(1)
Federal cybersecurity research and development strategic plan
The heads of the applicable agencies and departments, working through the National Science and Technology Council and the Networking and Information Technology Research and Development Program, shall develop and update every 4 years a Federal cybersecurity research and development strategic plan (referred to in this subsection as the “strategic plan”) based on an assessment of cybersecurity risk to guide the overall direction of Federal cybersecurity and information assurance research and development for information technology and networking systems. The heads of the applicable agencies and departments shall build upon existing programs and plans to develop the strategic plan to meet objectives in cybersecurity, such as—
(A)
how to design and build complex software-intensive systems that are secure and reliable when first deployed;
(B)
how to test and verify that software and hardware, whether developed locally or obtained from a third party, is free of significant known security flaws;
(C)
how to test and verify that software and hardware obtained from a third party correctly implements stated functionality, and only that functionality;
(D)
how to guarantee the privacy of an individual, including that individual’s identity, information, and lawful transactions when stored in distributed systems or transmitted over networks;
(E)
how to build new protocols to enable the Internet to have robust security as one of the key capabilities of the Internet;
(F)
how to determine the origin of a message transmitted over the Internet;
(G)
how to support privacy in conjunction with improved security;
(H)
how to address the problem of insider threats;
(I)
how improved consumer education and digital literacy initiatives can address human factors that contribute to cybersecurity;
(J)
how to protect information processed, transmitted, or stored using cloud computing or transmitted through wireless services;
(K)
implementation of
section 7432 of this title through research and development on the topics identified under subsection (a) of such section; and
(L)
any additional objectives the heads of the applicable agencies and departments, in coordination with the head of any relevant Federal agency and with input from stakeholders, including appropriate national laboratories, industry, and academia, determine appropriate.
(2)
Requirements
(A)
Contents of plan
The strategic plan shall—
(i)
specify and prioritize near-term, mid-term, and long-term research objectives, including objectives associated with the research identified in
section 7403(a)(1) of this title;
(ii)
specify how the near-term objectives described in clause (i) complement research and development areas in which the private sector is actively engaged;
(iii)
describe how the heads of the applicable agencies and departments will focus on innovative, transformational technologies with the potential to enhance the security, reliability, resilience, and trustworthiness of the digital infrastructure, and to protect consumer privacy;
(iv)
describe how the heads of the applicable agencies and departments will foster the rapid transfer of research and development results into new cybersecurity technologies and applications for the timely benefit of society and the national interest, including through the dissemination of best practices and other outreach activities;
(v)
describe how the heads of the applicable agencies and departments will establish and maintain a national research infrastructure for creating, testing, and evaluating the next generation of secure networking and information technology systems; and
(vi)
describe how the heads of the applicable agencies and departments will facilitate access by academic researchers to the infrastructure described in clause (v), as well as to relevant data, including event data.
(B)
Private sector efforts
(C)
Recommendations
In developing and updating the strategic plan the heads of the applicable agencies and departments shall solicit recommendations and advice from—
(ii)
a wide range of stakeholders, including industry, academia, including representatives of minority serving institutions and community colleges, National Laboratories, and other relevant organizations and institutions.
(D)
Implementation roadmap
The heads of the applicable agencies and departments, working through the National Science and Technology Council and Networking and Information Technology Research and Development Program, shall develop and annually update an implementation roadmap for the strategic plan. The implementation roadmap shall—
(i)
specify the role of each Federal agency in carrying out or sponsoring research and development to meet the research objectives of the strategic plan, including a description of how progress toward the research objectives will be evaluated;
(ii)
specify the funding allocated to each major research objective of the strategic plan and the source of funding by agency for the current fiscal year;
(iii)
estimate the funding required for each major research objective of the strategic plan for the following 3 fiscal years; and
(iv)
track ongoing and completed Federal cybersecurity research and development projects.
(3)
Reports to Congress
The heads of the applicable agencies and departments, working through the National Science and Technology Council and Networking and Information Technology Research and Development Program, shall submit to the Committee on Commerce, Science, and Transportation of the Senate and the Committee on Science, Space, and Technology of the House of Representatives—
(A)
the strategic plan not later than 1 year after
(B)
each quadrennial update to the strategic plan; and
(C)
the implementation roadmap under subparagraph (D), and its annual updates, which shall be appended to the annual report required under
section 5511(a)(2)(D) of this title.