K-12 Cybersecurity Act of 2021 (S. 1917)

Summary

Directs the federal government to study cyber threats to schools and create free, easy-to-use resources to help them stay safe online.

What problem does this solve?

Schools across the country are facing more cyber attacks, which puts the private information of students and staff at risk. This law requires the government to study these threats and give schools recommendations and tools to better protect their computer systems.

What does this law do?

Requires a study on school cybersecurity risks

Directs the Cybersecurity and Infrastructure Security Agency (CISA) to study the specific cyber risks that K-12 schools face, including challenges with remote learning.

Develops cybersecurity recommendations for schools

Requires CISA to use the study's findings to create a set of cybersecurity guidelines to help schools protect their computer systems and sensitive data.

Creates an online training toolkit

Tasks CISA with developing an online toolkit to teach school officials about the new cybersecurity recommendations and help them put the guidelines into practice.

Makes all resources publicly available

Ensures the study, recommendations, and online toolkit are posted on the Department of Homeland Security website for anyone to access.

Adoption of recommendations is voluntary

States that schools are not required to use the cybersecurity recommendations developed under this law; their use is completely voluntary.

Who does this affect?

K-12 educational institutions
Students
Teachers and school administrators

What is the real world impact?

•

Provides schools with expert guidance

Creates a central, reliable source of cybersecurity recommendations and tools for schools that may lack the resources or knowledge to develop their own protections.

•

Recommendations are not mandatory

Makes the use of the cybersecurity guidelines voluntary. Critics might argue this could limit the law's effectiveness, as schools are not required to adopt the new safety measures.

When does this start?

This law takes effect immediately and sets several deadlines for government action.

Cybersecurity study and briefing

Within 120 days of the law's enactment, a study on K-12 cybersecurity risks must be completed and Congress must be briefed on the findings.

Development of recommendations

Within 60 days after the study is finished, cybersecurity recommendations for schools must be developed.

Creation of online toolkit

Within 120 days after the recommendations are developed, an online training toolkit for school officials must be created.