S.Amdt. 2646

1. Adds SEC. 305. CYBERSECURITY UNIVERSITY-INDUSTRY TASK FORCE at the end of title III

   Adds a section

   In S. 3414 · Placed on Calendar Senate

   The Secretary and the Secretary of Defense may jointly establish academic and professional Centers of Excellence in cybersecurity for the protection of critical infrastructure in conjunction with international academic and professional partners from countries that may include allies of the United States, as determined to be appropriate under title XIX of the Implementing Recommendations of the 9/11 Commission Act of 2007 (Public Law 110-53; 121 Stat. 505) in order to research and develop technologies, best practices, and other means to defend critical infrastructure.

   Inserted: SEC. 305. CYBERSECURITY UNIVERSITY-INDUSTRY TASK FORCE.

   Inserted: (a) Establishment of University-industry Task Force.--Not later than 180 days after the date of enactment of this Act, the Director of the Office of Science and Technology Policy shall convene a task force to explore mechanisms for carrying out collaborative research, development, education, and training activities for cybersecurity through a consortium, or other appropriate entity, with participants from institutions of higher education and industry.

   Inserted: (b) Functions.--The task force established under subsection (a) shall--

   Inserted: (1) develop options for a collaborative model and an organizational structure for such entity under which the joint research and development activities could be planned, managed, and conducted effectively, including mechanisms for the allocation of resources among the participants in the consortium;

   Inserted: (2) propose a process for developing a research and development agenda for such entity, including guidelines to ensure an appropriate scope of work focused on nationally significant challenges and requiring collaboration;

   Inserted: (3) define the roles and responsibilities for the participants from institutions of higher education and industry in such entity;

   Inserted: (4) propose guidelines for assigning intellectual property rights and for the transfer of research and development results to the private sector; and

   Inserted: (5) make recommendations for how such entity could be funded from Federal, State, and nongovernmental sources.

   Inserted: (c) Composition.--In establishing the task force under subsection (a), the Director of the Office of Science and Technology Policy shall appoint an equal number of individuals from institutions of higher education, including minority-serving institutions and community colleges, and from industry with knowledge and expertise in cybersecurity.

   Inserted: (d) Report.--Not later than 12 months after the date of enactment of this Act, the Director of the Office of Science and Technology Policy shall transmit to the Congress a report describing the findings and recommendations of the task force established under subsection (a).

   Inserted: (e) Termination.--The task force established under subsection (a) shall terminate upon transmittal of the report required under subsection (d).

   Inserted: (f) Compensation and Expenses.--Members of the task force established under subsection (a) shall serve without compensation.

   Show 38 more inserted paragraphsShow less

   Inserted: SEC. 306. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY RESEARCH AND DEVELOPMENT.

   Inserted: (a) NIST Cybersecurity Checklists, Configuration Profiles, and Deployment Recommendations.--Subsection (c) of section 8 of the Cyber Security Research and Development Act (15 U.S.C. 7406) is amended to read as follows:

   Inserted: "(c) Security Automation and Checklists for Government Systems.--

   Inserted: "(1) In general.--The Director of the National Institute of Standards and Technology shall develop, and revise as necessary, security automation standards, associated reference materials (including protocols), and checklists providing settings and option selections that minimize the security risks associated with each information technology hardware or software system and security tool that is, or is likely to become, widely used within the Federal Government in order to enable standardized and interoperable technologies, architectures, and frameworks for continuous monitoring of information security within the Federal Government.

   Inserted: "(2) Priorities for development, identification, revision, and adaptation.--The Director of the National Institute of Standards and Technology shall establish priorities for the development of standards, reference materials, and checklists under this subsection on the basis of--

   Inserted: "(A) the security risks associated with the use of each system;

   Inserted: "(B) the number of agencies that use a particular system or security tool;

   Inserted: "(C) the usefulness of the standards, reference materials, or checklists to Federal agencies that are users or potential users of the system;

   Inserted: "(D) the effectiveness of the associated standard, reference material, or checklist in creating or enabling continuous monitoring of information security; or

   Inserted: "(E) such other factors as the Director of the National Institute of Standards and Technology determines to be appropriate.

