H.R. 9918
Enhancing K–12 Cybersecurity Act
Sponsor: Doris O. Matsui
1 cosponsor
Official summary
Written by the Congressional Research Service.
Enhancing K-12 Cybersecurity Act
This bill establishes resources and a program to address cybersecurity of elementary and secondary schools.
First, the bill directs the Cybersecurity and Infrastructure Security Agency (CISA) to establish an information exchange to disseminate information, best practices, training, and resources to improve cybersecurity in elementary and secondary schools.
In addition, CISA must establish a registry to track cyber incidents affecting information technology systems that are owned or managed by schools and educational agencies. Schools and educational agencies may voluntarily submit information to the registry.
Finally, the bill requires CISA to establish a program to address cybersecurity threats to school information systems.
Text of the bill
(a) Establishment. The Director of the Cybersecurity and Infrastructure Security Agency shall enhance existing information exchange efforts implemented through partnerships with one or more information sharing and analysis organizations to focus specific attention on the needs of K–12 organizations with regard to cybersecurity, including a new publicly accessible website (to be known as the School Cybersecurity Information Exchange) to disseminate information, cybersecurity best practices, training, and lessons learned tailored to the specific needs, technical expertise, and resources available to K–12 organizations in accordance with subsection (b).
(b) Duties. In establishing the School Cybersecurity Information Exchange under subsection (a), the Director shall—
(1) engage appropriate Federal, State, local, and nongovernmental organizations to identify, promote, and disseminate information and best practices for local educational agencies, state educational agencies, and educational service agencies (as such terms are defined in section 8101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 7801)) with respect to cybersecurity, data protection, remote learning security, and student online privacy;
(2) maintain a database for an elementary school, secondary school, local educational agency, State educational agency, and educational service agency to identify cybersecurity security tools and services funded by the Federal Government, as well as tools and services recommended for purchase with State and local government funding; and
(3) provide a searchable database for an elementary school, secondary school, local educational agency, State educational agency, and educational service agency to find and apply for funding opportunities to improve cybersecurity.
(c) Consultation. In carrying out the duties under subsection (b), the Director shall consult with the following:
(1) The Secretary of Education.
(2) The Director of the National Institute of Standards and Technology.
(3) The Federal Communications Commission.
(4) The Director of the National Science Foundation.
(5) The Federal Bureau of Investigation.
(6) State and local leaders, including, when appropriate, Governors, employees of State government departments and agencies, members of State legislatures and State boards of education, local educational agencies, State educational agencies, representatives of Indian tribes, teachers, principals, other school leaders, charter school leaders, specialized instructional support personnel, paraprofessionals, administrators, other staff, and parents.
(7) When determined appropriate by the Director, subject-matter experts and expert organizations, including nongovernmental organizations, vendors of school information technology products and services, cybersecurity insurance companies, and cybersecurity threat companies.