15 U.S.C. § 7443: National cybersecurity…

Summary

The Director of NIST must keep a national cybersecurity awareness and education program going with help from federal agencies, industry, schools, labs, and other groups. The program covers things like sharing cybersecurity standards and best practices; making those practices easy to use for people, small and medium businesses, schools, and state, local, and tribal governments; raising public awareness about cybersecurity, safety, and ethics; helping governments and institutions understand cyber risk and how to fix vulnerabilities; supporting cybersecurity education at all school levels; finding workforce skill gaps; coordinating federal training and workforce efforts; thinking about the workforce needs of critical infrastructure; advising the Office of Management and Budget on metrics; and planning for future federal hiring, training, and retention. The Director must build on programs and plans in place on December 18, 2014 and make a strategic plan that explains how the program will work. That plan must be sent to the Senate Committee on Commerce, Science, and Transportation and the House Committee on Science, Space, and Technology within 1 year after December 18, 2014 and every 5 years after that. The Office of Management and Budget may ask NIST, DHS, DOD, OPM, and other agencies for help making measurable ways to judge federally funded cybersecurity workforce programs. NIST’s NICE program must make cooperative agreements with regional alliances or partnerships to support local cybersecurity education and jobs. These agreements should use the NICE Cybersecurity Workforce Framework (NIST SP 800‑181 or its successor) to identify local workforce needs and training opportunities. NIST may give up to $200,000 per agreement. Recipients must match federal funds with at least 50% non‑Federal money or in‑kind help. Applications must show a multistakeholder partnership that includes at least one college or nonprofit trainer and at least one local employer or critical infrastructure operator, describe how it will find local needs and recruit employers for internships or apprenticeships, and set success measures. Priority goes to alliances with a National Center of Academic Excellence in Cybersecurity or a Federal Cyber Scholarship for Service awardee in the region. Grants are subject to audits under 2 C.F.R. part 200, and regional alliances must report on their activities and the metrics they used.

Title 15, §7443

Commerce and Trade, Source: USLM XML via OLRC

(a)National cybersecurity awareness and education program

The Director of the National Institute of Standards and Technology (referred to in this section as the “Director”), in consultation with appropriate Federal agencies, industry, educational institutions, National Laboratories, the Networking and Information Technology Research and Development program, and other organizations shall continue to coordinate a national cybersecurity awareness and education program, that includes activities such as—

(1)the widespread dissemination of cybersecurity technical standards and best practices identified by the Director;

(2)efforts to make cybersecurity best practices usable by individuals, small to medium-sized businesses, educational institutions, and State, local, and tribal governments;

(3)increasing public awareness of cybersecurity, cyber safety, and cyber ethics;

(4)increasing the understanding of State, local, and tribal governments, institutions of higher education, and private sector entities of—

(A)the benefits of ensuring effective risk management of information technology versus the costs of failure to do so; and

(B)the methods to mitigate and remediate vulnerabilities;

(5)supporting formal cybersecurity education programs at all education levels to prepare and improve a skilled cybersecurity and computer science workforce for the private sector and Federal, State, local, and tribal government;

(6)supporting efforts to identify cybersecurity workforce skill gaps in public and private sectors;

(7)facilitating Federal programs to advance cybersecurity education, training, and workforce development;

(8)in coordination with the Department of Defense, the Department of Homeland Security, and other appropriate agencies, considering any specific needs of the cybersecurity workforce of critical infrastructure, including cyber physical systems and control systems;

(9)advising the Director of the Office of Management and Budget, as needed, in developing metrics to measure the effectiveness and effect of programs and initiatives to advance the cybersecurity workforce; and

(10)promoting initiatives to evaluate and forecast future cybersecurity workforce needs of the Federal Government and develop strategies for recruitment, training, and retention.

(b)Considerations

In carrying out the authority described in subsection (a), the Director, in consultation with appropriate Federal agencies, shall leverage existing programs designed to inform the public of safety and security of products or services, including self-certifications and independently verified assessments regarding the quantification and valuation of information security risk.

(c)Strategic plan

(1)In general

The Director, in cooperation with relevant Federal agencies and other stakeholders, shall build upon programs and plans in effect as of December 18, 2014, to develop and implement a strategic plan to guide Federal programs and activities in support of the national cybersecurity awareness and education program under subsection (a).

