Review – NSF Publishes RFI for Cyber-Physical Resilience Research

Today, the National Science Foundation (NSF) published a request for information in the Federal Register (89 FR 78915-78916) for “Networking and Information Technology Research and Development Request for Information on a National Plan for Cyber-Physical Systems Resilience”. The notice reports that: “The goal of the plan is to shape a whole-of-government research and development (R&D) plan related to cyber-physical resilience across systems that may be local, regional, or national in scope.”

The proposed research plan would be based, at least in part, on the following documents:

• PCAST Releases Report on Strategy for Cyber-Physical Resilience,

• Strategy for Cyber-Physical Resilience: Fortifying Our Critical Infrastructure for a Digital World, and

• Cyber-Physical Systems Resilience—The Networking and Information Technology Research and Development (NITRD) Program.

The NSF is soliciting comments that “address the topics of this RFI clearly and concisely”. Comments should be emailed to CPSR-ftacRFI@nitrd.gov. Comments should be submitted by October 26^th, 2024.

 

For more information about the RFI, including a brief description of the scope of the information requested, see my article a CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/nsf-publishes-rfi-for-cyber-physical - subscription required.

HR 7630 Passed in House – ANCHOR Act

Today, the House took up HR 7630 [removed from paywall], the Accelerating Networking, Cyberinfrastructure, and Hardware for Oceanic Research (ANCHOR) Act, under the suspension of the rules process. After less than ten minutes of debate, the bill was passed by a voice vote. The bill would require the National Science Foundation (NSF) to submit a plan to improve the cybersecurity and telecommunications of the Academic Research Fleet. No new funding is authorized by the legislation.

The bill now moves to the Senate for consideration. The legislation is not politically important enough to be considered under regular order, but it does appear to be a good candidate for consideration under the Senate’s unanimous consent process. A slightly different version of the bill, S 3943 [removed from paywall], was introduced in the Senate and subsequently was ordered reported favorably (without a written report) on August 1^st by the Senate Commerce, Science, and Transportation Committee.

Review - S 3943 Introduced – ANCHOR Act

Last month, Sen Padilla (D,CA) introduced S 3943, the Accelerating Networking, Cyberinfrastructure, and Hardware for Oceanic Research (ANCHOR) Act. The bill would require the National Science Foundation (NSF) to submit a plan to improve the cybersecurity and telecommunications of the Academic Research Fleet. No new funding is authorized by the legislation. The bill is very similar to HR 7630. That bill was adopted without amendment by the House Science, Space, and Technology Committee on March 20^th, 2024.

Differences From HR 7630

The major difference from the House bill is that Section 4 of the earlier bill is absent in the Senate version. That section authorized NSF to support cybersecurity upgrades described in the plan required in §3. Section 4 would have also required a report to Congress on progress made on the implementation of the plan.

Moving Forward

While Padilla is not a member of the Senate Commerce, Science, and Transportation Committee to which this bill was assigned for consideration, two of his three cosponsors are members. This means that there could be sufficient influence to see this bill considered in Committee. I see nothing in this bill, especially since it contains no new funding or regulatory requirements, that would engender any organized opposition to the legislation. I suspect that there would be bipartisan support for the bill. Unfortunately, this is yet another bill that is not politically important enough to take up the time to considered by the full Senate. If this bill is to move forward, it would need to be considered under the unanimous consent process (a politically fraught process) or be included in some larger, more politically necessary bill.

 

For more details about the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-3943-introduced - subscription required.

OMB Approves NSF CyberCorps Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved, ‘consistent with change’, a final rule form the National Science Foundation on “NSF CyberCorps Scholarship for Service Program”. The notice of proposed rulemaking for this action was published on July 15^th, 2022. This final rule was sent to OMB on April 27^th, 2023.

