§ 7406. National Institute of Standards and Technology programs

Legislative history

Reconstructed from this section’s Code source credit and amendment notes, resolved against the local Statutes at Large. Editorial notes are evidence, not the law that made the change.

1. 2002

   Cyber Security Research and Development Act

   Pub. L. 107–305 § 8 · 116 Stat. 2367

   Enacted · 15 U.S.C. § 7406

   Pub. L. 107–305, § 8, Nov. 27, 2002, 116 Stat. 2375

   Source evidence

   Code source credit
   Pub. L. 107–305, § 8, Nov. 27, 2002, 116 Stat. 2375

   Enacted provision · exact public law section
   SEC. 8. NATIONAL INSTITUTE OF STANDARDS AND TECHNOLOGY PROGRAMS. (a) Research Program.— The National Institute of Standards and Technology Act (15 U.S.C. 271 et seq.) is amended— (1) by moving section 22 to the end of the Act and redesignating it as section 32; and (2) by inserting after section 21 the following new section: “SEC. 22. RESEARCH PROGRAM ON SECURITY OF COMPUTER SYSTEMS “(a) Establishment.— The Director shall establish a program of assistance to institutions of higher education that enter into partnerships with for-profit entities to support research to improve the security of computer systems. The partnerships may also include government laboratories and nonprofit research institutions. The program shall— “(1) include multidisciplinary, long-term research; “(2) include research directed toward addressing needs identified through the activities of the Computer System Security and Privacy Advisory Board under section 20(f); and “(3) promote the development of a robust research community working at the leading edge of knowledge in subject areas relevant to the security of computer systems by providing support for graduate students, post-doctoral researchers, and senior researchers. “(b) Fellowships.— “(1) Post-doctoral research fellowships.— The Director is authorized to establish a program to award post-doctoral research fellowships to individuals who are citizens, nationals, or lawfully admitted permanent resident aliens of the United States and are seeking research positions at institutions, including the Institute, engaged in research activities related to the security of computer systems, including the research areas described in section 4(a)( 1) of the Cyber Security Research and Development Act. “(2) Senior research fellowships.— The Director is authorized to establish a program to award senior research fellowships to individuals seeking research positions at institutions, including the Institute, engaged in research activities related to the security of computer systems, including the research areas described in section 4(a)(1) of the Cyber Security Research and Development Act. Senior research fellowships shall be made available for established researchers at institutions of higher education who seek to change research fields and pursue studies related to the security of computer systems. “(3) Eligibility.— “(A) In general.— To be eligible for an award under this subsection, an individual shall submit an application to the Director at such time, in such manner, and containing such information as the Director may require. “(B) Stipends.— Under this subsection, the Director is authorized to provide stipends for post-doctoral research fellowships at the level of the Institute’s Post Doctoral Research Fellowship Program and senior research fellowships at levels consistent with support for a faculty member in a sabbatical position. “(c) Awards; Applications.— “(1) In general.— The Director is authorized to award grants or cooperative agreements to institutions of higher education to carry out the program established under subsection (a). No funds made available under this section shall be made available directly to any for-profit partners. “(2) Eligibility.— To be eligible for an award under this section, an institution of higher education shall submit an application to the Director at such time, in such manner, and containing such information as the Director may require. The application shall include, at a minimum, a description of— “(A) the number of graduate students anticipated to participate in the research project and the level of support to be provided to each; “(B) the number of post-doctoral research positions included under the research project and the level of support to be provided to each; “(C) the number of individuals, if any, intending to change research fields and pursue studies related to the security of computer systems to be included under the research project and the level of support to be provided to each; and “(D) how the for-profit entities, nonprofit research institutions, and any other partners will participate in developing and carrying out the research and education agenda of the partnership. “(d) Program Operation.— “(1) Management.— The program established under subsection (a) shall be managed by individuals who shall have both expertise in research related to the security of computer systems and knowledge of the vulnerabilities of existing computer systems. The Director shall designate such individuals as program managers. “(2) Managers may be employees.— Program managers designated under paragraph (1) may be new or existing employees of the Institute or individuals on assignment at the Institute under the Intergovernmental Personnel Act of 1970, except that individuals on assignment at the Institute under the Intergovernmental Personnel Act of 1970 shall not directly manage such employees. “(3) Manager responsibility.