IB 
Union Calendar No. 87 
117TH CONGRESS 
1ST SESSION H. R. 4691 
[Report No. 117–122] 
To establish a K–12 education cybersecurity initiative, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 26, 2021 
Mr. LANGEVIN (for himself, Ms. MATSUI, Ms. SLOTKIN, Mr. GARBARINO, and 
Mr. CLYDE) introduced the following bill; which was referred to the Com-
mittee on Homeland Security 
SEPTEMBER 14, 2021 
Reported from the Committee on Homeland Security; committed to the Com-
mittee of the Whole House on the State of the Union and ordered to be 
printed 
VerDate Sep 11 2014 
00:03 Sep 15, 2021
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H4691.RH
H4691
kjohnson on DSK79L0C42PROD with BILLS
A BILL 
To establish a K–12 education cybersecurity initiative, and 
for other purposes. 
VerDate Sep 11 2014 
00:03 Sep 15, 2021
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H4691.RH
H4691
kjohnson on DSK79L0C42PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘K–12 Cybersecurity 
Act of 2021’’. 
SEC. 2. FINDINGS. 
Congress finds the following: 
(1) K–12 educational institutions across the 
United States are facing cyber attacks. 
(2) Cyber attacks place the information systems 
of K–12 educational institutions at risk of possible 
disclosure of sensitive student and employee infor-
mation, including— 
(A) grades and information on scholastic 
development; 
(B) medical records; 
(C) family records; and 
(D) personally identifiable information. 
(3) Providing K–12 educational institutions 
with resources to aid cybersecurity efforts will help 
K–12 educational institutions prevent, detect, and 
respond to cyber events. 
SEC. 3. K–12 EDUCATION CYBERSECURITY INITIATIVE. 
(a) DEFINITIONS.—In this section: 
VerDate Sep 11 2014 
00:03 Sep 15, 2021
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4691.RH
H4691
kjohnson on DSK79L0C42PROD with BILLS
(1) CYBERSECURITY RISK.—The term ‘‘cyberse-
curity risk’’ has the meaning given the term in sec-
tion 2209 of the Homeland Security Act of 2002 (6 
U.S.C. 659). 
(2) DIRECTOR.—The term ‘‘Director’’ means 
the Director of Cybersecurity and Infrastructure Se-
curity. 
(3) INFORMATION SYSTEM.—The term ‘‘infor-
mation system’’ has the meaning given the term in 
section 3502 of title 44, United States Code. 
(4) K–12 EDUCATIONAL
INSTITUTION.—The 
term ‘‘K–12 educational institution’’ means an ele-
mentary school or a secondary school, as those terms 
are defined in section 8101 of the Elementary and 
Secondary Education Act of 1965 (20 U.S.C. 7801). 
(b) STUDY.— 
(1) IN
GENERAL.—Not later than 120 days 
after the date of enactment of this Act, the Director, 
in accordance with subsection (g)(1), shall conduct 
a study on the specific cybersecurity risks facing K– 
12 educational institutions that— 
(A) analyzes how identified cybersecurity 
risks specifically impact K–12 educational insti-
tutions; 
VerDate Sep 11 2014 
00:03 Sep 15, 2021
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4691.RH
H4691
kjohnson on DSK79L0C42PROD with BILLS
(B) includes an evaluation of the chal-
lenges K–12 educational institutions face in— 
(i) securing— 
(I) information systems owned, 
leased, or relied upon by K–12 edu-
cational institutions; and 
(II) sensitive student and em-
ployee records; and 
(ii) implementing cybersecurity proto-
cols; 
(C) identifies cybersecurity challenges re-
lating to remote learning; and 
(D) evaluates the most accessible ways to 
communicate cybersecurity recommendations 
and tools. 
(2) CONGRESSIONAL BRIEFING.—Not later than 
120 days after the date of enactment of this Act, the 
Director shall provide a congressional briefing on the 
study conducted under paragraph (1). 
(c) CYBERSECURITY RECOMMENDATIONS.—Not later 
than 60 days after the completion of the study required 
under subsection (b)(1), the Director, in accordance with 
subsection (g)(1), shall develop recommendations that in-
clude cybersecurity guidelines designed to assist K–12 
educational institutions in facing the cybersecurity risks 
VerDate Sep 11 2014 
00:03 Sep 15, 2021
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4691.RH
H4691
kjohnson on DSK79L0C42PROD with BILLS
described in subsection (b)(1), using the findings of the 
study. 
(d) ONLINE TRAINING TOOLKIT.—Not later than 
120 days after the completion of the development of the 
recommendations required under subsection (c), the Direc-
tor shall develop an online training toolkit designed for 
officials at K–12 educational institutions to— 
(1) educate the officials about the cybersecurity 
recommendations developed under subsection (c); 
and 
(2) provide strategies for the officials to imple-
ment the recommendations developed under sub-
section (c). 
(e) PUBLIC AVAILABILITY.—The Director shall make 
available on the website of the Department of Homeland 
Security with other information relating to school safety 
the following: 
(1) The findings of the study conducted under 
subsection (b)(1). 
(2) The cybersecurity recommendations devel-
oped under subsection (c). 
(3) The online training toolkit developed under 
subsection (d). 
VerDate Sep 11 2014 
00:03 Sep 15, 2021
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4691.RH
H4691
kjohnson on DSK79L0C42PROD with BILLS
(f) VOLUNTARY USE.—The use of the cybersecurity 
recommendations developed under (c) by K–12 edu-
cational institutions shall be voluntary. 
(g) CONSULTATION.— 
(1) IN GENERAL.—In the course of the conduc-
tion of the study required under subsection (b)(1) 
and the development of the recommendations re-
quired under subsection (c), the Director shall con-
sult with individuals and entities focused on cyberse-
curity and education, as appropriate, including— 
(A) teachers; 
(B) school administrators; 
(C) Federal agencies; 
(D) non-Federal cybersecurity entities with 
experience in education issues; and 
(E) private sector organizations. 
(2) INAPPLICABILITY OF FACA.—The Federal 
Advisory Committee Act (5 U.S.C App.) shall not 
apply to any consultation under paragraph (1). 
VerDate Sep 11 2014 
00:03 Sep 15, 2021
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4691.RH
H4691
kjohnson on DSK79L0C42PROD with BILLS
Union Calendar No. 87 
117TH CONGRESS 
1ST SESSION 
H. R. 4691 
[Report No. 117–122] 
A BILL 
To establish a K–12 education cybersecurity 
initiative, and for other purposes. 
SEPTEMBER 14, 2021 
Committed to the Committee of the Whole House on the 
State of the Union and ordered to be printed 
VerDate Sep 11 2014 
00:03 Sep 15, 2021
Jkt 019200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\H4691.RH
H4691
kjohnson on DSK79L0C42PROD with BILLS