of the Federal information system; or

   Inserted: "(B) an incident in which an operational or technical control essential to the security or operation of a Federal information system was defeated.

   Inserted: "(20) Technical control.--The term 'technical control' means a hardware or software restriction on, or audit of, access or use of an information system or information that is stored on, processed by, or transiting an information system that is intended to ensure the confidentiality, integrity, or availability of that system.

   Inserted: "Sec. 3553. Federal information security authority and

   Inserted: coordination

   Inserted: "(a) In General.--The Secretary, in consultation with the Secretary of Homeland Security, shall--

   Inserted: "(1) issue compulsory and binding policies and directives governing agency information security operations, and require implementation of such policies and directives, including--

   Show 1 more inserted paragraphShow less

   Inserted: "(A) policies and directives consistent with the standards and guidelines promulgated under section 11331 of title 40 to identify and provide information security protections prioritized and commensurate with the risk and impact resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of--

   "(i) information collected or maintained by or on behalf of an agency; or

   "(ii) [struck: that portion of an ]information [struck: system][inserted: systems] used or operated by an agency or by a contractor of an agency or other organization on behalf of an agency[struck: .][inserted: ;]

   Struck: "(f) National Security Systems.--

   Struck: "(1) In general.--This section shall not apply to a national security system.

   Struck: "(2) Information security.--Information security policies, directives, standards, and guidelines for national security systems shall be overseen as directed by the President and, in accordance with that direction, carried out under the authority of the heads of agencies that operate or exercise authority over national security systems.

   Struck: "(g) Delegation of Authorities.--

   Show 8 more struck paragraphsShow less

   Struck: "(1) In general.--The authorities of the Secretary described in paragraphs (1), (2), (3), and (4) of subsection (b) shall be delegated to--

   Struck: "(A) the Secretary of Defense in the case of systems described in paragraph (2);

   Struck: "(B) the Director of the Central Intelligence Agency in the case of systems described in paragraph (3); and

   Struck: "(C) the Director of National Intelligence in the case of systems described in paragraph (4).

   Struck: "(2) Department of defense.--The systems described in this paragraph are systems that are operated by the Department of Defense, a contractor of the Department of Defense, or another entity on behalf of the Department of Defense that process any information the unauthorized access, use, disclosure, disruption, modification, or destruction of which would have a debilitating impact on the mission of the Department of Defense.

   Struck: "(3) Central intelligence agency.--The systems described in this paragraph are systems that are operated by the Central Intelligence Agency, a contractor of the Central Intelligence Agency, or another entity on behalf of the Central Intelligence Agency that process any information the unauthorized access, use, disclosure, disruption, modification, or destruction of which would have a debilitating impact on the mission of the Central Intelligence Agency.

   Struck: "(4) Office of the director of national intelligence.--The systems described in this paragraph are systems that are operated by the Office of the Director of National Intelligence, a contractor of the Office of the Director of National Intelligence, or another entity on behalf of the Office of the Director of National Intelligence that process any information the unauthorized access, use, disclosure, disruption, modification, or destruction of which would have a debilitating impact on the mission of the Office of the Director of National Intelligence.

   Struck: "(5) Integration of information.--The Secretary of Defense, the Director of the Central Intelligence Agency, and the Director of National Intelligence shall carry out their responsibilities under this subsection in coordination with the Secretary and share relevant information in a timely manner with the Secretary relating to the security of agency information and information systems, including systems described in paragraphs (2), (3), and (4), to enable the Secretary to carry out the responsibilities set forth in this section and to maintain comprehensive situational awareness regarding information security incidents, threats, and vulnerabilities affecting agency information systems, consistent with standards and guidelines for national security systems, issued in accordance with law and as directed by the President.

   Inserted: "(B) minimum operational requirements for Federal Government to protect agency information systems and provide common situational awareness across all agency information systems;

   Inserted: "(C) reporting requirements, consistent with relevant law, regarding information security incidents and cyber threat information;

   Inserted: "(D) requirements for agencywide information security programs;

   Inserted: "(E) performance requirements and metrics for the security of agency information systems;

   Inserted: "(F) training requirements to ensure that agencies are able to fully and timely comply with the policies and directives issued by the Secretary under this subchapter;

   Inserted: "(G) training requirements regarding privacy, civil rights, and civil liberties, and information oversight for agency information security personnel;

   Inserted: "(H) requirements for the annual reports to the Secretary under section 3554(d);

   Inserted: "(I) any other information security operations or information security requirements as determined by the Secretary in coordination with relevant agency heads; and

   Inserted: "(J) coordinating the development of standards and guidelines under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) with agencies and offices operating or exercising control of national security systems (including the National Security Agency) to assure, to the maximum extent feasible, that such standards and guidelines are complementary with standards and guidelines developed for national security systems;

   Inserted: "(2) review the agencywide information security programs under section 3554; and

   Inserted: "(3) designate an individual or an entity at each cybersecurity center, among other responsibilities--

   Inserted: "(A) to receive reports and information about information security incidents, cyber threat information, and deterioration of security control affecting agency information systems; and

   Show 4 more inserted paragraphsShow less

   Inserted: "(B) to act on or share the information under subparagraph (A) in accordance with this subchapter.

   Inserted: "(b) Considerations.--When issuing policies and directives under subsection (a), the Secretary shall consider any applicable standards or guidelines developed by the National Institute of Standards and Technology under section 11331 of title 40.

   Inserted: "(c) Limitation of Authority.--The authorities of the Secretary under this section shall not apply to national security systems. Information security policies, directives, standards and guidelines for national security systems shall be overseen as directed by the President and, in accordance with that direction, carried out under the authority of the heads of agencies that operate or exercise authority over such national security systems.

   Inserted: "(d) Statutory Construction.--Nothing in this subchapter shall be construed to alter or amend any law regarding the authority of any head of an agency over such agency.

   "Sec. 3554. Agency responsibilities

   "(a) In General.--The head of each agency shall--

   "(1) be responsible for--

   Inserted: "(A) complying with the policies and directives issued under section 3553;

   "([struck: A][inserted: B]) providing information security protections commensurate with the risk resulting from unauthorized access, use, disclosure, disruption, modification, or destruction of--

   "(i) information collected[struck: , created, processed, stored, disseminated, ][inserted: or maintained by the agency ]or [struck: otherwise used or maintained by ][inserted: by a contractor of an agency ]or [inserted: other organization ]on behalf of [struck: the][inserted: an] agency; [struck: or][inserted: and]

   "(ii) information systems used or operated by [struck: the][inserted: an] agency or by a contractor of [struck: the][inserted: an] agency or other organization[struck: , such as a State government entity, ][inserted: ]on behalf of [struck: the][inserted: an] agency;

   "([struck: B][inserted: C]) complying with [inserted: the requirements of ]this subchapter, including--

   Struck: "(i) the policies and directives issued under section 3553, including any directions under section 3553(e); and

   Struck: "(ii) information security policies, directives, standards, and guidelines for national security systems issued in accordance with law and as directed by the President;

   "([struck: C][inserted: i]) [struck: complying with the requirements of the ]information security standards [struck: prescribed ][inserted: and guidelines promulgated ]under section 11331 of title 40[struck: , including any required security configuration checklists; and][inserted: ;]

   Inserted: "(ii) for any national security systems operated or controlled by that agency, information security policies, directives, standards and guidelines issued as directed by the President; and

   Inserted: "(iii) for any non-national security systems operated or controlled by that agency, information security policies, directives, standards and guidelines issued under section 3553;

   "(D) ensuring that information security management processes are integrated with agency strategic and operational planning processes;

   Struck: "(2) ensure that senior agency officials provide information security for the information and information systems that support the operations and assets under the control of the officials, including through--

   Struck: "(A) assessing, with a frequency commensurate with risk, the risk and impact that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information or information systems;

   Struck: "(B) determining the levels of information security appropriate to protect the information and information systems in accordance with the policies and directives issued under section 3553(b) and standards prescribed under section 11331 of title 40;

   Inserted: "(E) reporting and sharing, for an agency operating or exercising control of a national security system, information about information security incidents, cyber threat information, and deterioration of security controls to the individual or entity designated at each cybersecurity center and to other appropriate entities consistent with policies and directives for national security systems issued as directed by the President; and

   Inserted: "(F) reporting and sharing, for those agencies operating or exercising control of non-national security systems, information about information security incidents, cyber threat information, and deterioration of security controls to the individual or entity designated at each cybersecurity center and to other appropriate entities consistent with policies and directives for non-national security systems as prescribed under section 3553(a), including information to assist the entity designated under section 3555(a) with the ongoing security analysis under section 3555;

   Inserted: "(2) ensure that each senior agency official provides information security for the information and information systems that support the operations and assets under the senior agency official's control, including by--

   Inserted: "(A) assessing the risk and impact that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of such information or information systems;

   Inserted: "(B) determining the level of information security appropriate to protect such information and information systems in accordance with policies and directives issued under section 3553(a), and standards and guidelines promulgated under section 11331 of title 40 for information security classifications and related requirements;

   "(C) implementing policies, procedures, and capabilities to reduce risks to an acceptable level in a cost-effective manner;

   "(D) [struck: security testing and evaluation, including continuously ][inserted: actively ]monitoring the effective implementation of information security controls and techniques[struck: , threats, vulnerabilities, assets, and other aspects of information security as appropriate]; and

   Struck: "(E) reporting information about information security incidents, threats, and vulnerabilities in a timely manner as required under policies and procedures established under subsection (b)(7);

   Inserted: "(E) reporting information about information security incidents, cyber threat information, and deterioration of security controls in a timely and adequate manner to the entity designated under section 3553(a)(3) in accordance with paragraph (1);

   "(3) assess and maintain the resiliency of information [inserted: technology ]systems critical to [struck: the][inserted: agency] mission and operations[struck: of the agency];

   Inserted: "(4) designate the agency Inspector General (or an independent entity selected in consultation with the Director and the Council of Inspectors General on Integrity and Efficiency if the agency does not have an Inspector General) to conduct the annual independent evaluation required under section 3556, and allow the agency Inspector General to contract with an independent entity to perform such evaluation;

   "([struck: 4][inserted: 5]) delegate to the [struck: chief information officer][inserted: Chief Information Officer] or equivalent [struck: official ](or to a senior agency official who reports to the [struck: chief information officer][inserted: Chief Information Officer] or equivalent[struck: official])[struck: the authority to ensure and primary responsibility for ensuring compliance with this subchapter, including]--

   Struck: "(A) overseeing the establishment and maintenance of an agencywide security operations capability that on a continuous basis can--

   Struck: "(i) detect, report, respond to, contain, and mitigate information security incidents that impair adequate security of the agency information and information systems in a timely manner and in accordance with the policies and directives issued under section 3553(b); and

   Struck: "(ii) report any information security incident described under clause (i) to the entity designated under section 3553(b)(6);

   Struck: "(B) developing, maintaining, and overseeing an agencywide information security program as required under subsection (b);

   Show 9 more struck paragraphsShow less

   Struck: "(C) developing, maintaining, and overseeing information security policies, procedures, and control techniques to address all applicable requirements, including those issued under section 3553 and section 11331 of title 40;

   Struck: "(D) training and overseeing employees and contractors of the agency with significant responsibilities for information security with respect to such responsibilities; and

   Struck: "(E) assisting senior agency officials concerning their responsibilities under paragraph (2);

   Struck: "(5) the agency has trained and obtained security clearances for an adequate number of employees to assist the agency in complying with this subchapter, including the policies and directives issued under section 3553(b);

   Struck: "(6) ensure that the chief information officer (or other senior agency official designated under paragraph (4)), in coordination with other senior agency officials, reports to the head of the agency on the effectiveness of the agency information security program, including the progress of remedial actions;

   Struck: "(7) ensure that the chief information officer (or other senior agency official designated under paragraph (4))--

   Struck: "(A) possesses the necessary qualifications to administer the duties of the official under this subchapter; and

   Struck: "(B) has information security duties as a primary duty of the official; and

   Struck: "(8) ensure that senior agency officials (including component chief information officers or equivalent officials) carry out responsibilities under this subchapter as directed by the official delegated authority under paragraph (4).

   Inserted: "(A) the authority and primary responsibility to implement an agencywide information security program; and

   "([struck: b][inserted: B]) [struck: Agency Program.--The head of each agency shall develop, document, ][inserted: the authority to provide information security for the information collected ]and [struck: implement an agencywide information security program, which shall be reviewed under section 3553(b)(2), to provide information security][inserted: maintained by the agency (or by a contractor, other agency, or other source on behalf of the agency) and] for the information [struck: and information ]systems that support the operations[struck: ][inserted: , assets, ]and [struck: assets][inserted: mission] of the agency[struck: , ][inserted: (]including [struck: those ][inserted: any information system ]provided or managed by [struck: another agency, contractor][inserted: a contractor, other agency], or other source[struck: , which shall include--][inserted: on behalf of the agency);]

   Struck: "(1) the development, execution, and maintenance of a risk management strategy for information security that--

   Struck: "(A) considers information security threats, vulnerabilities, and consequences;

   Struck: "(B) includes periodic assessments and reporting of risk, with a frequency commensurate with risk and impact;

   Struck: "(2) policies and procedures that--

   Show 1 more struck paragraphShow less

   Struck: "(A) are based on the risk management strategy and assessment results required under paragraph (1);

   Inserted: "(6) delegate to the appropriate agency official (who is responsible for a particular agency system or subsystem) the responsibility to ensure and enforce compliance with all requirements of the agency's agencywide information security program in coordination with the Chief Information Officer or equivalent (or the senior agency official who reports to the Chief Information Officer or equivalent) under paragraph (5);

   Inserted: "(7) ensure that an agency has trained personnel who have obtained any necessary security clearances to permit them to assist the agency in complying with this subchapter;

   Inserted: "(8) ensure that the Chief Information Officer or equivalent (or the senior agency official who reports to the Chief Information Officer or equivalent) under paragraph (5), in coordination with other senior agency officials, reports to the agency head on the effectiveness of the agencywide information security program, including the progress of any remedial actions; and

   Inserted: "(9) ensure that the Chief Information Officer or equivalent (or the senior agency official who reports to the Chief Information Officer or equivalent) under paragraph (5) has the necessary qualifications to administer the functions described in this subchapter and has information security duties as a primary duty of that official.

   Inserted: "(b) Chief Information Officers.--Each Chief Information Officer or equivalent (or the senior agency official who reports to the Chief Information Officer or equivalent) under subsection (a)(5) shall--

   Inserted: "(1) establish and maintain an enterprise security operations capability that on a continuous basis--

   Inserted: "(A) detects, reports, contains, mitigates, and responds to information security incidents that impair adequate security of the agency's information or information system in a timely manner and in accordance with the policies and directives under section 3553; and

   Inserted: "(B) reports any information security incident under subparagraph (A) to the entity designated under section 3555;

   Inserted: "(2) develop, maintain, and oversee an agencywide information security program;

   Inserted: "(3) develop, maintain, and oversee information security policies, procedures, and control techniques to address applicable requirements, including requirements under section 3553 of this title and section 11331 of title 40; and

   Inserted: "(4) train and oversee the agency personnel who have significant responsibility for information security with respect to that responsibility.

   Inserted: "(c) Agencywide Information Security Programs.--

   Show 18 more inserted paragraphsShow less

   Inserted: "(1) In general.--Each agencywide information security program under subsection (b)(2) shall include--

   Inserted: "(A) relevant security risk assessments, including technical assessments and others related to the acquisition process;

   Inserted: "(B) security testing commensurate with risk and impact;

   Inserted: "(C) mitigation of deterioration of security controls commensurate with risk and impact;

   Inserted: "(D) risk-based continuous monitoring and threat assessment of the operational status and security of agency information systems to enable evaluation of the effectiveness of and compliance with information security policies, procedures, and practices, including a relevant and appropriate selection of security controls of information systems identified in the inventory under section 3505(c);

   Inserted: "(E) operation of appropriate technical capabilities in order to detect, mitigate, report, and respond to information security incidents, cyber threat information, and deterioration of security controls in a manner that is consistent with the policies and directives under section 3553, including--

   Inserted: "(i) mitigating risks associated with such information security incidents;

   Inserted: "(ii) notifying and consulting with the entity designated under section 3555; and

   Inserted: "(iii) notifying and consulting with, as appropriate--

   Inserted: "(I) law enforcement and the relevant Office of the Inspector General; and

   Inserted: "(II) any other entity, in accordance with law and as directed by the President;

   Inserted: "(F) a process to ensure that remedial action is taken to address any deficiencies in the information security policies, procedures, and practices of the agency; and

   Inserted: "(G) a plan and procedures to ensure the continuity of operations for information systems that support the operations and assets of the agency.

   Inserted: "(2) Risk management strategies.--Each agencywide information security program under subsection (b)(2) shall include the development and maintenance of a risk management strategy for information security. The risk management strategy shall include--

   Inserted: "(A) consideration of information security incidents, cyber threat information, and deterioration of security controls; and

   Inserted: "(B) consideration of the consequences that could result from the unauthorized access, use, disclosure, disruption, modification, or destruction of information and information systems that support the operations and assets of the agency, including any information system provided or managed by a contractor, other agency, or other source on behalf of the agency;

   Inserted: "(3) Policies and procedures.--Each agencywide information security program under subsection (b)(2) shall include policies and procedures that--

   Inserted: "(A) are based on the risk management strategy under paragraph (2);

   "(B) reduce information security risks to an acceptable level in a cost-effective manner;

   "(C) ensure that cost-effective and adequate information security is addressed [struck: throughout ][inserted: as part of ]the [struck: life cycle ][inserted: acquisition and ongoing management ]of each agency information system; and

   "(D) ensure compliance with--

   "(i) this subchapter;[inserted: and]

   Struck: "(ii) the information security policies and directives issued under section 3553(b); and

   "([struck: iii][inserted: ii]) any other applicable requirements[struck: ;][inserted: .]

   Struck: "(3) subordinate plans for providing adequate information security for networks, facilities, and systems or groups of information systems;

   "(4) [inserted: Training requirements.--Each agencywide information ]security [struck: awareness training developed in accordance with the requirements issued ][inserted: program under subsection (b)(2) shall include information security, privacy, civil rights, civil liberties, and information oversight training that meets any applicable requirements ]under section 3553[struck: (b) to ][inserted: . The training shall ]inform [struck: individuals with ][inserted: each information security personnel that has ]access to agency information systems[struck: , ][inserted: (]including [struck: information security employees, ]contractors[struck: ,] and other users of information systems that support the operations and assets of the agency[struck: ,][inserted: )] of--

   "(A) [inserted: the ]information security risks associated with [struck: their ][inserted: the information security personnel's ]activities;[inserted: and]

   "(B) [struck: their responsibilities in complying ][inserted: the individual's responsibility to comply ]with [inserted: the ]agency policies and procedures [struck: designed to ][inserted: that ]reduce [struck: those][inserted: the] risks[struck: ;][inserted: under subparagraph (A).]

   Struck: "(C) requirements for fulfilling privacy, civil rights, civil liberties, and other information oversight responsibilities; and

   Struck: "(D) methods for individuals to report risks and incidents to relevant Offices of Inspectors General and the Secretary under section 106 of the Cybersecurity Act of 2012;

   Struck: "(5) security testing and evaluation commensurate with risk and impact that includes--

   Struck: "(A) risk-based continuous monitoring of the operational status and security of agency information systems to enable evaluation of the effectiveness of and compliance with information security policies, procedures, and practices, including a relevant and appropriate selection of management, operational, and technical controls of information systems identified in the inventory required under section 3505(c);

   Show 40 more struck paragraphsShow less

   Struck: "(B) penetration testing exercises and operational evaluations in accordance with the requirements issued under section 3553(b) to evaluate whether the agency adequately protects against, detects, and responds to incidents;

   Struck: "(C) vulnerability scanning, intrusion detection and prevention, and penetration testing, in accordance with the requirements issued under section 3553(b); and

   Struck: "(D) any other periodic testing and evaluation, in accordance with the requirements issued under section 3553(b);

   Struck: "(6) a process for ensuring that remedial actions are taken to mitigate information security vulnerabilities commensurate with risk and impact, and otherwise address any deficiencies in the information security policies, procedures, and practices of the agency;

   Struck: "(7) policies and procedures to ensure detection, mitigation, reporting, and responses to information security incidents, in accordance with the policies and directives issued under section 3553(b), including--

   Struck: "(A) ensuring timely internal reporting of information security incidents;

   Struck: "(B) establishing and maintaining appropriate technical capabilities to detect and mitigate risks associated with information security incidents;

   Struck: "(C) notifying and consulting with the entity designated by the Secretary under section 3553(b)(6); and

   Struck: "(D) notifying and consulting with--

   Struck: "(i) law enforcement agencies and relevant Offices of Inspectors General;

   Struck: "(ii) relevant committees of Congress, as appropriate; and

   Struck: "(iii) any other entity, in accordance with law and as directed by the President; and

   Struck: "(8) plans and procedures to ensure continuity of operations for information systems that support the operations and assets of the agency.

   Struck: "(c) Annual Agency Reporting.--The head of each agency shall--

   Struck: "(1) report annually to the Committee on Government Reform and the Committee on Science, Space, and Technology of the House of Representatives, the Committee on Homeland Security and Governmental Affairs and the Committee on Commerce, Science, and Transportation of the Senate, any other appropriate committees of Congress, and the Secretary on the adequacy and effectiveness of information security policies, procedures, and practices, including--

   Struck: "(A) a description of each major information security incident, or set of related incidents, resulting in significant compromise of information security, including a summary of--

   Struck: "(i) the threats, vulnerabilities, and impact of the incident;

   Struck: "(ii) the system risk assessment conducted before the incident and required under section 3554(a)(2); and

   Struck: "(iii) the detection and response actions taken;

   Struck: "(B) the number of information security incidents within the agency resulting in significant compromise of information security, presented by system impact level, type of incident, and location;

   Struck: "(C) the total number of information security incidents within the agency, presented by system impact level, type of incident, and location;

   Struck: "(D) an identification and analysis of, including actions and plans to address, any significant deficiencies identified in such policies, procedures and practices;

   Struck: "(E) any information or evaluation required under the reporting requirements issued under section 3553(b); and

   Struck: "(2) address the adequacy and effectiveness of the information security policies, procedures, and practices of the agency as required for management and budget plans and reports, as appropriate.

   Struck: "(d) Communications and System Traffic.--Notwithstanding any other provision of law, the head of each agency is authorized to allow the Secretary, or a private entity providing assistance to the Secretary under section 3553, to acquire, intercept, retain, use, and disclose communications, system traffic, records, or other information transiting to or from or stored on an agency information system for the purpose of protecting agency information and information systems from information security threats or mitigating the threats in connection with the implementation of the information security capabilities authorized by paragraph (3) or (4) of section 3553(b).

   Struck: "Sec. 3555. Annual assessments

   Struck: "(a) In General.--Except as provided in subsection (c), the Secretary shall conduct periodic assessments of the information security programs and practices of agencies based on the annual agency reports required under section 3554(c), the annual independent evaluations required under section 3556, the results of any continuous monitoring, and other available information.

   Struck: "(b) Contents.--Each assessment conducted under subsection (a) shall--

   Struck: "(1) assess the effectiveness of agency information security policies, procedures, and practices;

   Struck: "(2) provide an assessment of the status of agency information system security for the Federal Government as a whole; and

   Struck: "(3) include recommendations for improving information system security for an agency or the Federal Government as a whole.

   Struck: "(c) Certain Information Systems.--

   Struck: "(1) National security systems.--A periodic assessment conducted under subsection (a) relating to a national security system shall be prepared as directed by the President.

   Struck: "(2) Specific agencies.--Periodic assessments conducted under subsection (a) shall be prepared in accordance with governmentwide reporting requirements by--

   Struck: "(A) the Secretary of Defense for information systems under the control of the Department of Defense;

   Struck: "(B) the Director of the Central Intelligence Agency for information systems under the control of the Central Intelligence Agency; and

   Struck: "(C) the Director of National Intelligence for information systems under the control of the Office of the Director of National Intelligence.

   Struck: "(d) Agency-specific Assessments.--Each assessment conducted under subsection (a) that relates, in whole or in part, to the information systems of an agency shall be made available to the head of the agency.

   Struck: "(e) Protection of Information.--In conducting assessments under subsection (a), the Secretary shall take appropriate actions to ensure the protection of information which, if disclosed, may adversely affect information security. Such protections shall be commensurate with the risk and comply with all applicable laws and policies.

   Struck: "(f) Report to Congress.--The Secretary, in coordination with the Secretary of Defense, the Director of the Central Intelligence Agency, and the Director of National Intelligence, shall evaluate and submit to Congress an annual report on the adequacy and effectiveness of the information security programs and practices assessed under this section.

   Inserted: "(d) Annual Report.--Each agency shall submit a report annually to the Secretary of Homeland Security on its agencywide information security program and information systems.

   Inserted: "Sec. 3555. Multiagency ongoing threat assessment

   Inserted: "(a) Implementation.--The Director of the Office of Management and Budget, in coordination with the Secretary of Homeland Security, shall designate an entity to implement ongoing security analysis concerning agency information systems--

   Inserted: "(1) based on cyber threat information;

   Inserted: "(2) based on agency information system and environment of operation changes, including--

   Inserted: "(A) an ongoing evaluation of the information system security controls; and

   Inserted: "(B) the security state, risk level, and environment of operation of an agency information system, including--

   Inserted: "(i) a change in risk level due to a new cyber threat;

   Inserted: "(ii) a change resulting from a new technology;

   Inserted: "(iii) a change resulting from the agency's mission; and

   Inserted: "(iv) a change resulting from the business practice; and

   Inserted: "(3) using automated processes to the maximum extent possible--

   Show 12 more inserted paragraphsShow less

   Inserted: "(A) to increase information system security;

   Inserted: "(B) to reduce paper-based reporting requirements; and

   Inserted: "(C) to maintain timely and actionable knowledge of the state of the information system security.

   Inserted: "(b) Standards.--The National Institute of Standards and Technology may promulgate standards, in coordination with the Secretary of Homeland Security, to assist an agency with its duties under this section.

   Inserted: "(c) Compliance.--The head of each appropriate department and agency shall be responsible for ensuring compliance and implementing necessary procedures to comply with this section. The head of each appropriate department and agency, in consultation with the Director of the Office of Management and Budget and the Secretary of Homeland Security, shall--

   Inserted: "(1) monitor compliance under this section;

   Inserted: "(2) develop a timeline and implement for the department or agency--

   Inserted: "(A) adoption of any technology, system, or method that facilitates continuous monitoring and threat assessments of an agency information system;

   Inserted: "(B) adoption or updating of any technology, system, or method that prevents, detects, or remediates a significant cyber incident to a Federal information system of the department or agency that has impeded, or is reasonably likely to impede, the performance of a critical mission of the department or agency; and

   Inserted: "(C) adoption of any technology, system, or method that satisfies a requirement under this section.

   Inserted: "(d) Limitation of Authority.--The authorities of the Director of the Office of Management and Budget and of the Secretary of Homeland Security under this section shall not apply to national security systems.

   Inserted: "(e) Report.--Not later than 6 months after the date of enactment of the Strengthening and Enhancing Cybersecurity by Using Research, Education, Information, and Technology Act of 2012, the Government Accountability Office shall issue a report evaluating each agency's status toward implementing this section.

   "Sec. 3556. Independent evaluations

   Inserted: "(a) In General.--The Council of the Inspectors General on Integrity and Efficiency, in consultation with the Director and the Secretary of Homeland Security, the Secretary of Commerce, and the Secretary of Defense, shall issue and maintain criteria for the timely, cost-effective, risk-based, and independent evaluation of each agencywide information security program (and practices) to determine the effectiveness of the agencywide information security program (and practices). The criteria shall include measures to assess any conflicts of interest in the performance of the evaluation and whether the agencywide information security program includes appropriate safeguards against disclosure of information where such disclosure may adversely affect information security.

   "([struck: a][inserted: b]) [struck: In General][inserted: Annual Independent Evaluations].--[struck: Not less than annually,][inserted: Each agency shall perform] an [inserted: annual ]independent evaluation of [struck: the ][inserted: its agencywide ]information security program [inserted: (]and practices[struck: of each agency shall be performed to assess ][inserted: ) in accordance with ]the [struck: effectiveness of the programs and practices][inserted: criteria under subsection (a)].

   Struck: "(b) Contents.--Each evaluation performed under subsection (a) shall include--

   Struck: "(1) testing of the effectiveness of information security policies, procedures, and practices of a representative subset of the information systems of the agency; and

   Struck: "(2) an assessment of the effectiveness of the information security policies, procedures, and practices of the agency.

   Struck: "(c) Conduct of Independent Evaluations.--Except as provided in subsection (f), an evaluation of an agency under subsection (a) shall be performed by--

   Show 5 more struck paragraphsShow less

   Struck: "(1) the Inspector General of the agency;

   Struck: "(2) at the discretion of the Inspector General of the agency, an independent entity entering a contract with the Inspector General to perform the evaluation; or

   Struck: "(3) if the agency does not have an Inspector General, an independent entity selected by the head of the agency, in consultation with the Secretary.

   Struck: "(d) Previously Conducted Evaluations.--The evaluation required by this section may be based in whole or in part on a previously conducted audit, evaluation, or report relating to programs or practices of the applicable agency.

   Struck: "(e) Reports.--The official or entity performing an evaluation of an agency under subsection (a) shall submit to Congress, the agency, and the Comptroller General of the United States a report regarding the evaluation. The head of the agency shall provide to the Secretary a report received under this subsection.

   Inserted: "(c) Distribution of Reports.--Not later than 30 days after receiving an independent evaluation under subsection (b), each agency head shall transmit a copy of the independent evaluation to the Secretary of Homeland Security, the Secretary of Commerce, and the Secretary of Defense.

   "([struck: f][inserted: d]) National Security Systems.--[struck: An evaluation under subsection (a) of a ][inserted: Evaluations involving ]national security [struck: system][inserted: systems] shall be [struck: performed][inserted: conducted] as directed by [struck: the ]President.

   Struck: "(g) Comptroller General.--The Comptroller General of the United States shall periodically evaluate and submit to Congress reports on--

   Struck: "(1) the adequacy and effectiveness of the information security policies and practices of agencies; and

   Struck: "(2) implementation of this subchapter.

   Struck: "Sec. 3557. National security systems "The head of each agency operating or exercising control of a national security system shall be responsible for ensuring that the agency--

   Show 12 more struck paragraphsShow less

   Struck: "(1) provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized use, disclosure, disruption, modification, or destruction of the information contained in the national security system;

   Struck: "(2) implements information security policies and practices as required by standards and guidelines for national security systems issued in accordance with law and as directed by the President; and

   Struck: "(3) complies with this subchapter.

   Struck: "Sec. 3558. Effect on existing law "Nothing in this subchapter shall be construed to alter or amend any law regarding the authority of any head of an agency over the agency.".

   Struck: (b) Technical and Conforming Amendment.--The table of sections for chapter 35 of title 44 is amended by striking the matter relating to subchapters II and III and inserting the following:

   Struck: "subchapter ii--information security

   Struck: "Sec. 3551. Purposes.

   Struck: "Sec. 3552. Definitions.

   Struck: "Sec. 3553. Federal information security authority and coordination.

   Struck: "Sec. 3554. Agency responsibilities.

   Struck: "Sec. 3555. Annual assessments.

   Struck: "Sec. 3556. Independent evaluations.

   "Sec. 3557. National security systems.

   Struck: "Sec. 3558. Effect on existing law.".

   Inserted: "The head of each agency operating or exercising control of a national security system shall be responsible for ensuring that the agency--

   Inserted: "(1) provides information security protections commensurate with the risk and magnitude of the harm resulting from the unauthorized access, use, disclosure, disruption, modification, or destruction of the information contained in such system; and

   Inserted: "(2) implements information security policies and practices as required by standards and guidelines for national security systems, issued in accordance with law and as directed by the President.".

   Inserted: (b) Savings Provisions.--

   Inserted: (1) Policy and compliance guidance.--Policy and compliance guidance issued by the Director before the date of enactment of this Act under section 3543(a)(1) of title 44, United States Code (as in effect on the day before the date of enactment of this Act), shall continue in effect, according to its terms, until modified, terminated, superseded, or repealed pursuant to section 3553(a)(1) of title 44, United States Code.

   Inserted: (2) Standards and guidelines.--Standards and guidelines issued by the Secretary of Commerce or by the Director before the date of enactment of this Act under section 11331(a)(1) of title 40, United States Code, (as in effect on the day before the date of enactment of this Act) shall continue in effect, according to their terms, until modified, terminated, superseded, or repealed pursuant to section 11331(a)(1) of title 40, United States Code, as amended by this Act.

   Inserted: (c) Technical and Conforming Amendments.--

   Inserted: (1) Chapter analysis.--The chapter analysis for chapter 35 of title 44, United States Code, is amended--

   Inserted: (A) by striking the items relating to sections 3531 through 3538;

   Inserted: (B) by striking the items relating to sections 3541 through 3549; and

   Inserted: (C) by inserting the following:

   Inserted: "3551. Purposes.

   Show 20 more inserted paragraphsShow less

   Inserted: "3552. Definitions.

   Inserted: "3553. Federal information security authority and coordination.

   Inserted: "3554. Agency responsibilities.

   Inserted: "3555. Multiagency ongoing threat assessment.

   Inserted: "3556. Independent evaluations.

   Inserted: "3557. National security systems.".

   Inserted: (2) Other references.--

   Inserted: (A) Section 1001(c)(1)(A) of the Homeland Security Act of 2002 (6 U.S.C. 511(1)(A)) is amended by striking "section 3532(3)" and inserting "section 3552".

   Inserted: (B) Section 2222(j)(5) of title 10, United States Code, is amended by striking "section 3542(b)(2)" and inserting "section 3552".

   Inserted: (C) Section 2223(c)(3) of title 10, United States Code, is amended, by striking "section 3542(b)(2)" and inserting "section 3552".

   Inserted: (D) Section 2315 of title 10, United States Code, is amended by striking "section 3542(b)(2)" and inserting "section 3552".

   Inserted: (E) Section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) is amended--

   Inserted: (i) in subsection (a)(2), by striking "section 3532(b)(2)" and inserting "section 3552";

   Inserted: (ii) in subsection (c)(3), by striking "Director of the Office of Management and Budget" and inserting "Secretary of Commerce";

   Inserted: (iii) in subsection (d)(1), by striking "Director of the Office of Management and Budget" and inserting "Secretary of Commerce";

   Inserted: (iv) in subsection (d)(8) by striking "Director of the Office of Management and Budget" and inserting "Secretary of Commerce";

   Inserted: (v) in subsection (d)(8), by striking "submitted to the Director" and inserting "submitted to the Secretary";

   Inserted: (vi) in subsection (e)(2), by striking "section 3532(1) of such title" and inserting "section 3552 of title 44"; and

   Inserted: (vii) in subsection (e)(5), by striking "section 3532(b)(2) of such title" and inserting "section 3552 of title 44".

   Inserted: (F) Section 8(d)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7406(d)(1)) is amended by striking "section 3534(b)" and inserting "section 3554(b)(2)".

   SEC. 202. MANAGEMENT OF INFORMATION TECHNOLOGY.

   (a) In General.--Section 11331 of title 40, United States Code, is amended to read as follows:

   "Sec. 11331. Responsibilities for Federal information systems standards

   Struck: "(a) Definitions.--In this section:

   Struck: "(1) Federal information system.--The term 'Federal information system' means an information system used or operated by an executive agency, by a contractor of an executive agency, or by another entity on behalf of an executive agency.

   Struck: "(2) Information security.--The term 'information security' has the meaning given that term in section 3552 of title 44.

   Struck: "(3) National security system.--The term 'national security system' has the meaning given that term in section 3552 of title 44.

   "([struck: b][inserted: a]) Standards and Guidelines.--

   Struck: "(1) Authority to prescribe.--Except as provided under paragraph (2), and based on the standards and guidelines developed by the National Institute of Standards and Technology under paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act (15 U.S.C. 278g- 3(a)), the Secretary of Commerce, in consultation with the Secretary of Homeland Security, shall prescribe standards and guidelines relating to Federal information systems.

   Inserted: "(1) Authority to prescribe.--Except as provided under paragraph (2), the Secretary of Commerce shall prescribe standards and guidelines pertaining to Federal information systems--

   Inserted: "(A) in consultation with the Secretary of Homeland Security; and

   Inserted: "(B) on the basis of standards and guidelines developed by the National Institute of Standards and Technology under paragraphs (2) and (3) of section 20(a) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3(a)(2) and (a)(3)).

   "(2) National security systems.--Standards and guidelines for national security systems shall be developed, prescribed, enforced, and overseen as otherwise authorized by law and as directed by the President.

   Struck: "(c) Mandatory Requirements.--

   Inserted: "(b) Mandatory Standards and Guidelines.--

   "(1) Authority to make mandatory[inserted: standards and guidelines].--The Secretary of Commerce [struck: may require executive agencies to comply with the ][inserted: shall make ]standards [struck: prescribed ][inserted: and guidelines ]under subsection ([struck: b][inserted: a])(1) [inserted: compulsory and binding ]to the extent determined necessary by the Secretary of Commerce to improve the efficiency of operation or security of Federal information systems.

   "(2) Required mandatory standards[inserted: and guidelines].--

   Struck: "(A) In general.--The Secretary of Commerce shall require executive agencies to comply with the standards described in subparagraph (B).

   Struck: "(B) Contents.--The standards described in this subparagraph are information security standards that--

   Inserted: "(A) In general.--Standards and guidelines under subsection (a)(1) shall include information security standards that--

   "(i) provide minimum information security requirements as determined under section 20(b) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3(b)); and

   "(ii) are otherwise necessary to improve the security of Federal information and [struck: Federal ]information systems.

   Struck: "(d) Authority To Disapprove or Modify.--The President may disapprove or modify the standards and guidelines prescribed under subsection (b)(1) if the President determines such action to be in the public interest. The authority of the President to disapprove or modify the standards and guidelines may be delegated to the Director of the Office of Management and Budget. Notice of a disapproval or modification under this subsection shall be published promptly in the Federal Register. Upon receiving notice of a disapproval or modification, the Secretary of Commerce shall immediately rescind or modify the standards or guidelines as directed by the President or the Director of the Office of Management and Budget.

   Inserted: "(B) Binding effect.--Information security standards under subparagraph (A) shall be compulsory and binding.

   "([struck: e][inserted: c]) Exercise of Authority.--To ensure fiscal and policy consistency, the Secretary of Commerce shall exercise the authority [struck: under ][inserted: conferred by ]this section subject to direction by the President and in coordination with the Director[struck: of the Office of Management and Budget].

   "([struck: f][inserted: d]) Application of More Stringent Standards[inserted: and Guidelines].--The head of an executive agency may employ standards for the cost-effective information security for [struck: Federal ]information systems [inserted: within or under the supervision ]of that agency that are more stringent than the standards [struck: prescribed by][inserted: and guidelines] the Secretary of Commerce [inserted: prescribes ]under [struck: subsection (b)(1)][inserted: this section] if the more stringent standards[inserted: and guidelines]--

   "(1) contain [struck: any standards with which the Secretary of Commerce has required ][inserted: at least the applicable standards and guidelines made compulsory and binding by ]the [struck: agency to comply][inserted: Secretary of Commerce]; and

   "(2) are otherwise consistent with the policies[struck: ][inserted: , directives, ]and [struck: directives ][inserted: implementation memoranda ]issued under section 3553([struck: b][inserted: a]) of title 44.

   "([struck: g][inserted: e]) Decisions on Promulgation of Standards[inserted: and Guidelines].--The decision by the Secretary of Commerce regarding the promulgation of any standard [inserted: or guideline ]under this section shall occur not later than 6 months after the [inserted: date of ]submission of the proposed standard to the Secretary of Commerce by the National Institute of Standards and Technology[struck: , as provided ][inserted: ]under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. [struck: 278g- 3][inserted: 278g-3]).[struck: ".]

   Struck: (b) Technical and Conforming Amendments.--

   Struck: (1) Section 3502(8)) of title 44, United States Code, is amended by inserting "hosting," after "collection,".

   Struck: (2) The National Institute of Standards and Technology Act (15 U.S.C. 271 et seq.) is amended--

   Struck: (A) in section 20(a)(2) (15 U.S.C. 278g-3(a)(2)), by striking "section 3532(b)(2)" and inserting "section 3552(b)"; and

   Show 16 more struck paragraphsShow less

   Struck: (B) in section 21(b) (15 U.S.C. 278g-4(b))--

   Struck: (i) in paragraph (2), by inserting ", the Secretary of Homeland Security," after "the Institute"; and

   Struck: (ii) in paragraph (3), by inserting "the Secretary of Homeland Security," after "the Secretary of Commerce,".

   Struck: (3) Section 1001(c)(1)(A) of the Homeland Security Act of 2002 (6 U.S.C. 511(c)(1)(A)) is amended by striking "section 3532(3)" and inserting "section 3552(b)".

   Struck: (4) Part IV of title 10, United States Code, is amended--

   Struck: (A) in section 2222(j)(5), by striking "section 3542(b)(2)" and inserting "section 3552(b)";

   Struck: (B) in section 2223(c)(3), by striking "section 3542(b)(2)" and inserting "section 3552(b)"; and

   Struck: (C) in section 2315, by striking "section 3542(b)(2)" and inserting "section 3552(b)".

   Struck: (5) Section 8(d)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7406(d)(1)) is amended by striking "section 3534(b)" and inserting "section 3554(b)".

   Struck: SEC. 203. SAVINGS PROVISIONS.

   Struck: (a) In General.--Policies and compliance guidance issued by the Director of the Office of Management and Budget before the date of enactment of this Act under section 3543(a)(1) of title 44 (as in effect on the day before the date of enactment of this Act) shall continue in effect, according to their terms, until modified, terminated, superseded, or repealed under section 3553(b)(1) of title 44, as added by this Act.

   Struck: (b) Other Standards and Guidelines.--Standards and guidelines issued by the Secretary of Commerce or by the Director of the Office of Management and Budget before the date of enactment of this Act under section 11331(b)(1) of title 40 (as in effect on the day before the date of enactment of this Act) shall continue in effect, according to their terms, until modified, terminated, superseded, or repealed under section 11331(b)(1), as added by this Act.

   Struck: SEC. 204. CONSOLIDATION OF EXISTING DEPARTMENTAL CYBER RESOURCES AND AUTHORITIES.

   Struck: (a) In General.--Title II of the Homeland Security Act of 2002 (6 U.S.C. 121 et seq.) is amended by adding at the end the following:

   Struck: "Subtitle E--Cybersecurity

   Struck: "SEC. 241. DEFINITIONS.

   Inserted: "(f) Notice and Comment.--A decision by the Secretary of Commerce to significantly modify, or not promulgate, a proposed standard submitted to the Secretary by the National Institute of Standards and Technology under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) shall be made after the public is given an opportunity to comment on the Secretary's proposed decision.

   "[inserted: (g) Definitions.--]In this [struck: subtitle][inserted: section]:

   Struck: "(1) Agency information infrastructure.--The term 'agency information infrastructure' means the Federal information infrastructure of a particular Federal agency.

   Struck: "(2) Center.--The term 'Center' means the National Center for Cybersecurity and Communications established under section 242.

   "([struck: 3][inserted: 1]) [struck: Damage][inserted: Federal information system].--The term '[struck: damage][inserted: Federal information system]' has the meaning given [struck: that][inserted: the] term in section [struck: 1030(e)][inserted: 3552] of title [struck: 18, United States Code][inserted: 44].

   "([struck: 4][inserted: 2]) [struck: Federal agency][inserted: Information security].--The term '[struck: Federal agency][inserted: information security]' has the meaning given the term [struck: 'agency' ]in section [struck: 3502][inserted: 3552] of title 44[struck: , United States Code].

   Struck: "(5) Federal cybersecurity center.--The term 'Federal cybersecurity center' has the meaning given that term in section 708 of the Cybersecurity Act of 2012.

   "([struck: 6][inserted: 3]) [struck: Federal entity][inserted: National security system].--The term '[struck: Federal entity][inserted: national security system]' has the meaning given [struck: that][inserted: the] term in section [struck: 708][inserted: 3552] of [struck: the Cybersecurity Act of 2012][inserted: title 44].[inserted: ".]

   Struck: "(7) Federal information infrastructure.--The term 'Federal information infrastructure'--

   Struck: "(A) means information and information systems that are owned, operated, controlled, or licensed solely for use by, or on behalf of, any Federal agency, including information systems used or operated by another entity on behalf of a Federal agency; and

   Struck: "(B) does not include--

   Struck: "(i) a national security system; or

   Show 119 more struck paragraphsShow less

   Struck: "(ii) information and information systems that are owned, operated, controlled, or licensed for use solely by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community.

   Struck: "(8) Incident.--The term 'incident' has the meaning given that term in section 3552 of title 44, United States Code.

   Struck: "(9) Information security.--The term 'information security' has the meaning given that term in section 3552 of title 44, United States Code.

   Struck: "(10) Information system.--The term 'information system' has the meaning given that term in section 3502 of title 44, United States Code.

   Struck: "(11) Intelligence community.--The term 'intelligence community' has the meaning given that term in section 3(4) of the National Security Act of 1947 (50 U.S.C. 401a(4)).

   Struck: "(12) National security and emergency preparedness communications infrastructure.--The term 'national security and emergency preparedness communications infrastructure' means the systems supported or covered by the Office of Emergency Communications and the National Communications System on the date of enactment of the Cybersecurity Act of 2012 or otherwise described in Executive Order 12472, or any successor thereto, relating to national security and emergency preparedness communications functions.

   Struck: "(13) National information infrastructure.--The term 'national information infrastructure' means information and information systems--

   Struck: "(A) that are owned, operated, or controlled, in whole or in part, within or from the United States; and

   Struck: "(B) that are not owned, operated, controlled, or licensed for use by a Federal agency.

   Struck: "(14) National security system.--The term 'national security system' has the meaning given that term in section 3552 of title 44, United States Code.

   Struck: "(15) Non-federal entity.--The term 'non-Federal entity' has the meaning given that term in section 708 of the Cybersecurity Act of 2012.

   Struck: "SEC. 242. CONSOLIDATION OF EXISTING RESOURCES.

   Struck: "(a) Establishment.--There is established within the Department a National Center for Cybersecurity and Communications.

   Struck: "(b) Transfer of Functions.--There are transferred to the Center the National Cyber Security Division, the Office of Emergency Communications, and the National Communications System, including all the functions, personnel, assets, authorities, and liabilities of the National Cyber Security Division, the Office of Emergency Communications, and the National Communications System.

   Struck: "(c) Director.--The Center shall be headed by a Director, who shall be appointed by the President, by and with the advice and consent of the Senate, and who shall report directly to the Secretary.

   Struck: "(d) Duties.--The Director of the Center shall--

   Struck: "(1) manage Federal efforts to secure, protect, and ensure the resiliency of the Federal information infrastructure, national information infrastructure, and national security and emergency preparedness communications infrastructure of the United States, working cooperatively with appropriate government agencies and the private sector;

   Struck: "(2) support private sector efforts to secure, protect, and ensure the resiliency of the national information infrastructure;

   Struck: "(3) prioritize the efforts of the Center to address the most significant risks and incidents that have caused or are likely to cause damage to the Federal information infrastructure, the national information infrastructure, and national security and emergency preparedness communications infrastructure of the United States;

   Struck: "(4) ensure, in coordination with the privacy officer designated under subsection (j), the privacy officer appointed under section 222, and the Director of the Office of Civil Rights and Civil Liberties appointed under section 705, that the activities of the Center comply with all policies, regulations, and laws protecting the privacy and civil liberties of United States persons; and

   Struck: "(5) perform such other duties as the Secretary may require relating to the security and resiliency of the Federal information infrastructure, national information infrastructure, and the national security and emergency preparedness communications infrastructure of the United States.

   Struck: "(e) Authorities and Responsibilities of Center.--The Center shall--

   Struck: "(1) engage in activities and otherwise coordinate Federal efforts to identify, protect against, remediate, and mitigate, respond to, and recover from cybersecurity threats, consequences, vulnerabilities and incidents impacting the Federal information infrastructure and the national information infrastructure, including by providing support to entities that own or operate national information infrastructure, at their request;

   Struck: "(2) conduct risk-based assessments of the Federal information infrastructure, and risk assessments of critical infrastructure;

   Struck: "(3) develop, oversee the implementation of, and enforce policies, principles, and guidelines on information security for the Federal information infrastructure, including exercise of the authorities under the Federal Information Security Management Act of 2002 (title III of Public Law 107-347; 116 Stat. 2946);

   Struck: "(4) evaluate and facilitate the adoption of technologies designed to enhance the protection of information infrastructure, including making such technologies available to entities that own or operate national information infrastructure, with or without reimbursement, as necessary to accomplish the purposes of this section;

   Struck: "(5) oversee the responsibilities related to national security and emergency preparedness communications infrastructure, including the functions of the Office of Emergency Communications and the National Communications System;

   Struck: "(6)(A) maintain comprehensive situational awareness of the security of the Federal information infrastructure and the national information infrastructure for the purpose of enabling and supporting activities under subparagraph (e)(1); and

   Struck: "(B) receive and distribute classified and unclassified information from and to entities that own or operate national information infrastructure to support efforts by such entities to secure such infrastructure and for enhancing overall situational awareness;

   Struck: "(7) serve as the focal point for, and foster collaboration between, the Federal Government, State and local governments, and private entities on matters relating to the security of the national information infrastructure;

   Struck: "(8) develop, in coordination with the Assistant Secretary for Infrastructure Protection, other Federal agencies, the private sector, and State and local governments a national incident response plan that details the roles of Federal agencies, State and local governments, and the private sector, and coordinate national cyber incident response efforts;

   Struck: "(9) consult, in coordination with the Secretary of State, with appropriate international partners to enhance the security of the Federal information infrastructure, national information infrastructure, and information infrastructure located outside the United States the disruption of which could result in national or regional catastrophic damage in the United States;

   Struck: "(10) coordinate the activities undertaken by Federal agencies to--

   Struck: "(A) protect Federal information infrastructure and national information infrastructure; and

   Struck: "(B) prepare the Nation to respond to, recover from, and mitigate against risks of incidents involving such infrastructure; and

   Struck: "(11) perform such other duties as the Secretary may require relating to the security and resiliency of the Federal information infrastructure, national information infrastructure, and national security and emergency preparedness communications infrastructure of the United States.

   Struck: "(f) Use of Existing Mechanisms for Collaboration.--To avoid unnecessary duplication or waste, in carrying out the authorities and responsibilities of the Center under this subtitle, to the maximum extent practicable, the Director of the Center shall make use of existing mechanisms for collaboration and information sharing, including mechanisms relating to the identification and communication of cybersecurity threats, vulnerabilities, and associated consequences, established by other components of the Department or other Federal agencies and the information sharing mechanisms established under title VII of the Cybersecurity Act of 2012.

   Struck: "(g) Deputy Directors.--

   Struck: "(1) In general.--There shall be a Deputy Director appointed by the Secretary, who shall--

   Struck: "(A) have expertise in infrastructure protection; and

   Struck: "(B) ensure that the operations of the Center and the Office of Infrastructure Protection avoid duplication and use, to the maximum extent practicable, joint mechanisms for information sharing and coordination with the private sector.

   Struck: "(2) Intelligence community.--The Director of National Intelligence, with the concurrence of the Secretary, shall identify an employee of an element of the intelligence community to serve as a Deputy Director of the Center. The employee shall be detailed to the Center on a reimbursable basis for such period as is agreed to by the Director of the Center and the Director of National Intelligence, and, while serving as Deputy Director, shall report directly to the Director of the Center.

   Struck: "(h) Cybersecurity Exercise Program.--The Director of the Center shall develop and implement a national cybersecurity exercise program with the participation of State and local governments, international partners of the United States, and the private sector.

   Struck: "(i) Liaison Officers.--

   Struck: "(1) Required detail of liaison officers.--The Secretary of Defense, the Attorney General, the Secretary of Commerce, and the Director of National Intelligence shall assign personnel to the Center to act as full-time liaisons.

   Struck: "(2) Optional detail of liaison officers.--The head of any Federal agency not described in paragraph (1), with the concurrence of the Director of the Center, may assign personnel to the Center to act as liaisons.

   Struck: "(3) Private sector liaison.--The Director of the Center shall designate not less than 1 employee of the Center to serve as a liaison with the private sector.

   Struck: "(j) Privacy Officer.--The Director of the Center, in consultation with the Secretary, shall designate a full-time privacy officer.

   Struck: "(k) Sufficiency of Resources Plan.--

   Struck: "(1) Report.--Not later than 120 days after the date of enactment of the Cybersecurity Act of 2012, the Director of the Office of Management and Budget shall submit to the appropriate committees of Congress and the Comptroller General of the United States a report on the resources and staff necessary to carry out fully the responsibilities under this subtitle, including the availability of existing resources and staff.

   Struck: "(2) Comptroller general review.--The Comptroller General of the United States shall evaluate the reasonableness and adequacy of the report submitted by the Director of the Office of Management and Budget under paragraph (1) and submit to the appropriate committees of Congress a report regarding the same.

   Struck: "(l) No Right or Benefit.--The provision of assistance or information under this section to governmental or private entities that own or operate critical infrastructure shall be at the discretion of the Secretary. The provision of certain assistance or information to a governmental or private entity pursuant to this section shall not create a right or benefit, substantive or procedural, to similar assistance or information for any other governmental or private entity.

   Struck: "SEC. 243. DEPARTMENT OF HOMELAND SECURITY INFORMATION SHARING.

   Struck: "(a) Information Sharing.--The Director of the Center shall establish procedures to--

   Struck: "(1) ensure the appropriate, regular, and timely sharing of classified and unclassified cybersecurity information, including information relating to threats, vulnerabilities, traffic, trends, incidents, and other anomalous activities that affect the Federal information infrastructure, national information infrastructure, or information systems between and among appropriate Federal and non-Federal entities, including Federal cybersecurity centers, Federal and non-Federal network and security operations centers, cybersecurity exchanges, and non-Federal entities responsible for such information systems;

   Struck: "(2) expand and enhance the sharing of timely and actionable cybersecurity threat and vulnerability information by the Federal Government with owners and operators of the national information infrastructure;

   Struck: "(3) establish a method of accessing classified or unclassified information, as appropriate and in accordance with applicable laws protecting trade secrets, that will provide situational awareness of the security of the Federal information infrastructure and the national information infrastructure relating to cybersecurity threats, and vulnerabilities, including traffic, trends, incidents, damage, and other anomalous activities affecting the Federal information infrastructure or the national information infrastructure;

   Struck: "(4) develop, in consultation with the Attorney General, the Director of National Intelligence, and the privacy officer established under section 242(j), guidelines to protect the privacy and civil liberties of United States persons and intelligence sources and methods, while carrying out this subsection; and

   Struck: "(5) ensure, to the extent necessary, that any information sharing under this section is consistent with title VII of the Cybersecurity Act of 2012.

   Struck: "(b) Voluntarily Shared Information.--

   Struck: "(1) In general.--The Director of the Center shall ensure that information submitted in accordance with this section by States and units of local governments, private entities, and international partners of the United States regarding threats, vulnerabilities, incidents, and anomalous activities affecting the national information infrastructure, Federal information infrastructure, or information infrastructure that is owned, operated, controlled, or licensed solely for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community is treated as voluntarily shared critical infrastructure information under section 214 as requested by submitting entities.

   Struck: "(2) Limitation.--Paragraph (1) shall not apply to information that is submitted to--

   Struck: "(A) conceal violations of law, inefficiency, or administrative error;

   Struck: "(B) prevent embarrassment to a person, organization, or agency; or

   Struck: "(C) interfere with competition in the private sector.

   Struck: "(c) Limitation on Use of Voluntarily Submitted Information for Regulatory Enforcement Actions.--A Federal entity may not use information submitted under this subtitle as evidence in a regulatory enforcement action against the individual or entity that lawfully submitted the information.

   Struck: "(d) Federal Agencies.--

   Struck: "(1) Information sharing program.--The Director of the Center, in consultation with the members of the Chief Information Officers Council established under section 3603 of title 44, United States Code, shall establish a program for sharing information with and between the Center and other Federal agencies that includes processes and procedures--

   Struck: "(A) under which the Director of the Center regularly shares with each Federal agency analyses and reports regarding the security of such agency information infrastructure and on the overall security of the Federal information infrastructure and information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, which shall include means and methods of preventing, responding to, mitigating, and remediating cybersecurity threats and vulnerabilities; and

   Struck: "(B) under which Federal agencies provide the Director of the Center, upon request, with information concerning the security of the Federal information infrastructure, information infrastructure that is owned, operated, controlled, or licensed for use by, or on behalf of, the Department of Defense, a military department, or another element of the intelligence community, or the national information infrastructure necessary to carry out the duties of the Director of the Center under this subtitle or any other provision of law.

   Struck: "(2) Access to information.--

   Struck: "(A) In general.--The Director of the Center shall ensure--

   Struck: "(i) that the head of each Federal agency has timely access to data, including appropriate raw and processed data, regarding the information infrastructure of the Federal agency; and

   Struck: "(ii) to the greatest extent possible, that the head of each Federal agency is kept apprised of common trends in security compliance as well as the likelihood that a significant cybersecurity risk or incident could cause damage to the agency information infrastructure.

   Struck: "(B) Compliance.--The head of a Federal agency shall comply with all processes and procedures established under this subsection regarding notification to the Director of the Center relating to incidents.

   Struck: "(C) Immediate notification required.--Unless otherwise directed by the President, any Federal agency with a national security system shall, consistent with the level of the risk, immediately notify the Director of the Center regarding any incident affecting the security of a national security system.

   Struck: "SEC. 244. PROHIBITED CONDUCT.

   Struck: "None of the authorities provided under this subtitle shall authorize the Director of the Center, the Center, the Department, or any other Federal entity to--

   Struck: "(1) compel the disclosure of information from a private entity relating to an incident unless otherwise authorized by law; or

   Struck: "(2) intercept a wire, oral, or electronic communication (as those terms are defined in section 2510 of title 18, United States Code), access a stored electronic or wire communication, install or use a pen register or trap and trace device, or conduct electronic surveillance (as defined in section 101 of the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C.1801)) relating to an incident unless otherwise authorized under chapter 119, chapter 121, or chapter 206 of title 18, United States Code, or the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.).".

   Struck: (b) Technical and Conforming Amendment.--The table of contents in section 1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.) is amended by inserting after the item relating to section 237 the following:

   Struck: "Subtitle E--Cybersecurity

   Struck: "Sec. 241. Definitions.

   Struck: "Sec. 242. Consolidation of existing resources.

   Struck: "Sec. 243. Department of Homeland Security information sharing.

   Struck: "Sec. 244. Prohibited conduct.".

   Struck: TITLE III--RESEARCH AND DEVELOPMENT

   Struck: SEC. 301. FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT.

   Struck: (a) Fundamental Cybersecurity Research.--The Director of the Office of Science and Technology Policy (referred to in this section as the "Director"), in coordination with the Secretary and the head of any relevant Federal agency, shall build upon programs and plans in effect as of the date of enactment of this Act to develop a national cybersecurity research and development plan, which shall be updated biennially.

   Struck: (b) Requirements.--The plan required to be developed under subsection (a) shall encourage computer and information science and engineering research to meet challenges in cybersecurity, including--

   Struck: (1) how to design and build complex software-intensive systems that are secure and reliable when first deployed;

   Struck: (2) how to test and verify that software, whether developed locally or obtained from a third party, is free of significant known security flaws;

   Struck: (3) how to test and verify that software obtained from a third party correctly implements stated functionality, and only that functionality;

   Struck: (4) how to guarantee the privacy of the identity, information, or lawful transactions of an individual when stored in distributed systems or transmitted over networks;

   Struck: (5) how to build new protocols to enable the Internet to have robust security as one of the key capabilities of the Internet;

   Struck: (6) how to determine the origin of a message transmitted over the Internet;

   Struck: (7) how to support privacy in conjunction with improved security;

   Struck: (8) how to address the growing problem of insider threat;

   Struck: (9) how improved consumer education and digital literacy initiatives can address human factors that contribute to cybersecurity;

   Struck: (10) how to protect information stored through cloud computing or transmitted through wireless services;

   Struck: (11) conducting research in the areas described in section 4(a)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7403(a)(1)), as amended by subsection (f); and

   Struck: (12) any additional objectives the Director or Secretary determines appropriate.

   Struck: (c) Cybersecurity Practices Research.--The Director of the National Science Foundation shall support research--

   Struck: (1) that develops, evaluates, disseminates, and integrates new cybersecurity practices and concepts into the core curriculum of computer science programs and of other programs where graduates of such programs have a substantial probability of developing software after graduation, including new practices and concepts relating to secure coding education and improvement programs; and

   Struck: (2) that develops new models for professional development of faculty in cybersecurity education, including secure coding development.

   Struck: (d) Cybersecurity Modeling and Test Beds.--

   Struck: (1) Review.--Not later than 1 year after the date of enactment of this Act, the Director shall conduct a review of cybersecurity test beds in existence on the date of enactment of this Act to inform the program established under paragraph (2).

   Struck: (2) Establishment of program.--

   Struck: (A) In general.--The Director of the National Science Foundation, the Secretary, and the Secretary of Commerce shall establish a program for the appropriate Federal agencies to award grants to institutions of higher education or research and development non-profit institutions to establish cybersecurity test beds capable of realistic modeling of real-time cyber attacks and defenses.

   Struck: (B) Requirement.--The test beds established under subparagraph (A) shall be sufficiently large in order to model the scale and complexity of real world networks and environments.

   Struck: (3) Purpose.--The purpose of the program established under paragraph (2) shall be to support the rapid development of new cybersecurity defenses, techniques, and processes by improving understanding and assessing the latest technologies in a real- world environment.

   Struck: (e) Coordination With Other Research Initiatives.--The Director shall to the extent practicable, coordinate research and development activities under this section with other ongoing research and development security-related initiatives, including research being conducted by--

   Struck: (1) the National Institute of Standards and Technology;

   Struck: (2) the Department;

   Struck: (3) other Federal agencies;

   Struck: (4) other Federal and private research laboratories, research entities, and universities and institutions of higher education, and relevant nonprofit organizations; and

   Struck: (5) international partners of the United States.

   Struck: (f) NSF Computer and Network Security Research Grant Areas.-- Section 4(a)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7403(a)(1)) is amended--

   Struck: (1) in subparagraph (H), by striking "and" at the end;

   Inserted: SEC. 203. NO NEW FUNDING.

   Inserted: An applicable Federal agency shall carry out the provisions of this title with existing facilities and funds otherwise available, through such means as the head of the agency considers appropriate.

   Inserted: SEC. 204. TECHNICAL AND CONFORMING AMENDMENTS.

   Inserted: Section 21(b) of the National Institute of Standards and Technology Act (15 U.S.C. 278g-4(b)) is amended--

   Inserted: (1) in paragraph (2), by striking "and the Director of the Office of Management and Budget" and inserting ", the Secretary of Commerce, and the Secretary of Homeland Security"; and

   Inserted: (2) in paragraph (3), by inserting ", the Secretary of Homeland Security," after "the Secretary of Commerce".

   Inserted: SEC. 205. CLARIFICATION OF AUTHORITIES.

   Inserted: Nothing in this title shall be construed to convey any new regulatory authority to any government entity implementing or complying with any provision of this title.

   Inserted: TITLE III--CRIMINAL PENALTIES

   Inserted: SEC. 301. PENALTIES FOR FRAUD AND RELATED ACTIVITY IN CONNECTION WITH COMPUTERS.

   Inserted: Section 1030(c) of title 18, United States Code, is amended to read as follows:

   Inserted: "(c) The punishment for an offense under subsection (a) or (b) of this section is--

   Show 167 more inserted paragraphsShow less

   Inserted: "(1) a fine under this title or imprisonment for not more than 20 years, or both, in the case of an offense under subsection (a)(1) of this section;

   Inserted: "(2)(A) except as provided in subparagraph (B), a fine under this title or imprisonment for not more than 3 years, or both, in the case of an offense under subsection (a)(2); or

   Inserted: "(B) a fine under this title or imprisonment for not more than ten years, or both, in the case of an offense under subsection (a)(2) of this section, if--

   Inserted: "(i) the offense was committed for purposes of commercial advantage or private financial gain;

   Inserted: "(ii) the offense was committed in the furtherance of any criminal or tortious act in violation of the Constitution or laws of the United States, or of any State; or

   Inserted: "(iii) the value of the information obtained, or that would have been obtained if the offense was completed, exceeds $5,000;

   Inserted: "(3) a fine under this title or imprisonment for not more than 10 years, or both, in the case of an offense under subsection (a)(3) of this section;

   Inserted: "(4) a fine under this title or imprisonment of not more than 20 years, or both, in the case of an offense under subsection (a)(4) of this section;

   Inserted: "(5)(A) except as provided in subparagraph (C), a fine under this title, imprisonment for not more than 20 years, or both, in the case of an offense under subsection (a)(5)(A) of this section, if the offense caused--

   Inserted: "(i) loss to 1 or more persons during any 1-year period (and, for purposes of an investigation, prosecution, or other proceeding brought by the United States only, loss resulting from a related course of conduct affecting 1 or more other protected computers) aggregating at least $5,000 in value;

   Inserted: "(ii) the modification or impairment, or potential modification or impairment, of the medical examination, diagnosis, treatment, or care of 1 or more individuals;

   Inserted: "(iii) physical injury to any person;

   Inserted: "(iv) a threat to public health or safety;

   Inserted: "(v) damage affecting a computer used by, or on behalf of, an entity of the United States Government in furtherance of the administration of justice, national defense, or national security; or

   Inserted: "(vi) damage affecting 10 or more protected computers during any 1-year period;

   Inserted: "(B) a fine under this title, imprisonment for not more than 20 years, or both, in the case of an offense under subsection (a)(5)(B), if the offense caused a harm provided in clause (i) through (vi) of subparagraph (A) of this subsection;

   Inserted: "(C) if the offender attempts to cause or knowingly or recklessly causes death from conduct in violation of subsection (a)(5)(A), a fine under this title, imprisonment for any term of years or for life, or both;

   Inserted: "(D) a fine under this title, imprisonment for not more than 10 years, or both, for any other offense under subsection (a)(5);

   Inserted: "(E) a fine under this title or imprisonment for not more than 10 years, or both, in the case of an offense under subsection (a)(6) of this section; or

   Inserted: "(F) a fine under this title or imprisonment for not more than 10 years, or both, in the case of an offense under subsection (a)(7) of this section.".

   Inserted: SEC. 302. TRAFFICKING IN PASSWORDS.

   Inserted: Section 1030(a)(6) of title 18, United States Code, is amended to read as follows:

   Inserted: "(6) knowingly and with intent to defraud traffics (as defined in section 1029) in any password or similar information or means of access through which a protected computer (as defined in subparagraphs (A) and (B) of subsection (e)(2)) may be accessed without authorization.".

   Inserted: SEC. 303. CONSPIRACY AND ATTEMPTED COMPUTER FRAUD OFFENSES.

   Inserted: Section 1030(b) of title 18, United States Code, is amended by inserting "as if for the completed offense" after "punished as provided".

   Inserted: SEC. 304. CRIMINAL AND CIVIL FORFEITURE FOR FRAUD AND RELATED ACTIVITY IN CONNECTION WITH COMPUTERS.

   Inserted: Section 1030 of title 18, United States Code, is amended by striking subsections (i) and (j) and inserting the following:

   Inserted: "(i) Criminal Forfeiture.--

   Inserted: "(1) The court, in imposing sentence on any person convicted of a violation of this section, or convicted of conspiracy to violate this section, shall order, in addition to any other sentence imposed and irrespective of any provision of State law, that such person forfeit to the United States--

   Inserted: "(A) such persons interest in any property, real or personal, that was used, or intended to be used, to commit or facilitate the commission of such violation; and

   Inserted: "(B) any property, real or personal, constituting or derived from any gross proceeds, or any property traceable to such property, that such person obtained, directly or indirectly, as a result of such violation.

   Inserted: "(2) The criminal forfeiture of property under this subsection, including any seizure and disposition of the property, and any related judicial or administrative proceeding, shall be governed by the provisions of section 413 of the Comprehensive Drug Abuse Prevention and Control Act of 1970 (21 U.S.C. 853), except subsection (d) of that section.

   Inserted: "(j) Civil Forfeiture.--

   Inserted: "(1) The following shall be subject to forfeiture to the United States and no property right, real or personal, shall exist in them:

   Inserted: "(A) Any property, real or personal, that was used, or intended to be used, to commit or facilitate the commission of any violation of this section, or a conspiracy to violate this section.

   Inserted: "(B) Any property, real or personal, constituting or derived from any gross proceeds obtained directly or indirectly, or any property traceable to such property, as a result of the commission of any violation of this section, or a conspiracy to violate this section.

   Inserted: "(2) Seizures and forfeitures under this subsection shall be governed by the provisions in chapter 46 relating to civil forfeitures, except that such duties as are imposed on the Secretary of the Treasury under the customs laws described in section 981(d) shall be performed by such officers, agents and other persons as may be designated for that purpose by the Secretary of Homeland Security or the Attorney General.".

   Inserted: SEC. 305. DAMAGE TO CRITICAL INFRASTRUCTURE COMPUTERS.

   Inserted: (a) In General.--Chapter 47 of title 18, United States Code, is amended by inserting after section 1030 the following:

   Inserted: "Sec. 1030A. Aggravated damage to a critical infrastructure computer

   Inserted: "(a) Definitions.--In this section--

   Inserted: "(1) the term 'computer' has the meaning given the term in section 1030;

   Inserted: "(2) the term 'critical infrastructure computer' means a computer that manages or controls systems or assets vital to national defense, national security, national economic security, public health or safety, or any combination of those matters, whether publicly or privately owned or operated, including--

   Inserted: "(A) oil and gas production, storage, conversion, and delivery systems;

   Inserted: "(B) water supply systems;

   Inserted: "(C) telecommunication networks;

   Inserted: "(D) electrical power generation and delivery systems;

   Inserted: "(E) finance and banking systems;

   Inserted: "(F) emergency services;

   Inserted: "(G) transportation systems and services; and

   Inserted: "(H) government operations that provide essential services to the public; and

   Inserted: "(3) the term 'damage' has the meaning given the term in section 1030.

   Inserted: "(b) Offense.--It shall be unlawful, during and in relation to a felony violation of section 1030, to knowingly cause or attempt to cause damage to a critical infrastructure computer if the damage results in (or, in the case of an attempt, if completed, would have resulted in) the substantial impairment-- "(1) of the operation of the critical infrastructure computer; or "(2) of the critical infrastructure associated with the computer.

   Inserted: "(c) Penalty.--Any person who violates subsection (b) shall be--

   Inserted: "(1) fined under this title;

   Inserted: "(2) imprisoned for not less than 3 years but not more than 20 years; or

   Inserted: "(3) penalized under paragraphs (1) and (2).

   Inserted: "(d) Consecutive Sentence.--Notwithstanding any other provision of law--

   Inserted: "(1) a court shall not place on probation any person convicted of a violation of this section;

   Inserted: "(2) except as provided in paragraph (4), no term of imprisonment imposed on a person under this section shall run concurrently with any other term of imprisonment, including any term of imprisonment imposed on the person under any other provision of law, including any term of imprisonment imposed for a felony violation of section 1030;

   Inserted: "(3) in determining any term of imprisonment to be imposed for a felony violation of section 1030, a court shall not in any way reduce the term to be imposed for such crime so as to compensate for, or otherwise take into account, any separate term of imprisonment imposed or to be imposed for a violation of this section; and

   Inserted: "(4) a term of imprisonment imposed on a person for a violation of this section may, in the discretion of the court, run concurrently, in whole or in part, only with another term of imprisonment that is imposed by the court at the same time on that person for an additional violation of this section, provided that such discretion shall be exercised in accordance with any applicable guidelines and policy statements issued by the United States Sentencing Commission pursuant to section 994 of title 28.".

   Inserted: (b) Technical and Conforming Amendment.--The chapter analysis for chapter 47 of title 18, United States Code, is amended by inserting after the item relating to section 1030 the following:

   Inserted: "1030A. Aggravated damage to a critical infrastructure computer.".

   Inserted: SEC. 306. LIMITATION ON ACTIONS INVOLVING UNAUTHORIZED USE.

   Inserted: Section 1030(e)(6) of title 18, United States Code, is amended by striking "alter;" and inserting "alter, but does not include access in violation of a contractual obligation or agreement, such as an acceptable use policy or terms of service agreement, with an Internet service provider, Internet website, or non-government employer, if such violation constitutes the sole basis for determining that access to a protected computer is unauthorized;".

   Inserted: SEC. 307. NO NEW FUNDING.

   Inserted: An applicable Federal agency shall carry out the provisions of this title with existing facilities and funds otherwise available, through such means as the head of the agency considers appropriate.

