H.R. 9918: Enhancing K–12 Cybersecurity Act

This bill would direct the Cybersecurity and Infrastructure Security Agency (CISA) to create new programs and information resources focused on helping K–12 schools improve cybersecurity.

What the bill would create

• A public website called the School Cybersecurity Information Exchange, which would collect and share cybersecurity guidance tailored to schools.
• A voluntary cybersecurity incident registry for schools and related education agencies to report cyber incidents.
• A K–12 Cybersecurity Technology Improvement Program to help schools adopt cybersecurity tools, services, and training.

School Cybersecurity Information Exchange

CISA would be required to improve existing information-sharing efforts so they better serve elementary and secondary schools. The website would be used to share:

• cybersecurity best practices;
• training materials;
• lessons learned from cyber incidents;
• information on data protection, remote learning security, and student online privacy;
• a database of cybersecurity tools and services that are federally funded, plus tools and services recommended for purchase with state or local funds;
• a searchable database of funding opportunities that schools and education agencies can use to improve cybersecurity.

CISA would consult with the Department of Education, NIST, FCC, NSF, FBI, state and local officials, school staff, parents, tribes, and, when appropriate, outside experts and vendors.

Cybersecurity incident registry

The bill would direct CISA to set up a voluntary registry of cyber incidents affecting school-related IT systems. Schools and education agencies could submit information such as:

• when the incident happened and when it was detected or publicly disclosed;
• what kind of incident it was, such as a breach, malware, or distributed denial-of-service attack;
• the effects and size of the incident;
• other information CISA decides is relevant.

CISA could use this registry to track nationwide trends, improve coordination, develop prevention and response methods, increase awareness, and help identify or investigate cyber incidents. The bill says annual reports on school cyber incidents must be de-identified, aggregated, and protected to the extent required by privacy laws.

Cybersecurity technology improvement program

The bill would also create a program to help elementary and secondary schools deploy cybersecurity capabilities. That program would focus on:

• developing cybersecurity strategies for schools;
• installing cybersecurity tools tailored to K–12 needs;
• providing services to help schools defend against ransomware and other threats;
• offering ongoing training on cyber threats, best practices, and relevant technology.

CISA would have to publish an annual report on the program’s impact, including what cybersecurity capabilities were made available, how many students were served, and what incidents were identified or prevented.

Funding

The bill authorizes $10 million for each of fiscal years 2027 and 2028 to carry out these activities.

Relevant Companies

• CRWD — CrowdStrike provides cybersecurity products and services that schools or education agencies could purchase or learn about through the bill’s information and funding resources.
• PANW — Palo Alto Networks sells cybersecurity tools that could be used in K–12 environments and may be among vendors affected by increased school cybersecurity spending.
• FTNT — Fortinet offers network security products that could be used by school systems seeking cybersecurity improvements.
• CHKP — Check Point Software provides cybersecurity software that may be relevant to schools and education agencies adopting new protections.
• S — SentinelOne sells endpoint security tools that could be used by K–12 organizations as part of expanded cybersecurity efforts.
• OKTA — Okta provides identity and access management tools, which schools may use to protect accounts and online systems.
• MSFT — Microsoft offers widely used education and cybersecurity products that could be included in school cybersecurity planning and procurement.