—Program managers designated under paragraph (1) shall be responsible for— “(A) establishing and publicizing the broad research goals for the program; “(B) soliciting applications for specific research projects to address the goals developed under subparagraph (A); “(C) selecting research projects for support under the program from among applications submitted to the Institute, following consideration of— “(i) the novelty and scientific and technical merit of the proposed projects; “(ii) the demonstrated capabilities of the individual or individuals submitting the applications to successfully carry out the proposed research; “(iii) the impact the proposed projects will have on increasing the number of computer security researchers; “(iv) the nature of the participation by for-profit entities and the extent to which the proposed projects address the concerns of industry; and “(v) other criteria determined by the Director, based on information specified for inclusion in applications under subsection (c); and “(D) monitoring the progress of research projects supported under the program. “(4) Reports.— The Director shall report to the Senate Committee on Commerce, Science, and Transportation and the House of Representatives Committee on Science annually on the use and responsibility of individuals on assignment at the Institute under the Intergovernmental Personnel Act of 1970 who are performing duties under subsection (d). “(e) Review of Program.— “(1) Periodic review.— The Director shall periodically review the portfolio of research awards monitored by each program manager designated in accordance with subsection (d). In conducting those reviews, the Director shall seek the advice of the Computer System Security and Privacy Advisory Board, established under section 21, on the appropriateness of the research goals and on the quality and utility of research projects managed by program managers in accordance with subsection (d). “(2) Comprehensive 5-year review.— The Director shall also contract with the National Research Council for a comprehensive review of the program established under subsection (a) during the 5th year of the program. Such review shall include an assessment of the scientific quality of the research conducted, the relevance of the research results obtained to the goals of the program established under subsection (d)(3)(A), and the progress of the program in promoting the development of a substantial academic research community working at the leading edge of knowledge in the field. The Director shall submit to Congress a report on the results of the review under this paragraph no later than 6 years after the initiation of the program. “(f) Definitions.— In this section: “(1) Computer system.— The term ‘computer system’ has the meaning given that term in section 20(d)(1). “(2) Institution of higher education.— The term ‘institution of higher education’ has the meaning given that term in section 101(a) of the Higher Education Act of 1965 (20 U.S.C. 1001(a)).”. (b) Amendment of Computer system Definition.— Section 20(d)(1)(B)(i) of National Institute of Standards and Technology Act (15 U.S.C. 278g-3(d)(1)(B)(i)) is amended to read as follows: “(i) computers and computer networks;”. (c) Checklists for Government Systems.— (1) In general.— The Director of the National Institute of Standards and Technology shall develop, and revise as necessary, a checklist setting forth settings and option selections that minimize the security risks associated with each computer hardware or software system that is, or is likely to become, widely used within the Federal Government. (2) Priorities for development; excluded systems.— The Director of the National Institute of Standards and Technology may establish priorities for the development of checklists under this paragraph on the basis of the security risks associated with the use of the system, the number of agencies that use a particular system, the usefulness of the checklist to Federal agencies that are users or potential users of the system, or such other factors as the Director determines to be appropriate. The Director of the National Institute of Standards and Technology may exclude from the application of paragraph (1) any computer hardware or software system for which the Director of the National Institute of Standards and Technology determines that the development of a checklist is inappropriate because of the infrequency of use of the system, the obsolescence of the system, or the inutility or impracticability of developing a checklist for the system. (3) Dissemination of checklists.— The Director of the National Institute of Standards and Technology shall make any checklist developed under this paragraph for any computer hardware or software system available to each Federal agency that is a user or potential user of the system. (4) Agency use requirements.— The development of a checklist under paragraph (1) for a computer hardware or software system does not— (A) require any Federal agency to select the specific settings or options recommended by the checklist for the system; (B) establish conditions or prerequisites for Federal agency procurement or deployment of any such system; (C) represent an endorsement of any such system by the Director of the National Institute of Standards and Technology; nor (D) preclude any Federal agency from procuring or deploying other computer hardware or software systems for which no such checklist has been developed. (d) Federal Agency Information Security Programs.— (1) In general.— In developing the agencywide information security program required by section 3534(b) of title 44, United States Code, an agency that deploys a computer hardware or software system for which the Director of the National Institute of Standards and Technology has developed a checklist under subsection (c) of this section— (A) shall include in that program an explanation of how the agency has considered such checklist in deploying that system; and (B) may treat the explanation as if it were a portion of the agency’s annual performance plan properly classified under criteria established by an Executive Order (within the meaning of section 1115(d) of title 31, United States Code). (2) Limitation.— Paragraph (1) does not apply to any computer hardware or software system for which the National Institute of Standards and Technology does not have responsibility under section 20(a)(3) of the National Institute of Standards and Technology Act (15 U.S.C.278g-3(a)(3)).