   Inserted: TITLE IV--CYBERSECURITY RESEARCH AND DEVELOPMENT

   Inserted: SEC. 401. NATIONAL HIGH-PERFORMANCE COMPUTING PROGRAM PLANNING AND COORDINATION.

   Inserted: (a) Goals and Priorities.--Section 101 of the High-Performance Computing Act of 1991 (15 U.S.C. 5511) is amended by adding at the end the following:

   Inserted: "(d) Goals and Priorities.--The goals and priorities for Federal high-performance computing research, development, networking, and other activities under subsection (a)(2)(A) shall include--

   Inserted: "(1) encouraging and supporting mechanisms for interdisciplinary research and development in networking and information technology, including-- "(A) through collaborations across agencies; "(B) through collaborations across Program Component Areas; "(C) through collaborations with industry; "(D) through collaborations with institutions of higher education; "(E) through collaborations with Federal laboratories (as defined in section 4 of the Stevenson-Wydler Technology Innovation Act of 1980 (15 U.S.C. 3703)); and "(F) through collaborations with international organizations;

   Inserted: "(2) addressing national, multi-agency, multi-faceted challenges of national importance; and

   Inserted: "(3) fostering the transfer of research and development results into new technologies and applications for the benefit of society.".

   Inserted: (b) Development of Strategic Plan.--Section 101 of the High-Performance Computing Act of 1991 (15 U.S.C. 5511) is amended by adding at the end the following:

   Inserted: "(e) Strategic Plan.--

   Inserted: "(1) In general.--Not later than 1 year after the date of enactment of the Strengthening and Enhancing Cybersecurity by Using Research, Education, Information, and Technology Act of 2012, the agencies under subsection (a)(3)(B), working through the National Science and Technology Council and with the assistance of the Office of Science and Technology Policy shall develop a 5-year strategic plan to guide the activities under subsection (a)(1).

   Inserted: "(2) Contents.--The strategic plan shall specify--

   Inserted: "(A) the near-term objectives for the Program;

   Inserted: "(B) the long-term objectives for the Program;

   Inserted: "(C) the anticipated time frame for achieving the near-term objectives;

   Inserted: "(D) the metrics that will be used to assess any progress made toward achieving the near-term objectives and the long-term objectives; and

   Inserted: "(E) how the Program will achieve the goals and priorities under subsection (d).

   Inserted: "(3) Implementation roadmap.--

   Inserted: "(A) In general.--The agencies under subsection (a)(3)(B) shall develop and annually update an implementation roadmap for the strategic plan.

   Inserted: "(B) Requirements.--The information in the implementation roadmap shall be coordinated with the database under section 102(c) and the annual report under section 101(a)(3). The implementation roadmap shall--

   Inserted: "(i) specify the role of each Federal agency in carrying out or sponsoring research and development to meet the research objectives of the strategic plan, including a description of how progress toward the research objectives will be evaluated, with consideration of any relevant recommendations of the advisory committee;

   Inserted: "(ii) specify the funding allocated to each major research objective of the strategic plan and the source of funding by agency for the current fiscal year; and

   Inserted: "(iii) estimate the funding required for each major research objective of the strategic plan for the next 3 fiscal years.

   Inserted: "(4) Recommendations.--The agencies under subsection (a)(3)(B) shall take into consideration when developing the strategic plan under paragraph (1) the recommendations of--

   Inserted: "(A) the advisory committee under subsection (b); and

   Inserted: "(B) the stakeholders under section 102(a)(3).

   Inserted: "(5) Report to congress.--The Director of the Office of Science and Technology Policy shall transmit the strategic plan under this subsection, including the implementation roadmap and any updates under paragraph (3), to--

   Inserted: "(A) the advisory committee under subsection (b);

   Inserted: "(B) the Committee on Commerce, Science, and Transportation of the Senate; and

   Inserted: "(C) the Committee on Science and Technology of the House of Representatives.".

   Inserted: (c) Periodic Reviews.--Section 101 of the High-Performance Computing Act of 1991 (15 U.S.C. 5511) is amended by adding at the end the following:

   Inserted: "(f) Periodic Reviews.--The agencies under subsection (a)(3)(B) shall--

   Inserted: "(1) periodically assess the contents and funding levels of the Program Component Areas and restructure the Program when warranted, taking into consideration any relevant recommendations of the advisory committee under subsection (b); and

   Inserted: "(2) ensure that the Program includes national, multi-agency, multi-faceted research and development activities, including activities described in section 104.".

   Inserted: (d) Additional Responsibilities of Director.--Section 101(a)(2) of the High-Performance Computing Act of 1991 (15 U.S.C. 5511(a)(2)) is amended--

   Inserted: (1) by redesignating subparagraphs (E) and (F) as subparagraphs (G) and (H), respectively; and

   Inserted: (2) by inserting after subparagraph (D) the following:

   Inserted: "(E) encourage and monitor the efforts of the agencies participating in the Program to allocate the level of resources and management attention necessary--

   Inserted: "(i) to ensure that the strategic plan under subsection (e) is developed and executed effectively; and

   Inserted: "(ii) to ensure that the objectives of the Program are met;

   Inserted: "(F) working with the Office of Management and Budget and in coordination with the creation of the database under section 102(c), direct the Office of Science and Technology Policy and the agencies participating in the Program to establish a mechanism (consistent with existing law) to track all ongoing and completed research and development projects and associated funding;".

   Inserted: (e) Advisory Committee.--Section 101(b) of the High-Performance Computing Act of 1991 (15 U.S.C. 5511(b)) is amended--

   Inserted: (1) in paragraph (1)--

   Inserted: (A) by inserting after the first sentence the following: "The co-chairs of the advisory committee shall meet the qualifications of committee members and may be members of the Presidents Council of Advisors on Science and Technology."; and

   Inserted: (B) by striking "high-performance" in subparagraph (D) and inserting "high-end"; and

   Inserted: (2) by amending paragraph (2) to read as follows:

   Inserted: "(2) In addition to the duties under paragraph (1), the advisory committee shall conduct periodic evaluations of the funding, management, coordination, implementation, and activities of the Program. The advisory committee shall report its findings and recommendations not less frequently than once every 3 fiscal years to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science and Technology of the House of Representatives. The report shall be submitted in conjunction with the update of the strategic plan.".

   Inserted: (f) Report.--Section 101(a)(3) of the High-Performance Computing Act of 1991 (15 U.S.C. 5511(a)(3)) is amended--

   Inserted: (1) in subparagraph (C)--

   Inserted: (A) by striking "is submitted," and inserting "is submitted, the levels for the previous fiscal year,"; and

   Inserted: (B) by striking "each Program Component Area" and inserting "each Program Component Area and each research area supported in accordance with section 104";

   Inserted: (2) in subparagraph (D)--

   Inserted: (A) by striking "each Program Component Area," and inserting "each Program Component Area and each research area supported in accordance with section 104,";

   Inserted: (B) by striking "is submitted," and inserting "is submitted, the levels for the previous fiscal year,"; and

   Inserted: (C) by striking "and" after the semicolon;

   Inserted: (3) by redesignating subparagraph (E) as subparagraph (G); and

   Inserted: (4) by inserting after subparagraph (D) the following:

   Inserted: "(E) include a description of how the objectives for each Program Component Area, and the objectives for activities that involve multiple Program Component Areas, relate to the objectives of the Program identified in the strategic plan under subsection (e);

   Inserted: "(F) include--

   Inserted: "(i) a description of the funding required by the Office of Science and Technology Policy to perform the functions under subsections (a) and (c) of section 102 for the next fiscal year by category of activity;

   Inserted: "(ii) a description of the funding required by the Office of Science and Technology Policy to perform the functions under subsections (a) and (c) of section 102 for the current fiscal year by category of activity; and

   Inserted: "(iii) the amount of funding provided for the Office of Science and Technology Policy for the current fiscal year by each agency participating in the Program; and".

   Inserted: (g) Definitions.--Section 4 of the High-Performance Computing Act of 1991 (15 U.S.C. 5503) is amended--

   Inserted: (1) by redesignating paragraphs (1) and (2) as paragraphs (2) and (3), respectively;

   Inserted: (2) by redesignating paragraph (3) as paragraph (6);

   Inserted: (3) by redesignating paragraphs (6) and (7) as paragraphs (7) and (8), respectively;

   Inserted: (4) by inserting before paragraph (2), as redesignated, the following:

   Inserted: "(1) 'cyber-physical systems' means physical or engineered systems whose networking and information technology functions and physical elements are deeply integrated and are actively connected to the physical world through sensors, actuators, or other means to perform monitoring and control functions;";

   Inserted: (5) in paragraph (3), as redesignated, by striking "high-performance computing" and inserting "networking and information technology";

   Inserted: (6) in paragraph (6), as redesignated--

   Inserted: (A) by striking "high-performance computing" and inserting "networking and information technology"; and

   Inserted: (B) by striking "supercomputer" and inserting "high-end computing";

   Inserted: (7) in paragraph (5), by striking "network referred to as" and all that follows through the semicolon and inserting "network, including advanced computer networks of Federal agencies and departments"; and

   Inserted: (8) in paragraph (7), as redesignated, by striking "National High-Performance Computing Program" and inserting "networking and information technology research and development program".

   Inserted: SEC. 402. RESEARCH IN AREAS OF NATIONAL IMPORTANCE.

   Inserted: (a) Research in Areas of National Importance.--Title I of the High-Performance Computing Act of 1991 (15 U.S.C. 5511 et seq.) is amended by adding at the end the following:

   Inserted: "SEC. 104. RESEARCH IN AREAS OF NATIONAL IMPORTANCE.

   Inserted: "(a) In General.--The Program shall encourage agencies under section 101(a)(3)(B) to support, maintain, and improve national, multi-agency, multi-faceted, research and development activities in networking and information technology directed toward application areas that have the potential for significant contributions to national economic competitiveness and for other significant societal benefits.

   Inserted: "(b) Technical Solutions.--An activity under subsection (a) shall be designed to advance the development of research discoveries by demonstrating technical solutions to important problems in areas including--

   Inserted: "(1) cybersecurity;

   Inserted: "(2) health care;

   Inserted: "(3) energy management and low-power systems and devices;

   Inserted: "(4) transportation, including surface and air transportation;

   Inserted: "(5) cyber-physical systems;

   Inserted: "(6) large-scale data analysis and modeling of physical phenomena;

   Inserted: "(7) large scale data analysis and modeling of behavioral phenomena;

   Inserted: "(8) supply chain quality and security; and

   Inserted: "(9) privacy protection and protected disclosure of confidential data.

   Inserted: "(c) Recommendations.--The advisory committee under section 101(b) shall make recommendations to the Program for candidate research and development areas for support under this section.

   Inserted: "(d) Characteristics.--

   Inserted: "(1) In general.--Research and development activities under this section--

   Inserted: "(A) shall include projects selected on the basis of applications for support through a competitive, merit-based process;

   Inserted: "(B) shall leverage, when possible, Federal investments through collaboration with related State initiatives;

   Inserted: "(C) shall include a plan for fostering the transfer of research discoveries and the results of technology demonstration activities, including from institutions of higher education and Federal laboratories, to industry for commercial development;

   Inserted: "(D) shall involve collaborations among researchers in institutions of higher education and industry; and

   Inserted: "(E) may involve collaborations among nonprofit research institutions and Federal laboratories, as appropriate.

   Inserted: "(2) Cost-sharing.--In selecting applications for support, the agencies under section 101(a)(3)(B) shall give special consideration to projects that include cost sharing from non-Federal sources.

   Inserted: "(3) Multidisciplinary research centers.--Research and development activities under this section shall be supported through multidisciplinary research centers, including Federal laboratories, that are organized to investigate basic research questions and carry out technology demonstration activities in areas described in subsection (a). Research may be carried out through existing multidisciplinary centers, including those authorized under section 7024(b)(2) of the America COMPETES Act (42 U.S.C. 1862o-10(2)).".

   Inserted: (b) Cyber-Physical Systems.--Section 101(a)(1) of the High-Performance Computing Act of 1991 (15 U.S.C. 5511(a)(1)) is amended--

   Inserted: (1) in subparagraph (H), by striking "and" after the semicolon;

   (2) in subparagraph (I), by striking the period at the end and inserting a semicolon; and

   (3) by adding at the end the following:

   Struck: "(J) secure fundamental protocols that are at the heart of inter-network communications and data exchange;

   Struck: "(K) secure software engineering and software assurance, including--

   Struck: "(i) programming languages and systems that include fundamental security features;

   Struck: "(ii) portable or reusable code that remains secure when deployed in various environments;

   Show 139 more struck paragraphsShow less

   Struck: "(iii) verification and validation technologies to ensure that requirements and specifications have been implemented; and

   Struck: "(iv) models for comparison and metrics to assure that required standards have been met;

   Struck: "(L) holistic system security that--

   Struck: "(i) addresses the building of secure systems from trusted and untrusted components;

   Struck: "(ii) proactively reduces vulnerabilities;

   Struck: "(iii) addresses insider threats; and

   Struck: "(iv) supports privacy in conjunction with improved security;

   Struck: "(M) monitoring and detection;

   Struck: "(N) mitigation and rapid recovery methods;

   Struck: "(O) security of wireless networks and mobile devices; and

   Struck: "(P) security of cloud infrastructure and services.".

   Struck: (g) Cybersecurity Faculty Development Traineeship Program.--Section 5(e)(9) of the Cyber Security Research and Development Act (15 U.S.C. 7404(e)(9)) is amended by striking "2003 through 2007" and inserting "2012 through 2014".

   Struck: (h) Networking and Information Technology Research and Development Program.--Section 204(a)(1) of the High-Performance Computing Act of 1991 (15 U.S.C. 5524(a)(1)) is amended--

   Struck: (1) in subparagraph (B), by striking "and" at the end; and

   Struck: (2) by adding at the end the following:

   Struck: "(D) develop and propose standards and guidelines, and develop measurement techniques and test methods, for enhanced cybersecurity for computer networks and common user interfaces to systems; and".

   Struck: SEC. 302. HOMELAND SECURITY CYBERSECURITY RESEARCH AND DEVELOPMENT.

   Struck: (a) In General.--Subtitle D of title II of the Homeland Security Act of 2002 (6 U.S.C. 161 et seq.) is amended by adding at the end the following:

   Struck: "SEC. 238. CYBERSECURITY RESEARCH AND DEVELOPMENT.

   Struck: "(a) Establishment of Research and Development Program.--The Under Secretary for Science and Technology, in coordination with the Director of the National Center for Cybersecurity and Communications, shall carry out a research and development program for the purpose of improving the security of information infrastructure.

   Struck: "(b) Eligible Projects.--The research and development program carried out under subsection (a) may include projects to--

   Struck: "(1) advance the development and accelerate the deployment of more secure versions of fundamental Internet protocols and architectures, including for the secure domain name addressing system and routing security;

   Struck: "(2) improve and create technologies for detecting and analyzing attacks or intrusions, including analysis of malicious software;

   Struck: "(3) improve and create mitigation and recovery methodologies, including techniques for containment of attacks and development of resilient networks and systems;

   Struck: "(4) develop and support infrastructure and tools to support cybersecurity research and development efforts, including modeling, test beds, and data sets for assessment of new cybersecurity technologies;

   Struck: "(5) assist the development and support of technologies to reduce vulnerabilities in process control systems;

   Struck: "(6) understand human behavioral factors that can affect cybersecurity technology and practices;

   Struck: "(7) test, evaluate, and facilitate, with appropriate protections for any proprietary information concerning the technologies, the transfer of technologies associated with the engineering of less vulnerable software and securing the information technology software development lifecycle;

   Struck: "(8) assist the development of identity management and attribution technologies;

   Struck: "(9) assist the development of technologies designed to increase the security and resiliency of telecommunications networks;

   Struck: "(10) advance the protection of privacy and civil liberties in cybersecurity technology and practices; and

   Struck: "(11) address other risks identified by the Director of the National Center for Cybersecurity and Communications.

   Struck: "(c) Coordination With Other Research Initiatives.--The Under Secretary for Science and Technology--

   Struck: "(1) shall ensure that the research and development program carried out under subsection (a) is consistent with any strategy to increase the security and resilience of cyberspace;

   Struck: "(2) shall, to the extent practicable, coordinate the research and development activities of the Department with other ongoing research and development security-related initiatives, including research being conducted by--

   Struck: "(A) the National Institute of Standards and Technology;

   Struck: "(B) the National Science Foundation;

   Struck: "(C) the National Academy of Sciences;

   Struck: "(D) other Federal agencies;

   Struck: "(E) other Federal and private research laboratories, research entities, and universities and institutions of higher education, and relevant nonprofit organizations; and

   Struck: "(F) international partners of the United States;

   Struck: "(3) shall carry out any research and development project under subsection (a) through a reimbursable agreement with an appropriate Federal agency, if the Federal agency--

   Struck: "(A) is sponsoring a research and development project in a similar area; or

   Struck: "(B) has a unique facility or capability that would be useful in carrying out the project;

   Struck: "(4) may make grants to, or enter into cooperative agreements, contracts, other transactions, or reimbursable agreements with, the entities described in paragraph (2); and

   Struck: "(5) shall submit a report to the appropriate committees of Congress on a review of the cybersecurity activities, and the capacity, of the national laboratories and other research entities available to the Department to determine if the establishment of a national laboratory dedicated to cybersecurity research and development is necessary.".

   Struck: (b) Technical and Conforming Amendment.--The table of contents in section 1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.), as amended by section 204, is amended by inserting after the item relating to section 237 the following:

   Struck: "Sec. 238. Cybersecurity research and development.".

   Struck: SEC. 303. RESEARCH CENTERS FOR CYBERSECURITY.

   Struck: (a) Establishment.--Not later than 1 year after the date of enactment of this Act, the Director of the National Science Foundation, in coordination with the Secretary, shall establish cybersecurity research centers based at institutions of higher education and other entities that meet the criteria described in subsection (b) to develop solutions and strategies that support the efforts of the Federal government under this Act in--

   Struck: (1) improving the security and resilience of information infrastructure;

   Struck: (2) reducing cyber vulnerabilities; and

   Struck: (3) mitigating the consequences of cyber attacks on critical infrastructure.

   Struck: (b) Criteria for Selection.--In selecting an institution of higher education or other entity to serve as a Research Center for Cybersecurity, the Director of the National Science Foundation shall consider--

   Struck: (1) demonstrated expertise in systems security, wireless security, networking and protocols, formal methods and high- performance computing, nanotechnology, and industrial control systems;

   Struck: (2) demonstrated capability to conduct high performance computation integral to complex cybersecurity research, whether through on-site or off-site computing;

   Struck: (3) demonstrated expertise in interdisciplinary cybersecurity research;

   Struck: (4) affiliation with private sector entities involved with industrial research described in paragraph (1) and ready access to testable commercial data;

   Struck: (5) prior formal research collaboration arrangements with institutions of higher education and Federal research laboratories;

   Struck: (6) capability to conduct research in a secure environment; and

   Struck: (7) affiliation with existing research programs of the Federal Government.

   Struck: SEC. 304. CENTERS OF EXCELLENCE.

   Struck: The Secretary and the Secretary of Defense may jointly establish academic and professional Centers of Excellence in cybersecurity for the protection of critical infrastructure in conjunction with international academic and professional partners from countries that may include allies of the United States, as determined to be appropriate under title XIX of the Implementing Recommendations of the 9/11 Commission Act of 2007 (Public Law 110-53; 121 Stat. 505) in order to research and develop technologies, best practices, and other means to defend critical infrastructure.

   Struck: TITLE IV--EDUCATION, WORKFORCE, AND AWARENESS

   Struck: SEC. 401. DEFINITIONS.

   Struck: In this title:

   Struck: (1) Cybersecurity mission.--The term "cybersecurity mission" means activities that encompass the full range of threat reduction, vulnerability reduction, deterrence, international engagement, incident response, resiliency, and recovery policies and activities, including computer network operations, information assurance, law enforcement, diplomacy, military, and intelligence missions as such activities relate to the security and stability of cyberspace.

   Struck: (2) Cybersecurity mission of a federal agency.--The term "cybersecurity mission of a Federal agency" means the portion of a cybersecurity mission that is the responsibility of a Federal agency.

   Struck: SEC. 402. EDUCATION AND AWARENESS.

   Struck: (a) Assessment of Cybersecurity Education in Colleges and Universities.--

   Struck: (1) Report.--Not later than 1 year after the date of enactment of this Act, the Director of the National Science Foundation shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives a report on the state of cybersecurity education in institutions of higher education in the United States.

   Struck: (2) Contents of report.--The report required under paragraph (1) shall include baseline data on--

   Struck: (A) the state of cybersecurity education in the United States;

   Struck: (B) the extent of professional development opportunities for faculty in cybersecurity principles and practices;

   Struck: (C) descriptions of the content of cybersecurity courses in undergraduate computer science curriculum;

   Struck: (D) the extent of the partnerships and collaborative cybersecurity curriculum development activities that leverage industry and government needs, resources, and tools; and

   Struck: (E) proposed metrics to assess progress toward improving cybersecurity education.

   Struck: (b) Enrichment Programs.--The Director of the National Science Foundation shall--

   Struck: (1) encourage and support programming, including summer enrichment programs, to be provided by nonprofit organizations, in math, computer programming, science, technology, and engineering, with a goal of increasing cybersecurity skills in students enrolled in kindergarten through grade 12; and

   Struck: (2) when appropriate, provide opportunities for top- achieving students to participate in the programs described in paragraph (1) at no cost.

   Struck: (c) National Education and Awareness Campaign.--The Secretary, in consultation with appropriate Federal agencies shall develop and implement outreach and awareness programs on cybersecurity, including--

   Struck: (1) in consultation with the Director of the National Institute of Standards and Technology--

   Struck: (A) a public education campaign to increase the awareness of cybersecurity, cyber safety, and cyber ethics, which shall include the use of the Internet, social media, entertainment, and other media to reach the public; and

   Struck: (B) an education campaign to increase the understanding of State and local governments and private sector entities of the benefits of ensuring effective risk management of the information infrastructure versus the costs of failure to do so and methods to mitigate and remediate vulnerabilities;

   Struck: (2) in coordination with the Secretary of Commerce, development of a program to publicly recognize or identify products, services, and companies, including owners and operators, that meet the highest standards of cybersecurity; and

   Struck: (3) in accordance with subsection (d), a program for carrying out collaborative education and training activities for cybersecurity through a consortium or other appropriate entity.

   Struck: (d) Collaborative Education and Training.--

   Struck: (1) In general.--The consortium or other entity established under subsection (c)(3) shall--

   Struck: (A) provide training to State and local first responders and officials specifically for preparing and responding to cyber attacks;

   Struck: (B) develop and update a curriculum and training models for State and local first responders and officials;

   Struck: (C) provide technical assistance services to build and sustain capabilities in support of cybersecurity preparedness and response; and

   Struck: (D) conduct cybersecurity training and simulation exercises to defend from and respond to cyber attacks.

   Struck: (2) Members.--The Consortium or other entity established under subsection (c)(3) shall consist of academic, nonprofit, Federal Government, and State and local government partners that develop, update, and deliver cybersecurity training in support of homeland security.

   Struck: (e) Considerations.--In carrying out the authority described in subsection (c), the Secretary of Commerce, the Secretary, and the Director of the National Institute of Standards and Technology shall leverage existing programs designed to inform the public of safety and security of products or services, including self-certifications and independently-verified assessments regarding the quantification and valuation of information security risk.

   Struck: SEC. 403. NATIONAL CYBERSECURITY COMPETITION AND CHALLENGE.

   Struck: (a) Talent Competition and Challenge.--

   Struck: (1) In general.--The Secretary and the Secretary of Commerce shall establish a program to conduct competitions and challenges and ensure the effective operation of national and statewide competitions and challenges that seek to identify, develop, and recruit talented individuals to work in Federal agencies, State and local government agencies, and the private sector to perform duties relating to the security of the Federal information infrastructure or the national information infrastructure.

   Struck: (2) Participation.--Participants in the competitions and challenges of the program established under paragraph (1) shall include--

   Struck: (A) students enrolled in grades 9 through 12;

   Struck: (B) students enrolled in a postsecondary program of study leading to a baccalaureate degree at an institution of higher education;

   Struck: (C) students enrolled in a postbaccalaureate program of study at an institution of higher education;

   Struck: (D) institutions of higher education and research institutions;

   Struck: (E) veterans; and

   Struck: (F) other groups or individuals as the Secretary and the Secretary of Commerce determine appropriate.

