Section 1 Short title
This Act may cited as the “Enhancing K–12 Cybersecurity Act”.
Enhancing K–12 Cybersecurity Act
A BILL
To direct the Director of the Cybersecurity and Infrastructure Security Agency to establish a School Cybersecurity Clearinghouse, and for other purposes.
Sec. 2 School cybersecurity clearinghouse
Establishment— The Director of the Cybersecurity and Infrastructure Security Agency shall establish a publicly accessible website (to be known as the “School Cybersecurity Clearinghouse”) to disseminate information, best practices, and grant opportunities in accordance with subsection (b) and section 2(e).
Duties— In establishing the School Cybersecurity Clearinghouse under subsection (a), the Secretary shall—
engage appropriate Federal, State, local, and nongovernmental organizations to identify, promote, and disseminate information and best practices for local educational agencies (as defined in section 101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 8101)) with respect to cybersecurity, data protection, remote learning security, and student online privacy; and
maintain a searchable database for an elementary school, secondary school, local educational agency, State educational agency, and educational service agency to find and apply for funding opportunities (including the opportunity provided under section 3) to improve cybersecurity.
Consultation— In carrying out the duties under subsection (b), the Secretary shall consult with the following:
The Secretary of Education.
The Director of the National Institute of Standards and Technology.
The Federal Communication Commission.
The Director of the National Science Foundation.
The Federal Bureau of Investigation.
State and local leaders, including, when appropriate, Governors, members of State legislatures and State boards of education, local educational agencies, representatives of Indian tribes, teachers, principals, other school leaders, charter school leaders, specialized instructional support personnel, paraprofessionals, administrators, other staff, and parents.
Sec. 3 Cybersecurity registry
In general— The Director of the Cybersecurity and Infrastructure Security Agency shall establish a voluntary registry of information relating to cyber attacks on elementary schools and secondary schools.
Use— Information in the registry established pursuant to subsection (a) may be used to—
improve data collection and coordination activities related to the nationwide monitoring of the incidence and financial impact of cyber attacks on elementary schools and secondary schools;
conduct analyses regarding trends in cyber attacks against such schools;
develop systematic approaches to assist such schools in preventing and responding to cyber attacks;
increase the awareness and preparedness of elementary school and secondary school administrators regarding the cybersecurity of such schools; and
identify, prevent, or investigate cyber attacks on elementary schools and secondary schools.
Information collection— The Director of the Cybersecurity and Infrastructure Security Agency may collect information relating to cyber attacks on schools to store in the registry established pursuant to subsection (a). Such information may be submitted by schools and may include the following:
The dates of each cyber attack, including the dates on which each such attack was initially detected and the dates on which each such attack was first reported.
A description of each cyber attack which shall include whether each such attack was as a result of a breach, malware, distributed denial of service attack, or other method designed to cause a vulnerability.
The effects of each cyber attack, including descriptions of the type and size of each such attack.
Other information determined relevant by the Secretary.
Access— The Director of the Cybersecurity and Infrastructure Security Agency may make information submitted to the registry established pursuant to subsection (a) available to relevant law enforcement agencies, and State and local government agencies, as determined appropriate, for the purpose identified in subsection (b)(5).
Report— The Director of the Cybersecurity and Infrastructure Security Agency shall make available on the School Cybersecurity Clearinghouse established under section 1, an annual report relating to cyber attacks on elementary schools and secondary schools which includes data, and the analysis of such data, in a manner that—
is—
de-identified; and
presented in the aggregate; and
at a minimum, protects personal privacy to the extent required by applicable Federal and State privacy laws.
Sec. 4 K–12 Cybersecurity Human Capacity grant program
Establishment— The Director of the National Science Foundation, acting through the Director of the Office of Advanced Cyberinfrastructure, shall establish a program (to be known as the “K–12 Cybersecurity Human Capacity grant program”) to make grants available to eligible entities to address cybersecurity risks and threats to information systems of elementary schools and secondary schools through—
expanded workforce capacity and development; and
improved network and cyberinfrastructure.
Applications— An eligible entity applying for a grant under the program shall submit to the Director a proposal that includes the following:
A description of how the proposed cybersecurity capacity improvements will be conceived, designed, and implemented to meet local needs. Such description shall take the form of a coherent cybersecurity strategy and approach for a school, district, or region such that such strategy and approach are integrated horizontally (intra-school, district, or region) and vertically (regionally and nationally) with cybersecurity investments and best practices.
A plan for increasing the ability of educational leaders to prevent, recognize, and address cybersecurity threats.
An assessment of the sustainability of the activities under such proposal in light of any recurring operational and engineering costs associated with such activities.
A plan to address the relevant cybersecurity issues and challenges implicated by the activities under such plan which includes issues or challenges pertaining to data integrity, privacy, network security measures, federated access and identity management, and infrastructure monitoring.
Federal share— The Director shall provide grants to eligible entities in an amount not to exceed 80 percent of the total cost of the plan.
Selection— In selecting recipients for grants under this section, the Director shall consider, and give preference to the extent practicable, the percentage of—
students in the eligible entity’s jurisdiction eligible to receive free or reduced price lunch under the Richard B. Russell National School Lunch Act (42 U.S.C. 1751 et seq.); or
household units in the eligible entity’s jurisdiction receiving non-cash benefits under the supplemental nutrition assistance program under the Food and Nutrition Act of 2008.
Authorization of appropriations— There are authorized to be appropriated for grants under this section $400,000,000 for fiscal year 2020, to remain available through fiscal year 2021.
Sec. 5 Definitions
In this Act:
Educational service agency— The term educational service agency has the meaning given that term in section 8101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 7801).
Elementary school— The term elementary school has the meaning given that term in section 8101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 7801).
Eligible entities— The term eligible entities means—
an elementary school;
a secondary school;
a local educational agency;
a State educational agency;
an educational service agency; and
any combination of the entities listed in subparagraph consortia of such entities.
Local educational agency— The term local educational agency has the meaning given that term in section 8101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 7801).
State educational agency— The term State educational agency has the meaning given that term in section 8101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 7801).
Secondary school— The term secondary school has the meaning given that term in section 8101 of the Elementary and Secondary Education Act of 1965 (20 U.S.C. 7801).