#aagth ,,congress  #ast ,session  ,s4   
#aiag  ,,an ,,act  ,to establish a      
,k-#ab education cybersecurity          
initiative1 and for other purposes4  #a4
 ,short title ,this ,act may be cited as
 the ,k-#ab ,cybersecurity ,act of      
#bjba4  #b4 ,findings ,congress finds   
the following3 7#a7 ,k-#ab educational  
institutions across the ,united ,states 
are facing cyber attacks4  7#b7 ,cyber  
attacks place the information systems of
 ,k-#ab educational institutions at risk
 of possible disclosure of sensitive    
student and employee information1       
including-- 7,a7 grades and information 
on scholastic development2  7,b7 medical
 records2  7,c7 family records2 and     
7,d7 personally identifiable            
information4  7#c7 ,providing ,k-#ab    
educational institutions with resources 
to aid cybersecurity efforts will help  
,k-#ab educational institutions prevent1
 detect1 and respond to cyber events4   
#c4 ,k-#ab education cybersecurity      
initiative  7a7 ,definitions ,in this   

section3 7#a7 ,cybersecurity risk ,the  
term cybersecurity risk has the meaning 
given the term in section #bbji of the  
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #fei74  7#b7 ,director ,the   
term ,director means the ,director of   
,cybersecurity and ,infrastructure      
,security4  7#c7 ,information system    
,the term information system has the    
meaning given the term in section #cejb 
of title #dd1 ,united ,states ,code4    
7#d7 ,k-#ab educational institution ,the
 term ,k-#ab educational institution    
means an elementary school or a         
secondary school1 as those terms are    
defined in section #haja of the         
,elementary and ,secondary ,education   
,act of #aife 7#bj ,u4,s4,c4 #ghja74    
7b7 ,study  7#a7 ,in general ,not later 
than #abj days after the date of        
enactment of this ,act1 the ,director1  
in accordance with subsection 7g77#a71  
shall conduct a study on the specific   
cybersecurity risks facing ,k-#ab       
educational institutions that-- 7,a7    

analyzes how identified cybersecurity   
risks specifically impact ,k-#ab        
educational institutions2  7,b7 includes
 an evaluation of the challenges ,k-#ab 
educational institutions face in-- 7i7  
securing-- 7,i7 information systems     
owned1 leased1 or relied upon by ,k-#ab 
educational institutions2 and  7,,ii7   
sensitive student and employee records2 
and  7ii7 implementing cybersecurity    
protocols2  7,c7 identifies             
cybersecurity challenges relating to    
remote learning2 and  7,d7 evaluates the
 most accessible ways to communicate    
cybersecurity recommendations and tools4
  7#b7 ,congressional briefing ,not     
later than #abj days after the date of  
enactment of this ,act1 the ,director   
shall provide a ,congressional briefing 
on the study conducted under paragraph  
7#a74  7c7 ,cybersecurity               
,recommendations ,not later than #fj    
days after the completion of the study  
required under subsection 7b77#a71 the  
,director1 in accordance with subsection

 7g77#a71 shall develop recommendations 
that include cybersecurity guidelines   
designed to assist ,k-#ab educational   
institutions in facing the cybersecurity
 risks described in subsection 7b77#a71 
using the findings of the study4  7d7   
,online training toolkit ,not later than
 #abj days after the completion of the  
development of the recommendations      
required under subsection 7c71 the      
,director shall develop an online       
training toolkit designed for officials 
at ,k-#ab educational institutions to-- 
7#a7 educate the officials about the    
cybersecurity recommendations developed 
under subsection 7c72 and  7#b7 provide 
strategies for the officials to         
implement the recommendations developed 
under subsection 7c74  7e7 ,public      
availability ,the ,director shall make  
available on the website of the         
,department of ,homeland ,security with 
other information relating to school    
safety the following3 7#a7 ,the findings
 of the study conducted under subsection

 7b77#a74  7#b7 ,the cybersecurity      
recommendations developed under         
subsection 7c74  7#c7 ,the online       
training toolkit developed under        
subsection 7d74  7f7 ,voluntary use ,the
 use of the cybersecurity               
recommendations developed under 7c7 by  
,k-#ab educational institutions shall be
 voluntary4  7g7 ,consultation  7#a7 ,in
 general ,in the course of the          
conduction of the study required under  
subsection 7b77#a7 and the development  
of the recommendations required under   
subsection 7c71 the ,director shall     
consult with individuals and entities   
focused on cybersecurity and education1 
as appropriate1 including-- 7,a7        
teachers2  7,b7 school administrators2  
7,c7 ,federal agencies2  7,d7           
non-,federal cybersecurity entities with
 experience in education issues2 and    
7,e7 private sector organizations4  7#b7
 ,inapplicability of ,,faca ,the        
,federal ,advisory ,committee ,act 7#e  
,u4,s4,c ,app47 shall not apply to any  

consultation under paragraph 7#a74      
,passed the ,senate ,august #i1         
#bjba4,secretary