According to the Spring 2023 Unified Agenda entry for this rulemaking:

“NSF is finalizing amendments to the CyberCorps Scholarship for Service (SFS) Program, which provides scholarships for cybersecurity undergraduate and graduate (MS or PhD) education. In return for the financial support, recipients must agree to work after graduation in the cybersecurity mission of an agency of the U.S. Government or a State, local, or Tribal government or another qualifying entity, for a period equal to the length of the scholarship. These regulations govern the process of converting scholarships to student loans when the scholarship recipients fail to meet their required service obligations.”

NSF Sends CyberCorps Final Rule to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a final rule from the National Science Foundation on “NSF CyberCorps Scholarship for Service Program”. According to the listing for this rulemaking in the Fall 2022 Unified Agenda:

“NSF is finalizing amendments to the CyberCorps Scholarship for Service (SFS) Program which provides scholarships for cybersecurity undergraduate and graduate (MS or PhD) education. In return for the financial support, recipients must agree to work for the U.S. Government or a State, local, or Tribal government after graduation in a cybersecurity-related position, for a period equal to the length of the scholarship. NSF, in consultation with the Secretary of Education, is finalizing regulations governing the process of converting scholarships to student loans when the scholarship recipients fail to meet their required service obligations.”

NSF Publishes CyberCorps NPRM

Today, the National Science Foundation published a notice of proposed rulemaking (NPRM) in the Federal Register (87 FR 42431-42437) for changes to “NSF Federal Cyber Scholarship-for-Service Program”. The rulemaking is “is proposing standards for how a  CyberCorps SFS scholarship would be repaid if a scholarship recipient fails to meet the program requirements, as well as the process to discharge the repayment obligation, in whole or in part, in certain circumstances.”

The preamble to the proposed rule discusses the problem with the current system if a scholarship recipient is required to repay a scholarship because of failure to:

• Satisfy the academic requirements of the program, or

• Complete the service obligation.

This NPRM is proposing a single, centralized process for NSF and the Department of Education to convert the repayments amounts to Direct Unsubsidized Loans for the benefit of individual scholars, institutions, and Federal agencies.  

NSF is proposing to add a new Part 620 to 45 CFR:

PART 620—CYBERCORPS® SCHOLARSHIP FOR SERVICE (SFS) PROGRAM

620.1  Scope and purpose.

620.2  Definitions.

620.3  Documenting the service obligation.

620.4  Deferral of obligation.

620.5  Discharge of agreement to serve or repay.

620.6  Obligation to repay the CyberCorps SFS scholarship.

620.7  Severability.

NSF is soliciting public comments on the rulemaking. Comments may be submitted via the Federal eRulemaking Portal (www.Regulations.gov). The Federal Register Notice does not provide the docket number necessary for submitting a comment, but a brief search shows that the appropriate docket number is “NSF_FRDOC_0001-2960”. Comments should be submitted by September 19^th, 2022.

OMB Approves NSF CyberCorps NPRM

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking (NPRM) from the National Science Foundation for “NSF CyberCorps Scholarship for Service Program”. The NPRM was sent to OIRA back on May 2^nd, 2022. According to the Abstract for this rulemaking in the Spring 2022 Unified Agenda:

“The CyberCorps Scholarship for Service (SFS) Program is designed to recruit and train the next generation of cybersecurity professionals to meet the needs of Federal, State, local, tribal, and territorial government. The program provides scholarships for cybersecurity undergraduate and graduate (MS or PhD) education funded through grants awarded by the NSF. In return for the financial support, recipients must agree to work for the U.S. Government or a State, local, or Tribal government after graduation in a cybersecurity-related position, for a period equal to the length of the scholarship. Under the statute, NSF, in consultation with the Secretary of Education, must issue regulations that govern the process of converting scholarships to student loans when the scholarship recipients fail to meet their required service obligations.” [emphasis added]

We can probably expect to see the NPRM published in the Federal Register in the next week or so.

NSF Sends CyberCorps Scholarship NPRM to OMB

On Friday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rule making (NPRM) from the National Science Foundation for a proposed rule on “NSF CyberCorps Scholarship for Service Program” (RIN 3145-AA64). According to the Fall 2021 Regulatory Agenda entry for this rulemaking:

“The CyberCorps Scholarship for Service (SFS) Program is designed to recruit and train the next generation of cybersecurity professionals to meet the needs of Federal, State, local, tribal, and territorial government. The program provides scholarships for cybersecurity undergraduate and graduate (MS or PhD) education funded through grants awarded by the NSF. In return for the financial support, recipients must agree to work for the U.S. Government or a State, local, or Tribal government after graduation in a cybersecurity-related position, for a period equal to the length of the scholarship. Under the statute, NSF, in consultation with the Secretary of Education, must issue regulations that govern the process of converting scholarships to student loans when the scholarship recipients fail to meet their required service obligations. [emphasis added]”

Review - HR 2225 Introduced – NSF for the Future Act

Back in March Rep Johnson (D,TX) introduced HR 2225, the National Science Foundation for the Future Act. This is the annual authorization bill for the NSF. As introduced there was only one mention of cybersecurity in the bill. A markup hearing by the Subcommittee on Research And Technology of the House Science, Space, and Technology Committee conducted last month added two amendments addressing cybersecurity workforce issues.

For a more detailed analysis of the provisions of this bill see my post on CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-2225-introduced  - Subscription required.

S 1329 Introduced – FY 2014 DOC Spending

As I briefly noted last week Sen. Mikulski (D,MD) introduced S 1329, the Commerce, Justice, Science, and Related Agencies Appropriations Act, 2014. The Senate Appropriations Committee also favorably reported the bill for consideration by the Senate.

The bill itself does not contain any specific cybersecurity language; the programs are all funded at too low a level to show up as items in the bill. The Committee Report does provide some cybersecurity language for programs at both NIST and NSF. Interestingly there is no mention of the President’s cybersecurity executive order (EO 13636) in the Report even though NIST is one of the prime movers in executing the EO provisions.

NIST Cybersecurity

The Committee Report (pg 20) lists three cybersecurity programs supported by NIST spending:

$15,000,000 for the National Cybersecurity Center of Excellence;

$15,000,000 for the Comprehensive National Cybersecurity Initiative; and

$24,500,000 for the National Strategy for Trusted Identities in Cyberspace

There is nothing here that specifically targets control system security, though research funding could be used for that purpose.

NSF Cybersecurity

The Report notes (pg 122) full funding for NSF cybersecurity research ($159,250,000) which includes $57 million for the above mentioned Comprehensive National Cybersecurity Initiative.

A separately funded program, the CyberCorps scholarship for service program is being funded at $45,000,000, which is $20,000,000 above the requested level. The report notes that:

“More than 900 students have completed the program, which was initiated in fiscal year 2001; 92.6 percent of students have placed with more than 120 Federal agencies.”

It would be interesting to see how many of them have since transferred to private industry.

Moving Forward

As with all Senate spending bills the typical process will entail the language from this bill being substituted for the House language (in HR 2787 in this case which was introduced yesterday) and then goes to conference to work out the differences. Only in this case this is one of the lower priority spending bills so some version of the two bills will probably get folded into an omnibus spending bill or continuing resolution.

NSF Cybersecurity Meeting 05-19-10

In today’s Federal Register the National Science Foundation (NSF) announced that they would be making a public presentation on their recently identified R&D themes that will “exemplify and motivate future Federal cybersecurity game-change research activities” (75 FR 27007) on May 19th at the Claremont Hotel in Berkeley, CA at 1:30 pm PDT. Following that presentation the NSF will be opening an on-line discussion forum for public comments and feedback on the proposal starting May 19th thru June 18th. A separate notice in the Federal Register provides more information on “Federal cybersecurity game-change research and development agenda” (75 FR 27006). There will be three ‘themes’ that will be an integral part of that agenda; “(a) Tailored Trustworthy Spaces, (b) Moving Target, (c) Cyber Economic Incentives”. While most of the discussion will apparently be focused on information technology the NSF definition of cyberspace is the “globally interconnected network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors in critical industries [emphasis added]”. So there may be something of interest to the chemical security community in this discussion.