(2)Requirement

The strategic plan developed and implemented under paragraph (1) shall include an indication of how the Director will carry out this section.

(d)Report

Not later than 1 year after December 18, 2014, and every 5 years thereafter, the Director shall transmit the strategic plan under subsection (c) to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives.

(e)Cybersecurity metrics

In carrying out subsection (a), the Director of the Office of Management and Budget may seek input from the Director of the National Institute of Standards and Technology, in coordination with the Department of Homeland Security, the Department of Defense, the Office of Personnel Management, and such agencies as the Director of the National Institute of Standards and Technology considers relevant, to develop quantifiable metrics for evaluating Federally funded cybersecurity workforce programs and initiatives based on the outcomes of such programs and initiatives.

(f)Regional alliances and multistakeholder partnerships

(1)In general

Pursuant to section 272(b)(4) of this title, the Director shall establish cooperative agreements between the National Initiative for Cybersecurity Education (NICE) of the Institute and regional alliances or partnerships for cybersecurity education and workforce.

(2)Agreements

The cooperative agreements established under paragraph (1) shall advance the goals of the National Initiative for Cybersecurity Education Cybersecurity Workforce Framework (NIST Special Publication 800–181), or successor framework, by facilitating local and regional partnerships to—

(A)identify the workforce needs of the local economy and classify such workforce in accordance with such framework;

(B)identify the education, training, apprenticeship, and other opportunities available in the local economy; and

(C)support opportunities to meet the needs of the local economy.

(3)Financial assistance

(A)Financial assistance authorized

The Director may award financial assistance to a regional alliance or partnership with whom the Director enters into a cooperative agreement under paragraph (1) in order to assist the regional alliance or partnership in carrying out the terms of the cooperative agreement.

(B)Amount of assistance

The aggregate amount of financial assistance awarded under subparagraph (A) per cooperative agreement shall not exceed $200,000.

(C)Matching requirement

The Director may not award financial assistance to a regional alliance or partnership under subparagraph (A) unless the regional alliance or partnership agrees that, with respect to the costs to be incurred by the regional alliance or partnership in carrying out the cooperative agreement for which the assistance was awarded, the regional alliance or partnership will make available (directly or through donations from public or private entities) non-Federal contributions, including in-kind contributions, in an amount equal to 50 percent of Federal funds provided under the award.

(4)Application

(A)In general

A regional alliance or partnership seeking to enter into a cooperative agreement under paragraph (1) and receive financial assistance under paragraph (3) shall submit to the Director an application therefore at such time, in such manner, and containing such information as the Director may require.

(B)Requirements

Each application submitted under subparagraph (A) shall include the following:

(i)(I)A plan to establish (or identification of, if it already exists) a multistakeholder workforce partnership that includes—

(aa)at least one institution of higher education or nonprofit training organization; and

(bb)at least one local employer or owner or operator of critical infrastructure.

(II)Participation from academic institutions in the Federal Cyber Scholarships for Service Program, the National Centers of Academic Excellence in Cybersecurity Program, or advanced technological education programs, as well as elementary and secondary schools, training and certification providers, State and local governments, economic development organizations, or other community organizations is encouraged.

(ii)A description of how the workforce partnership would identify the workforce needs of the local economy.

(iii)A description of how the multistakeholder workforce partnership would leverage the programs and objectives of the National Initiative for Cybersecurity Education, such as the Cybersecurity Workforce Framework and the strategic plan of such initiative.

(iv)A description of how employers in the community will be recruited to support internships, externships, apprenticeships, or cooperative education programs in conjunction with providers of education and training. Inclusion of programs that seek to include veterans, Indian Tribes, and underrepresented groups, including women, minorities, persons from rural and underserved areas, and persons with disabilities is encouraged.

(v)A definition of the metrics to be used in determining the success of the efforts of the regional alliance or partnership under the agreement.

(C)Priority consideration

In awarding financial assistance under paragraph (3)(A), the Director shall give priority consideration to a regional alliance or partnership that includes an institution of higher education that is designated as a National Center of Academic Excellence in Cybersecurity or which received an award under the Federal Cyber Scholarship for Service program located in the State or region of the regional alliance or partnership.