   Struck: (3) Support of other competitions and challenges.--The program established under paragraph (1) may support other competitions and challenges not established under this subsection through affiliation and cooperative agreements with--

   Struck: (A) Federal agencies;

   Struck: (B) regional, State, or school programs supporting the development of cyber professionals;

   Struck: (C) State, local, and tribal governments; or

   Struck: (D) other private sector organizations.

   Struck: (4) Areas of talent.--The program established under paragraph (1) shall seek to identify, develop, and recruit exceptional talent relating to--

   Struck: (A) ethical hacking;

   Struck: (B) penetration testing;

   Struck: (C) vulnerability assessment;

   Struck: (D) continuity of system operations;

   Struck: (E) cyber forensics;

   Struck: (F) offensive and defensive cyber operations; and

   Struck: (G) other areas to fulfill the cybersecurity mission as the Secretary determines appropriate.

   Struck: (5) Internships.--The Director of the Office of Personnel Management shall establish, in coordination with the Director of the National Center for Cybersecurity and Communications, a program to provide, where appropriate, internships or other work experience in the Federal government to the winners of the competitions and challenges.

   Struck: (b) National Research and Development Competition and Challenge.--

   Struck: (1) In general.--The Director of the National Science Foundation, in consultation with appropriate Federal agencies, shall establish a program of cybersecurity competitions and challenges to stimulate innovation in basic and applied cybersecurity research, technology development, and prototype demonstration that has the potential for application to the information technology activities of the Federal Government.

   Struck: (2) Participation.--Participants in the competitions and challenges of the program established under paragraph (1) shall include--

   Struck: (A) students enrolled in grades 9 through 12;

   Struck: (B) students enrolled in a postsecondary program of study leading to a baccalaureate degree at an institution of higher education;

   Struck: (C) students enrolled in a postbaccalaureate program of study at an institution of higher education;

   Struck: (D) institutions of higher education and research institutions;

   Struck: (E) veterans; and

   Struck: (F) other groups or individuals as the Director of the National Science Foundation determines appropriate.

   Struck: (3) Topics.--In selecting topics for competitions and challenges held as part of the program established under paragraph (1), the Director--

   Struck: (A) shall consult widely both within and outside the Federal Government; and

   Struck: (B) may empanel advisory committees.

   Struck: (4) Internships.--The Director of the Office of Personnel Management shall establish, in coordination with the Director of the National Science Foundation, a program to provide, where appropriate, internships or other work experience in the Federal government to the winners of the competitions and challenges held as part of the program established under paragraph (1).

   Struck: SEC. 404. FEDERAL CYBER SCHOLARSHIP-FOR-SERVICE PROGRAM.

   Struck: (a) In General.--The Director of the National Science Foundation, in coordination with the Secretary, shall establish a Federal Cyber Scholarship-for-Service program to recruit and train the next generation of information technology professionals, industrial control system security professionals, and security managers to meet the needs of the cybersecurity mission for the Federal Government and State, local, and tribal governments.

   Struck: (b) Program Description and Components.--The program established under subsection (a) shall--

   Struck: (1) incorporate findings from the assessment and development of the strategy under section 405;

   Struck: (2) provide not more than 1,000 scholarships per year, to students who are enrolled in a program of study at an institution of higher education leading to a degree or specialized program certification in the cybersecurity field, in an amount that covers each student's tuition and fees at the institution and provides the student with an additional stipend;

   Struck: (3) require each scholarship recipient, as a condition of receiving a scholarship under the program, to enter into an agreement under which the recipient agrees to work in the cybersecurity mission of a Federal, State, local, or tribal agency for a period equal to the length of the scholarship following receipt of the student's degree if offered employment in that field by a Federal, State, local, or tribal agency;

   Struck: (4) provide a procedure by which the National Science Foundation or a Federal agency may, consistent with regulations of the Office of Personnel Management, request and fund security clearances for scholarship recipients, including providing for clearances during summer internships and after the recipient receives the degree; and

   Struck: (5) provide opportunities for students to receive temporary appointments for meaningful employment in the cybersecurity mission of a Federal agency during school vacation periods and for internships.

   Inserted: "(J) provide for increased understanding of the scientific principles of cyber-physical systems and improve the methods available for the design, development, and operation of cyber-physical systems that are characterized by high reliability, safety, and security; and

   Inserted: "(K) provide for research and development on human-computer interactions, visualization, and big data.".

   Inserted: (c) Task Force.--Title I of the High-Performance Computing Act of 1991 (15 U.S.C. 5511 et seq.), as amended by section 402(a) of this Act, is amended by adding at the end the following:

   Inserted: "SEC. 105. TASK FORCE.

   Inserted: "(a) Establishment.--Not later than 180 days after the date of enactment the Strengthening and Enhancing Cybersecurity by Using Research, Education, Information, and Technology Act of 2012, the Director of the Office of Science and Technology Policy under section 102 shall convene a task force to explore mechanisms for carrying out collaborative research and development activities for cyber-physical systems (including the related technologies required to enable these systems) through a consortium or other appropriate entity with participants from institutions of higher education, Federal laboratories, and industry.

   Inserted: "(b) Functions.--The task force shall--

   Inserted: "(1) develop options for a collaborative model and an organizational structure for such entity under which the joint research and development activities could be planned, managed, and conducted effectively, including mechanisms for the allocation of resources among the participants in such entity for support of such activities;

   Inserted: "(2) propose a process for developing a research and development agenda for such entity, including guidelines to ensure an appropriate scope of work focused on nationally significant challenges and requiring collaboration and to ensure the development of related scientific and technological milestones;

   Inserted: "(3) define the roles and responsibilities for the participants from institutions of higher education, Federal laboratories, and industry in such entity;

   Inserted: "(4) propose guidelines for assigning intellectual property rights and for transferring research results to the private sector; and

   Inserted: "(5) make recommendations for how such entity could be funded from Federal, State, and non-governmental sources.

   Inserted: "(c) Composition.--In establishing the task force under subsection (a), the Director of the Office of Science and Technology Policy shall appoint an equal number of individuals from institutions of higher education and from industry with knowledge and expertise in cyber-physical systems, and may appoint not more than 2 individuals from Federal laboratories.

   Show 92 more inserted paragraphsShow less

   Inserted: "(d) Report.--Not later than 1 year after the date of enactment of the Strengthening and Enhancing Cybersecurity by Using Research, Education, Information, and Technology Act of 2012, the Director of the Office of Science and Technology Policy shall transmit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science and Technology of the House of Representatives a report describing the findings and recommendations of the task force.

   Inserted: "(e) Termination.--The task force shall terminate upon transmittal of the report required under subsection (d).

   Inserted: "(f) Compensation and Expenses.--Members of the task force shall serve without compensation.".

   Inserted: SEC. 403. PROGRAM IMPROVEMENTS.

   Inserted: Section 102 of the High-Performance Computing Act of 1991 (15 U.S.C. 5512) is amended to read as follows:

   Inserted: "SEC. 102. PROGRAM IMPROVEMENTS.

   Inserted: "(a) Functions.--The Director of the Office of Science and Technology Policy shall continue--

   Inserted: "(1) to provide technical and administrative support to--

   Inserted: "(A) the agencies participating in planning and implementing the Program, including support needed to develop the strategic plan under section 101(e); and

   Inserted: "(B) the advisory committee under section 101(b);

   Inserted: "(2) to serve as the primary point of contact on Federal networking and information technology activities for government agencies, academia, industry, professional societies, State computing and networking technology programs, interested citizen groups, and others to exchange technical and programmatic information;

   Inserted: "(3) to solicit input and recommendations from a wide range of stakeholders during the development of each strategic plan under section 101(e) by convening at least 1 workshop with invitees from academia, industry, Federal laboratories, and other relevant organizations and institutions;

   Inserted: "(4) to conduct public outreach, including the dissemination of the advisory committee's findings and recommendations, as appropriate;

   Inserted: "(5) to promote access to and early application of the technologies, innovations, and expertise derived from Program activities to agency missions and systems across the Federal Government and to United States industry;

   Inserted: "(6) to ensure accurate and detailed budget reporting of networking and information technology research and development investment; and

   Inserted: "(7) to encourage agencies participating in the Program to use existing programs and resources to strengthen networking and information technology education and training, and increase participation in such fields, including by women and underrepresented minorities.

   Inserted: "(b) Source of Funding.--

   Inserted: "(1) In general.--The functions under this section shall be supported by funds from each agency participating in the Program.

   Inserted: "(2) Specifications.--The portion of the total budget of the Office of Science and Technology Policy that is provided by each agency participating in the Program for each fiscal year shall be in the same proportion as each agency's share of the total budget for the Program for the previous fiscal year, as specified in the database under section 102(c).

   Inserted: "(c) Database.--

   Inserted: "(1) In general.--The Director of the Office of Science and Technology Policy shall develop and maintain a database of projects funded by each agency for the fiscal year for each Program Component Area.

   Inserted: "(2) Public accessibility.--The Director of the Office of Science and Technology Policy shall make the database accessible to the public.

   Inserted: "(3) Database contents.--The database shall include, for each project in the database--

   Inserted: "(A) a description of the project;

   Inserted: "(B) each agency, industry, institution of higher education, Federal laboratory, or international institution involved in the project;

   Inserted: "(C) the source funding of the project (set forth by agency);

   Inserted: "(D) the funding history of the project; and

   Inserted: "(E) whether the project has been completed.".

   Inserted: SEC. 404. IMPROVING EDUCATION OF NETWORKING AND INFORMATION TECHNOLOGY, INCLUDING HIGH PERFORMANCE COMPUTING.

   Inserted: Section 201(a) of the High-Performance Computing Act of 1991 (15 U.S.C. 5521(a)) is amended--

   Inserted: (1) by redesignating paragraphs (2) through (4) as paragraphs (3) through (5), respectively; and

   Inserted: (2) by inserting after paragraph (1) the following:

   Inserted: "(2) the National Science Foundation shall use its existing programs, in collaboration with other agencies, as appropriate, to improve the teaching and learning of networking and information technology at all levels of education and to increase participation in networking and information technology fields;".

   Inserted: SEC. 405. CONFORMING AND TECHNICAL AMENDMENTS TO THE HIGH-PERFORMANCE COMPUTING ACT OF 1991.

   Inserted: (a) Section 3.--Section 3 of the High-Performance Computing Act of 1991 (15 U.S.C. 5502) is amended--

   Inserted: (1) in the matter preceding paragraph (1), by striking "high-performance computing" and inserting "networking and information technology";

   Inserted: (2) in paragraph (1)--

   Inserted: (A) in the matter preceding subparagraph (A), by striking "high-performance computing" and inserting "networking and information technology";

   Inserted: (B) in subparagraphs (A), (F), and (G), by striking "high-performance computing" each place it appears and inserting "networking and information technology"; and

   Inserted: (C) in subparagraph (H), by striking "high-performance" and inserting "high-end"; and

   Inserted: (3) in paragraph (2)--

   Inserted: (A) by striking "high-performance computing and" and inserting "networking and information technology, and"; and

   Inserted: (B) by striking "high-performance computing network" and inserting "networking and information technology".

   Inserted: (b) Title Heading.--The heading of title I of the High-Performance Computing Act of 1991 (105 Stat. 1595) is amended by striking "HIGH-PERFORMANCE COMPUTING" and inserting "NETWORKING AND INFORMATION TECHNOLOGY".

   Inserted: (c) Section 101.--Section 101 of the High-Performance Computing Act of 1991 (15 U.S.C. 5511) is amended--

   Inserted: (1) in the section heading, by striking "high-performance computing" and inserting "networking and information technology research and development";

   Inserted: (2) in subsection (a)--

   Inserted: (A) in the subsection heading, by striking "National High-Performance Computing" and inserting "Networking and Information Technology Research and Development";

   Inserted: (B) in paragraph (1)--

   Inserted: (i) by striking "National High-Performance Computing Program" and inserting "networking and information technology research and development program";

   Inserted: (ii) in subparagraph (A), by striking "high-performance computing, including networking" and inserting "networking and information technology";

   Inserted: (iii) in subparagraphs (B) and (G), by striking "high-performance" each place it appears and inserting "high-end"; and

   Inserted: (iv) in subparagraph (C), by striking "high-performance computing and networking" and inserting "high-end computing, distributed, and networking"; and

   Inserted: (C) in paragraph (2)--

   Inserted: (i) in subparagraphs (A) and (C)--

   Inserted: (I) by striking "high-performance computing" each place it appears and inserting "networking and information technology"; and

   Inserted: (II) by striking "development, networking," each place it appears and inserting "development,"; and

   Inserted: (ii) in subparagraphs (G) and (H), as redesignated by section 401(d) of this Act, by striking "high-performance" each place it appears and inserting "high-end";

   Inserted: (3) in subsection (b)(1), in the matter preceding subparagraph (A), by striking "high-performance computing" each place it appears and inserting "networking and information technology"; and

   Inserted: (4) in subsection (c)(1)(A), by striking "high-performance computing" and inserting "networking and information technology".

   Inserted: (d) Section 201.--Section 201(a)(1) of the High-Performance Computing Act of 1991 (15 U.S.C. 5521(a)(1)) is amended by striking "high-performance computing and advanced high-speed computer networking" and inserting "networking and information technology research and development".

   Inserted: (e) Section 202.--Section 202(a) of the High-Performance Computing Act of 1991 (15 U.S.C. 5522(a)) is amended by striking "high-performance computing" and inserting "networking and information technology".

   Inserted: (f) Section 203.--Section 203(a) of the High-Performance Computing Act of 1991 (15 U.S.C. 5523(a)) is amended--

   Inserted: (1) in paragraph (1), by striking "high-performance computing and networking" and inserting "networking and information technology"; and

   Inserted: (2) in paragraph (2)(A), by striking "high-performance" and inserting "high-end".

   Inserted: (g) Section 204.--Section 204 of the High-Performance Computing Act of 1991 (15 U.S.C. 5524) is amended--

   Inserted: (1) in subsection (a)(1)--

   Inserted: (A) in subparagraph (A), by striking "high-performance computing systems and networks" and inserting "networking and information technology systems and capabilities";

   Inserted: (B) in subparagraph (B), by striking "interoperability of high-performance computing systems in networks and for common user interfaces to systems" and inserting "interoperability and usability of networking and information technology systems"; and

   Inserted: (C) in subparagraph (C), by striking "high-performance computing" and inserting "networking and information technology"; and

   Inserted: (2) in subsection (b)--

   Inserted: (A) by striking "High-Performance Computing and Network" in the heading and inserting "Networking and Information Technology"; and

   Inserted: (B) by striking "sensitive".

   Inserted: (h) Section 205.--Section 205(a) of the High-Performance Computing Act of 1991 (15 U.S.C. 5525(a)) is amended by striking "computational" and inserting "networking and information technology".

   Inserted: (i) Section 206.--Section 206(a) of the High-Performance Computing Act of 1991 (15 U.S.C. 5526(a)) is amended by striking "computational research" and inserting "networking and information technology research".

   Inserted: (j) Section 207.--Section 207 of the High-Performance Computing Act of 1991 (15 U.S.C. 5527) is amended by striking "high-performance computing" and inserting "networking and information technology".

   Inserted: (k) Section 208.--Section 208 of the High-Performance Computing Act of 1991 (15 U.S.C. 5528) is amended--

   Inserted: (1) in the section heading, by striking "HIGH-PERFORMANCE COMPUTING" and inserting "NETWORKING AND INFORMATION TECHNOLOGY"; and

   Inserted: (2) in subsection (a)--

   Inserted: (A) in paragraph (1), by striking "High-performance computing and associated" and inserting "Networking and information";

   Inserted: (B) in paragraph (2), by striking "high-performance computing" and inserting "networking and information technologies";

   Inserted: (C) in paragraph (3), by striking "high-performance" and inserting "high-end";

   Inserted: (D) in paragraph (4), by striking "high-performance computers and associated" and inserting "networking and information"; and

   Inserted: (E) in paragraph (5), by striking "high-performance computing and associated" and inserting "networking and information".

   Inserted: SEC. 406. FEDERAL CYBER SCHOLARSHIP-FOR-SERVICE PROGRAM.

   Inserted: (a) In General.--The Director of the National Science Foundation, in coordination with the Secretary of Homeland Security, shall carry out a Federal cyber scholarship-for-service program to recruit and train the next generation of information technology professionals and security managers to meet the needs of the cybersecurity mission for the Federal government.

   Inserted: (b) Program Description and Components.--The program shall--

   Inserted: (1) annually assess the workforce needs of the Federal government for cybersecurity professionals, including network engineers, software engineers, and other experts in order to determine how many scholarships should be awarded annually to ensure that the workforce needs following graduation match the number of scholarships awarded;

   Inserted: (2) provide scholarships for up to 1,000 students per year in their pursuit of undergraduate or graduate degrees in the cybersecurity field, in an amount that may include coverage for full tuition, fees, and a stipend;

   Inserted: (3) require each scholarship recipient, as a condition of receiving a scholarship under the program, to serve in a Federal information technology workforce for a period equal to one and one-half times each year, or partial year, of scholarship received, in addition to an internship in the cybersecurity field, if applicable, following graduation;

   Inserted: (4) provide a procedure for the National Science Foundation or a Federal agency, consistent with regulations of the Office of Personnel Management, to request and fund a security clearance for a scholarship recipient, including providing for clearance during a summer internship and upon graduation; and

   Inserted: (5) provide opportunities for students to receive temporary appointments for meaningful employment in the Federal information technology workforce during school vacation periods and for internships.

   (c) Hiring Authority.--

   (1) In general.--For purposes of any law or regulation governing the appointment of [struck: individuals ][inserted: an individual ]in the Federal civil service, upon [struck: receiving a degree for which an individual received ][inserted: the successful completion of the student's studies, a student receiving ]a scholarship under [struck: this section, ]the [struck: individual shall be][inserted: program may]--

   (A) [inserted: be ]hired under [struck: the authority provided for in ]section 213.3102(r) of title 5, Code of Federal Regulations; and

   (B) [inserted: be ]exempt from competitive service.

   (2) Competitive service[struck: position].--Upon satisfactory fulfillment of the service term [struck: of an individual hired ]under paragraph (1), [struck: the][inserted: an] individual may be converted to a competitive service position without competition if the individual meets the requirements for that position.

   (d) Eligibility.--[struck: To be eligible to receive ][inserted: The eligibility requirements for ]a scholarship under this section[struck: , an individual shall][inserted: shall include that a scholarship applicant]--

   (1) be a citizen [struck: or lawful permanent resident ]of the United States;

   Struck: (2) demonstrate a commitment to a career in improving the security of information infrastructure; and

   Struck: (3) have demonstrated a high level of proficiency in mathematics, engineering, or computer sciences.

   Struck: (e) Repayment.--If a recipient of a scholarship under this section does not meet the terms of the scholarship program, the recipient shall refund the scholarship payments in accordance with rules established by the Director of the National Science Foundation, in coordination with the Secretary.

   Struck: (f) Evaluation and Report.--The Director of the National Science Foundation shall evaluate and report periodically to Congress on the success of recruiting individuals for the scholarships and on hiring and retaining those individuals in the public sector workforce.

   Show 497 more struck paragraphsShow less

   Struck: SEC. 405. ASSESSMENT OF CYBERSECURITY FEDERAL WORKFORCE.

   Struck: (a) In General.--The Director of the Office of Personnel Management and the Secretary, in coordination with the Director of National Intelligence, the Secretary of Defense, and the Chief Information Officers Council established under section 3603 of title 44, United States Code, shall assess the readiness and capacity of the Federal workforce to meet the needs of the cybersecurity mission of the Federal Government.

   Struck: (b) Strategy.--

   Struck: (1) In general.--Not later than 180 days after the date of enactment of this Act, the Director of the Office of Personnel Management, in consultation with the Director of the National Center for Cybersecurity and Communications and the Director of the Office of Management and Budget, shall develop a comprehensive workforce strategy that enhances the readiness, capacity, training, and recruitment and retention of cybersecurity personnel of the Federal Government.

   Struck: (2) Contents.--The strategy developed under paragraph (1) shall include--

   Struck: (A) a 5-year plan on recruitment of personnel for the Federal workforce; and

   Struck: (B) a 10-year projections of Federal workforce needs.

   Struck: (c) Updates.--The Director of the Office of Personnel Management, in consultation with the Director of the National Center for Cybersecurity and Communications and the Director of the Office of Management and Budget, shall update the strategy developed under subsection (b) as needed.

   Struck: SEC. 406. FEDERAL CYBERSECURITY OCCUPATION CLASSIFICATIONS.

   Struck: (a) In General.--Not later than 1 year after the date of enactment of this Act, the Director of the Office of Personnel Management, in coordination with the Director of the National Center for Cybersecurity and Communications, shall develop and issue comprehensive occupation classifications for Federal employees engaged in cybersecurity missions.

   Struck: (b) Applicability of Classifications.--The Director of the Office of Personnel Management shall ensure that the comprehensive occupation classifications issued under subsection (a) may be used throughout the Federal Government.

   Struck: SEC. 407. TRAINING AND EDUCATION OF FEDERAL EMPLOYEES.

   Struck: (a) Definition.--In this section, the term "agency information infrastructure" means the Federal information infrastructure of a Federal agency.

   Struck: (b) Training.--

   Struck: (1) Federal government employees and federal contractors.-- The Director of the Office of Personnel Management, in coordination with the Secretary, the Director of National Intelligence, the Secretary of Defense, and the Chief Information Officers Council established under section 3603 of title 44, United States Code, shall establish a cybersecurity awareness and education curriculum that shall be required for all Federal employees and contractors engaged in the design, development, or operation of an agency information infrastructure or the Federal information infrastructure.

   Struck: (2) Contents.--The curriculum established under paragraph (1) shall include, at a minimum--

   Struck: (A) role-based security awareness training;

   Struck: (B) recommended cybersecurity practices;

   Struck: (C) cybersecurity recommendations for traveling abroad;

   Struck: (D) unclassified counterintelligence information;

   Struck: (E) information regarding industrial espionage;

   Struck: (F) information regarding malicious activity online;

   Struck: (G) information regarding cybersecurity and law enforcement;

   Struck: (H) identity management information;

   Struck: (I) information regarding supply chain security;

   Struck: (J) information security risks associated with the activities of Federal employees and contractors; and

   Struck: (K) the responsibilities of Federal employees and contractors in complying with policies and procedures designed to reduce information security risks identified under subparagraph (J).

   Struck: (3) Federal cybersecurity professionals.--The Director of the Office of Personnel Management in conjunction with the Secretary, the Director of National Intelligence, the Secretary of Defense, the Director of the Office of Management and Budget, and, as appropriate, colleges, universities, and nonprofit organizations with cybersecurity training expertise, shall develop a program to provide training to improve and enhance the skills and capabilities of Federal employees engaged in the cybersecurity mission, including training specific to the acquisition workforce.

   Struck: (4) Heads of federal agencies.--Not later than 30 days after the date on which an individual is appointed to a position at level I or II of the Executive Schedule, the Secretary and the Director of National Intelligence shall provide that individual with a cybersecurity threat briefing.

   Struck: (5) Certification.--The head of each Federal agency shall include in the annual report required under section 3554(c) of title 44, United States Code, as amended by this Act, a certification regarding whether all employees and contractors of the Federal agency have completed the training required under this subsection.

   Struck: (c) Recruitment.--The Director of the Office of Personnel Management, in coordination with the Director of the National Center for Cybersecurity and Communications, shall develop strategies and programs to recruit students enrolled in institutions of higher education and students enrolled in career and technical institutions in the United States to serve as Federal employees engaged in cybersecurity missions.

   Struck: (d) Leadership in Cybersecurity.--The head of each Federal agency shall adopt best practices, developed by the Office of Personnel Management, regarding effective ways to educate and motivate employees of the Federal Government to demonstrate leadership in cybersecurity, including--

   Struck: (1) promotions and other nonmonetary awards; and

   Struck: (2) publicizing information sharing accomplishments by individual employees and, if appropriate, the tangible benefits that resulted.

   Struck: SEC. 408. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS ACQUISITION AUTHORITIES.

   Struck: (a) In General.--Subtitle E of title II of the Homeland Security Act of 2002, as added by section 204, is amended by adding at the end the following:

   Struck: "SEC. 245. NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS ACQUISITION AUTHORITIES.

   Struck: "(a) In General.--The National Center for Cybersecurity and Communications is authorized to use the authorities under subsections (c)(1) and (d)(1)(B) of section 2304 of title 10, United States Code, instead of the authorities under subsections (a)(1) and (b)(2) of section 3304 of title 41, United States Code, subject to all other requirements of sections 3301 and 3304 of title 41, United States Code.

