NIST COVID–19 Cybersecurity Act

I 116TH CONGRESS 2D SESSION H. R. 7998 To require the Director of the National Institute of Standards and Technology to disseminate guidance to institutions of higher education and nonprofit research institutions to help mitigate cybersecurity risks to COVID- 19 related research, and for other purposes. IN THE HOUSE OF REPRESENTATIVES AUGUST 11, 2020 Mr. BARR (for himself and Mr. LUCAS) introduced the following bill; which was referred to the Committee on Science, Space, and Technology A BILL To require the Director of the National Institute of Stand- ards and Technology to disseminate guidance to institu- tions of higher education and nonprofit research institu- tions to help mitigate cybersecurity risks to COVID- 19 related research, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘NIST COVID–19 Cy- 4 bersecurity Act’’. 5 SEC. 2. DEFINITIONS. 6 In this Act: 7 VerDate Sep 11 2014 23:04 Sep 11, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H7998.IH H7998 2 •HR 7998 IH (1) DIRECTOR.—The term ‘‘Director’’ means 1 the Director of the National Institute of Standards 2 and Technology. 3 (2) INSTITUTION OF HIGHER EDUCATION.—The 4 term ‘‘institution of higher education’’ has the 5 meaning given such term in section 101 of the High- 6 er Education Act of 1965 (20 U.S.C. 1001). 7 (3) RESOURCES.—The term ‘‘resources’’ means 8 guidelines, tools, best practices, standards, meth- 9 odologies, and other ways of providing information. 10 (4) RESEARCH INSTITUTION.—The term ‘‘re- 11 search institution’’— 12 (A) means a nonprofit institution (as de- 13 fined in section 4(5) of the Stevenson-Wydler 14 Technology Innovation Act of 1980 (15 U.S.C. 15 3703(5))); and 16 (B) includes federally funded research and 17 development centers, as identified by the Na- 18 tional Science Foundation in accordance with 19 the Federal Acquisition Regulation issued in ac- 20 cordance with section 1303(a)(1) of title 41 (or 21 any successor regulation). 22 VerDate Sep 11 2014 15:48 Aug 29, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H7998.IH H7998 3 •HR 7998 IH SEC. 3. IMPROVING CYBERSECURITY OF INSTITUTIONS OF 1 HIGHER EDUCATION. 2 Section 2(e)(1)(A) of the National Institute of Stand- 3 ards and Technology Act (15 U.S.C. 272(e)(1)(A)) is 4 amended— 5 (1) in clause (viii), by striking ‘‘and’’ after the 6 semicolon; 7 (2) by redesignating clause (ix) as clause (x); 8 and 9 (3) by inserting after clause (viii) the following: 10 ‘‘(ix) consider institutions of higher 11 education (as defined in section 101 of the 12 Higher Education Act of 1965 (20 U.S.C. 13 1001)); and’’. 14 SEC. 4. DISSEMINATION OF RESOURCES FOR RESEARCH IN- 15 STITUTIONS. 16 (a) IN GENERAL.—Not later than 90 days after the 17 date of the enactment of this Act, the Director shall, using 18 the authorities of the Director under subsections (c)(15) 19 and (e)(1)(A)(ix) of section 2 of the National Institute of 20 Standards and Technology Act (15 U.S.C. 272), as 21 amended by section 3, disseminate and make publicly 22 available resources to help research institutions and insti- 23 tutions of higher education identify, assess, manage, and 24 reduce their cybersecurity risk related to conducting re- 25 search with respect to COVID–19. 26 VerDate Sep 11 2014 15:48 Aug 29, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H7998.IH H7998 4 •HR 7998 IH (b) REQUIREMENTS.—The Director shall ensure that 1 the resources disseminated pursuant to subsection (a)— 2 (1) are generally applicable and usable by a 3 wide range of research institutions and institutions 4 of higher education; 5 (2) vary with the nature and size of the imple- 6 menting research institutions or institutions of high- 7 er education, and the nature and sensitivity of the 8 data collected or stored on the information systems 9 or devices of the implementing research institutions 10 or institutions of higher education; 11 (3) include elements that promote awareness of 12 simple, basic controls, a workplace cybersecurity cul- 13 ture, and third-party stakeholder relationships, to 14 assist research institutions or institutions of higher 15 education in mitigating common cybersecurity risks; 16 (4) include case studies of practical application; 17 (5) are technology-neutral and can be imple- 18 mented using technologies that are commercial and 19 off-the-shelf; and 20 (6) to the extent practicable, are based on inter- 21 national standards. 22 (c) NATIONAL CYBERSECURITY AWARENESS AND 23 EDUCATION PROGRAM.—The Director shall ensure that 24 the resources disseminated under subsection (a) are con- 25 VerDate Sep 11 2014 15:48 Aug 29, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H7998.IH H7998 5 •HR 7998 IH sistent with the efforts of the Director under section 401 1 of the Cybersecurity Enhancement Act of 2014 (15 U.S.C. 2 7451). 3 (d) UPDATES.—The Director shall review periodically 4 and update the resources under subsection (a) as the Di- 5 rector determines appropriate. 6 (e) VOLUNTARY RESOURCES.—The use of the re- 7 sources disseminated under paragraph (1) shall be consid- 8 ered voluntary. 9 (f) OTHER FEDERAL CYBERSECURITY REQUIRE- 10 MENTS.—Nothing in this section may be construed to su- 11 persede, alter, or otherwise affect any cybersecurity re- 12 quirements applicable to Federal agencies. 13 (g) FUNDING.—This Act shall be carried out using 14 funds made available to the Director. 15 Æ VerDate Sep 11 2014 15:48 Aug 29, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H7998.IH H7998