15 U.S.C. § 7406 — National Institute of Standards and Tech-

Page 2352 TITLE 15—COMMERCE AND TRADE § 7405 (3) Application Each institution of higher education desir- ing to receive a grant under this subsection shall submit an application to the Director at such time, in such manner, and containing such information as the Director shall require. (4) Use of funds Funds received by an institution of higher education under this paragraph shall— (A) be made available to individuals on a merit-reviewed competitive basis and in ac- cordance with the requirements established in paragraph (7); (B) be in an amount that is sufficient to cover annual tuition and fees for doctoral study at an institution of higher education for the duration of the graduate traineeship, and shall include, in addition, an annual liv- ing stipend of $25,000; and (C) be provided to individuals for a dura- tion of no more than 5 years, the specific du- ration of each graduate traineeship to be de- termined by the institution of higher edu- cation, on a case-by-case basis. (5) Repayment Each graduate traineeship shall— (A) subject to paragraph (5)(B), be subject to full repayment upon completion of the doctoral degree according to a repayment schedule established and administered by the institution of higher education; (B) be forgiven at the rate of 20 percent of the total amount of the graduate traineeship assistance received under this section for each academic year that a recipient is em- ployed as a full-time faculty member at an institution of higher education for a period not to exceed 5 years; and (C) be monitored by the institution of higher education receiving a grant under this subsection to ensure compliance with this subsection. (6) Exceptions The Director may provide for the partial or total waiver or suspension of any service obli- gation or payment by an individual under this section whenever compliance by the individual is impossible or would involve extreme hard- ship to the individual, or if enforcement of such obligation with respect to the individual would be unconscionable. (7) Eligibility To be eligible to receive a graduate traineeship under this section, an individual shall— (A) be a citizen, national, or lawfully ad- mitted permanent resident alien of the United States; and (B) demonstrate a commitment to a career in higher education. (8) Consideration In making selections for graduate traineeships under this paragraph, an institu- tion receiving a grant under this subsection shall consider, to the extent possible, a diverse pool of applicants whose interests are of an interdisciplinary nature, encompassing the so- cial scientific as well as the technical dimen- sions of cyber security. (9) Authorization of appropriations There are authorized to be appropriated to the National Science Foundation to carry out this paragraph $5,000,000 for each of fiscal years 2003 through 2007. (Pub. L. 107–305, § 5, Nov. 27, 2002, 116 Stat. 2370; Pub. L. 116–115, § 3(f), (g), Feb. 11, 2020, 134 Stat. 107.) Editorial Notes REFERENCES IN TEXT The Scientific and Advanced Technology Act of 1992, referred to in subsec. (b)(1), is Pub. L. 102–476, Oct. 23, 1992, 106 Stat. 2297, which enacted sections 1862h to 1862j of Title 42, The Public Health and Welfare, and amend- ed section 1862 of Title 42. For complete classification of this Act to the Code, see Short Title of 1992 Amend- ment note set out under section 1861 of Title 42 and Ta- bles. AMENDMENTS 2020—Subsec. (a)(1). Pub. L. 116–115, § 3(f)(1), inserted ‘‘and students who are veterans’’ after ‘‘these fields’’. Subsec. (a)(3)(J), (K). Pub. L. 116–115, § 3(f)(2), added subpar. (J) and redesignated former subpar. (J) as (K). Subsec. (c)(6)(C). Pub. L. 116–115, § 3(g), inserted ‘‘or veterans’’ after ‘‘disciplines’’. § 7405. Consultation In carrying out sections 7403 and 7404 of this title, the Director shall consult with other Fed- eral agencies. (Pub. L. 107–305, § 6, Nov. 27, 2002, 116 Stat. 2374.) § 7406. National Institute of Standards and Tech- nology programs (a), (b) Omitted (c) Security automation and checklists for Gov- ernment systems (1) In general The Director of the National Institute of Standards and Technology shall, as necessary, develop and revise security automation stand- ards, associated reference materials (including protocols), and checklists providing settings and option selections that minimize the secu- rity risks associated with each information technology hardware or software system and security tool that is, or is likely to become, widely used within the Federal Government, thereby enabling standardized and interoper- able technologies, architectures, and frame- works for continuous monitoring of informa- tion security within the Federal Government. (2) Priorities for development The Director of the National Institute of Standards and Technology shall establish pri- orities for the development of standards, ref- erence materials, and checklists under this subsection on the basis of— (A) the security risks associated with the use of the system; (B) the number of agencies that use a par- ticular system or security tool; (C) the usefulness of the standards, ref- erence materials, or checklists to Federal Page 2353 TITLE 15—COMMERCE