,i  #aafth ,,congress  #b;d ,session    
,h4 ,r4 #giih  ,,in ,,the ,,house ,,of  
,,representatives  ,august #aa1         
#bjbj,mr4 ,barr 7for himself and ,mr4   
,lucas7 introduced the following bill2  
which was referred to the ,committee on 
,science1 ,space1 and ,technology  ,a   
,,bill  ,to require the ,director of the
 ,national ,institute of ,standards and 
,technology to disseminate guidance to  
institutions of higher education and    
nonprofit research institutions to help 
mitigate cybersecurity risks to         
,,covid-#ai related research1 and for   
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,,nist         
,,covid-#ai ,cybersecurity ,act4  #b4   
,definitions ,in this ,act3 7#a7        
,director ,the term ,director means the 
,director of the ,national ,institute of
 ,standards and ,technology4  7#b7      
,institution of higher education ,the   
term institution of higher education has
 the meaning given such term in section 
#aja of the ,higher ,education ,act of  

#aife 7#bj ,u4,s4,c4 #ajja74  7#c7      
,resources ,the term resources means    
guidelines1 tools1 best practices1      
standards1 methodologies1 and other ways
 of providing information4  7#d7        
,research institution ,the term research
 institution-- 7,a7 means a nonprofit   
institution 7as defined in section #d7e7
 of the ,stevenson-,wydler ,technology  
,innovation ,act of #aihj 7#ae ,u4,s4,c4
 #cgjc7e7772 and  7,b7 includes         
federally funded research and           
development centers1 as identified by   
the ,national ,science ,foundation in   
accordance with the ,federal            
,acquisition ,regulation issued in      
accordance with section #acjc7;a77#a7 of
 title #da 7or any successor            
regulation74  #c4 ,improving            
cybersecurity of institutions of higher 
education ,section #b7;e77#a77;,a7 of   
the ,national ,institute of ,standards  
and ,technology ,act 7#ae ,u4,s4,c4     
#bgb7;e77#a77;,a77 is amended-- 7#a7 in 
clause 7viii71 by striking and after the

 semicolon2  7#b7 by redesignating      
clause 7ix7 as clause 7x72 and  7#c7 by 
inserting after clause 7viii7 the       
following3  7ix7 consider institutions  
of higher education 7as defined in      
section #aja of the ,higher ,education  
,act of #aife 7#bj ,u4,s4,c4 #ajja772   
and  4  #d4 ,dissemination of resources 
for research institutions  7a7 ,in      
general ,not later than #ij days after  
the date of the enactment of this ,act1 
the ,director shall1 using the          
authorities of the ,director under      
subsections 7c77#ae7 and                
7e77#a77;,a77ix7 of section #b of the   
,national ,institute of ,standards and  
,technology ,act 7#ae ,u4,s4,c4 #bgb71  
as amended by section #c1 disseminate   
and make publicly available resources to
 help research institutions and         
institutions of higher education        
identify1 assess1 manage1 and reduce    
their cybersecurity risk related to     
conducting research with respect to     
,,covid-#ai4  7b7 ,requirements ,the    

,director shall ensure that the         
resources disseminated pursuant to      
subsection 7a7-- 7#a7 are generally     
applicable and usable by a wide range of
 research institutions and institutions 
of higher education2  7#b7 vary with the
 nature and size of the implementing    
research institutions or institutions of
 higher education1 and the nature and   
sensitivity of the data collected or    
stored on the information systems or    
devices of the implementing research    
institutions or institutions of higher  
education2  7#c7 include elements that  
promote awareness of simple1 basic      
controls1 a workplace cybersecurity     
culture1 and third-party stakeholder    
relationships1 to assist research       
institutions or institutions of higher  
education in mitigating common          
cybersecurity risks2  7#d7 include case 
studies of practical application2  7#e7 
are technology-neutral and can be       
implemented using technologies that are 
commercial and off-the-shelf2 and  7#f7 

to the extent practicable1 are based on 
international standards4  7c7 ,national 
cybersecurity awareness and education   
program ,the ,director shall ensure that
 the resources disseminated under       
subsection 7a7 are consistent with the  
efforts of the ,director under section  
#dja of the ,cybersecurity ,enhancement 
,act of #bjad 7#ae ,u4,s4,c4 #gdea74    
7d7 ,updates ,the ,director shall review
 periodically and update the resources  
under subsection 7a7 as the ,director   
determines appropriate4  7e7 ,voluntary 
resources ,the use of the resources     
disseminated under paragraph 7#a7 shall 
be considered voluntary4  7f7 ,other    
,federal ,cybersecurity ,requirements   
,nothing in this section may be         
construed to supersede1 alter1 or       
otherwise affect any cybersecurity      
requirements applicable to ,federal     
agencies4  7g7 ,funding ,this ,act shall
 be carried out using funds made        
available to the ,director4