HACKED Act

I 116TH CONGRESS 2D SESSION H. R. 8634 To improve United States cybersecurity through STEM scholarships, prize competitions, and other STEM activities, and for other purposes. IN THE HOUSE OF REPRESENTATIVES OCTOBER 20, 2020 Ms. KENDRA S. HORN of Oklahoma introduced the following bill; which was referred to the Committee on Science, Space, and Technology, and in ad- dition to the Committee on Education and Labor, for a period to be sub- sequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To improve United States cybersecurity through STEM scholarships, prize competitions, and other STEM activi- ties, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘HACKED Act’’. 4 VerDate Sep 11 2014 19:09 Nov 04, 2020 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 2 •HR 8634 IH SEC. 2. IMPROVING NATIONAL INITIATIVE FOR CYBERSE- 1 CURITY EDUCATION. 2 (a) PROGRAM IMPROVEMENTS GENERALLY.—Sub- 3 section (a) of section 401 of the Cybersecurity Enhance- 4 ment Act of 2014 (15 U.S.C. 7451(a)) is amended— 5 (1) in paragraph (5), by striking ‘‘; and’’ and 6 inserting a semicolon; 7 (2) by redesignating paragraph (6) as para- 8 graph (10); and 9 (3) by inserting after paragraph (5) the fol- 10 lowing: 11 ‘‘(6) supporting efforts to identify cybersecurity 12 workforce skill gaps in public and private sectors; 13 ‘‘(7) facilitating efforts for Federal programs to 14 advance cybersecurity education, training, and work- 15 force development; 16 ‘‘(8) in coordination with the Department of 17 Homeland Security and other appropriate agencies, 18 considering any specific needs of the cybersecurity 19 workforce of critical infrastructure, to include cyber 20 physical systems and control systems; 21 ‘‘(9) advising the Director of the Office of Man- 22 agement and Budget, as needed, in developing 23 metrics to measure the effectiveness and effect of 24 programs and initiatives to advance the cybersecu- 25 rity workforce; and’’. 26 VerDate Sep 11 2014 01:44 Nov 06, 2020 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 3 •HR 8634 IH (b) STRATEGIC PLAN.—Subsection (c) of such sec- 1 tion is amended— 2 (1) by striking ‘‘The Director’’ and inserting 3 the following: 4 ‘‘(1) IN GENERAL.—The Director’’; and 5 (2) by adding at the end the following: 6 ‘‘(2) REQUIREMENT.—The strategic plan devel- 7 oped and implemented under paragraph (1) shall in- 8 clude an indication of how the Director will carry 9 out this subsection.’’. 10 (c) CYBERSECURITY CAREER PATHWAYS.— 11 (1) IDENTIFICATION OF MULTIPLE CYBERSECU- 12 RITY CAREER PATHWAYS.—In carrying out sub- 13 section (a) of such section and not later than 540 14 days after the date of the enactment of this Act, the 15 Director of the National Institute of Standards and 16 Technology shall, in coordination with the Secretary 17 of Homeland Security, the Director of the Office of 18 Personnel Management, and other appropriate agen- 19 cies, use a consultative process with other Federal 20 agencies, academia, and industry to make public a 21 report identifying multiple career pathways for cy- 22 bersecurity work roles that can be used in the pri- 23 vate and public sectors. 24 VerDate Sep 11 2014 19:09 Nov 04, 2020 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 4 •HR 8634 IH (2) REQUIREMENTS.—The Director of the Na- 1 tional Institute of Standards and Technology shall 2 ensure that the multiple cybersecurity career path- 3 ways identified under paragraph (1) indicate the 4 knowledge, skills, and abilities, including relevant 5 education, training, internships, apprenticeships, cer- 6 tifications, and other experiences, that— 7 (A) align with employers’ cybersecurity 8 skill needs, including proficiency level require- 9 ments, for its workforce; and 10 (B) prepare an individual to be successful 11 in entering or advancing in a cybersecurity ca- 12 reer. 13 (3) EXCHANGE PROGRAM.—Consistent with re- 14 quirements under chapter 37 of title 5, United 15 States Code, the Director of the National Institute 16 of Standards and Technology, in coordination with 17 the Director of the Office of Personnel Management, 18 may establish a voluntary program for the exchange 19 of employees engaged in one of the cybersecurity 20 work roles identified in the National Initiative for 21 Cybersecurity Education (NICE) Cybersecurity 22 Workforce Framework (NIST Special Publication 23 800–181), or successor framework, between the Na- 24 tional Institute of Standards and Technology and 25 VerDate Sep 11 2014 19:09 Nov 04, 2020 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 5 •HR 8634 IH private sector institutions, including nonpublic or 1 commercial businesses, research institutions, or in- 2 stitutions of higher education, as the Director of the 3 National Institute of Standards and Technology con- 4 siders feasible. 