   Struck: "(b) Guidelines.--Not later than 90 days after the date of enactment of the Cybersecurity Act of 2012, the chief procurement officer of the Department shall issue guidelines for use of the authority under subsection (a).

   Struck: "(c) Termination.--The National Center for Cybersecurity and Communications may not use the authority under subsection (a) on and after the date that is 3 years after the date of enactment of this Act.

   Struck: "(d) Reporting.--

   Struck: "(1) In general.--On a semiannual basis, the Director of the Center shall submit a report on use of the authority granted by subsection (a) to--

   Struck: "(A) the Committee on Homeland Security and Governmental Affairs of the Senate; and

   Struck: "(B) the Committee on Homeland Security of the House of Representatives.

   Struck: "(2) Contents.--Each report submitted under paragraph (1) shall include, at a minimum--

   Struck: "(A) the number of contract actions taken under the authority under subsection (a) during the period covered by the report; and

   Struck: "(B) for each contract action described in subparagraph (A)--

   Struck: "(i) the total dollar value of the contract action;

   Struck: "(ii) a summary of the market research conducted by the National Center for Cybersecurity and Communications, including a list of all offerors who were considered and those who actually submitted bids, in order to determine that use of the authority was appropriate; and

   Struck: "(iii) a copy of the justification and approval documents required by section 3304(e) of title 41, United States Code.

   Struck: "(3) Classified annex.--A report submitted under this subsection shall be submitted in an unclassified form, but may include a classified annex, if necessary.

   Struck: "SEC. 246. RECRUITMENT AND RETENTION PROGRAM FOR THE NATIONAL CENTER FOR CYBERSECURITY AND COMMUNICATIONS.

   Struck: "(a) Definitions.--In this section:

   Struck: "(1) Collective bargaining agreement.--The term 'collective bargaining agreement' has the meaning given that term in section 7103(a)(8) of title 5, United States Code.

   Struck: "(2) Qualified employee.--The term 'qualified employee' means an employee who performs functions relating to the security of Federal systems and critical information infrastructure.

   Struck: "(b) General Authority.--

   Struck: "(1) Establish positions, appoint personnel, and fix rates of pay.--The Secretary may exercise with respect to qualified employees of the Department the same authority of that the Secretary of Defense has with respect to civilian intelligence personnel under sections 1601, 1602, and 1603 of title 10, United States Code, to establish as positions in the excepted service, to appoint individuals to those positions, and fix pay. Such authority shall be exercised subject to the same conditions and limitations applicable to the Secretary of Defense with respect to civilian intelligence personnel of the Department of Defense.

   Struck: "(2) Scholarship program.--The Secretary may exercise with respect to qualified employees of the Department the same authority of the Secretary of Defense has with respect to civilian personnel under section 2200a of title 10, United States Code, to the same extent, and subject to the same conditions and limitations, that the Secretary of Defense may exercise such authority with respect to civilian personnel of the Department of Defense.

   Struck: "(3) Plan for execution of authorities.--Not later than 120 days after the date of enactment of this subtitle, the Secretary shall submit a report to the appropriate committees of Congress with a plan for the use of the authorities provided under this subsection.

   Struck: "(4) Collective bargaining agreements.--Nothing in paragraph (1) may be construed to impair the continued effectiveness of a collective bargaining agreement with respect to an office, component, subcomponent, or equivalent of the Department that is a successor to an office, component, subcomponent, or equivalent of the Department covered by the agreement before the succession.

   Struck: "(5) Required regulations.--The Secretary, in coordination with the Director of the Center and the Director of the Office of Personnel Management, shall prescribe regulations for the administration of this section.

   Struck: "(c) Merit System Principles and Civil Service Protections: Applicability.--

   Struck: "(1) Applicability of merit system principles.--The Secretary shall exercise the authority under subsection (b) in a manner consistent with the merit system principles set forth in section 2301 of title 5, United States Code.

   Struck: "(2) Civil service protections.--Section 1221, section 2302, and chapter 75 of title 5, United States Code, shall apply to the positions established under subsection (b)(1).

   Struck: "(d) Requirements.--Before the initial exercise of any authority authorized under subsection (b)(1) the Secretary shall--

   Struck: "(1) seek input from affected employees, and the union representatives of affected employees as applicable, and Federal manager and professional associations into the design and implementation of a fair, credible, and transparent system for exercising any authority under subsection (b)(1);

   Struck: "(2) make a good faith attempt to resolve any employee concerns regarding proposed changes in conditions of employment through discussions with the groups described in paragraph (1);

   Struck: "(3) develop a program to provide training to supervisors of cybersecurity employees at the Department on the use of the new authorities, including actions, options, and strategies a supervisor may use in--

   Struck: "(A) developing and discussing relevant goals and objectives with the employee, communicating and discussing progress relative to performance goals and objectives, and conducting performance appraisals;

   Struck: "(B) mentoring and motivating employees, and improving employee performance and productivity;

   Struck: "(C) fostering a work environment characterized by fairness, respect, equal opportunity, and attention to the quality of work of the employees;

   Struck: "(D) effectively managing employees with unacceptable performance;

   Struck: "(E) addressing reports of a hostile work environment, reprisal, or harassment of or by another supervisor or employee; and

   Struck: "(F) otherwise carrying out the duties and responsibilities of a supervisor;

   Struck: "(4) develop a program to provide training to supervisors of cybersecurity employees at the Department on the prohibited personnel practices under section 2302 of title 5, United States Code, (particularly with respect to the practices described in paragraphs (1) and (8) of section 2302(b) of title 5, United States Code), employee collective bargaining and union participation rights, and the procedures and processes used to enforce employee rights; and

   Struck: "(5) develop a program under which experienced supervisors mentor new supervisors by--

   Struck: "(A) sharing knowledge and advice in areas such as communication, critical thinking, responsibility, flexibility, motivating employees, teamwork, leadership, and professional development; and

   Struck: "(B) pointing out strengths and areas for development.

   Struck: "(e) Supervisor Requirement.--

   Struck: "(1) In general.--Except as provided in paragraph (2), not later than 1 year after the date of enactment of the Cybersecurity Act of 2012 and every 3 years thereafter, every supervisor of cybersecurity employees at the Department shall complete the programs established under paragraphs (3) and (4) of subsection (d).

   Struck: "(2) Exception.--A supervisor of cybersecurity employees at the Department who is appointed after the date of enactment of the Cybersecurity Act of 2012 shall complete the programs established under paragraphs (3) and (4) of subsection (d) not later than 1 year after the date on which the supervisor is appointed to the position, and every 3 years thereafter.

   Struck: "(3) Ongoing participation.--Participation by supervisors of cybersecurity employees at the Department in the program established under subsection (d)(5) shall be ongoing.

   Struck: "(f) Conversion to Competitive Service.--In consultation with the Director of the Center, the Secretary may grant competitive civil service status to a qualified employee appointed to the excepted service under subsection (b) if that employee is employed in the Center or is transferring to the Center.

   Struck: "(g) Annual Report.--Not later than 1 year after the date of enactment of this subtitle, and every year thereafter for 4 years, the Secretary shall submit to the appropriate committees of Congress a detailed report that--

   Struck: "(1) discusses the process used by the Secretary in accepting applications, assessing candidates, ensuring adherence to veterans' preference, and selecting applicants for vacancies to be filled by a qualified employee;

   Struck: "(2) describes--

   Struck: "(A) how the Secretary plans to fulfill the critical need of the Department to recruit and retain qualified employees;

   Struck: "(B) the measures that will be used to measure progress; and

   Struck: "(C) any actions taken during the reporting period to fulfill such critical need;

   Struck: "(3) discusses how the planning and actions taken under paragraph (2) are integrated into the strategic workforce planning of the Department;

   Struck: "(4) provides metrics on actions occurring during the reporting period, including--

   Struck: "(A) the number of qualified employees hired by occupation and grade and level or pay band;

   Struck: "(B) the total number of veterans hired;

   Struck: "(C) the number of separations of qualified employees by occupation and grade and level or pay band;

   Struck: "(D) the number of retirements of qualified employees by occupation and grade and level or pay band; and

   Struck: "(E) the number and amounts of recruitment, relocation, and retention incentives paid to qualified employees by occupation and grade and level or pay band.".

   Struck: (b) Technical and Conforming Amendment.--The table of contents in section 1(b) of the Homeland Security Act of 2002 (6 U.S.C. 101 et seq.), as amended by section 204, is amended by inserting after the item relating to section 244 the following:

   Struck: "Sec. 245. National Center for Cybersecurity and Communications acquisition authorities.

   Struck: "Sec. 246. Recruitment and retention program for the national center for cybersecurity and communications.".

   Struck: SEC. 409. REPORTS ON CYBER INCIDENTS AGAINST GOVERNMENT NETWORKS.

   Struck: (a) Department of Homeland Security.--Not later than 180 days after the date of enactment of this Act, and annually thereafter, the Secretary shall submit to Congress a report that--

   Struck: (1) summarizes major cyber incidents involving networks of Executive agencies (as defined in section 105 of title 5, United States Code), except for the Department of Defense;

   Struck: (2) provides aggregate statistics on the number of breaches of networks of Executive agencies, the volume of data exfiltrated, and the estimated cost of remedying the breaches; and

   Struck: (3) discusses the risk of cyber sabotage.

   Struck: (b) Department of Defense.--Not later than 180 days after the date of enactment of this Act, and annually thereafter, the Secretary of Defense shall submit to Congress a report that--

   Struck: (1) summarizes major cyber incidents against networks of the Department of Defense and the military departments;

   Struck: (2) provides aggregate statistics on the number of breaches against networks of the Department of Defense and the military departments, the volume of data exfiltrated, and the estimated cost of remedying the breaches; and

   Struck: (3) discusses the risk of cyber sabotage.

   Struck: (c) Form of Reports.--Each report submitted under this section shall be in unclassified form, but may include a classified annex as necessary to protect sources, methods, and national security.

   Struck: (d) Contents of Reports.--Each report submitted under this section may be based in whole or in part on the reporting requirements under section 3553 of chapter 35 of title 44, United States Code, as amended by this Act.

   Struck: SEC. 410. REPORTS ON PROSECUTION FOR CYBERCRIME.

   Struck: (a) In General.--Not later than 180 days after the date of enactment of this Act, the Attorney General and the Directors of the Federal Bureau of Investigation and the United States Secret Service shall submit to Congress reports--

   Struck: (1) describing investigations and prosecutions relating to cyber intrusions or other cybercrimes the preceding year, including--

   Struck: (A) the number of investigations initiated relating to such crimes;

   Struck: (B) the number of arrests relating to such crimes;

   Struck: (C) the number and description of instances in which investigations or prosecutions relating to such crimes have been delayed or prevented because of an inability to extradite a criminal defendant in a timely manner; and

   Struck: (D) the number of prosecutions for such crimes, including--

   Struck: (i) the number of defendants prosecuted;

   Struck: (ii) whether the prosecutions resulted in a conviction;

   Struck: (iii) the sentence imposed and the statutory maximum for each such crime for which a defendant was convicted; and

   Struck: (iv) the average sentence imposed for a conviction of such crimes;

   Struck: (2) identifying the number of employees, financial resources, and other resources (such as technology and training) devoted to the enforcement, investigation, and prosecution of cyber intrusions or other cybercrimes, including the number of investigators, prosecutors, and forensic specialists dedicated to investigating and prosecuting cyber intrusions or other cybercrimes; and

   Struck: (3) discussing any impediments under the laws of the United States or international law to prosecutions for cyber intrusions or other cybercrimes.

   Struck: (b) Updates.--The Attorney General and the Directors of the Federal Bureau of Investigation and the United States Secret Service shall annually submit to Congress reports updating the reports submitted under subsection (a) at the same time the Attorney General and the Directors submit annual reports under section 404 of the Prioritizing Resources and Organization for Intellectual Property Act of 2008 (42 U.S.C. 3713d).

   Struck: SEC. 411. REPORT ON RESEARCH RELATING TO SECURE DOMAIN.

   Struck: (a) In General.--The Secretary shall enter into a contract with the National Research Council, or another federally funded research and development corporation, under which the Council or corporation shall submit to Congress reports on available technical options, consistent with constitutional and statutory privacy rights, for enhancing the security of the information networks of entities that own or manage critical infrastructure through--

   Struck: (1) technical improvements, including developing a secure domain; or

   Struck: (2) increased notice of and consent to the use of technologies to scan for, detect, and defeat cyber security threats, such as technologies used in a secure domain.

   Struck: (b) Timing.--The contract entered into under subsection (a) shall require that the report described in subsection (a) be submitted--

   Struck: (1) not later than 180 days after the date of enactment of this Act;

   Struck: (2) annually, after the first report submitted under subsection (a), for 3 years; and

   Struck: (3) more frequently, as determined appropriate by the Secretary in response to new risks or technologies that emerge.

   Struck: SEC. 412. REPORT ON PREPAREDNESS OF FEDERAL COURTS TO PROMOTE CYBERSECURITY.

   Struck: Not later than 180 days after the date of enactment of this Act, the Attorney General, in coordination with the Administrative Office of the United States Courts, shall submit to Congress a report--

   Struck: (1) on whether Federal courts have granted timely relief in matters relating to botnets and other cybercrime and cyber security threats; and

   Struck: (2) that includes, as appropriate, recommendations on changes or improvements to--

   Struck: (A) the Federal Rules of Civil Procedure or the Federal Rules of Criminal Procedure;

   Struck: (B) the training and other resources available to support the Federal judiciary;

   Struck: (C) the capabilities and specialization of courts to which such cases may be assigned; and

   Struck: (D) Federal civil and criminal laws.

   Struck: SEC. 413. REPORT ON IMPEDIMENTS TO PUBLIC AWARENESS.

   Struck: Not later than 180 days after the date of enactment of this Act, and annually thereafter for 3 years (or more frequently if determined appropriate by the Secretary) the Secretary shall submit to Congress a report on--

   Struck: (1) legal or other impediments to appropriate public awareness of--

   Struck: (A) the nature of, methods of propagation of, and damage caused by common cyber security threats such as computer viruses, phishing techniques, and malware;

   Struck: (B) the minimal standards of computer security necessary for responsible Internet use; and

   Struck: (C) the availability of commercial off the shelf technology that allows consumers to meet such levels of computer security;

   Struck: (2) a summary of the plans of the Secretary to enhance public awareness of common cyber security threats, including a description of the metrics used by the Department for evaluating the efficacy of public awareness campaigns; and

   Struck: (3) recommendations for congressional actions to address these impediments to appropriate public awareness of common cyber security threats.

   Struck: SEC. 414. REPORT ON PROTECTING THE ELECTRICAL GRID OF THE UNITED STATES.

   Struck: Not later than 180 days after the date of enactment of this Act, the Secretary, in consultation with the Secretary of Defense and the Director of National Intelligence, shall submit to Congress a report on--

   Struck: (1) the threat of a cyber attack disrupting the electrical grid of the United States;

   Struck: (2) the implications for the national security of the United States if the electrical grid is disrupted;

   Struck: (3) the options available to the United States and private sector entities to quickly reconstitute electrical service to provide for the national security of the United States, and, within a reasonable time frame, the reconstitution of all electrical service within the United States; and

   Struck: (4) a plan to prevent disruption of the electric grid of the United States caused by a cyber attack.

   Struck: SEC. 415. MARKETPLACE INFORMATION.

   Struck: (a) Sense of Congress.--It is the sense of Congress that--

   Struck: (1) registrants that file reports with the Securities and Exchange Commission have an obligation to disclose material risks to investors; and

   Struck: (2) as with longstanding rules regarding other material risks, information security risks and related events that are material to investors should be disclosed on a regular basis to provide quality information to the marketplace and enable informed investor decisions.

   Struck: (b) Definition of Information Security Risk.--In this section, the term "information security risk and related events" means the risk to a registrant's business operations, assets, financial condition, strategy, competitive positioning, and reputation, due to the potential for unauthorized access, use, disclosure, disruption, modification, or destruction of registrant information, information of third parties collected by the registrant, or information systems of the registrant.

   Struck: (c) Guidance.--Not later than 1 year after the date of enactment of this Act, the Securities and Exchange Commission (referred to in this section as the "Commission") shall evaluate existing guidance to registrants related to disclosures by registrants of information security risks and related events (including Securities and Exchange Commission Division of Corporation Finance, CF Disclosure Guidance: Topic No. 2, Cybersecurity) to determine whether such guidance, in light of the evaluation, should be--

   Struck: (1) updated by the Division of Corporation Finance; or

   Struck: (2) issued as Commission interpretive guidance.

   Struck: (d) Annual Reports.--For 5 years following the evaluation under subsection (b), the Commission shall submit to Congress, on an annual basis, a report that reviews--

   Struck: (1) the types of information security risks and related events that registrants disclosed in the previous year;

   Struck: (2) whether the staff of the Commission has requested registrants to provide additional information on the disclosures under paragraph (1);

   Struck: (3) any awareness or education activities for registrants or investors, on the subject of information security risks and related events disclosure requirements, sponsored by the Commission or attended by a Commissioner or staff of the Commission; and

   Struck: (4) any public actions commenced by the Commission relating to the enforcement of disclosure requirements pertaining to the information security risks and related events.

   Struck: TITLE V--FEDERAL ACQUISITION RISK MANAGEMENT STRATEGY

   Struck: SEC. 501. FEDERAL ACQUISITION RISK MANAGEMENT STRATEGY.

   Struck: (a) In General.--The Secretary, in coordination with relevant private sector and academic experts and each Federal entity described in paragraphs (1) through (9) of subsection (b), shall develop and periodically update an acquisition risk management strategy designed to ensure, based on mission criticality and cost effectiveness, the security of the Federal information infrastructure.

   Struck: (b) Coordination.--In developing the acquisition risk management strategy required under subsection (a), the Secretary shall coordinate with--

   Struck: (1) the Secretary of Defense;

   Struck: (2) the Secretary of Commerce;

   Struck: (3) the Secretary of State;

   Struck: (4) the Director of National Intelligence;

   Struck: (5) the Administrator of General Services;

   Struck: (6) the Administrator for Federal Procurement Policy;

   Struck: (7) the members of the Chief Information Officers Council established under section 3603 of title 44, United States Code;

   Struck: (8) the Chief Acquisition Officers Council established under section 1311 of title 41, United States Code; and

   Struck: (9) the Chief Financial Officers Council established under section 302 of the Chief Financial Officers Act of 1990 (31 U.S.C. 901 note).

   Struck: (c) Elements.--The risk management strategy developed under subsection (a) shall--

   Struck: (1) address risks in the acquisition of any part of the Federal information infrastructure; and

   Struck: (2) include developing processes that--

   Struck: (A) incorporate all-source intelligence analysis into assessments of the integrity of the supply chain for the Federal information infrastructure;

   Struck: (B) incorporate internationally recognized standards, guidelines, and best practices, including those developed by the private sector, for supply chain integrity;

   Struck: (C) enhance capabilities to test and evaluate software and hardware within or for use in the Federal information infrastructure, and, where appropriate, make the capabilities available for use by the private sector;

   Struck: (D) protect the intellectual property and trade secrets of suppliers of information and communications technology products and services;

   Struck: (E) share with the private sector, to the fullest extent possible, the risks identified in the supply chain and working with the private sector to mitigate those threats as identified;

   Struck: (F) identify specific acquisition practices of Federal agencies that increase risks to the supply chain and develop a process to provide recommendations for revisions to those processes; and

   Struck: (G) to the maximum extent practicable, promote the ability of Federal agencies to procure authentic commercial off-the-shelf information and communications technology products and services from a diverse pool of suppliers, consistent with the preferences for the acquisition of commercial items under section 2377 of title 10, United States Code, and section 3307 of title 41, United States Code.

   Struck: SEC. 502. AMENDMENTS TO CLINGER-COHEN PROVISIONS TO ENHANCE AGENCY PLANNING FOR INFORMATION SECURITY NEEDS.

   Struck: Chapter 113 of title 40, United States Code, is amended--

   Struck: (1) in section 11302--

   Struck: (A) in subsection (f), by striking "technology." and inserting "technology, including information technology or network information security requirements.";

   Struck: (B) in subsection (i)--

   Struck: (i) by inserting ", including information security requirements," after "information resources management"; and

   Struck: (ii) by adding at the end the following: "The Administrator for Federal Procurement Policy, in coordination with the Chief Information Officers Council and the Federal Acquisition Institute, shall ensure that contracting officers and the individuals preparing descriptions of the Government requirements and statements of work have adequate training in information security requirements, including in information technology security contracts.";

   Struck: (C) in subsection (j), by adding at the end the following: "The Director shall review and report on possible impediments in the acquisition process or elsewhere that are acting to slow agency uptake of the newest, most secure technologies."; and

   Struck: (D) by adding at the end the following:

   Struck: "(l) Multiple Award Schedule for Information Security.--The Administrator of General Services shall develop a special item number under Schedule 70 for information security products and services and consolidate those products and services under that special item number to promote acquisition.

   Struck: "(m) Reducing the Use of Counterfeit Products.--Not later than 180 days after the date of enactment of the Cybersecurity Act of 2012, the Director shall issue guidance requiring, to the extent practicable, Federal agencies to purchase information technology products only through the authorized channels or distributors of a supplier."; and

   Struck: (2) in section 11312(b)(3), by inserting ", information security improvement," after "risk-adjusted return on investment".

   Struck: TITLE VI--INTERNATIONAL COOPERATION

   Struck: SEC. 601. DEFINITIONS.

   Struck: In this title:

   Struck: (1) Computer system; computer data.--The terms "computer system" and "computer data" have the meanings given those terms in chapter I of the Convention on Cybercrime.

   Struck: (2) Convention on cybercrime.--The term "Convention on Cybercrime" means the Council of Europe's Convention on Cybercrime, done at Budapest November 23, 2001 as ratified by the United States Senate on August 3, 2006 (Treaty 108-11) with any relevant reservations of declarations.

   Struck: (3) Cyber issues.--The term "cyber issues" means the full range of international policies designed to ensure an open, interoperable, secure, and reliable global information and communications infrastructure.

   Struck: (4) Cybercrime.--The term "cybercrime" refers to criminal offenses relating to computer systems of computer data described in the Convention of Cybercrime.

   Struck: (5) Relevant federal agencies.--The term "relevant Federal agencies" means any Federal agency that has responsibility for combating cybercrime globally, including the Department of Commerce, the Department of Homeland Security, the Department of Justice, the Department of State, the Department of the Treasury, and the Office of the United States Trade Representative.

   Struck: SEC. 602. FINDINGS.

   Struck: Congress finds the following:

   Struck: (1) On February 2, 2010, Admiral Dennis C. Blair, the Director of National Intelligence, testified before the Select Committee on Intelligence of the Senate regarding the Annual Threat Assessment of the U.S. Intelligence Community, stating "The national security of the United States, our economic prosperity, and the daily functioning of our government are dependent on a dynamic public and private information infrastructure, which includes tele-communications, computer networks and systems, and the information residing within. This critical infrastructure is severely threatened. . . . We cannot protect cyberspace without a coordinated and collaborative effort that incorporates both the US private sector and our international partners." (2) In a January 2010 speech on Internet freedom, Secretary of State Hillary Clinton stated: "Those who disrupt the free flow of information in our society, or any other, pose a threat to our economy, our government, and our civil society. Countries or individuals that engage in cyber attacks should face consequences and international condemnation. In an Internet-connected world, an attack on one nation's networks can be an attack on all. And by reinforcing that message, we can create norms of behavior among states and encourage respect for the global networked commons." (3) November 2011 marked the tenth anniversary of the Convention on Cybercrime, the only multilateral agreement on cybercrime, to which the Senate provided advice and consent on August 3, 2006, and is currently ratified by over 30 countries.

   Struck: (4) The May 2009 White House Cyberspace Policy Review asserts "[t]he Nation also needs a strategy for cybersecurity designed to shape the international environment and bring like- minded nations together on a host of issues, such as technical standards and acceptable legal norms regarding territorial jurisdiction, sovereign responsibility, and use of force. International norms are critical to establishing a secure and thriving digital infrastructure."

   Struck: SEC. 603. SENSE OF CONGRESS.

