15 U.S.C. § 7443 — National cybersecurity awareness and

Page 2365 TITLE 15—COMMERCE AND TRADE § 7443 par. (E) which read as follows: ‘‘fails to fulfill the post- award employment obligation of the individual under this section.’’ Subsec. (h)(2). Pub. L. 116–283, § 9404(3), inserted ‘‘and the Director of the Office of Personnel Management’’ after ‘‘Foundation’’. Subsec. (k)(1)(A). Pub. L. 116–283, § 9404(4), substituted ‘‘, the Director of the National Science Foundation, and the Director of the Office of Personnel Manage- ment of the amounts owed’’ for ‘‘and the Director of the National Science Foundation of the amounts owed’’. Subsec. (m)(1). Pub. L. 116–283, § 9403(3)(A), sub- stituted ‘‘cybersecurity’’ for ‘‘cyber’’ in introductory provisions. Subsec. (m)(2). Pub. L. 116–283, § 9404(5), substituted ‘‘once every two years, to the Committee on Com- merce, Science, and Transportation and the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Science, Space, and Technology and the Committee on Oversight and Re- form of the House of Representatives a report, includ- ing—’’ and subpars. (A) to (C) for ‘‘once every 3 years, to the Committee on Commerce, Science, and Trans- portation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives a report, including the results of the evaluation under paragraph (1) and any recent statistics regarding the size, composition, and educational requirements of the Federal cybersecurity workforce’’. Pub. L. 116–283, § 9403(3)(B), substituted ‘‘cybersecurity’’ for ‘‘cyber’’. Subsequent amendment by Pub. L. 116–283, § 9404(5), reenacted the word ‘‘cyber’’ in subsec. (m)(2)(C). 2017—Subsec. (b)(3), (4). Pub. L. 115–91, § 1649B(a)(1), added pars. (3) and (4) and struck out former par. (3) which read as follows: ‘‘prioritize the employment placement of scholarship recipients in the Federal Gov- ernment.’’ Subsec. (d). Pub. L. 115–91, § 1649B(a)(2), amended sub- sec. (d) generally. Prior to amendment, text read as fol- lows: ‘‘Each scholarship recipient, as a condition of re- ceiving a scholarship under the program, shall enter into an agreement under which the recipient agrees to work in the cybersecurity mission of a Federal, State, local, or tribal agency for a period equal to the length of the scholarship following receipt of the student’s de- gree.’’ Subsec. (f)(3). Pub. L. 115–91, § 1649B(a)(3)(A), amended par. (3) generally. Prior to amendment, par. (3) read as follows: ‘‘have demonstrated a high level of proficiency in mathematics, engineering, or computer sciences;’’. Subsec. (f)(4). Pub. L. 115–91, § 1649B(a)(3)(B), amended par. (4) generally. Prior to amendment, par. (4) read as follows: ‘‘be a full-time student in an eligible degree program at a qualified institution of higher education, as determined by the Director of the National Science Foundation; and’’. Subsec. (m). Pub. L. 115–91, § 1649B(a)(4), amended sub- sec. (m) generally. Prior to amendment, text read as follows: ‘‘The Director of the National Science Founda- tion shall evaluate and report periodically to Congress on the success of recruiting individuals for scholarships under this section and on hiring and retaining those in- dividuals in the public sector workforce.’’ Statutory Notes and Related Subsidiaries CHANGE OF NAME Committee on Oversight and Reform of House of Rep- resentatives changed to Committee on Oversight and Accountability of House of Representatives by House Resolution No. 5, One Hundred Eighteenth Congress, Jan. 9, 2023. SAVINGS PROVISION Pub. L. 115–91, div. A, title XVI, § 1649B(b), Dec. 12, 2017, 131 Stat. 1755, provided that: ‘‘Nothing in this sec- tion [amending this section], or an amendment made by this section, shall affect any agreement, scholar- ship, loan, or repayment, under section 302 of the Cybersecurity Enhancement Act of 2014 (15 U.S.C. 7442), in effect on the day before the date of enactment of this subtitle [Dec. 12, 2017].’’ COMMUNITY COLLEGE CYBER PILOT PROGRAM AND ASSESSMENT Pub. L. 115–91, div. A, title XVI, § 1649A, Dec. 12, 2017, 131 Stat. 1753, provided that: ‘‘(a) PILOT PROGRAM.—Not later than 1 year after the date of enactment of this subtitle [Dec. 12, 2017], as part of the Federal Cyber Scholarship-for-Service program established under section 302 of the Cybersecurity En- hancement Act of 2014 (15 U.S.C. 7442), the Director of the National Science Foundation, in coordination with the Director of the Office of Personnel Management, shall develop and implement a pilot program at not more than 10, but at least 5, community colleges to provide scholarships to eligible students who— ‘‘(1) are pursuing associate degrees or specialized program certifications in the field of cybersecurity; and ‘‘(2)(A) have bachelor’s degrees; or ‘‘(B) are veterans of the Armed Forces. ‘‘(b) ASSESSMENT.—Not later than 1 year after the date of enactment of this subtitle, as part of the Fed- eral Cyber Scholarship-for-Service program established under section 302 of the Cybersecurity Enhancement Act of 2014 (15 U.S.C. 7442), the Director of the National Science Foundation, in coordination with the Director of the Office of Personnel Management, shall assess the potential benefits and feasibility of providing scholar- ships through community colleges to eligible students who are pursuing associate degrees, but do not have bachelor’s degrees.’’ § 7443. National cybersecurity awareness and education program (a) National cybersecurity awareness and edu- cation program The Director of the National Institute of Standards and Technology (referred to in this section as the ‘‘Director’’), in consultation with appropriate Federal agencies, industry, edu- cational institutions, National Laboratories, the Networking and Information Technology Re- search and Development program, and other or- ganizations shall continue to coordinate a na- tional cybersecurity awareness and education program, that includes activities such as— (1) the widespread dissemination of cybersecurity technical standards and best practices identified by the Director; (2) efforts to make cybersecurity best prac- tices usable by individuals, small to medium- sized businesses, educational institutions, and State, local, and tribal governments; (3) increasing public awareness of cybersecurity, cyber safety, and cyber ethics; (4) increasing the understanding of State, local, and tribal governments, institutions of higher education, and private sector entities of— (A) the benefits of ensuring effective risk management of information technology versus the costs of failure to do so; and (B) the methods to mitigate and remediate vulnerabilities; (5) supporting formal cybersecurity edu- cation programs at all education levels to pre- pare and improve a skilled cybersecurity and computer science workforce for the private sector and Federal, State, local, and tribal government; Page 2366 TITLE 15—COMMERCE AND TRADE § 7443 (6) supporting efforts to identify cybersecurity workforce skill gaps in public and private sectors; (7) facilitating Federal programs to advance cybersecurity education, training, and work- force development; (8) in coordination with the Department of Defense, the Department of Homeland Secu- rity, and other appropriate agencies, consid- ering any specific needs of the cybersecurity workforce of critical infrastructure, including cyber physical systems and control systems; (9) advising the Director of the Office of Management and Budget, as needed, in devel- oping metrics to measure the effectiveness and effect of programs and initiatives to advance the cybersecurity workforce; and (10) promoting initiatives to evaluate and forecast future cybersecurity workforce needs of the Federal Government and develop strate- gies for recruitment, training, and retention. (b) Considerations In carrying out the authority described in sub- section (a), the Director, in consultation with appropriate Federal agencies, shall leverage ex- isting programs designed to inform the public of safety and security of products or services, in- cluding self-certifications and independently verified assessments regarding the quantifica- tion and valuation of information security risk. (c) Strategic plan (1) In general The Director, in cooperation with relevant Federal agencies and other stakeholders, shall build upon programs and plans in effect as of December 18, 2014, to develop and implement a strategic plan to guide Federal programs and activities in support of the national cybersecurity awareness and education pro- gram under subsection (a). (2) Requirement The strategic plan developed and imple- mented under paragraph (1) shall include an indication of how the Director will carry out this section. (d) Report Not later than 1 year after December 18, 2014, and every 5 years thereafter, the Director shall transmit the strategic plan under subsection (c) to the Committee on Commerce, Science, and Transportation of the Senate and the Com- mittee on Science, Space, and Technology of the House of Representatives. (e) Cybersecurity metrics In carrying out subsection (a), the Director of the Office of Management and Budget may seek input from the Director of the National Insti- tute of Standards and Technology, in coordina- tion with the Department of Homeland Secu- rity, the Department of Defense, the Office of Personnel Management, and such agencies as the Director of the National Institute of Stand- ards and Technology considers relevant, to de- velop quantifiable metrics for evaluating Feder- ally funded cybersecurity workforce programs and initiatives based on the outcomes of such programs and initiatives. (f) Regional alliances and multistakeholder part- nerships (1) In general Pursuant to section 272(b)(4) of this title, the Director shall establish cooperative agree- ments between the National Initiative for Cybersecurity Education (NICE) of the Insti- tute and regional alliances or partnerships for cybersecurity education and workforce. (2) Agreements The cooperative agreements established under paragraph (1) shall advance the goals of the National Initiative for Cybersecurity Edu- cation Cybersecurity Workforce Framework (NIST Special Publication 800–181), or suc- cessor framework, by facilitating local and re- gional partnerships to— (A) identify the workforce needs of the local economy and classify such workforce in accordance with such framework; (B) identify the education, training, ap- prenticeship, and other opportunities avail- able in the local economy; and (C) support opportunities to meet the needs of the local economy. (3) Financial assistance (A) Financial assistance authorized The Director may award financial assist- ance to a regional alliance or partnership with whom the Director enters into a coop- erative agreement under paragraph (1) in order to assist the regional alliance or part- nership in carrying out the terms of the co- operative agreement. (B) Amount of assistance The aggregate amount of financial assist- ance awarded under subparagraph (A) per co- operative agreement shall not exceed $200,000. (C) Matching requirement The Director may not award financial as- sistance to a regional alliance or partnership under subparagraph (A) unless the regional alliance or partnership agrees that, with re- spect to the costs to be incurred by the re- gional alliance or partnership in carrying out the cooperative agreement for which the assistance was awarded, the regional alli- ance or partnership will make available (di- rectly or through donations from public or private entities) non-Federal contributions, including in-kind contributions, in an amount equal to 50 percent of Federal funds provided under the award. (4) Application (A) In general A regional alliance or partnership seeking to enter into a cooperative agreement under paragraph (1) and receive financial assist- ance under paragraph (3) shall submit to the Director an application therefore at such time, in such manner, and containing such information as the Director may require. (B) Requirements Each application submitted under subpara- graph (A) shall include the following: Page 2367 TITLE 15—COMMERCE AND TRADE § 7443 (i)(I) A plan to establish (or identifica- tion of, if it already exists) a multistake- holder workforce partnership that in- cludes— (aa) at least one institution of higher education or nonprofit training organi- zation; and (bb) at least one local employer or owner or operator of critical infrastruc- ture. (II) Participation from academic institu- tions in the Federal Cyber Scholarships for Service Program, the National Centers of Academic Excellence in Cybersecurity Program, or advanced technological edu- cation programs, as well as elementary and secondary schools, training and cer- tification providers, State and local gov- ernments, economic development organi- zations, or other community organizations is encouraged. (ii) A description of how the workforce partnership would identify the workforce needs of the local economy. (iii) A description of how the multistake- holder workforce partnership would lever- age the programs and objectives of the Na- tional Initiative for Cybersecurity Edu- cation, such as the Cybersecurity Work- force Framework and the strategic plan of such initiative. (iv) A description of how employers in the community will be recruited to sup- port internships, externships, apprentice- ships, or cooperative education programs in conjunction with providers of education and training. Inclusion of programs that seek to include veterans, Indian Tribes, and underrepresented groups, including women, minorities, persons from rural and underserved areas, and persons with dis- abilities is encouraged. (v) A definition of the metrics to be used in determining the success of the efforts of the regional alliance or partnership under the agreement. (C) Priority consideration In awarding financial assistance under paragraph (3)(A), the Director shall give pri- ority consideration to a regional alliance or partnership that includes an institution of higher education that is designated as a Na- tional Center of Academic Excellence in Cybersecurity or which received an award under the Federal Cyber Scholarship for Service program located in the State or re- gion of the regional alliance or partnership. (5) Audits Each cooperative agreement for which finan- cial assistance is awarded under paragraph (3) shall be subject to audit requirements under part 200 of title 2, Code of Federal Regulations (relating to uniform administrative require- ments, cost principles, and audit requirements for Federal awards), or successor regulation. (6) Reports (A) In general Upon completion of a cooperative agree- ment under paragraph (1), the regional alli- ance or partnership that participated in the agreement shall submit to the Director a re- port on the activities of the regional alli- ance or partnership under the agreement, which may include training and education outcomes. (B) Contents Each report submitted under subparagraph (A) by a regional alliance or partnership shall include the following: (i) An assessment of efforts made by the regional alliance or partnership to carry out paragraph (2). (ii) The metrics used by the regional alli- ance or partnership to measure the success of the efforts of the regional alliance or partnership under the cooperative agree- ment. (Pub. L. 113–274, title III, § 303, formerly title IV, § 401, Dec. 18, 2014, 128 Stat. 2985; renumbered title III, § 303, and amended Pub. L. 116–283, div. H, title XCIV, § 9401(a), (b), (e)–(g)(1), Jan. 1, 2021, 134 Stat. 4805–4807, 4809.) Editorial Notes CODIFICATION Section was classified to section 7451 of this title prior to renumbering by Pub. L. 116–283. AMENDMENTS 2021—Subsec. (a)(6) to (10). Pub. L. 116–283, § 9401(a), added pars. (6) to (9) and redesignated former par. (6) as (10). Subsec. (c). Pub. L. 116–283, § 9401(b), designated exist- ing provisions as par. (1), inserted heading, and added par. (2). Subsec. (e). Pub. L. 116–283, § 9401(e), added subsec. (e). Subsec. (f). Pub. L. 116–283, § 9401(f), added subsec. (f). Statutory Notes and Related Subsidiaries CYBERSECURITY CAREER PATHWAYS Pub. L. 116–283, div. H, title XCIV, § 9401(c), Jan. 1, 2021, 134 Stat. 4806, provided that: ‘‘(1) IDENTIFICATION OF MULTIPLE CYBERSECURITY CA- REER PATHWAYS.—In carrying out subsection (a) of such section [meaning 15 U.S.C. 7451(a), now 15 U.S.C. 7443(a)] and not later than 540 days after the date of the enactment of this Act [Jan. 1, 2021], the Director of the National Institute of Standards and Technology shall, in coordination with the Secretary of Defense, the Sec- retary of Homeland Security, the Director of the Office of Personnel Management, and the heads of other ap- propriate agencies, use a consultative process with other Federal agencies, academia, and industry to iden- tify multiple career pathways for cybersecurity work roles that can be used in the private and public sectors. ‘‘(2) REQUIREMENTS.—The Director shall ensure that the multiple cybersecurity career pathways identified under paragraph (1) indicate the knowledge, skills, and abilities, including relevant education, training, in- ternships, apprenticeships, certifications, and other ex- periences, that— ‘‘(A) align with employers’ cybersecurity skill needs, including proficiency level requirements, for its workforce; and ‘‘(B) prepare an individual to be successful in enter- ing or advancing in a cybersecurity career. ‘‘(3) EXCHANGE PROGRAM.—Consistent with require- ments under chapter 37 of title 5, United States Code, the Director of the National Institute of Standards and Technology, in coordination with the Director of the Office of Personnel Management, may establish a vol- Page 2368 TITLE 15—COMMERCE AND TRADE § 7451 untary program for the exchange of employees engaged in one of the cybersecurity work roles identified in the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (NIST Special Publication 800–181), or successor framework, between the National Institute of Standards and Technology and private sector institutions, including nonpublic or commercial businesses, research institutions, or insti- tutions of higher education, as the Director of the Na- tional Institute of Standards and Technology considers feasible.’’ PROFICIENCY TO PERFORM CYBERSECURITY TASKS Pub. L. 116–283, div. H, title XCIV, § 9401(d), Jan. 1, 2021, 134 Stat. 4806, provided that: ‘‘Not later than 540 days after the date of the enactment of this Act [Jan. 1, 2021], the Director of the National Institute of Stand- ards and Technology shall, in coordination with the Secretary of Defense, the Secretary of Homeland Secu- rity, and the heads of other appropriate agencies— ‘‘(1) in carrying out subsection (a) of such section [meaning 15 U.S.C. 7451(a), now 15 U.S.C. 7443(a)], as- sess the scope and sufficiency of efforts to measure an individual’s capability to perform specific tasks found in the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Frame- work (NIST Special Publication 800–181) at all pro- ficiency levels; and ‘‘(2) submit to Congress a report— ‘‘(A) on the findings of the Director with respect to the assessment carried out under paragraph (1); and ‘‘(B) with recommendations for effective methods for measuring the cybersecurity proficiency of learners.’’ SUBCHAPTER III—CYBERSECURITY AWARENESS AND PREPAREDNESS Editorial Notes CODIFICATION This subchapter was comprised of title IV of Pub. L. 113–274, Dec. 18, 2014, 128 Stat. 2985, prior to its repeal by Pub. L. 116–283, div. H, title XCIV, § 9401(g)(2), Jan. 1, 2021, 134 Stat. 4809. § 7451. Transferred Editorial Notes CODIFICATION Section, Pub. L. 113–274, title IV, § 401, Dec. 18, 2014, 128 Stat. 2985, which related to national cybersecurity awareness and education program, was renumbered § 303 of title III of Pub. L. 113–274, by Pub. L. 116–283, div. H, title XCIV, § 9401(g)(1), Jan. 1, 2021, 134 Stat. 4809, and transferred to section 7443 of this title. SUBCHAPTER IV—ADVANCEMENT OF CYBERSECURITY TECHNICAL STANDARDS § 7461. Definitions In this subchapter: (1) Director The term ‘‘Director’’ means the Director of the National Institute of Standards and Tech- nology. (2) Institute The term ‘‘Institute’’ means the National In- stitute of Standards and Technology. (Pub. L. 113–274, title V, § 501, Dec. 18, 2014, 128 Stat. 2986.) § 7462. International cybersecurity technical standards (a) In general The Director, in coordination with appropriate Federal authorities, shall— (1) as appropriate, ensure coordination of Federal agencies engaged in the development of international technical standards related to information system security; and (2) not later than 1 year after December 18, 2014, develop and transmit to Congress a plan for ensuring such Federal agency coordina- tion. (b) Consultation with the private sector In carrying out the activities specified in sub- section (a)(1), the Director shall ensure con- sultation with appropriate private sector stake- holders. (Pub. L. 113–274, title V, § 502, Dec. 18, 2014, 128 Stat. 2986.) § 7463. Cloud computing strategy (a) In general The Director, in coordination with the Office of Management and Budget, in collaboration with the Federal Chief Information Officers Council, and in consultation with other relevant Federal agencies and stakeholders from the pri- vate sector, shall continue to develop and en- courage the implementation of a comprehensive strategy for the use and adoption of cloud com- puting services by the Federal Government. (b) Activities In carrying out the strategy described under subsection (a), the Director shall give consider- ation to activities that— (1) accelerate the development, in collabora- tion with the private sector, of standards that address interoperability and portability of cloud computing services; (2) advance the development of conformance testing performed by the private sector in sup- port of cloud computing standardization; and (3) support, in coordination with the Office of Management and Budget, and in consulta- tion with the private sector, the development of appropriate security frameworks and ref- erence materials, and the identification of best practices, for use by Federal agencies to address security and privacy requirements to enable the use and adoption of cloud com- puting services, including activities— (A) to ensure the physical security of cloud computing data centers and the data stored in such centers; (B) to ensure secure access to the data stored in cloud computing data centers; (C) to develop security standards as re- quired under section 278g–3 of this title; and (D) to support the development of the au- tomation of continuous monitoring systems. (Pub. L. 113–274, title V, § 503, Dec. 18, 2014, 128 Stat. 2986.) § 7464. Identity management research and devel- opment (a) In general The Director shall carry out a program of re- search to support the development of voluntary,