(5)Audits

Each cooperative agreement for which financial assistance is awarded under paragraph (3) shall be subject to audit requirements under part 200 of title 2, Code of Federal Regulations (relating to uniform administrative requirements, cost principles, and audit requirements for Federal awards), or successor regulation.

(6)Reports

(A)In general

Upon completion of a cooperative agreement under paragraph (1), the regional alliance or partnership that participated in the agreement shall submit to the Director a report on the activities of the regional alliance or partnership under the agreement, which may include training and education outcomes.

(B)Contents

Each report submitted under subparagraph (A) by a regional alliance or partnership shall include the following:

(i)An assessment of efforts made by the regional alliance or partnership to carry out paragraph (2).

(ii)The metrics used by the regional alliance or partnership to measure the success of the efforts of the regional alliance or partnership under the cooperative agreement.

Notes & Related Subsidiaries

Editorial Notes

Codification Section was classified to section 7451 of this title prior to renumbering by Pub. L. 116–283.

Amendments

2021—Subsec. (a)(6) to (10). Pub. L. 116–283, § 9401(a), added pars. (6) to (9) and redesignated former par. (6) as (10). Subsec. (c). Pub. L. 116–283, § 9401(b), designated existing provisions as par. (1), inserted heading, and added par. (2). Subsec. (e). Pub. L. 116–283, § 9401(e), added subsec. (e). Subsec. (f). Pub. L. 116–283, § 9401(f), added subsec. (f).

Statutory Notes and Related Subsidiaries

Cybersecurity Career Pathways Pub. L. 116–283, div. H, title XCIV, § 9401(c), Jan. 1, 2021, 134 Stat. 4806, provided that: “(1) Identification of multiple cybersecurity career pathways.—In carrying out subsection (a) of such section [meaning 15 U.S.C. 7451(a), now 15 U.S.C. 7443(a)] and not later than 540 days after the date of the enactment of this Act [Jan. 1, 2021], the Director of the National Institute of Standards and Technology shall, in coordination with the Secretary of Defense, the Secretary of Homeland Security, the Director of the Office of Personnel Management, and the heads of other appropriate agencies, use a consultative process with other Federal agencies, academia, and industry to identify multiple career pathways for cybersecurity work roles that can be used in the private and public sectors. “(2) Requirements.—The Director shall ensure that the multiple cybersecurity career pathways identified under paragraph (1) indicate the knowledge, skills, and abilities, including relevant education, training, internships, apprenticeships, certifications, and other experiences, that—“(A) align with employers’ cybersecurity skill needs, including proficiency level requirements, for its workforce; and “(B) prepare an individual to be successful in entering or advancing in a cybersecurity career. “(3) Exchange program.—Consistent with requirements under chapter 37 of title 5, United States Code, the Director of the National Institute of Standards and Technology, in coordination with the Director of the Office of Personnel Management, may establish a voluntary program for the exchange of employees engaged in one of the cybersecurity work roles identified in the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (NIST Special Publication 800–181), or successor framework, between the National Institute of Standards and Technology and private sector institutions, including nonpublic or commercial businesses, research institutions, or institutions of higher education, as the Director of the National Institute of Standards and Technology considers feasible.” Proficiency to Perform Cybersecurity Tasks Pub. L. 116–283, div. H, title XCIV, § 9401(d), Jan. 1, 2021, 134 Stat. 4806, provided that: “Not later than 540 days after the date of the enactment of this Act [Jan. 1, 2021], the Director of the National Institute of Standards and Technology shall, in coordination with the Secretary of Defense, the Secretary of Homeland Security, and the heads of other appropriate agencies— “(1) in carrying out subsection (a) of such section [meaning 15 U.S.C. 7451(a), now 15 U.S.C. 7443(a)], assess the scope and sufficiency of efforts to measure an individual’s capability to perform specific tasks found in the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (NIST Special Publication 800–181) at all proficiency levels; and “(2) submit to Congress a report—“(A) on the findings of the Director with respect to the assessment carried out under paragraph (1); and “(B) with recommendations for effective methods for measuring the cybersecurity proficiency of learners.”

§7443 National Cybersecurity Awareness and Education Program