   Struck: It is the sense of Congress that--

   Struck: (1) engagement with other countries to advance the cyberspace objectives of the United States should be an integral part of the conduct of United States foreign relations and diplomacy;

   Struck: (2) the cyberspace objectives of the United States include the full range of cyber issues, including issues related to governance, standards, cybersecurity, cybercrime, international security, human rights, and the free flow of information;

   Struck: (3) it is in the interest of the United States to work with other countries to build consensus on principles and standards of conduct that protect computer systems and users that rely on them, prevent and punish acts of cybercrime, and promote the free flow of information;

   Struck: (4) a comprehensive national cyberspace strategy must include tools for addressing threats to computer systems and acts of cybercrime from sources and by persons outside the United States;

   Struck: (5) developing effective solutions to international cyberspace threats requires engagement with foreign countries on a bilateral basis and through relevant regional and multilateral fora;

   Struck: (6) it is in the interest of the United States to encourage the development of effective frameworks for international cooperation to combat cyberthreats, and the development of foreign government capabilities to combat cyberthreats; and

   Struck: (7) the Secretary of State, in consultation with other relevant Federal agencies, should develop and lead Federal Government efforts to engage with other countries to advance the cyberspace objectives of the United States, including efforts to bolster an international framework of cyber norms, governance and deterrence.

   Struck: SEC. 604. COORDINATION OF INTERNATIONAL CYBER ISSUES WITHIN THE UNITED STATES GOVERNMENT.

   Struck: The Secretary of State is authorized to designate a senior level official at the Department of State, to carry out the Secretary's responsibilities to--

   Struck: (1) coordinate the United States global diplomatic engagement on the full range of international cyber issues, including building multilateral cooperation and developing international norms, common policies, and responses to secure the integrity of cyberspace;

   Struck: (2) provide strategic direction and coordination for United States Government policy and programs aimed at addressing and responding to cyber issues overseas, especially in relation to issues that affect United States foreign policy and related national security concerns;

   Struck: (3) coordinate with relevant Federal agencies, including the Department, the Department of Defense, the Department of the Treasury, the Department of Justice, the Department of Commerce, and the intelligence community to develop interagency plans regarding international cyberspace, cybersecurity, and cybercrime issues; and

   Struck: (4) ensure that cyber issues, including cybersecurity and cybercrime, are included in the responsibilities of overseas Embassies and consulates of the United States, as appropriate.

   Struck: SEC. 605. CONSIDERATION OF CYBERCRIME IN FOREIGN POLICY AND FOREIGN ASSISTANCE PROGRAMS.

   Struck: (a) Briefing.--

   Struck: (1) In general.--Not later than 1 year after the date of enactment of this Act, the Secretary of State, after consultation with the heads of the relevant Federal agencies, shall provide a comprehensive briefing to relevant congressional committees--

   Struck: (A) assessing global issues, trends, and actors considered to be significant with respect to cybercrime;

   Struck: (B) assessing, after consultation with private industry groups, civil society organizations, and other relevant domestic or multilateral organizations, which shall be selected by the President based on an interest in combating cybercrime, means of enhancing multilateral or bilateral efforts in areas of significance--

   Struck: (i) to prevent and investigate cybercrime;

   Struck: (ii) to develop and share best practices with respect to directly or indirectly combating cybercrime; and

   Struck: (iii) to cooperate and take action with respect to the prevention, investigation, and prosecution of cybercrime; and

   Struck: (C) describing the steps taken by the United States to promote the multilateral or bilateral efforts described in subparagraph (B).

   Struck: (2) Contributions from relevant federal agencies.--Not later than 30 days before the date on which the briefing is to be provided under paragraph (1), the head of each relevant Federal agency shall consult with and provide to the Secretary of State relevant information appropriate for the briefing.

   Struck: (b) Periodic Updates.--The Secretary of State shall provide updated information highlighting significant developments relating to the issues described in subsection (a), through periodic briefings to Congress.

   Struck: (c) Use of Foreign Assistance Programs.--

   Struck: (1) Foreign assistance programs to combat cybercrime.--The Secretary of State is authorized to accord priority in foreign assistance to programs designed to combat cybercrime in a region or program of significance in order to better combat cybercrime by, among other things, improving the effectiveness and capacity of the legal and judicial systems and the capabilities of law enforcement agencies with respect to cybercrime.

   Struck: (2) Sense of the congress with respect to bilateral and multilateral assistance.--It is the sense of Congress that the Secretary of State should include programs designed to combat cybercrime in relevant bilateral or multilateral assistance programs administered or supported by the United States Government.

   Struck: TITLE VII--INFORMATION SHARING

   Struck: SEC. 701. AFFIRMATIVE AUTHORITY TO MONITOR AND DEFEND AGAINST CYBERSECURITY THREATS.

   Struck: (a) In General.--Notwithstanding chapter 119, 121, or 206 of title 18, United States Code, the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801 et seq.), and sections 222 and 705 of the Communications Act of 1934 (47 U.S.C. 222 and 605), any private entity may--

   Struck: (1) monitor its information systems and information that is stored on, processed by, or transiting such information systems for--

   Struck: (A) malicious reconnaissance;

   Struck: (B) efforts to defeat a technical control or an operational control;

   Struck: (C) technical vulnerabilities;

   Struck: (D) efforts to cause a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a technical control or an operational control;

   Struck: (E) malicious cyber command and control;

   Struck: (F) information exfiltrated as a result of defeating a technical control or an operational control;

   Struck: (G) any other attribute of a cybersecurity threat, if monitoring for such attribute is not otherwise prohibited by law; or

   Struck: (H) any combination of subparagraphs (A) through (G);

   Struck: (2) operate countermeasures on its information systems to protect its rights or property from cybersecurity threats;

   Struck: (3) consent to another private entity monitoring or operating countermeasures on its information systems and information that is stored on, processed by, or transiting such information systems in accordance with this section;

   Struck: (4) monitor a third party's information systems and information that is stored on, processed by, or transiting such information systems for the information listed in subparagraphs (A) through (H) of paragraph (1), if--

   Struck: (A) the third party provides express prior consent to such monitoring; and

   Struck: (B) such monitoring would be lawful under paragraph (1) or under any other provision of law if the third party were to perform such monitoring of its own networks; and

   Struck: (5) operate countermeasures on a third party's information systems to protect the third party's rights or property from cybersecurity threats, if--

   Struck: (A) the third party provides express prior consent to such countermeasures; and

   Struck: (B) operating such countermeasures would be lawful under paragraph (2) or under any other provision of law if the third party were to operate such countermeasures on its own information systems to protect its own rights or property.

   Struck: (b) Use and Protection of Information.--A private entity performing monitoring or operating countermeasures under subsection (a)--

   Struck: (1) may use cybersecurity threat indicators acquired under this title, provided such use is solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that may be used to identify specific persons acquired in the course of such monitoring from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the use of cybersecurity threat indicators, including, if requested, the removal or destruction of information that can be used to identify specific persons from such indicators;

   Struck: (4) may not use cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the entity that authorized such monitoring or operation of countermeasures; and

   Struck: (5) may use information obtained under any other provision of law.

   Struck: SEC. 702. VOLUNTARY DISCLOSURE OF CYBERSECURITY THREAT INDICATORS AMONG PRIVATE ENTITIES.

   Struck: (a) Authority to Disclose.--Notwithstanding any other provision of law, any private entity may disclose lawfully obtained cybersecurity threat indicators to any other private entity in accordance with this section.

   Struck: (b) Use and Protection of Information.--A private entity disclosing or receiving cybersecurity threat indicators pursuant to subsection (a)--

   Struck: (1) may use, retain, or further disclose such cybersecurity threat indicators solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that can be used to identify specific persons from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the disclosure or use of cybersecurity threat indicators, including, if requested, the removal of information that may be used to identify specific persons from such indicators; and

   Struck: (4) may not use the cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the entity that authorized such sharing.

   Struck: (c) Transfers to Unreliable Private Entities Prohibited.--A private entity may not disclose cybersecurity threat indicators to another private entity that the disclosing entity knows--

   Struck: (1) has intentionally or willfully violated the requirements of subsection (b); and

   Struck: (2) is reasonably likely to violate such requirements.

   Struck: SEC. 703. CYBERSECURITY EXCHANGES.

   Struck: (a) Designation of Cybersecurity Exchanges.--The Secretary of Homeland Security, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall establish--

   Struck: (1) a process for designating one or more appropriate civilian Federal entities or non-Federal entities to serve as cybersecurity exchanges to receive and distribute cybersecurity threat indicators;

   Struck: (2) procedures to facilitate and ensure the sharing of classified and unclassified cybersecurity threat indicators in as close to real time as possible with appropriate Federal entities and non-Federal entities in accordance with this title; and

   Struck: (3) a process for identifying certified entities to receive classified cybersecurity threat indicators in accordance with paragraph (2).

   Struck: (b) Purpose.--The purpose of a cybersecurity exchange is to receive and distribute, in as close to real time as possible, cybersecurity threat indicators, and to thereby avoid unnecessary and duplicative Federal bureaucracy for information sharing as provided in this title.

   Struck: (c) Requirement for a Lead Federal Civilian Cybersecurity Exchange.--

   Struck: (1) In general.--The Secretary, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall designate a civilian Federal entity as the lead cybersecurity exchange to serve as a focal point within the Federal Government for cybersecurity information sharing among Federal entities and with non-Federal entities.

   Struck: (2) Responsibilities.--The lead Federal civilian cybersecurity exchange designated under paragraph (1) shall--

   Struck: (A) receive and distribute, in as close to real time as possible, cybersecurity threat indicators in accordance with this title;

   Struck: (B) facilitate information sharing, interaction, and collaboration among and between--

   Struck: (i) Federal entities;

   Struck: (ii) State, local, tribal, and territorial governments;

   Struck: (iii) private entities;

   Struck: (iv) academia;

   Struck: (v) international partners, in consultation with the Secretary of State; and

   Struck: (vi) other cybersecurity exchanges;

   Struck: (C) disseminate timely and actionable cybersecurity threat, vulnerability, mitigation, and warning information lawfully obtained from any source, including alerts, advisories, indicators, signatures, and mitigation and response measures, to appropriate Federal and non-Federal entities in as close to real time as possible, to improve the security and protection of information systems;

   Struck: (D) coordinate with other Federal and non-Federal entities, as appropriate, to integrate information from Federal and non-Federal entities, including Federal cybersecurity centers, non-Federal network or security operation centers, other cybersecurity exchanges, and non-Federal entities that disclose cybersecurity threat indicators under section 704(a), in as close to real time as possible, to provide situational awareness of the United States information security posture and foster information security collaboration among information system owners and operators;

   Struck: (E) conduct, in consultation with private entities and relevant Federal and other governmental entities, regular assessments of existing and proposed information sharing models to eliminate bureaucratic obstacles to information sharing and identify best practices for such sharing; and

   Struck: (F) coordinate with other Federal entities, as appropriate, to compile and analyze information about risks and incidents that threaten information systems, including information voluntarily submitted in accordance with section 704(a) or otherwise in accordance with applicable laws.

   Struck: (3) Schedule for designation.--The designation of a lead Federal civilian cybersecurity exchange under paragraph (1) shall be made concurrently with the issuance of the interim policies and procedures under section 704(g)(3)(D).

   Struck: (d) Additional Civilian Federal Cybersecurity Exchanges.--In accordance with the process and procedures established in subsection (a), the Secretary, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, may designate additional civilian Federal entities to receive and distribute cybersecurity threat indicators, if such entities are subject to the requirements for use, retention, and disclosure of information by a cybersecurity exchange under section 704(b) and the special requirements for Federal entities under section 704(g).

   Struck: (e) Requirements for Non-Federal Cybersecurity Exchanges.--

   Struck: (1) In general.--In considering whether to designate a private entity or any other non-Federal entity as a cybersecurity exchange to receive and distribute cybersecurity threat indicators under section 704, and what entity to designate, the Secretary shall consider the following factors:

   Struck: (A) The net effect that such designation would have on the overall cybersecurity of the United States.

   Struck: (B) Whether such designation could substantially improve such overall cybersecurity by serving as a hub for receiving and sharing cybersecurity threat indicators in as close to real time as possible, including the capacity of the non-Federal entity for performing those functions.

   Struck: (C) The capacity of such non-Federal entity to safeguard cybersecurity threat indicators from unauthorized disclosure and use.

   Struck: (D) The adequacy of the policies and procedures of such non-Federal entity to protect personally identifiable information from unauthorized disclosure and use.

   Struck: (E) The ability of the non-Federal entity to sustain operations using entirely non-Federal sources of funding.

   Struck: (2) Regulations.--The Secretary may promulgate regulations as may be necessary to carry out this subsection.

   Struck: (f) Construction With Other Authorities.--Nothing in this section may be construed to alter the authorities of a Federal cybersecurity center, unless such cybersecurity center is acting in its capacity as a designated cybersecurity exchange.

   Struck: (g) Congressional Notification of Designation of Cybersecurity Exchanges.--

   Struck: (1) In general.--The Secretary, in coordination with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, shall promptly notify Congress, in writing, of any designation of a cybersecurity exchange under this title.

   Struck: (2) Requirement.--Written notification under paragraph (1) shall include a description of the criteria and processes used to make the designation.

   Struck: SEC. 704. VOLUNTARY DISCLOSURE OF CYBERSECURITY THREAT INDICATORS TO A CYBERSECURITY EXCHANGE.

   Struck: (a) Authority to Disclose.--Notwithstanding any other provision of law, a non-Federal entity may disclose lawfully obtained cybersecurity threat indicators to a cybersecurity exchange in accordance with this section.

   Struck: (b) Use, Retention, and Disclosure of Information by a Cybersecurity Exchange.--A cybersecurity exchange may only use, retain, or further disclose information provided pursuant to subsection (a)--

   Struck: (1) in order to protect information systems from cybersecurity threats and to mitigate cybersecurity threats; or

   Struck: (2) to law enforcement pursuant to subsection (g)(2).

   Struck: (c) Use and Protection of Information Received From a Cybersecurity Exchange.--A non-Federal entity receiving cybersecurity threat indicators from a cybersecurity exchange--

   Struck: (1) may use, retain, or further disclose such cybersecurity threat indicators solely for the purpose of protecting an information system or information that is stored on, processed by, or transiting an information system from cybersecurity threats or mitigating such threats;

   Struck: (2) shall make reasonable efforts to safeguard communications, records, system traffic, or other information that can be used to identify specific persons from unauthorized access or acquisition;

   Struck: (3) shall comply with any lawful restrictions placed on the disclosure or use of cybersecurity threat indicators by the cybersecurity exchange or a third party, if the cybersecurity exchange received such information from the third party, including, if requested, the removal of information that can be used to identify specific persons from such indicators; and

   Struck: (4) may not use the cybersecurity threat indicators to gain an unfair competitive advantage to the detriment of the third party that authorized such sharing.

   Struck: (d) Exemption From Public Disclosure.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) shall be--

   Struck: (1) exempt from disclosure under section 552(b)(3) of title 5, United States Code, or any comparable State law; and

   Struck: (2) treated as voluntarily shared information under section 552 of title 5, United States Code, or any comparable State law.

   Struck: (e) Exemption From Ex Parte Limitations.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) shall not be subject to the rules of any governmental entity or judicial doctrine regarding ex parte communications with a decision making official.

   Struck: (f) Exemption From Waiver of Privilege.--Any cybersecurity threat indicator disclosed by a non-Federal entity to a cybersecurity exchange pursuant to subsection (a) may not be construed to be a waiver of any applicable privilege or protection provided under Federal, State, tribal, or territorial law, including any trade secret protection.

   Struck: (g) Special Requirements for Federal and Law Enforcement Entities.--

   Struck: (1) Receipt, disclosure and use of cybersecurity threat indicators by a federal entity.--

   Struck: (A) Authority to receive and use cybersecurity threat indicators.--A Federal entity that is not a cybersecurity exchange may receive, retain, and use cybersecurity threat indicators from a cybersecurity exchange in order--

   Struck: (i) to protect information systems from cybersecurity threats and to mitigate cybersecurity threats; and

   Struck: (ii) to disclose such cybersecurity threat indicators to law enforcement in accordance with paragraph (2).

   Struck: (B) Authority to disclose cybersecurity threat indicators.--A Federal entity that is not a cybersecurity exchange shall ensure that if disclosing cybersecurity threat indicators to a non-Federal entity under this section, such non-Federal entity shall use or retain such cybersecurity threat indicators in a manner that is consistent with the requirements in--

   Struck: (i) subsection (b) on the use and protection of information; and

   Struck: (ii) paragraph (2).

   Struck: (2) Law enforcement access and use of cybersecurity threat indicators.--

   Struck: (A) Disclosure to law enforcement.--A Federal entity may disclose cybersecurity threat indicators received under this title to a law enforcement entity if--

   Struck: (i) the disclosure is permitted under the procedures developed by the Secretary and approved by the Attorney General under paragraph (3); and

   Struck: (ii) the information appears to pertain--

   Struck: (I) to a cybersecurity crime which has been, is being, or is about to be committed;

   Struck: (II) to an imminent threat of death or serious bodily harm; or

   Struck: (III) to a serious threat to minors, including sexual exploitation and threats to physical safety.

   Struck: (B) Use by law enforcement.--A law enforcement entity may only use cybersecurity threat indicators received by a Federal entity under paragraph (A) in order--

   Struck: (i) to protect information systems from a cybersecurity threat or investigate, prosecute, or disrupt a cybersecurity crime;

   Struck: (ii) to protect individuals from an imminent threat of death or serious bodily harm; or

   Struck: (iii) to protect minors from any serious threat, including sexual exploitation and threats to physical safety.

   Struck: (3) Privacy and civil liberties.--

   Struck: (A) Requirement for policies and procedures.--The Secretary, in consultation with privacy and civil liberties experts, the Director of National Intelligence, and the Secretary of Defense, shall develop and periodically review policies and procedures governing the receipt, retention, use, and disclosure of cybersecurity threat indicators by a Federal entity obtained in connection with activities authorized in this title. Such policies and procedures shall--

   Struck: (i) minimize the impact on privacy and civil liberties, consistent with the need to protect information systems from cybersecurity threats and mitigate cybersecurity threats;

   Struck: (ii) reasonably limit the receipt, retention, use and disclosure of cybersecurity threat indicators associated with specific persons consistent with the need to carry out the responsibilities of this title, including establishing a process for the timely destruction of cybersecurity threat indicators that are received pursuant to this section that do not reasonably appear to be related to the purposes identified in paragraph (1)(A);

   Struck: (iii) include requirements to safeguard cybersecurity threat indicators that may be used to identify specific persons from unauthorized access or acquisition;

   Struck: (iv) include procedures for notifying entities, as appropriate, if information received pursuant to this section is not a cybersecurity threat indicator; and

   Struck: (v) protect the confidentiality of cybersecurity threat indicators associated with specific persons to the greatest extent practicable and require recipients to be informed that such indicators may only be used for the purposes identified in paragraph (1)(A).

   Struck: (B) Adoption of policies and procedures.--The head of an agency responsible for a Federal entity designated as a cybersecurity exchange under section 703 shall adopt and comply with the policies and procedures developed under this paragraph.

   Struck: (C) Review by the attorney general.--The policies and procedures developed under this subsection shall be provided to the Attorney General for review not later than 1 year after the date of the enactment of this title, and shall not be issued without the Attorney General's approval.

   Struck: (D) Requirement for interim policies and procedures.--The Secretary shall issue interim policies and procedures not later than 60 days after the date of the enactment of this title.

   Struck: (E) Provision to congress.--The policies and procedures issued under this title and any amendments to such policies and procedures shall be provided to Congress in an unclassified form and be made public, but may include a classified annex.

   Struck: (4) Oversight.--

   Struck: (A) Requirement for oversight.--The Secretary and the Attorney General shall establish a mandatory program to monitor and oversee compliance with the policies and procedures issued under this subsection.

   Struck: (B) Notification of the attorney general.--The head of each Federal entity that receives information under this title shall--

   Struck: (i) comply with the policies and procedures developed by the Secretary and approved by the Attorney General under paragraph (3);

   Struck: (ii) promptly notify the Attorney General of significant violations of such policies and procedures; and

   Struck: (iii) provide to the Attorney General any information relevant to the violation that the Attorney General requires.

   Struck: (C) Annual report.--On an annual basis, the Chief Privacy and Civil Liberties Officer of the Department of Justice and the Chief Privacy Officer of the Department, in consultation with the most senior privacy and civil liberties officer or officers of any appropriate agencies, shall jointly submit to Congress a report assessing the privacy and civil liberties impact of the governmental activities conducted pursuant to this title.

   Struck: (5) Reports on information sharing.--

   Struck: (A) Privacy and civil liberties oversight board report.--Not later than 2 years after the date of the enactment of this title, and every 2 years thereafter, the Privacy and Civil Liberties Oversight Board shall submit to Congress and the President a report providing--

   Struck: (i) an analysis of the practices of private entities that are performing, monitoring, operating countermeasures, or disclosing cybersecurity threat indicators pursuant to this title;

   Struck: (ii) an assessment of the privacy and civil liberties impact of the activities carried out by the Federal entities under this title; and

   Struck: (iii) recommendations for improvements to or modifications of the law and the policies and procedures established pursuant to paragraph (3) in order to address privacy and civil liberties concerns.

   Struck: (B) Inspectors general annual report.--The Inspector General of the Department, the Inspector General of the Intelligence Community, the Inspector General of the Department of Justice, and the Inspector General of the Department of Defense shall, on an annual basis, jointly submit to Congress a report on the receipt, use and disclosure of information shared with a Federal cybersecurity exchange under this title, including--

   Struck: (i) a review of the use by Federal entities of such information for a purpose other than to protect information systems from cybersecurity threats and to mitigate cybersecurity threats, including law enforcement access and use pursuant to paragraph (2);

   Struck: (ii) a review of the type of information shared with a Federal cybersecurity exchange;

   Struck: (iii) a review of the actions taken by Federal entities based on such information;

   Struck: (iv) appropriate metrics to determine the impact of the sharing of such information with a Federal cybersecurity exchange on privacy and civil liberties;

   Struck: (v) a list of Federal entities receiving such information;

   Struck: (vi) a review of the sharing of such information among Federal entities to identify inappropriate stovepiping of shared information; and

   Struck: (vii) any recommendations of the inspectors general for improvements or modifications to the authorities under this title.

   Struck: (C) Form.--Each report required under this paragraph shall be submitted in unclassified form, but may include a classified annex.

   Struck: (6) Sanctions.--The head of each Federal entity that conducts activities under this title shall develop and enforce appropriate sanctions for officers, employees, or agents of such entities who conducts such activities--

   Struck: (A) outside the normal course of their specified duties;

   Struck: (B) in a manner inconsistent with the discharge of the responsibilities of such entity; or

   Struck: (C) in contravention of the requirements, policies, and procedures required by this subsection.

   Struck: (7) Federal government liability for violations of this title.--

   Struck: (A) In general.--If a Federal entity intentionally or willfully violates a provision of this title or a regulation promulgated under this title, the United States shall be liable to a person adversely affected by such violation in an amount equal to the sum of--

   Struck: (i) the actual damages sustained by the person as a result of the violation or $1,000, whichever is greater; and

   Struck: (ii) the costs of the action together with reasonable attorney fees as determined by the court.

   Struck: (B) Venue.--An action to enforce liability created under this subsection may be brought in the district court of the United States in--

   Struck: (i) the district in which the complainant resides;

   Struck: (ii) the district in which the principal place of business of the complainant is located;

   Struck: (iii) the district in which the Federal entity that disclosed the information is located; or

   Struck: (iv) the District of Columbia.

   Struck: (C) Statute of limitations.--No action shall lie under this subsection unless such action is commenced not later than 2 years after the date of the violation that is the basis for the action.

   Struck: (D) Exclusive cause of action.--A cause of action under this subsection shall be the exclusive means available to a complainant seeking a remedy for a disclosure of information in violation of this title by a Federal entity.

   Struck: SEC. 705. SHARING OF CLASSIFIED CYBERSECURITY THREAT INDICATORS.

   Struck: (a) Sharing of Classified Cybersecurity Threat Indicators.--The procedures established under section 703(a)(2) shall provide that classified cybersecurity threat indicators may only be--

   Struck: (1) shared with certified entities;

   Struck: (2) shared in a manner that is consistent with the need to protect the national security of the United States;

   Struck: (3) shared with a person with an appropriate security clearance to receive such cybersecurity threat indicators; and

   Struck: (4) used by a certified entity in a manner that protects such cybersecurity threat indicators from unauthorized disclosure.