AND TRADE § 7407 1 See References in Text note below. agencies that are users or potential users of the system; (D) the effectiveness of the associated standard, reference material, or checklist in creating or enabling continuous monitoring of information security; or (E) such other factors as the Director of the National Institute of Standards and Technology determines to be appropriate. (3) Excluded systems The Director of the National Institute of Standards and Technology may exclude from the application of paragraph (1) any informa- tion technology hardware or software system or security tool for which such Director deter- mines that the development of a standard, ref- erence material, or checklist is inappropriate because of the infrequency of use of the sys- tem, the obsolescence of the system, or the lack of utility or impracticability of devel- oping a standard, reference material, or check- list for the system. (4) Dissemination of standards and related ma- terials The Director of the National Institute of Standards and Technology shall ensure that Federal agencies are informed of the avail- ability of any standard, reference material, checklist, or other item developed under this subsection. (5) Agency use requirements The development of standards, reference ma- terials, and checklists under paragraph (1) for an information technology hardware or soft- ware system or tool does not— (A) require any Federal agency to select the specific settings or options rec- ommended by the standard, reference mate- rial, or checklist for the system; (B) establish conditions or prerequisites for Federal agency procurement or deploy- ment of any such system; (C) imply an endorsement of any such sys- tem by the Director of the National Insti- tute of Standards and Technology; or (D) preclude any Federal agency from pro- curing or deploying other information tech- nology hardware or software systems for which no such standard, reference material, or checklist has been developed or identified under paragraph (1). (d) Federal agency information security pro- grams (1) In general In developing the agencywide information security program required by section 3554(b) of title 44, an agency that deploys a computer hardware or software system for which the Di- rector of the National Institute of Standards and Technology has developed a checklist under subsection (c) of this section— (A) shall include in that program an expla- nation of how the agency has considered such checklist in deploying that system; and (B) may treat the explanation as if it were a portion of the agency’s annual perform- ance plan properly classified under criteria established by an Executive Order (within the meaning of section 1115(d) of title 31). (2) Limitation Paragraph (1) does not apply to any com- puter hardware or software system for which the National Institute of Standards and Tech- nology does not have responsibility under sec- tion 278g–3(a)(3) of this title. (Pub. L. 107–305, § 8, Nov. 27, 2002, 116 Stat. 2375; Pub. L. 113–274, title II, § 203, Dec. 18, 2014, 128 Stat. 2979; Pub. L. 113–283, § 2(e)(2), Dec. 18, 2014, 128 Stat. 3086.) Editorial Notes CODIFICATION Section is comprised of section 8 of Pub. L. 107–305. Subsec. (a) of section 8 of Pub. L. 107–305 enacted sec- tion 278h of this title and renumbered former section 278h of this title as section 278q of this title. Subsec. (b) of section 8 of Pub. L. 107–305 amended section 278g–3 of this title. AMENDMENTS 2014—Subsec. (c). Pub. L. 113–274 amended subsec. (c) generally. Prior to amendment, text related to check- lists setting forth settings and option selections that minimize the security risks associated with computer hardware or software systems likely to become widely used within the Federal Government. Subsec. (d)(1). Pub. L. 113–283, which directed amend- ment of section 8 of the Cybersecurity Research and Development Act by substituting ‘‘section 3554’’ for ‘‘section 3534’’ in subsec. (d)(1), was executed to this section, which is section 8 of the Cyber Security Re- search and Development Act, to reflect the probable in- tent of Congress. § 7407. Authorization of appropriations There are authorized to be appropriated to the Secretary of Commerce for the National Insti- tute of Standards and Technology— (1) for activities under section 278h of this title— (A) $25,000,000 for fiscal year 2003; (B) $40,000,000 for fiscal year 2004; (C) $55,000,000 for fiscal year 2005; (D) $70,000,000 for fiscal year 2006; (E) $85,000,000 for fiscal year 2007; and (2) for activities under section 278g–3(f) 1 of this title— (A) $6,000,000 for fiscal year 2003; (B) $6,200,000 for fiscal year 2004; (C) $6,400,000 for fiscal year 2005; (D) $6,600,000 for fiscal year 2006; and (E) $6,800,000 for fiscal year 2007. (Pub. L. 107–305, § 11, Nov. 27, 2002, 116 Stat. 2379.) Editorial Notes REFERENCES IN TEXT Section 278g–3 of this title, referred to in par. (2), was amended by Pub. L. 107–347, title III, § 303, Dec. 17, 2002, 116 Stat. 2957, and, as so amended, did not contain a subsec. (f). A later amendment by Pub. L. 113–274, title II, § 204(1), Dec. 18, 2014, 128 Stat. 2980, redesignated sub- sec. (e) of section 278g–3 of this title, relating to defini- tions, as (f).