Yesterday the House Science, Space, and Technology Committee held a markup hearing that included consideration of HR 2225, the National Science Foundation for the Future Act. The Committee adopted substitute language for the bill after considering thirteen additional amendments. All amendments and the substitute language were adopted by voice vote. Additional cybersecurity language was included. The Committee ordered the bill favorably reported to the House.
Substitute Language
From a cybersecurity perspective there were three significant changes made to the bill in the substitute language. There was a change in funding for the FY 2022 Cybercorps Scholarship for Service Program. There was new language added addressing cyber workforce development research and protecting research from cyber theft.
A revision was made in the Cybercorps funding allotment for FY 2022 in §4(a)(2)(iv). The funding was increased from $66 million to $70 million. No changes were made to the funding for the outyears, so it looks like this may have been simply correcting an editorial error in the original bill.
Cyber Workforce Development
A new subsection (f), Cyber workforce development research and development, was added to §5 of the bill. It would require NSF to award grants to carry out research on the cyber workforce. The research would address:
Understanding the current state of the cyber workforce, including factors that influence growth, retention, and development of that workforce,
Examining paths to entry and re-entry into the cyber workforce,
Understanding trends of the cyber workforce, including demographic representation, educational and professional backgrounds present, competencies available,
Looking at how to increase the size, diversity, and capability of the cyber workforce, and
Examining and evaluating training practices, models, programs, and technologies.
No specific funding was provided for this grant program.
Research Security
A new paragraph (4) was added to §8(d), Securing American research from cyber theft. First it would amend 15 USC 5511(a)(1) by inserting a new subparagraph (J) which would add a new requirement for the a Networking and Information Technology Research and Development Program established in §5511(a). This would require that the Program would “provide for improving the security, reliability, and resiliency of computing and networking systems used by institutions of higher education and other nonprofit research institutions for the processing, storage and transmission of sensitive federally funded research and associated data”.
Next the new paragraph would require NSF to establish a ‘Computing Enclave Pilot Program’ to “to award grants [at three universities{new §8(d)(4)( B)(i)} to ensure the security of federally-supported research data and to assist regional institutions of higher education and their researchers in compliance with regulations regarding the safeguarding of sensitive information and other relevant regulations and Federal guidelines” {new §8(d)(4)( B)(i)}. NSF would be required to work with those grantees to develop {new §8(d)(4)( B)(iv)}:
An approved design blueprint for compliance with Federal data protection protocols,
A comprehensive and confidential list, or a bill of materials, of each binary component of the software, firmware, or product that is required to deploy additional secure computing enclaves,
Templates for all policies and procedures required to operate the secure computing enclave in a research setting,
A system security plan template; and
A process for managing a plan of action and milestones for the secure computing enclave.
The new paragraph would authorize $38 million per year through 2024 for the Pilot Program.
Cybersecurity Amendments
An amendment offered by Rep Waltz (R,FL) would amend the Federal Cyber Scholarship-for-Service Program (15 USC 7442) by adding at the end of §7442(b)(1) “and cybersecurity-related aspects of other related fields as appropriate, including artificial intelligence, quantum computing and aerospace”. This would expand the cybersecurity areas that could be supported by the Program.
The second cybersecurity related amendment was offered by Rep Posey (R,FL). It would add a new subsection (g) to §5 of the bill. That subsection would require NSF to establish a cybersecurity workforce data initiative. That initiative would:
Assess the feasibility of providing nationally representative estimates and statistical information on the cybersecurity workforce,
Utilize the National Initiative for Cybersecurity Education (NICE) Cybersecurity Workforce Framework (NIST Special Publication 800–181), or other frameworks, as appropriate, to enable a consistent measurement of the cybersecurity workforce;
Moving Forward
This bill will almost certainly move forward to the full House. It is likely to be considered under regular order with a rule providing for consideration of at least some amendments from the floor. The bill is likely to receive bipartisan support and will certainly pass in the House.
The question will be what happens in the Senate. There is some overlap between this bill and S 1260. The areas of overlap would have to be addressed in the Senate and subsequently in a conference committee. There will be additional changes made by the Senate, as there are in any authorization bill. So, the final bill will have to be worked out in conference. I do not expect to see that happen until after the summer recess.