5 (d) PROFICIENCY TO PERFORM CYBERSECURITY 6 TASKS.—In carrying out subsection (a) of such section, 7 the Director of the National Institute of Standards and 8 Technology shall, in coordination with the Secretary of 9 Homeland Security, and other appropriate agencies— 10 (1) assess the scope and sufficiency of efforts to 11 measure an individual’s capability to perform spe- 12 cific tasks found in the National Initiative for Cyber- 13 security Education (NICE) Cybersecurity Workforce 14 Framework (NIST Special Publication 800–181) at 15 all proficiency levels; and 16 (2) not later than 540 days after the date of 17 the enactment of this Act, submit to Congress a re- 18 port— 19 (A) on the findings of the Director with re- 20 spect to the assessment carried out under para- 21 graph (1); and 22 (B) with recommendations for effective 23 methods for measuring the cybersecurity pro- 24 ficiency of learners. 25 VerDate Sep 11 2014 01:44 Nov 06, 2020 Jkt 019200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 6 •HR 8634 IH (e) CYBERSECURITY METRICS.—Such section is fur- 1 ther amended by adding at the end the following: 2 ‘‘(e) CYBERSECURITY METRICS.—In carrying out 3 subsection (a), the Director of the Office of Management 4 and Budget may seek input from the Director of the Na- 5 tional Institute of Standards and Technology, in coordina- 6 tion with the Department of Homeland Security, the Of- 7 fice of Personnel Management, and such agencies as the 8 Director of the National Institute of Standards and Tech- 9 nology considers relevant, to develop quantifiable metrics 10 for evaluating federally funded cybersecurity workforce 11 programs and initiatives based on the outcomes of such 12 programs and initiatives.’’. 13 (f) REGIONAL ALLIANCES AND MULTISTAKEHOLDER 14 PARTNERSHIPS.—Such section is further amended by 15 adding at the end the following: 16 ‘‘(f) REGIONAL ALLIANCES AND MULTISTAKE- 17 HOLDER PARTNERSHIPS.— 18 ‘‘(1) IN GENERAL.—Pursuant to section 2(b)(4) 19 of the National Institute of Standards and Tech- 20 nology Act, the Director shall establish cooperative 21 agreements between the National Initiative for Cy- 22 bersecurity Education (NICE) of the Institute and 23 regional alliances or partnerships for cybersecurity 24 education and workforce. 25 VerDate Sep 11 2014 01:44 Nov 06, 2020 Jkt 019200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 7 •HR 8634 IH ‘‘(2) AGREEMENTS.—The cooperative agree- 1 ments established under paragraph (1) shall advance 2 the goals of the National Initiative for Cybersecurity 3 Education Cybersecurity Workforce Framework 4 (NIST Special Publication 800–181), or successor 5 framework, by facilitating local and regional partner- 6 ships— 7 ‘‘(A) to identify the workforce needs of the 8 local economy and classify such workforce in ac- 9 cordance with such framework; 10 ‘‘(B) to identify the education, training, 11 apprenticeship, and other opportunities avail- 12 able in the local economy; and 13 ‘‘(C) to support opportunities to meet the 14 needs of the local economy. 15 ‘‘(3) FINANCIAL ASSISTANCE.— 16 ‘‘(A) FINANCIAL ASSISTANCE AUTHOR- 17 IZED.—The Director may award financial as- 18 sistance to a regional alliance or partnership 19 with whom the Director enters into a coopera- 20 tive agreement under paragraph (1) in order to 21 assist the regional alliance or partnership in 22 carrying out the term of the cooperative agree- 23 ment. 24 VerDate Sep 11 2014 19:09 Nov 04, 2020 Jkt 019200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 8 •HR 8634 IH ‘‘(B) AMOUNT OF ASSISTANCE.—The ag- 1 gregate amount of financial assistance awarded 2 under subparagraph (A) per cooperative agree- 3 ment shall not exceed $200,000. 4 ‘‘(C) MATCHING REQUIREMENT.—The Di- 5 rector may not award financial assistance to a 6 regional alliance or partnership under subpara- 7 graph (A) unless the regional alliance or part- 8 nership agrees that, with respect to the costs to 9 be incurred by the regional alliance or partner- 10 ship in carrying out the cooperative agreement 11 for which the assistance was awarded, the re- 12 gional alliance or partnership will make avail- 13 able (directly or through donations from public 14 or private entities) non-Federal contributions, 15 including in-kind contributions, in an amount 16 equal to 50 percent of Federal funds provided 17 under the award. 18 ‘‘(4) APPLICATION.— 19 ‘‘(A) IN GENERAL.