   Struck: (b) Requirement for Guidelines.--Not later than 60 days after the date of the enactment of this title, the Director of National Intelligence shall issue guidelines providing that appropriate Federal officials may, as the Director considers necessary to carry out this title--

   Struck: (1) grant a security clearance on a temporary or permanent basis to an employee of a certified entity;

   Struck: (2) grant a security clearance on a temporary or permanent basis to a certified entity and approval to use appropriate facilities; or

   Struck: (3) expedite the security clearance process for such an employee or entity, if appropriate, in a manner consistent with the need to protect the national security of the United States.

   Struck: (c) Distribution of Procedures and Guidelines.--Following the establishment of the procedures under section 703(a)(2) and the issuance of the guidelines under subsection (b), the Secretary and the Director of National Intelligence shall expeditiously distribute such procedures and guidelines to--

   Struck: (1) appropriate governmental entities and private entities;

   Struck: (2) the Committee on Armed Services, the Committee on Commerce, Science, and Transportation, the Committee on Homeland Security and Governmental Affairs, the Committee on the Judiciary, and the Select Committee on Intelligence of the Senate; and

   Struck: (3) the Committee on Armed Services, the Committee on Energy and Commerce, the Committee on Homeland Security, the Committee on the Judiciary, and the Permanent Select Committee on Intelligence of the House of Representatives.

   Struck: SEC. 706. LIMITATION ON LIABILITY AND GOOD FAITH DEFENSE FOR CYBERSECURITY ACTIVITIES.

   Struck: (a) In General.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any entity acting as authorized by this title, and any such action shall be dismissed promptly for activities authorized by this title consisting of--

   Struck: (1) the cybersecurity monitoring activities authorized by paragraph (1), (3) or (4) of section 701(a); or

   Struck: (2) the voluntary disclosure of a lawfully obtained cybersecurity threat indicator--

   Struck: (A) to a cybersecurity exchange pursuant to section 704(a);

   Struck: (B) by a provider of cybersecurity services to a customer of that provider;

   Struck: (C) to a private entity or governmental entity that provides or manages critical infrastructure (as that term is used in section 1016 of the Critical Infrastructures Protection Act of 2001 (42 U.S.C. 5195c)); or

   Struck: (D) to any other private entity under section 702(a), if the cybersecurity threat indicator is also disclosed within a reasonable time to a cybersecurity exchange.

   Struck: (b) Good Faith Defense.--If a civil or criminal cause of action is not barred under subsection (a), a reasonable good faith reliance that this title permitted the conduct complained of is a complete defense against any civil or criminal action brought under this title or any other law.

   Struck: (c) Limitation on Use of Cybersecurity Threat Indicators for Regulatory Enforcement Actions.--No Federal entity may use a cybersecurity threat indicator received pursuant to this title as evidence in a regulatory enforcement action against the entity that lawfully shared the cybersecurity threat indicator with a cybersecurity exchange that is a Federal entity.

   Struck: (d) Delay of Notification Authorized for Law Enforcement, National Security, or Homeland Security Purposes.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any entity, and any such action shall be dismissed promptly, for a failure to disclose a cybersecurity threat indicator if--

   Struck: (1) the Attorney General or the Secretary determines that disclosure of a cybersecurity threat indicator would impede a civil or criminal investigation and submits a written request to delay notification for up to 30 days, except that the Attorney General or the Secretary may, by a subsequent written request, revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary; or

   Struck: (2) the Secretary, the Attorney General, or the Director of National Intelligence determines that disclosure of a cybersecurity threat indicator would threaten national or homeland security and submits a written request to delay notification, except that the Secretary, the Attorney General, or the Director, may, by a subsequent written request, revoke such delay or extend the period of time set forth in the original request made under this paragraph if further delay is necessary.

   Struck: (e) Limitation on Liability for Failure to Act.--No civil or criminal cause of action shall lie or be maintained in any Federal or State court against any private entity, or any officer, employee, or agent of such an entity, and any such action shall be dismissed promptly, for the reasonable failure to act on information received under this title.

   Struck: (f) Defense for Breach of Contract.--Compliance with lawful restrictions placed on the disclosure or use of cybersecurity threat indicators is a complete defense to any tort or breach of contract claim originating in a failure to disclose cybersecurity threat indicators to a third party.

   Struck: (g) Limitation on Liability Protections.--Any person who, knowingly or acting in gross negligence, violates a provision of this title or a regulation promulgated under this title shall--

   Struck: (1) not receive the protections of this title; and

   Struck: (2) be subject to any criminal or civil cause of action that may arise under any other State or Federal law prohibiting the conduct in question.

   Struck: SEC. 707. CONSTRUCTION AND FEDERAL PREEMPTION.

   Struck: (a) Construction.--Nothing in this title may be construed--

   Struck: (1) to limit any other existing authority or lawful requirement to monitor information systems and information that is stored on, processed by, or transiting such information systems, operate countermeasures, and retain, use or disclose lawfully obtained information;

   Struck: (2) to permit the unauthorized disclosure of--

   Struck: (A) information that has been determined by the Federal Government pursuant to an Executive order or statute to require protection against unauthorized disclosure for reasons of national defense or foreign relations;

   Struck: (B) any restricted data (as that term is defined in paragraph (y) of section 11 of the Atomic Energy Act of 1954 (42 U.S.C. 2014));

   Struck: (C) information related to intelligence sources and methods; or

   Struck: (D) information that is specifically subject to a court order or a certification, directive, or other authorization by the Attorney General precluding such disclosure;

   Struck: (3) to provide additional authority to, or modify an existing authority of, the Department of Defense or the National Security Agency or any other element of the intelligence community to control, modify, require, or otherwise direct the cybersecurity efforts of a non-Federal entity or a Federal entity;

   Struck: (4) to limit or modify an existing information sharing relationship;

   Struck: (5) to prohibit a new information sharing relationship;

   Struck: (6) to require a new information sharing relationship between a Federal entity and a private entity;

   Struck: (7) to limit the ability of a non-Federal entity or a Federal entity to receive data about its information systems, including lawfully obtained cybersecurity threat indicators;

   Struck: (8) to authorize or prohibit any law enforcement, homeland security, or intelligence activities not otherwise authorized or prohibited under another provision of law;

   Struck: (9) to permit price-fixing, allocating a market between competitors, monopolizing or attempting to monopolize a market, boycotting, or exchanges of price or cost information, customer lists, or information regarding future competitive planning;

   Struck: (10) to authorize or limit liability for actions that would violate the regulations adopted by the Federal Communications Commission on preserving the open Internet, or any successor regulations thereto, nor to modify or alter the obligations of private entities under such regulations; or

   Struck: (11) to prevent a governmental entity from using information not acquired through a cybersecurity exchange for regulatory purposes.

   Struck: (b) Federal Preemption.--This title supersedes any law or requirement of a State or political subdivision of a State that restricts or otherwise expressly regulates the provision of cybersecurity services or the acquisition, interception, retention, use or disclosure of communications, records, or other information by private entities to the extent such law contains requirements inconsistent with this title.

   Struck: (c) Preservation of Other State Law.--Except as expressly provided, nothing in this title shall be construed to preempt the applicability of any other State law or requirement.

   Struck: (d) No Creation of a Right to Information.--The provision of information to a non-Federal entity under this title does not create a right or benefit to similar information by any other non-Federal entity.

   Struck: (e) Prohibition on Requirement to Provide Information to the Federal Government.--Nothing in this title may be construed to permit a Federal entity--

   Struck: (1) to require a non-Federal entity to share information with the Federal Government;

   Struck: (2) to condition the disclosure of unclassified or classified cybersecurity threat indicators pursuant to this title with a non-Federal entity on the provision of cybersecurity threat information to the Federal Government; or

   Struck: (3) to condition the award of any Federal grant, contract or purchase on the provision of cybersecurity threat indicators to a Federal entity, if the provision of such indicators does not reasonably relate to the nature of activities, goods, or services covered by the award.

   Struck: (f) Limitation on Use of Information.--No cybersecurity threat indicators obtained pursuant to this title may be used, retained, or disclosed by a Federal entity or non-Federal entity, except as authorized under this title.

   Struck: (g) Declassification and Sharing of Information.--Consistent with the exemptions from public disclosure of section 704(d), the Director of National Intelligence, in consultation with the Secretary and the head of the Federal entity in possession of the information, shall facilitate the declassification and sharing of information in the possession of a Federal entity that is related to cybersecurity threats, as the Director deems appropriate.

   Struck: (h) Report on Implementation.--Not later than 2 years after the date of the enactment of this title, the Secretary, the Director of National Intelligence, the Attorney General, and the Secretary of Defense shall jointly submit to Congress a report that--

   Struck: (1) describes the extent to which the authorities conferred by this title have enabled the Federal Government and the private sector to mitigate cybersecurity threats;

   Struck: (2) discloses any significant acts of noncompliance by a non-Federal entity with this title, with special emphasis on privacy and civil liberties, and any measures taken by the Federal Government to uncover such noncompliance;

   Struck: (3) describes in general terms the nature and quantity of information disclosed and received by governmental entities and private entities under this title; and

   Struck: (4) identifies the emergence of new threats or technologies that challenge the adequacy of the law, including the definitions, authorities and requirements of this title, for keeping pace with the threat.

   Struck: (i) Requirement for Annual Report.--On an annual basis, the Director of National Intelligence shall provide a report to the Select Committee on Intelligence of the Senate and the Permanent Select Committee on Intelligence of the House of Representatives on the implementation of section 705. Such report, which shall be submitted in a classified and in an unclassified form, shall include a list of private entities that receive classified cybersecurity threat indicators under this title, except that the unclassified report shall not contain information that may be used to identify specific private entities unless such private entities consent to such identification.

   Struck: SEC. 708. DEFINITIONS.

   Struck: In this title:

   Struck: (1) Certified entity.--The term "certified entity" means a protected entity, a self-protected entity, or a provider of cybersecurity services that--

   Struck: (A) possesses or is eligible to obtain a security clearance, as determined by the Director of National Intelligence; and

   Struck: (B) is able to demonstrate to the Director of National Intelligence that such provider or such entity can appropriately protect and use classified cybersecurity threat indicators.

   Struck: (2) Countermeasure.--The term "countermeasure" means automated or manual actions to modify, redirect, or block information that is stored on, processed by, or transiting an information system that is known or suspected to contain cybersecurity threat indicators for the purpose of protecting an information system from cybersecurity threats, conducted on an information system owned or operated by or on behalf of the party to be protected or operated by a private entity acting as a provider of electronic communication services, remote computing services, or cybersecurity services to the party to be protected.

   Struck: (3) Cybersecurity crime.--The term "cybersecurity crime" means the violation of a provision of State or Federal law relating to computer crimes, including a violation of any provision of title 18, United States Code, enacted or amended by the Computer Fraud and Abuse Act of 1986 (Public Law 99-474; 100 Stat. 1213).

   Struck: (4) Cybersecurity exchange.--The term "cybersecurity exchange" means any governmental entity or private entity designated by the Secretary of Homeland Security, in consultation with the Director of National Intelligence, the Attorney General, and the Secretary of Defense, to receive and distribute cybersecurity threat indicators under section 703(a).

   Struck: (5) Cybersecurity services.--The term "cybersecurity services" means products, goods, or services intended to detect, mitigate, or prevent cybersecurity threats.

   Struck: (6) Cybersecurity threat.--The term "cybersecurity threat" means any action that may result in unauthorized access to, exfiltration of, manipulation of, harm of, or impairment to the integrity, confidentiality, or availability of an information system or information that is stored on, processed by, or transiting an information system, except that none of the following shall be considered a cybersecurity threat--

   Struck: (A) actions protected by the first amendment to the Constitution of the United States; and

   Struck: (B) exceeding authorized access of an information system, if such access solely involves a violation of consumer terms of service or consumer licensing agreements.

   Struck: (7) Cybersecurity threat indicator.--The term "cybersecurity threat indicator" means information--

   Struck: (A) that is reasonably necessary to describe--

   Struck: (i) malicious reconnaissance, including anomalous patterns of communications that reasonably appear to be transmitted for the purpose of gathering technical information related to a cybersecurity threat;

   Struck: (ii) a method of defeating a technical control;

   Struck: (iii) a technical vulnerability;

   Struck: (iv) a method of defeating an operational control;

   Struck: (v) a method of causing a user with legitimate access to an information system or information that is stored on, processed by, or transiting an information system to unwittingly enable the defeat of a technical control or an operational control;

   Struck: (vi) malicious cyber command and control;

   Struck: (vii) the actual or potential harm caused by an incident, including information exfiltrated as a result of defeating a technical control or an operational control when it is necessary in order to identify or describe a cybersecurity threat;

   Struck: (viii) any other attribute of a cybersecurity threat, if disclosure of such attribute is not otherwise prohibited by law; or

   Struck: (ix) any combination thereof; and

   Struck: (B) from which reasonable efforts have been made to remove information that can be used to identify specific persons unrelated to the cybersecurity threat.

   Struck: (8) Federal cybersecurity center.--The term "Federal cybersecurity center" means the Department of Defense Cyber Crime Center, the Intelligence Community Incident Response Center, the United States Cyber Command Joint Operations Center, the National Cyber Investigative Joint Task Force, the National Security Agency/Central Security Service Threat Operations Center, the United States Computer Emergency Readiness Team, or successors to such centers.

   Struck: (9) Federal entity.--The term "Federal entity" means an agency or department of the United States, or any component, officer, employee, or agent of such an agency or department.

   Struck: (10) Governmental entity.--The term "governmental entity" means any Federal entity and agency or department of a State, local, tribal, or territorial government other than an educational institution, or any component, officer, employee, or agent of such an agency or department.

   Struck: (11) Information system.--The term "information system" means a discrete set of information resources organized for the collection, processing, maintenance, use, sharing, dissemination, or disposition of information, including communications with, or commands to, specialized systems such as industrial and process control systems, telephone switching and private branch exchanges, and environmental control systems.

   Struck: (12) Malicious cyber command and control.--The term "malicious cyber command and control" means a method for remote identification of, access to, or use of, an information system or information that is stored on, processed by, or transiting an information system associated with a known or suspected cybersecurity threat.

   Struck: (13) Malicious reconnaissance.--The term "malicious reconnaissance" means a method for actively probing or passively monitoring an information system for the purpose of discerning technical vulnerabilities of the information system, if such method is associated with a known or suspected cybersecurity threat.

   Struck: (14) Monitor.--The term "monitor" means the interception, acquisition, or collection of information that is stored on, processed by, or transiting an information system for the purpose of identifying cybersecurity threats.

   Struck: (15) Non-federal entity.--The term "non-Federal entity" means a private entity or a governmental entity other than a Federal entity.

   Struck: (16) Operational control.--The term "operational control" means a security control for an information system that primarily is implemented and executed by people.

   Struck: (17) Private entity.--The term "private entity" has the meaning given the term "person" in section 1 of title 1, United States Code, and does not include a governmental entity.

   Struck: (18) Protect.--The term "protect" means actions undertaken to secure, defend, or reduce the vulnerabilities of an information system, mitigate cybersecurity threats, or otherwise enhance information security or the resiliency of information systems or assets.

   Struck: (19) Technical control.--The term "technical control" means a hardware or software restriction on, or audit of, access or use of an information system or information that is stored on, processed by, or transiting an information system that is intended to ensure the confidentiality, integrity, or availability of that system.

   Struck: (20) Technical vulnerability.--The term "technical vulnerability" means any attribute of hardware or software that could enable or facilitate the defeat of a technical control.

   Struck: (21) Third party.--The term "third party" includes Federal entities and non-Federal entities.

   Inserted: (2) be eligible to be granted a security clearance;

   Inserted: (3) maintain a grade point average of 3.2 or above on a 4.0 scale for undergraduate study or a 3.5 or above on a 4.0 scale for postgraduate study;

   Inserted: (4) demonstrate a commitment to a career in improving the security of the information infrastructure; and

   Inserted: (5) has demonstrated a level of proficiency in math or computer sciences.

   Inserted: (e) Failure to Complete Service Obligation.--

   Inserted: (1) In general.--A scholarship recipient under this section shall be liable to the United States under paragraph (2) if the scholarship recipient--

   Inserted: (A) fails to maintain an acceptable level of academic standing in the educational institution in which the individual is enrolled, as determined by the Director;

   Inserted: (B) is dismissed from such educational institution for disciplinary reasons;

   Inserted: (C) withdraws from the program for which the award was made before the completion of such program;

   Inserted: (D) declares that the individual does not intend to fulfill the service obligation under this section;

   Inserted: (E) fails to fulfill the service obligation of the individual under this section; or

   Inserted: (F) loses a security clearance or becomes ineligible for a security clearance.

   Show 62 more inserted paragraphsShow less

   Inserted: (2) Repayment amounts.--

   Inserted: (A) Less than 1 year of service.--If a circumstance under paragraph (1) occurs before the completion of 1 year of a service obligation under this section, the total amount of awards received by the individual under this section shall be repaid.

   Inserted: (B) One or more years of service.--If a circumstance described in subparagraph (D) or (E) of paragraph (1) occurs after the completion of 1 year of a service obligation under this section, the total amount of scholarship awards received by the individual under this section, reduced by the ratio of the number of years of service completed divided by the number of years of service required, shall be repaid.

   Inserted: (f) Evaluation and Report.--The Director of the National Science Foundation shall--

   Inserted: (1) evaluate the success of recruiting individuals for scholarships under this section and of hiring and retaining those individuals in the public sector workforce, including the annual cost and an assessment of how the program actually improves the Federal workforce; and

   Inserted: (2) periodically report the findings under paragraph (1) to Congress.

   Inserted: (g) Authorization of Appropriations.--From amounts made available under section 503 of the America COMPETES Reauthorization Act of 2010 (124 Stat. 4005), the Director may use funds to carry out the requirements of this section for fiscal years 2012 through 2013.

   Inserted: SEC. 407. STUDY AND ANALYSIS OF CERTIFICATION AND TRAINING OF INFORMATION INFRASTRUCTURE PROFESSIONALS.

   Inserted: (a) Study.--The President shall enter into an agreement with the National Academies to conduct a comprehensive study of government, academic, and private-sector accreditation, training, and certification programs for personnel working in information infrastructure. The agreement shall require the National Academies to consult with sector coordinating councils and relevant governmental agencies, regulatory entities, and nongovernmental organizations in the course of the study.

   Inserted: (b) Scope.--The study shall include--

   Inserted: (1) an evaluation of the body of knowledge and various skills that specific categories of personnel working in information infrastructure should possess in order to secure information systems;

   Inserted: (2) an assessment of whether existing government, academic, and private-sector accreditation, training, and certification programs provide the body of knowledge and various skills described in paragraph (1);

   Inserted: (3) an analysis of any barriers to the Federal Government recruiting and hiring cybersecurity talent, including barriers relating to compensation, the hiring process, job classification, and hiring flexibility; and

   Inserted: (4) an analysis of the sources and availability of cybersecurity talent, a comparison of the skills and expertise sought by the Federal Government and the private sector, an examination of the current and future capacity of United States institutions of higher education, including community colleges, to provide current and future cybersecurity professionals, through education and training activities, with those skills sought by the Federal Government, State and local entities, and the private sector.

   Inserted: (c) Report.--Not later than 1 year after the date of enactment of this Act, the National Academies shall submit to the President and Congress a report on the results of the study. The report shall include--

   Inserted: (1) findings regarding the state of information infrastructure accreditation, training, and certification programs, including specific areas of deficiency and demonstrable progress; and

   Inserted: (2) recommendations for the improvement of information infrastructure accreditation, training, and certification programs.

   Inserted: SEC. 408. INTERNATIONAL CYBERSECURITY TECHNICAL STANDARDS.

   Inserted: (a) In General.--The Director of the National Institute of Standards and Technology, in coordination with appropriate Federal authorities, shall--

   Inserted: (1) as appropriate, ensure coordination of Federal agencies engaged in the development of international technical standards related to information system security; and

   Inserted: (2) not later than 1 year after the date of enactment of this Act, develop and transmit to Congress a plan for ensuring such Federal agency coordination.

   Inserted: (b) Consultation With the Private Sector.--In carrying out the activities under subsection (a)(1), the Director shall ensure consultation with appropriate private sector stakeholders.

   Inserted: SEC. 409. IDENTITY MANAGEMENT RESEARCH AND DEVELOPMENT.

   Inserted: The Director of the National Institute of Standards and Technology shall continue a program to support the development of technical standards, metrology, testbeds, and conformance criteria, taking into account appropriate user concerns--

   Inserted: (1) to improve interoperability among identity management technologies;

   Inserted: (2) to strengthen authentication methods of identity management systems;

   Inserted: (3) to improve privacy protection in identity management systems, including health information technology systems, through authentication and security protocols; and

   Inserted: (4) to improve the usability of identity management systems.

   Inserted: SEC. 410. FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT.

   Inserted: (a) National Science Foundation Computer and Network Security Research Grant Areas.--Section 4(a)(1) of the Cyber Security Research and Development Act (15 U.S.C. 7403(a)(1)) is amended--

   Inserted: (1) in subparagraph (H), by striking "and" after the semicolon;

   Inserted: (2) in subparagraph (I), by striking "property." and inserting "property;"; and

   Inserted: (3) by adding at the end the following:

   Inserted: "(J) secure fundamental protocols that are at the heart of inter-network communications and data exchange;

   Inserted: "(K) system security that addresses the building of secure systems from trusted and untrusted components;

   Inserted: "(L) monitoring and detection; and

   Inserted: "(M) resiliency and rapid recovery methods.".

   Inserted: (b) National Science Foundation Computer and Network Security Grants.--Section 4(a)(3) of the Cyber Security Research and Development Act (15 U.S.C. 7403(a)(3)) is amended--

   Inserted: (1) in subparagraph (D), by striking "and";

   Inserted: (2) in subparagraph (E), by striking "2007." and inserting "2007;"; and

   Inserted: (3) by adding at the end the following:

   Inserted: "(F) such funds from amounts made available under section 503 of the America COMPETES Reauthorization Act of 2010 (124 Stat. 4005), as the Director finds necessary to carry out the requirements of this subsection for fiscal years 2012 through 2013.".

   Inserted: (c) Computer and Network Security Centers.--Section 4(b)(7) of the Cyber Security Research and Development Act (15 U.S.C. 7403(b)(7)) is amended--

   Inserted: (1) in subparagraph (D), by striking "and";

   Inserted: (2) in subparagraph (E), by striking "2007." and inserting "2007;"; and

   Inserted: (3) by adding at the end the following:

   Inserted: "(F) such funds from amounts made available under section 503 of the America COMPETES Reauthorization Act of 2010 (124 Stat. 4005), as the Director finds necessary to carry out the requirements of this subsection for fiscal years 2012 through 2013.".

   Inserted: (d) Computer and Network Security Capacity Building Grants.--Section 5(a)(6) of the Cyber Security Research and Development Act (15 U.S.C. 7404(a)(6)) is amended--

   Inserted: (1) in subparagraph (D), by striking "and";

   Inserted: (2) in subparagraph (E), by striking "2007." and inserting "2007;"; and

   Inserted: (3) by adding at the end the following:

   Inserted: "(F) such funds from amounts made available under section 503 of the America COMPETES Reauthorization Act of 2010 (124 Stat. 4005), as the Director finds necessary to carry out the requirements of this subsection for fiscal years 2012 through 2013.".

   Inserted: (e) Scientific and Advanced Technology Act Grants.--Section 5(b)(2) of the Cyber Security Research and Development Act (15 U.S.C. 7404(b)(2)) is amended--

   Inserted: (1) in subparagraph (D), by striking "and";

   Inserted: (2) in subparagraph (E), by striking "2007." and inserting "2007;"; and

   Inserted: (3) by adding at the end the following:

   Inserted: "(F) such funds from amounts made available under section 503 of the America COMPETES Reauthorization Act of 2010 (124 Stat. 4005), as the Director finds necessary to carry out the requirements of this subsection for fiscal years 2012 through 2013.".

   Inserted: (f) Graduate Traineeships in Computer and Network Security Research.--Section 5(c)(7) of the Cyber Security Research and Development Act (15 U.S.C. 7404(c)(7)) is amended--

   Inserted: (1) in subparagraph (D), by striking "and";

   Inserted: (2) in subparagraph (E), by striking "2007." and inserting "2007;"; and

   Inserted: (3) by adding at the end the following:

   Inserted: "(F) such funds from amounts made available under section 503 of the America COMPETES Reauthorization Act of 2010 (124 Stat. 4005), as the Director finds necessary to carry out the requirements of this subsection for fiscal years 2012 through 2013.".

   Original wording

   Strike all after the enacting clause and insert the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed