15 U.S.C. § 7431 — Federal cybersecurity research and devel-

Page 2358 TITLE 15—COMMERCE AND TRADE § 7422 ment, or other activities in furtherance of national se- curity or public safety activities. (e) This order is not intended to, and does not, create any right or benefit, substantive or procedural, enforce- able at law or in equity by any party against the United States, its departments, agencies, or entities, its officers, employees, or agents, or any other person. DONALD J. TRUMP. § 7422. No regulatory authority Nothing in this chapter shall be construed to confer any regulatory authority on any Federal, State, tribal, or local department or agency. (Pub. L. 113–274, § 3, Dec. 18, 2014, 128 Stat. 2972.) Editorial Notes REFERENCES IN TEXT This chapter, referred to in text, was in the original ‘‘this Act’’, meaning Pub. L. 113–274, Dec. 18, 2014, 128 Stat. 2971, which is classified principally to this chap- ter. For complete classification of this Act to the Code, see Short Title note set out under section 7421 of this title and Tables. § 7423. No additional funds authorized No additional funds are authorized to carry out this Act, and the amendments made by this Act. This Act, and the amendments made by this Act, shall be carried out using amounts oth- erwise authorized or appropriated. (Pub. L. 113–274, § 4, Dec. 18, 2014, 128 Stat. 2972.) Editorial Notes REFERENCES IN TEXT This Act, and the amendments made by this Act, re- ferred to in text, is Pub. L. 113–274, Dec. 18, 2014, 128 Stat. 2971, which enacted this chapter and amended sec- tions 272, 278g–3, 7403, and 7406 of this title. For com- plete classification of this Act to the Code, see Short Title note set out under section 7421 of this title and Tables. SUBCHAPTER I—CYBERSECURITY RESEARCH AND DEVELOPMENT § 7431. Federal cybersecurity research and devel- opment (a) Fundamental cybersecurity research (1) Federal cybersecurity research and devel- opment strategic plan The heads of the applicable agencies and de- partments, working through the National Science and Technology Council and the Net- working and Information Technology Re- search and Development Program, shall de- velop and update every 4 years a Federal cybersecurity research and development stra- tegic plan (referred to in this subsection as the ‘‘strategic plan’’) based on an assessment of cybersecurity risk to guide the overall direc- tion of Federal cybersecurity and information assurance research and development for infor- mation technology and networking systems. The heads of the applicable agencies and de- partments shall build upon existing programs and plans to develop the strategic plan to meet objectives in cybersecurity, such as— (A) how to design and build complex soft- ware-intensive systems that are secure and reliable when first deployed; (B) how to test and verify that software and hardware, whether developed locally or obtained from a third party, is free of sig- nificant known security flaws; (C) how to test and verify that software and hardware obtained from a third party correctly implements stated functionality, and only that functionality; (D) how to guarantee the privacy of an in- dividual, including that individual’s iden- tity, information, and lawful transactions when stored in distributed systems or trans- mitted over networks; (E) how to build new protocols to enable the Internet to have robust security as one of the key capabilities of the Internet; (F) how to determine the origin of a mes- sage transmitted over the Internet; (G) how to support privacy in conjunction with improved security; (H) how to address the problem of insider threats; (I) how improved consumer education and digital literacy initiatives can address human factors that contribute to cybersecurity; (J) how to protect information processed, transmitted, or stored using cloud com- puting or transmitted through wireless serv- ices; (K) implementation of section 7432 of this title through research and development on the topics identified under subsection (a) of such section; and (L) any additional objectives the heads of the applicable agencies and departments, in coordination with the head of any relevant Federal agency and with input from stake- holders, including appropriate national lab- oratories, industry, and academia, deter- mine appropriate. (2) Requirements (A) Contents of plan The strategic plan shall— (i) specify and prioritize near-term, mid- term, and long-term research objectives, including objectives associated with the research identified in section 7403(a)(1) of this title; (ii) specify how the near-term objectives described in clause (i) complement re- search and development areas in which the private sector is actively engaged; (iii) describe how the heads of the appli- cable agencies and departments will focus on innovative, transformational tech- nologies with the potential to enhance the security, reliability, resilience, and trust- worthiness of the digital infrastructure, and to protect consumer privacy; (iv) describe how the heads of the appli- cable agencies and departments will foster the rapid transfer of research and develop- ment results into new cybersecurity tech- nologies and applications for the timely benefit of society and the national inter- est, including through the dissemination of best practices and other outreach ac- tivities; (v) describe how the heads of the applica- ble agencies and departments will estab- Page 2359 TITLE 15—COMMERCE AND TRADE § 7431 1 See References in Text note below. lish and maintain a national research in- frastructure for creating, testing, and evaluating the next generation of secure networking and information technology systems; and (vi) describe how the heads of the appli- cable agencies and departments will facili- tate access by academic researchers to the infrastructure described in clause (v), as well as to relevant data, including event data. (B) Private sector efforts In developing, implementing, and updating the strategic plan, the heads of the applica- ble agencies and departments, working through the National Science and Tech- nology Council and Networking and Infor- mation Technology Research and Develop- ment Program, shall work in close coopera- tion with industry, academia, and other in- terested stakeholders to ensure, to the ex- tent possible, that Federal cybersecurity re- search and development is not duplicative of private sector efforts. (C) Recommendations In developing and updating the strategic plan the heads of the applicable agencies and departments shall solicit recommendations and advice from— (i) the advisory committee established under section 5511(b)(1) of this title; and (ii) a wide range of stakeholders, includ- ing industry, academia, including rep- resentatives of minority serving institu- tions and community colleges, National Laboratories, and other relevant organiza- tions and institutions. (D) Implementation roadmap The heads of the applicable agencies and departments, working through the National Science and Technology Council and Net- working and Information Technology Re- search and Development Program, shall de- velop and annually update an implementa- tion roadmap for the strategic plan. The im- plementation roadmap shall— (i) specify the role of each Federal agen- cy in carrying out or sponsoring research and development to meet the research ob- jectives of the strategic plan, including a description of how progress toward the re- search objectives will be evaluated; (ii) specify the funding allocated to each major research objective of the strategic plan and the source of funding by agency for the current fiscal year; (iii) estimate the funding required for each major research objective of the stra- tegic plan for the following 3 fiscal years; and (iv) track ongoing and completed Fed- eral cybersecurity research and develop- ment projects. (3) Reports to Congress The heads of the applicable agencies and de- partments, working through the National Science and Technology Council and Net- working and Information Technology Re- search and Development Program, shall sub- mit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives— (A) the strategic plan not later than 1 year after December 18, 2014; (B) each quadrennial update to the stra- tegic plan; and (C) the implementation roadmap under subparagraph (D), and its annual updates, which shall be appended to the annual report required under section 5511(a)(2)(D) of this title. (4) Definition of applicable agencies and de- partments In this subsection, the term ‘‘applicable agencies and departments’’ means the agen- cies and departments identified in clauses (i) through (xi) of section 5511(a)(3)(B) 1 of this title or designated under clause (xii) of that section. (b) Cybersecurity practices research The Director of the National Science Founda- tion shall support research that— (1) develops, evaluates, disseminates, and in- tegrates new cybersecurity practices and con- cepts into the core curriculum of computer science programs and of other programs where graduates of such programs have a substantial probability of developing software after grad- uation, including new practices and concepts relating to secure coding education and im- provement programs; and (2) develops new models for professional de- velopment of faculty in cybersecurity edu- cation, including secure coding development. (c) Cybersecurity modeling and test beds (1) Review Not later than 1 year after December 18, 2014, the Director of the National Science Foundation, in coordination with the Director of the Office of Science and Technology Pol- icy, shall conduct a review of cybersecurity test beds in existence on December 18, 2014, to inform the grants under paragraph (2). The re- view shall include an assessment of whether a sufficient number of cybersecurity test beds are available to meet the research needs under the Federal cybersecurity research and devel- opment strategic plan. Upon completion, the Director shall submit the review to the Com- mittee on Commerce, Science, and Transpor- tation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives. (2) Additional cybersecurity modeling and test beds (A) In general If the Director of the National Science Foundation, after the review under para- graph (1), determines that the research needs under the Federal cybersecurity re- search and development strategic plan re- quire the establishment of additional cybersecurity test beds, the Director of the Page 2360 TITLE 15—COMMERCE AND TRADE § 7432 National Science Foundation, in coordina- tion with the Secretary of Commerce and the Secretary of Homeland Security, may award grants to institutions of higher edu- cation or research and development non- profit institutions to establish cybersecurity test beds. (B) Requirement The cybersecurity test beds under subpara- graph (A) shall be sufficiently robust in order to model the scale and complexity of real-time cyber attacks and defenses on real world networks and environments. (C) Assessment required The Director of the National Science Foundation, in coordination with the Sec- retary of Commerce and the Secretary of Homeland Security, shall evaluate the effec- tiveness of any grants awarded under this subsection in meeting the objectives of the Federal cybersecurity research and develop- ment strategic plan not later than 2 years after the review under paragraph (1) of this subsection, and periodically thereafter. (d) Coordination with other research initiatives In accordance with the responsibilities under section 5511 of this title, the Director of the Of- fice of Science and Technology Policy shall co- ordinate, to the extent practicable, Federal re- search and development activities under this section with other ongoing research and devel- opment security-related initiatives, including research being conducted by— (1) the National Science Foundation; (2) the National Institute of Standards and Technology; (3) the Department of Homeland Security; (4) other Federal agencies; (5) other Federal and private research lab- oratories, research entities, and universities; (6) institutions of higher education; (7) relevant nonprofit organizations; and (8) international partners of the United States. (e) Omitted (f) Research on the science of cybersecurity The head of each agency and department iden- tified under section 5511(a)(3)(B) 1 of this title, through existing programs and activities, shall support research that will lead to the develop- ment of a scientific foundation for the field of cybersecurity, including research that increases understanding of the underlying principles of se- curing complex networked systems, enables re- peatable experimentation, and creates quantifi- able security metrics. (Pub. L. 113–274, title II, § 201, Dec. 18, 2014, 128 Stat. 2974; Pub. L. 114–329, title I, § 105(t), Jan. 6, 2017, 130 Stat. 2985; Pub. L. 116–283, div. H, title XCIV, § 9407(b), Jan. 1, 2021, 134 Stat. 4814.) Editorial Notes REFERENCES IN TEXT Section 5511(a)(3)(B) of this title, referred to in sub- secs. (a)(4) and (f), was redesignated section 5511(a)(3)(C) of this title by Pub. L. 114–329, title I, § 105(f)(2)(D)(i), Jan. 6, 2017, 130 Stat. 2979. CODIFICATION Section is comprised of section 201 of Pub. L. 113–274. Subsec. (e) of section 201 of Pub. L. 113–274 amended section 7403 of this title. AMENDMENTS 2021—Subsec. (a)(1)(K), (L). Pub. L. 116–283 added sub- par. (K) and redesignated former subpar. (K) as (L). 2017—Subsec. (a)(4). Pub. L. 114–329 substituted ‘‘clauses (i) through (xi)’’ for ‘‘clauses (i) through (x)’’ and ‘‘under clause (xii)’’ for ‘‘under clause (xi)’’. § 7432. National cybersecurity challenges (a) Establishment of national cybersecurity chal- lenges (1) In general To achieve high-priority breakthroughs in cybersecurity by 2028, the Secretary of Com- merce shall establish the following national cybersecurity challenges: (A) Economics of a cyber attack Building more resilient systems that measurably and exponentially raise adver- sary costs of carrying out common cyber at- tacks. (B) Cyber training (i) Empowering the people of the United States with an appropriate and measurably sufficient level of digital literacy to make safe and secure decisions online. (ii) Developing a cybersecurity workforce with measurable skills to protect and main- tain information systems. (C) Emerging technology Advancing cybersecurity efforts in re- sponse to emerging technology, such as arti- ficial intelligence, quantum science, next generation communications, autonomy, data science, and computational technologies. (D) Reimagining digital identity Maintaining a high sense of usability while improving the privacy, security, and safety of online activity of individuals in the United States. (E) Federal agency resilience Reducing cybersecurity risks to Federal networks and systems, and improving the re- sponse of Federal agencies to cybersecurity incidents on such networks and systems. (2) Coordination In establishing the challenges under para- graph (1), the Secretary shall coordinate with the Secretary of Homeland Security on the challenges under subparagraphs (B) and (E) of such paragraph. (b) Pursuit of national cybersecurity challenges (1) In general Not later than 180 days after January 1, 2021, the Secretary, acting through the Under Sec- retary of Commerce for Standards and Tech- nology, shall commence efforts to pursue the national cybersecurity challenges established under subsection (a). (2) Competitions The efforts required by paragraph (1) shall include carrying out programs to award prizes,