—A regional alliance or 20 partnership seeking to enter into a cooperative 21 agreement under paragraph (1) and receive fi- 22 nancial assistance under paragraph (3) shall 23 submit to the Director an application therefore 24 VerDate Sep 11 2014 19:09 Nov 04, 2020 Jkt 019200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 9 •HR 8634 IH at such time, in such manner, and containing 1 such information as the Director may require. 2 ‘‘(B) REQUIREMENTS.—Each application 3 submitted under subparagraph (A) shall include 4 the following: 5 ‘‘(i)(I) An identification of, or a plan 6 to establish, a multistakeholder workforce 7 partnership that includes— 8 ‘‘(aa) at least one institution of 9 higher education or nonprofit training 10 organization; and 11 ‘‘(bb) at least one local employer 12 or owner or operator of critical infra- 13 structure. 14 ‘‘(II) Participation from academic in- 15 stitutions in the Federal Cyber Scholar- 16 ships for Service, National Centers of Aca- 17 demic Excellence in Cybersecurity program 18 or advanced technological education pro- 19 grams, as well as elementary and sec- 20 ondary schools, training and certification 21 providers, State and local governments, 22 economic development organizations, or 23 other community organizations is encour- 24 aged. 25 VerDate Sep 11 2014 19:09 Nov 04, 2020 Jkt 019200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 10 •HR 8634 IH ‘‘(ii) A description of how the work- 1 force partnership would identify the work- 2 force needs of the local economy. 3 ‘‘(iii) A description of how the multi- 4 stakeholder workforce partnership would 5 leverage the programs and objectives of the 6 National Initiative for Cybersecurity Edu- 7 cation, such as the Cybersecurity Work- 8 force Framework and the strategic plan of 9 such initiative. 10 ‘‘(iv) A description of how employers 11 in the community will be recruited to sup- 12 port internships, externships, apprentice- 13 ships, or cooperative education programs 14 in conjunction with providers of education 15 and training. Inclusion of programs that 16 seek to include veterans and underrep- 17 resented groups, including women, minori- 18 ties, persons from rural and underserved 19 areas, and persons with disabilities, is en- 20 couraged. 21 ‘‘(v) A definition of the metrics to be 22 used in determining the success of the ef- 23 forts of the regional alliance or partnership 24 under the agreement. 25 VerDate Sep 11 2014 19:09 Nov 04, 2020 Jkt 019200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 11 •HR 8634 IH ‘‘(C) PRIORITY CONSIDERATION.—In 1 awarding financial assistance under paragraph 2 (3), the Director shall give priority consider- 3 ation to a regional alliance or partnership that 4 includes an institution of higher education that 5 is designated as a National Center of Academic 6 Excellence in Cybersecurity or which received 7 an award under the Federal Cyber Scholarship 8 for Service program located in the State or re- 9 gion of the regional alliance or partnership. 10 ‘‘(5) AUDITS.—Each cooperative agreement for 11 which financial assistance is awarded under para- 12 graph (3) shall be subject to audit requirements 13 under part 200 of title 2, Code of Federal Regula- 14 tions (relating to uniform administrative require- 15 ments, cost principles, and audit requirements for 16 Federal awards), or successor regulation. 17 ‘‘(6) REPORTS.— 18 ‘‘(A) IN GENERAL.—Upon completion of a 19 cooperative agreement under paragraph (1), the 20 regional alliance or partnership that partici- 21 pated in the agreement shall submit to the Di- 22 rector a report on the activities of the regional 23 alliance or partnership under the agreement, 24 VerDate Sep 11 2014 19:09 Nov 04, 2020 Jkt 019200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H8634.IH H8634 pamtmann on DSKBC07HB2PROD with BILLS 12 •HR 8634 IH which may include training and education out- 1 comes. 2 ‘‘(B) CONTENTS.—Each report submitted 3 under subparagraph (A) by a regional alliance 4 or partnership shall include the following: 5 ‘‘(i) An assessment of efforts made by 6 the regional alliance or partnership to 7 carry out paragraph (2). 8 ‘‘(ii) The metrics used by the regional 9 alliance or partnership to measure the suc- 10 cess of the efforts of the regional alliance 11 or partnership under the cooperative agree- 12 ment.’’. 13 (g) TRANSFER OF SECTION.— 14 (1) TRANSFER.—Such section is transferred to 15 the end of title III of such Act and redesignated as 16 section 303. 17 (2) REPEAL.—Title IV of such Act is repealed. 18 (3) CLERICAL.—The table of contents in sec- 19 tion 1(b) of such Act is amended— 20 (A) by striking the items relating to title 21 IV and section 401; and 22 (B) by inserting after the item relat [Text truncated for display. Full text available on Congress.gov.]