I 
118TH CONGRESS 
1ST SESSION H. R. 2845 
To direct the Director of the Cybersecurity and Infrastructure Security Agen-
cy to establish a School Cybersecurity Improvement Program, and for 
other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 25, 2023 
Ms. MATSUI (for herself and Mr. NUNN of Iowa) introduced the following bill; 
which was referred to the Committee on Homeland Security, and in addi-
tion to the Committee on Education and the Workforce, for a period to 
be subsequently determined by the Speaker, in each case for consider-
ation of such provisions as fall within the jurisdiction of the committee 
concerned 
A BILL 
To direct the Director of the Cybersecurity and Infrastruc-
ture Security Agency to establish a School Cybersecurity 
Improvement Program, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may cited as the ‘‘Enhancing K–12 Cyberse-
curity Act’’. 
VerDate Sep 11 2014 
22:59 May 01, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS
SEC. 
2. 
SCHOOL 
CYBERSECURITY 
INFORMATION 
EX-
CHANGE. 
(a) ESTABLISHMENT.—The Director of the Cyberse-
curity and Infrastructure Security Agency shall enhance 
existing 
information 
exchange 
efforts 
implemented 
through partnerships with one or more information shar-
ing and analysis organizations to focus specific attention 
on the needs of K–12 organizations with regard to cyber-
security, including a new publicly accessible website (to be 
known as the ‘‘School Cybersecurity Information Ex-
change’’) to disseminate information, cybersecurity best 
practices, training, and lessons learned tailored to the spe-
cific needs, technical expertise, and resources available to 
K–12 organizations in accordance with subsection (b). 
(b) DUTIES.—In establishing the School Cybersecu-
rity Information Exchange under subsection (a), the Di-
rector shall— 
(1) engage appropriate Federal, State, local, 
and nongovernmental organizations to identify, pro-
mote, and disseminate information and best prac-
tices for local educational agencies, State educational 
agencies, and educational service agencies (as such 
terms are defined in section 8101 of the Elementary 
and Secondary Education Act of 1965 (20 U.S.C. 
7801)) with respect to cybersecurity, data protec-
VerDate Sep 11 2014 
01:30 May 02, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS
tion, remote learning security, and student online 
privacy; 
(2) maintain a database for an elementary 
school, secondary school, local educational agency, 
State educational agency, and educational service 
agency to identify cybersecurity security tools and 
services funded by the Federal Government, as well 
as tools and services recommended for purchase with 
State and local government funding; and 
(3) provide a searchable database for an ele-
mentary school, secondary school, local educational 
agency, State educational agency, and educational 
service agency to find and apply for funding oppor-
tunities to improve cybersecurity. 
(c) CONSULTATION.—In carrying out the duties 
under subsection (b), the Director shall consult with the 
following: 
(1) The Secretary of Education. 
(2) The Director of the National Institute of 
Standards and Technology. 
(3) The Federal Communication Commission. 
(4) The Director of the National Science Foun-
dation. 
(5) The Federal Bureau of Investigation. 
VerDate Sep 11 2014 
22:59 May 01, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS
(6) State and local leaders, including, when ap-
propriate, Governors, employees of State government 
departments and agencies, members of State legisla-
tures and State boards of education, local edu-
cational agencies, State educational agencies, rep-
resentatives of Indian tribes, teachers, principals, 
other school leaders, charter school leaders, special-
ized instructional support personnel, paraprofes-
sionals, administrators, other staff, and parents. 
(7) When determined appropriate by the Direc-
tor, subject-matter experts and expert organizations, 
including nongovernmental organizations, vendors of 
school information technology products and services, 
cybersecurity insurance companies, and cybersecu-
rity threat companies. 
SEC. 3. CYBERSECURITY INCIDENT REGISTRY. 
(a) IN GENERAL.—The Director of the Cybersecurity 
and Infrastructure Security Agency shall establish, 
through partnerships with one or more information shar-
ing and analysis organizations, a voluntary registry of in-
formation relating to cyber incidents affecting information 
technology systems owned or managed by a covered entity, 
and determine the scope of cyber incidents to be included 
in the registry and processes by which incidents can be 
reported for collection in the registry. 
VerDate Sep 11 2014 
22:59 May 01, 2023
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS
(b) USE.—Information in the registry established 
pursuant to subsection (a) may be used to— 
(1) improve data collection and coordination ac-
tivities related to the nationwide monitoring of the 
incidence and impact of cyber incidents affecting a 
covered entity; 
(2) conduct analyses regarding trends in cyber 
incidents against such entity; 
(3) develop systematic approaches to assist such 
entity in preventing and responding to cyber inci-
dents; 
(4) increase the awareness and preparedness of 
a covered entity regarding the cybersecurity of such 
covered entity; and 
(5) identify, prevent, or investigate cyber inci-
dents targeting a covered entity. 
