K–12 Cybersecurity Act of 2019

II 116TH CONGRESS 1ST SESSION S. 3033 To establish a K–12 education cybersecurity initiative, and for other purposes. IN THE SENATE OF THE UNITED STATES DECEMBER 12, 2019 Mr. PETERS (for himself and Mr. SCOTT of Florida) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To establish a K–12 education cybersecurity initiative, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘K–12 Cybersecurity 4 Act of 2019’’. 5 SEC. 2. FINDINGS. 6 Congress finds the following: 7 (1) K–12 educational institutions across the 8 United States are facing cyber attacks. 9 VerDate Sep 11 2014 03:56 Dec 14, 2019 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S3033.IS S3033 kjohnson on DSK79L0C42 with BILLS 2 •S 3033 IS (2) Cyber attacks place the information systems 1 of K–12 educational institutions at risk of possible 2 disclosure of sensitive student and employee infor- 3 mation, including— 4 (A) grades and information on scholastic 5 development; 6 (B) medical records; 7 (C) family records; and 8 (D) personally identifiable information. 9 (3) Providing K–12 educational institutions 10 with resources to aid cybersecurity efforts will help 11 K–12 educational institutions prevent, detect, and 12 respond to cyber events. 13 SEC. 3. K–12 EDUCATION CYBERSECURITY INITIATIVE. 14 (a) DEFINITIONS.—In this section: 15 (1) CYBERSECURITY RISK.—The term ‘‘cyberse- 16 curity risk’’ has the meaning given that term in sec- 17 tion 2209 of the Homeland Security Act of 2002 (6 18 U.S.C. 659). 19 (2) DIRECTOR.—The term ‘‘Director’’ means 20 the Director of Cybersecurity and Infrastructure Se- 21 curity. 22 (3) INFORMATION SYSTEM.—The term ‘‘infor- 23 mation system’’ has the meaning given that term in 24 section 3502 of title 44, United States Code. 25 VerDate Sep 11 2014 03:56 Dec 14, 2019 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S3033.IS S3033 kjohnson on DSK79L0C42 with BILLS 3 •S 3033 IS (4) K–12 EDUCATIONAL INSTITUTION.—The 1 term ‘‘K–12 educational institution’’ means an ele- 2 mentary school or a secondary school, as defined in 3 section 8101 of the Elementary and Secondary Edu- 4 cation Act of 1965 (20 U.S.C. 7801). 5 (b) STUDY.— 6 (1) IN GENERAL.—Not later than 1 year after 7 the date of enactment of this Act, the Director, in 8 accordance with subsection (f), shall conduct a study 9 on the cybersecurity risks facing K–12 educational 10 institutions, including the challenges K–12 edu- 11 cational institutions face in securing— 12 (A) information systems owned, leased, or 13 relied upon by K–12 educational institutions; 14 and 15 (B) sensitive student and employee re- 16 cords. 17 (2) CONGRESSIONAL BRIEFING.—Not later than 18 1 year after the enactment of this Act, the Director 19 shall provide a Congressional briefing on the study 20 required under paragraph (1). 21 (c) CYBERSECURITY RECOMMENDATIONS.— 22 (1) IN GENERAL.—Not later than 270 days 23 after the completion of the study required under 24 subsection (b)(1), the Director, in accordance with 25 VerDate Sep 11 2014 03:56 Dec 14, 2019 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S3033.IS S3033 kjohnson on DSK79L0C42 with BILLS 4 •S 3033 IS subsection (f), shall develop recommendations that 1 include cybersecurity guidelines designed to assist 2 K–12 educational institutions in facing the cyberse- 3 curity risks described in subsection (b)(1), using the 4 findings of the study. 5 (2) VOLUNTARY USE.—The use of the cyberse- 6 curity recommendations developed under paragraph 7 (1) by K–12 educational institutions shall be vol- 8 untary. 9 (d) ONLINE TRAINING TOOLKIT.—Not later than 90 10 days after the completion of the development of the rec- 11 ommendations required under subsection (c)(1), the Di- 12 rector shall develop an online training toolkit designed for 13 officials at K–12 educational institutions to— 14 (1) educate the officials about the cybersecurity 15 recommendations developed under subsection (c)(1); 16 and 17 (2) provide strategies for the officials to imple- 18 ment the recommendations developed under sub- 19 section (c)(1). 20 (e) PUBLIC AVAILABILITY.—The Director shall make 21 available on the website of the Department of Homeland 22 Security with other information relating to school safety 23 the following: 24 VerDate Sep 11 2014 03:56 Dec 14, 2019 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S3033.IS S3033 kjohnson on DSK79L0C42 with BILLS 5 •S 3033 IS (1) The findings of the study conducted under 1 subsection (b)(1). 2 (2) The cybersecurity guidelines developed 3 under subsection (c)(1). 4 (3) The online training toolkit developed under 5 subsection (d). 6 (f) CONSULTATION.—In the course of the conduction 7 of the study required under subsection (b)(1) and the de- 8 velopment of the guidelines required under subsection 9 (c)(1), the Director shall consult with entities focused on 10 cybersecurity and education, including appropriate— 11 (1) Federal agencies; and 12 (2) private sector organizations. 13 Æ VerDate Sep 11 2014 03:56 Dec 14, 2019 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\S3033.IS S3033 kjohnson on DSK79L0C42 with BILLS