   Inserted: "(3) Excluded systems.--The Director of the National Institute of Standards and Technology may exclude from the requirements of paragraph (1) any information technology hardware or software system or security tool for which such Director determines that the development of a standard, reference material, or checklist is inappropriate because of the infrequency of use of the system, the obsolescence of the system, or the inutility or impracticability of developing a standard, reference material, or checklist for the system.

   Inserted: "(4) Dissemination of checklists, configuration profiles, and deployment recommendations.--The Director of the National Institute of Standards and Technology shall ensure that Federal agencies are informed of the availability of any standard, reference material, checklist, or other item developed under this subsection.

   Inserted: "(5) Agency use requirements.--The development of standards, reference materials, and checklists under paragraph (1) for an information technology hardware or software system or tool does not--

   Inserted: "(A) require any Federal agency to select the specific settings or options recommended by the standard, reference material, or checklist for the system;

   Inserted: "(B) establish conditions or prerequisites for Federal agency procurement or deployment of any such system;

   Inserted: "(C) imply an endorsement of any such system by the Director of the National Institute of Standards and Technology; or

   Inserted: "(D) preclude any Federal agency from procuring or deploying other information technology hardware or software systems for which no such standard, reference material, or checklist has been developed, or identified under paragraph (1).".

   Inserted: (b) NIST Cybersecurity Research and Development.--Section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3) is amended by redesignating subsection (e) as subsection (f), and by inserting after subsection (d) the following:

   Inserted: "(e) Intramural Security Research.--As part of the research activities conducted in accordance with subsection (d)(3), the Institute shall--

   Inserted: "(1) conduct a research program to develop a unifying and standardized identity, privilege, and access control management framework for the execution of a wide variety of resource protection policies and that is amenable to implementation within a wide variety of existing and emerging computing environments;

   Inserted: "(2) carry out research associated with improving the security of information systems and networks;

   Inserted: "(3) carry out research associated with improving the testing, measurement, usability, and assurance of information systems and networks; and

   Inserted: "(4) carry out research associated with improving security of industrial control systems.".

   Inserted: (c) NIST Identity Management Research and Development.--The Director shall continue a program to support the development of technical standards, metrology, testbeds, and conformance criteria, taking into account appropriate user concerns--

   Inserted: (1) to improve interoperability among identity management technologies;

   Inserted: (2) to strengthen authentication methods of identity management systems;

   Inserted: (3) to improve privacy protection in identity management systems, including health information technology systems, through authentication and security protocols; and

   Inserted: (4) to improve the usability of identity management systems.

   Inserted: (d) Federal Government Cloud Computing Strategy.--

   Inserted: (1) In general.--The Director, in collaboration with the Federal Chief Information Officers Council, and in consultation with other relevant Federal agencies and stakeholders from the private sector, shall continue to develop and encourage the implementation of a comprehensive strategy for the use and adoption of cloud computing services by the Federal Government.

   Inserted: (2) Activities.--In carrying out the strategy developed under subsection (a), the Director shall give consideration to activities that--

   Inserted: (A) accelerate the development, in collaboration with the private sector, of standards that address interoperability and portability of cloud computing services;

   Inserted: (B) advance the development of conformance testing performed by the private sector in support of cloud computing standardization; and

   Inserted: (C) support, in consultation with the private sector, the development of appropriate security frameworks and reference materials, and the identification of best practices, for use by Federal agencies to address security and privacy requirements to enable the use and adoption of cloud computing services, including activities--

   Inserted: (i) to ensure the physical security of cloud computing data centers and the data stored in such centers;

   Inserted: (ii) to ensure secure access to the data stored in cloud computing data centers;

   Inserted: (iii) to develop security standards as required under section 20 of the National Institute of Standards and Technology Act (15 U.S.C. 278g-3); and

   Inserted: (iv) to support the development of the automation of continuous monitoring systems.

   Original wording

   At the end of title III, add the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed