HACKED Act of 2019

II Calendar No. 515 116TH CONGRESS 2D SESSION S. 2775 [Report No. 116–254] To improve the cyber workforce of the United States, and for other purposes. IN THE SENATE OF THE UNITED STATES NOVEMBER 5, 2019 Mr. WICKER (for himself, Ms. CANTWELL, Mr. THUNE, and Ms. ROSEN) in- troduced the following bill; which was read twice and referred to the Com- mittee on Commerce, Science, and Transportation AUGUST 12, 2020 Reported by Mr. WICKER, with amendments [Omit the part struck through and insert the part printed in italic] A BILL To improve the cyber workforce of the United States, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Harvesting American 4 Cybersecurity Knowledge through Education Act of 2019’’ 5 or the ‘‘HACKED Act of 2019’’. 6 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 2 •S 2775 RS SEC. 2. IMPROVING NATIONAL INITIATIVE FOR CYBERSE- 1 CURITY EDUCATION. 2 (a) PROGRAM IMPROVEMENTS GENERALLY.—Sub- 3 section (a) of section 401 of the Cybersecurity Enhance- 4 ment Act of 2014 (15 U.S.C. 7451) is amended— 5 (1) in paragraph (5), by striking ‘‘; and’’ and 6 inserting a semicolon; 7 (2) by redesignating paragraph (6) as para- 8 graph (11); and 9 (3) by inserting after paragraph (5) the fol- 10 lowing: 11 ‘‘(6) identifying cybersecurity workforce skill 12 gaps in public and private sectors; 13 ‘‘(7) leading interagency efforts to facilitate co- 14 ordination of Federal programs to advance cyberse- 15 curity education, training, and workforce, such as— 16 ‘‘(A) the Federal Cyber Scholarship for 17 Service program of the National Science Foun- 18 dation; 19 ‘‘(B) the National Centers of Academic 20 Excellence in Cybersecurity program of the Na- 21 tional Security Agency and the Department of 22 Homeland Security; 23 ‘‘(C) the GenCyber Program of the Na- 24 tional Science Foundation and the National Se- 25 curity Agency; 26 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 3 •S 2775 RS ‘‘(D) the apprenticeship program of the 1 Department of Labor; 2 ‘‘(E) the Cybersecurity Education and 3 Training Assistance Program of the Depart- 4 ment of Homeland Security; 5 ‘‘(F) the Cyber Center of Excellence of the 6 Army; 7 ‘‘(G) the Information Operations Com- 8 mand program of the Navy; and 9 ‘‘(H) such others as the Director considers 10 appropriate; 11 ‘‘(8) promoting higher education and expertise 12 in cybersecurity through designation by the National 13 Security Agency and the Department of Homeland 14 Security of institutions of higher education as Na- 15 tional Centers of Academic Excellence in Cybersecu- 16 rity if such institutions have robust degree programs 17 that align to specific cybersecurity-related knowledge 18 units that are aligned to the knowledge, skills, abili- 19 ties, and tasks from the National Initiative for Cy- 20 bersecurity Education (NICE) Cybersecurity Work- 21 force Framework (NIST Special Publication 800– 22 181), or successor framework; 23 ‘‘(9) consideration of any specific needs of the 24 cybersecurity workforce of critical infrastructure; 25 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 4 •S 2775 RS ‘‘(10) developing metrics to measure the effec- 1 tiveness and effect of programs and initiatives to ad- 2 vance the cybersecurity workforce; and’’. 3 (b) STRATEGIC PLAN.—Subsection (c) of such sec- 4 tion is amended— 5 (1) by striking ‘‘The Director’’ and inserting 6 the following: 7 ‘‘(1) IN GENERAL.—The Director’’; and 8 (2) by adding at the end the following: 9 ‘‘(2) REQUIREMENT.—The strategic plan devel- 10 oped and implemented under paragraph (1) shall in- 11 clude an indication of how the Director will carry 12 out this section.’’. 13 (c) CYBERSECURITY CAREER PATHWAYS.— 14 (1) IDENTIFICATION OF MULTIPLE CYBERSECU- 15 RITY CAREER PATHWAYS.—In carrying out sub- 16 section (a) of such section and not later than 540 17 days after the date of the enactment of this Act, the 18 Director of the National Institute of Standards and 19 Technology shall use a consultative process with 20 other Federal agencies, academia, and industry to 21 identify multiple career pathways for cybersecurity 22 work roles that can be used in the private and public 23 sectors. 24 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 5 •S 2775 RS (2) REQUIREMENTS.—The Director shall en- 1 sure that the multiple cybersecurity career pathways 2 identified under paragraph (1) indicate the knowl- 3 edge, skills, and abilities, including relevant edu- 4 cation, training, apprenticeships, certifications, and 5 other experiences, that— 6 (A) align with employers’ cybersecurity 7 skill needs, including proficiency level require- 8 ments, for its workforce; and 9 (B) prepare an individual to be successful 10 in entering or advancing in a cybersecurity ca- 11 reer. 12 (3) FEDERAL CAREERS.—The Director, in co- 13 ordination with the Director of the Office of Per- 14 sonnel Management, shall ensure the cybersecurity 15 career pathways identified under paragraph (1) 16 identify career opportunities in the Federal Govern- 17 ment, including noncompetitive hiring pathways, in- 18 cluding for individuals who participate in Federal cy- 19 bersecurity workforce training programs referred to 20 in section 401(a)(7) of the Cybersecurity Enhance- 21 ment Act of 2014, as added by subsection (a)(3). 22 (4) EXCHANGE PROGRAM.—The Director of the 23 National Institute of Standards and Technology, in 24 coordination with the Director of the Office of Per- 25 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6203 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 6 •S 2775 RS sonnel Management, shall establish a voluntary pro- 1 gram for the exchange of employees engaged in one of 2 the cybersecurity work roles identified in the National 3 Initiative for Cybersecurity Education (NICE) Cyber- 4 security Workforce Framework (NIST Special Publi- 5 cation 800–181), or successor framework, between the 6 National Institute of Standards and Technology and 7 private sector institutions, including a nonpublic or 8 commercial business, a research institution, or an in- 9 stitution of higher education, as the Director of the 10 National Institute of Standards and Technology con- 11 siders feasible. 12 (d) PROFICIENCY TO PERFORM CYBERSECURITY 13 TASKS.—Not later than 540 days after the date of the 14 enactment of this Act, the Director of the National Insti- 15 tute of Standards and Technology shall— 16 (1) in carrying out subsection (a) of such sec- 17 tion, assess the scope and sufficiency of efforts to 18 measure a learner’s capability to perform specific 19 tasks found in the National Initiative for Cybersecu- 20 rity Education (NICE) Cybersecurity Workforce 21 Framework (NIST Special Publication 800–181) at 22 all proficiency levels; and 23 (2) submit to Congress a report— 24 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 7 •S 2775 RS (A) on the findings of the Director with re- 1 spect to the assessment carried out under para- 2 graph (1); and 3 (B) with recommendations for effective 4 methods for measuring the cybersecurity pro- 5 ficiency of learners. 6 (e) CYBERSECURITY METRICS.—Such section is fur- 7 ther amended by adding at the end the following: 8 ‘‘(e) CYBERSECURITY METRICS.—In carrying out 9 subsection (a), the Director, in coordination with such 10 agencies as the Director considers relevant, shall develop 11 repeatable measures and reliable metrics for measuring 12 and evaluating Federally funded cybersecurity workforce 13 programs and initiatives based on the outcomes of such 14 programs and initiatives.’’. 15 (f) REGIONAL ALLIANCES AND MULTISTAKEHOLDER 16 PARTNERSHIPS.—Such section is further amended by 17 adding at the end the following: 18 ‘‘(f) REGIONAL ALLIANCES AND MULTISTAKE- 19 HOLDER PARTNERSHIPS.— 20 ‘‘(1) IN GENERAL.—Pursuant to section 2(b)(4) 21 of the National Institute of Standards and Tech- 22 nology Act (15 U.S.C. 272(b)(4)), the Director shall 23 establish cooperative agreements between the Na- 24 tional Initiative for Cybersecurity Education (NICE) 25 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 8 •S 2775 RS of the Institute and regional alliances or partner- 1 ships for cybersecurity education and workforce. 2 ‘‘(2) AGREEMENTS.—The cooperative agree- 3 ments established under paragraph (1) shall advance 4 the goals of the National Initiative for Cybersecurity 5 Education Cybersecurity Workforce Framework 6 (NIST Special Publication 800–181), or successor 7 framework, by facilitating local and regional partner- 8 ships— 9 ‘‘(A) to identify the workforce needs of the 10 local economy and classify such workforce in ac- 11 cordance with such framework; 12 ‘‘(B) to identify the education, training, 13 apprenticeship, and other opportunities avail- 14 able in the local economy; and 15 ‘‘(C) to support opportunities to meet the 16 needs of the local economy. 17 ‘‘(3) FINANCIAL ASSISTANCE.— 18 ‘‘(A) FINANCIAL ASSISTANCE AUTHOR- 19 IZED.—The Director may award financial as- 20 sistance to a regional alliance or partnership 21 with whom the Director enters into a coopera- 22 tive agreement under paragraph (1) in order to 23 assist the regional alliance or partnership in 24 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 9 •S 2775 RS carrying out the term of the cooperative agree- 1 ment. 2 ‘‘(B) AMOUNT OF ASSISTANCE.—The ag- 3 gregate amount of financial assistance awarded 4 under subparagraph (A) per cooperative agree- 5 ment shall not exceed $200,000. 6 ‘‘(C) MATCHING REQUIREMENT.—The Di- 7 rector may not award financial assistance to a 8 regional alliance or partnership under subpara- 9 graph (A) unless the regional alliance or part- 10 nership agrees that, with respect to the costs to 11 be incurred by the regional alliance or partner- 12 ship in carrying out the cooperative agreement 13 for which the assistance was awarded, the re- 14 gional alliance or partnership will make avail- 15 able (directly or through donations from public 16 or private entities) non-Federal contributions in 17 an amount equal to 50 percent of Federal funds 18 provided under the award. 19 ‘‘(4) APPLICATION.— 20 ‘‘(A) IN GENERAL.—A regional alliance or 21 partnership seeking to enter into a cooperative 22 agreement under paragraph (1) and receive fi- 23 nancial assistance under paragraph (3) shall 24 submit to the Director an application therefor 25 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 10 •S 2775 RS at such time, in such manner, and containing 1 such information as the Director may require. 2 ‘‘(B) REQUIREMENTS.—Each application 3 submitted under subparagraph (A) shall include 4 the following: 5 ‘‘(i)(I) A plan to establish (or identi- 6 fication of, if it already exists) a multi- 7 stakeholder workforce partnership that in- 8 cludes— 9 ‘‘(aa) at least one institution of 10 higher education or nonprofit training 11 organization; and 12 ‘‘(bb) at least one local employer 13 or owner or operator of critical infra- 14 structure. 15 ‘‘(II) Participation from Federal 16 Cyber Scholarships for Service organiza- 17 tions, National Centers of Academic Excel- 18 lence in Cybersecurity, advanced techno- 19 logical education programs, elementary and 20 secondary schools, training and certifi- 21 cation providers, State and local govern- 22 ments, economic development organiza- 23 tions, or other community organizations is 24 encouraged. 25 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 11 •S 2775 RS ‘‘(ii) A description of how the work- 1 force partnership would identify the work- 2 force needs of the local economy. 3 ‘‘(iii) A description of how the multi- 4 stakeholder workforce partnership would 5 leverage the programs and objectives of the 6 National Initiative for Cybersecurity Edu- 7 cation, such as the Cybersecurity Work- 8 force Framework and the strategic plan of 9 such initiative. 10 ‘‘(iv) A description of how employers 11 in the community will be recruited to sup- 12 port internships, apprenticeships, or coop- 13 erative education programs in conjunction 14 with providers of education and training. 15 Inclusion of programs that seek to include 16 women, minorities, or veterans is encour- 17 aged. 18 ‘‘(v) A definition of the metrics that 19 will be used to measure the success of the 20 efforts of the regional alliance or partner- 21 ship under the agreement. 22 ‘‘(C) PRIORITY CONSIDERATION.—In 23 awarding financial assistance under subpara- 24 graph (A) paragraph (3)(A), the Director shall 25 VerDate Sep 11 2014 20:44 Aug 12, 2020 Jkt 099200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\S2775.RS S2775 pamtmann on DSKBC07HB2PROD with BILLS 12 •S 2775 RS give priority consideration to a regional alliance 1 or partnership that includes an institution of 2 higher education that is designated as a Na- 3 tional Center of Academic Excellence in Cyber- 4 security or which receives an award under the 5 Federal Cyber Scholarship for Service program 6 located in the State or region of the regional al- 7 liance or partnership. 8 ‘‘(5) AUDITS.—Each cooperative agreement for 9 which financial assistance is awarded under para- 10 graph (3) shall be subject to audit requirements 11 under part 200 of title 2, Code of Federal Regula- 12 tions (relating to uniform administrative require- 13 ments, cost principles, and audit requirements for 14 Federal awards), or successor regulation. 15 ‘‘(6) REPORTS.— 16 ‘‘(A) IN GENERAL.—Upon completion of a 17 cooperative agreement under paragraph (1), the 18 regional alliance or partnership that partici- 19 pated in the agreement shall submit to the Di- 20 rector a report on the activities of the regional 21 alliance or partnership under the agreement, 22 which may include training and education out- 23 com [Text truncated for display. Full text available on Congress.gov.]