2. 2014

   Cybersecurity Enhancement Act of 2014

   Pub. L. 113–274 title II § 203 · 128 Stat. 2971

   Amended · 15 U.S.C. § 7406(c)

   Pub. L. 113–274 amended subsec. (c) generally. Prior to amendment, text related to checklists setting forth settings and option selections that minimize the security risks associated with computer hardware or software systems likely to become widely used within the Federal Government

   Source evidence

   Code amendment note
   Subsec. (c). Pub. L. 113–274 amended subsec. (c) generally. Prior to amendment, text related to checklists setting forth settings and option selections that minimize the security risks associated with computer hardware or software systems likely to become widely used within the Federal Government.

   Enacted provision · exact public law section
   SEC. 203. CYBERSECURITY AUTOMATION AND CHECKLISTS FOR GOVERNMENT SYSTEMS.   Section 8(c) of the Cyber Security Research and Development Act (15 U.S.C. 7406(c)) is amended to read as follows: “(c) Security Automation and Checklists for Government Systems.— “(1) In general.— The Director of the National Institute of Standards and Technology shall, as necessary, develop and revise security automation standards, associated reference materials (including protocols), and checklists providing settings and option selections that minimize the security risks associated with each information technology hardware or software system and security tool that is, or is likely to become, widely used within the Federal Government, thereby enabling standardized and interoperable technologies, architectures, and frameworks for continuous monitoring of information security within the Federal Government. “(2) Priorities for development.— The Director of the National Institute of Standards and Technology shall establish priorities for the development of standards, reference materials, and checklists under this subsection on the basis of— “(A) the security risks associated with the use of the system; “(B) the number of agencies that use a particular system or security tool; “(C) the usefulness of the standards, reference materials, or checklists to Federal agencies that are users or potential users of the system; “(D) the effectiveness of the associated standard, reference material, or checklist in creating or enabling continuous monitoring of information security; or “(E) such other factors as the Director of the National Institute of Standards and Technology determines to be appropriate. “(3) Excluded systems.— The Director of the National Institute of Standards and Technology may exclude from the application of paragraph (1) any information technology hardware or software system or security tool for which such Director determines that the development of a standard, reference material, or checklist is inappropriate because of the infrequency of use of the system, the obsolescence of the system, or the lack of utility or impracticability of developing a standard, reference material, or checklist for the system. “(4) Dissemination of standards and related materials.— The Director of the National Institute of Standards and Technology shall ensure that Federal agencies are informed of the availability of any standard, reference material, checklist, or other item developed under this subsection. “(5) Agency use requirements.— The development of standards, reference materials, and checklists under paragraph (1) for an information technology hardware or software system or tool does not— “(A) require any Federal agency to select the specific settings or options recommended by the standard, reference material, or checklist for the system; “(B) establish conditions or prerequisites for Federal agency procurement or deployment of any such system; “(C) imply an endorsement of any such system by the Director of the National Institute of Standards and Technology; or “(D) preclude any Federal agency from procuring or deploying other information technology hardware or software systems for which no such standard, reference material, or checklist has been developed or identified under paragraph (1).” .

3. 2014

   Federal Information Security Modernization Act of 2014

   Pub. L. 113–283 § 2(e)(2) · 128 Stat. 3073

   Substituted · 15 U.S.C. § 7406(d)(1)

   Pub. L. 113–283, which directed amendment of section 8 of the Cybersecurity Research and Development Act by substituting “section 3554” for “section 3534” in subsec. (d)(1), was executed to this section, which is section 8 of the Cyber Security Research and Development Act, to reflect the probable intent of Congress

   Source evidence

   Code amendment note
   Subsec. (d)(1). Pub. L. 113–283, which directed amendment of section 8 of the Cybersecurity Research and Development Act by substituting “section 3554” for “section 3534” in subsec. (d)(1), was executed to this section, which is section 8 of the Cyber Security Research and Development Act, to reflect the probable intent of Congress.

   Enacted provision · exact public law section
   (2) Cybersecurity research and development act.— Section 8(d)(1) of the Cybersecurity Research and Development Act (15 U.S.C. 7406) is amended by striking “section 3534” and inserting “section 3554”.

3 of 3 references resolved to an enrolled provision