15 U.S.C. § 7431 — Federal cybersecurity research and development

(a) Fundamental cybersecurity research (1) Strategic plan: The heads of certain federal agencies and departments, working through the National Science and Technology Council and the Networking and Information Technology Research and Development Program, must write and update — every 4 years — a Federal cybersecurity research and development strategic plan, based on an assessment of cybersecurity risk. The plan must build on existing programs to meet goals like: (A) building secure, reliable software-heavy systems from the start; (B) testing whether software and hardware (in-house or third-party) has known security flaws; (C) testing whether third-party software and hardware does only what it claims to do; (D) protecting individual privacy — identity, information, and transactions — in distributed systems and over networks; (E) building internet protocols with strong security built in; (F) tracing the origin of a message sent over the internet; (G) supporting privacy alongside better security; (H) addressing insider threats; (I) improving consumer education and digital literacy about cybersecurity; (J) protecting information processed in cloud computing or sent over wireless services; (K) carrying out the research goals identified under section 7432 of this title; and (L) any other goals the agency heads decide fit, after consulting the head of any relevant federal agency and getting input from stakeholders, including national laboratories, industry, and academia. (2) Requirements: (A) The plan must: (i) specify and rank near-term, mid-term, and long-term research goals, including goals tied to the research identified in section 7403(a)(1); (ii) explain how the near-term goals complement private-sector research; (iii) describe how the agencies will focus on innovative, transformational technologies that improve the security, reliability, resilience, and trustworthiness of digital infrastructure, and protect consumer privacy; (iv) describe how the agencies will quickly move research results into new cybersecurity technologies and applications, including by sharing best practices; (v) describe how the agencies will build and maintain a national research infrastructure for creating, testing, and evaluating next-generation secure networking and information technology systems; and (vi) describe how the agencies will let academic researchers access that infrastructure and relevant data, including event data. (B) While developing, carrying out, and updating the plan, the agencies must work closely with industry, academia, and other stakeholders, so that federal cybersecurity research isn't duplicating private-sector efforts, as far as possible. (C) In developing and updating the plan, the agencies must get recommendations and advice from the advisory committee established under section 5511(b)(1), and from a wide range of stakeholders — industry, academia (including minority-serving institutions and community colleges), National Laboratories, and other relevant organizations. (D) The agencies must also develop and update every year an "implementation roadmap" for the plan. It must: (i) specify each federal agency's role in carrying out or sponsoring research toward the plan's goals, including how progress will be evaluated; (ii) specify the funding allocated to each major research goal and its source, for the current fiscal year; (iii) estimate the funding needed for each major goal over the following 3 fiscal years; and (iv) track ongoing and completed federal cybersecurity research and development projects. (3) Reports to Congress: The agencies must submit to the Senate Commerce Committee and the House Science Committee: (A) the strategic plan, no later than 1 year after December 18, 2014; (B) each 4-year update to the plan; and (C) the implementation roadmap and its yearly updates, appended to the annual report required under section 5511(a)(2)(D). (4) Definition: "Applicable agencies and departments" means the agencies and departments identified in clauses (i) through (xi) of section 5511(a)(3)(B), or designated under clause (xii) of that section. (b) Cybersecurity practices research: The Director of the National Science Foundation must support research that (1) develops, evaluates, shares, and builds new cybersecurity practices and concepts — including secure coding education — into the core curriculum of computer science programs and other programs whose graduates have a substantial chance of writing software after graduating, and (2) develops new models for training faculty in cybersecurity education, including secure coding development. (c) Cybersecurity modeling and test beds: (1) No later than 1 year after December 18, 2014, the Director of the National Science Foundation, with the Director of the Office of Science and Technology Policy, must review the cybersecurity test beds that existed as of that date, to inform the grants in paragraph (2). The review must assess whether there are enough cybersecurity test beds to meet the research needs of the strategic plan. Once finished, the Director must submit the review to the Senate Commerce Committee and the House Science Committee. (2)(A) If the Director of the National Science Foundation decides, after the review, that the strategic plan's research needs require more cybersecurity test beds, the Director — with the Secretary of Commerce and the Secretary of Homeland Security — may award grants to institutions of higher education or nonprofit research and development institutions to build them. (B) These test beds must be strong enough to realistically model the scale and complexity of real-time cyberattacks and defenses on real-world networks and environments. (C) The Director of the National Science Foundation, with the Secretary of Commerce and the Secretary of Homeland Security, must evaluate how effective any grants under this subsection were at meeting the strategic plan's goals, no later than 2 years after the review under paragraph (1), and periodically after that. (d) Coordination with other research initiatives: Consistent with the responsibilities under section 5511, the Director of the Office of Science and Technology Policy must coordinate, as far as practical, this section's federal research and development activities with other ongoing security-related research, including research by: (1) the National Science Foundation; (2) the National Institute of Standards and Technology; (3) the Department of Homeland Security; (4) other federal agencies; (5) other federal and private research laboratories, research entities, and universities; (6) institutions of higher education; (7) relevant nonprofit organizations; and (8) international partners of the United States. (e) Omitted: This subsection has no content. (f) Research on the science of cybersecurity: Each agency and department head identified under section 5511(a)(3)(B), using existing programs and activities, must support research that builds a scientific foundation for the field of cybersecurity — including research that deepens understanding of how to secure complex networked systems, enables repeatable experiments, and creates measurable security standards.