(c) INFORMATION COLLECTION.—The Director of the 
Cybersecurity and Infrastructure Security Agency may 
collect information relating to cyber incidents to store in 
the registry established pursuant to subsection (a). Such 
information may be submitted by a covered entity and may 
include the following: 
(1) The dates of each cyber incident, including 
the dates on which each such incident was initially 
detected and the dates on which each such incident 
VerDate Sep 11 2014 
22:59 May 01, 2023
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS
was first publicly reported or disclosed to another 
entity. 
(2) A description of each cyber incident, which 
shall include whether each such incident was as a re-
sult of a breach, malware, distributed denial of serv-
ice attack, or other method designed to cause a vul-
nerability. 
(3) The effects of each cyber incident, including 
descriptions of the type and size of each such inci-
dent. 
(4) Other information determined relevant by 
the Director. 
(d) REPORT.—The Director of the Cybersecurity and 
Infrastructure Security Agency shall make available on 
the School Cybersecurity Information Exchange estab-
lished under section 2 an annual report relating to cyber 
incidents affecting elementary schools and secondary 
schools which includes data, and the analysis of such data, 
in a manner that— 
(1) is— 
(A) de-identified; and 
(B) presented in the aggregate; and 
(2) at a minimum, protects personal privacy to 
the extent required by applicable Federal and State 
privacy laws. 
VerDate Sep 11 2014 
22:59 May 01, 2023
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS
(e) COVERED ENTITY DEFINED.—In this section, the 
term ‘‘covered entity’’ means the following: 
(1) An elementary school. 
(2) A secondary school. 
(3) A local educational agency. 
(4) A State educational agency. 
(5) An educational service agency. 
SEC. 4. K–12 CYBERSECURITY TECHNOLOGY IMPROVEMENT 
PROGRAM. 
(a) ESTABLISHMENT.—The Director of the Cyberse-
curity and Infrastructure Security Agency, shall establish, 
through partnerships with one or more information shar-
ing and analysis organizations, a program (to be known 
as the ‘‘K–12 Cybersecurity Technology Improvement pro-
gram’’) to deploy cybersecurity capabilities to address cy-
bersecurity risks and threats to information systems of el-
ementary schools and secondary schools through— 
(1) developing cybersecurity strategies and in-
stallation of effective cybersecurity tools tailored for 
K–12 schools; 
(2) making available cybersecurity services that 
enhance the ability of K–12 schools to protect them-
selves from ransomware and other cybersecurity 
threats; and 
VerDate Sep 11 2014 
22:59 May 01, 2023
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS
(3) continuing training opportunities on cyber-
security threats, best practices, and relevant tech-
nologies for K–12 schools. 
(b) REPORT.—The Director of the Cybersecurity and 
Infrastructure Security Agency shall make available on 
the School Cybersecurity Information Exchange estab-
lished under section 2 an annual report relating to the 
impact of the K–12 Cybersecurity Technology Improve-
ment Program, including information on the cybersecurity 
capabilities made available to information technology sys-
tems owned or managed by elementary schools, secondary 
schools, local educational agencies, State educational 
agencies, and educational service agencies, the number of 
students served, and cybersecurity incidents identified or 
prevented. 
SEC. 5. AUTHORIZATION OF APPROPRIATIONS. 
There are authorized to be appropriated to carry out 
this Act $10,000,000 for each of fiscal years 2024 and 
2025. 
SEC. 6. DEFINITIONS. 
In this Act: 
(1) 
EDUCATIONAL
SERVICE
AGENCY.—The 
term ‘‘educational service agency’’ has the meaning 
given that term in section 8101 of the Elementary 
VerDate Sep 11 2014 
22:59 May 01, 2023
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS
and Secondary Education Act of 1965 (20 U.S.C. 
7801). 
(2) ELEMENTARY SCHOOL.—The term ‘‘elemen-
tary school’’ has the meaning given that term in sec-
tion 8101 of the Elementary and Secondary Edu-
cation Act of 1965 (20 U.S.C. 7801). 
(3) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘‘information sharing and 
analysis organization’’ has the meaning given that 
term in section 2200 of the Homeland Security Act 
of 2002 (6 U.S.C. 650). 
(4) LOCAL EDUCATIONAL AGENCY.—The term 
‘‘local educational agency’’ has the meaning given 
that term in section 8101 of the Elementary and 
Secondary Education Act of 1965 (20 U.S.C. 7801). 
(5) STATE EDUCATIONAL AGENCY.—The term 
‘‘State educational agency’’ has the meaning given 
that term in section 8101 of the Elementary and 
Secondary Education Act of 1965 (20 U.S.C. 7801). 
(6) SECONDARY
SCHOOL.—The term ‘‘sec-
ondary school’’ has the meaning given that term in 
section 8101 of the Elementary and Secondary Edu-
cation Act of 1965 (20 U.S.C. 7801). 
Æ 
VerDate Sep 11 2014 
22:59 May 01, 2023
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H2845.IH
H2845
kjohnson on DSK79L0C42PROD with BILLS