S. 5098 — Enhancing K–12 Cybersecurity Act

This section defines terms for the Act, including "covered entity" as an elementary school, secondary school, local educational agency, State educational agency, or educational service agency; "Director" as the Director of the Cybersecurity and Infrastructure Security Agency; and "Information Exchange" as the School Cybersecurity Information Exchange established under section 3(a).

This section establishes the School Cybersecurity Information Exchange, a publicly accessible website to disseminate cybersecurity best practices, training, and lessons learned for elementary and secondary schools, local educational agencies, and educational service agencies. It requires the Director to maintain databases identifying federally funded cybersecurity tools and available funding opportunities, and to consult with the Secretary of Education, NIST, FCC, NSF, FBI, and specified state, local, and nongovernmental stakeholders.

This section establishes a voluntary registry, through partnerships with Information Sharing and Analysis Organizations, of cyber incidents affecting information technology systems of covered entities. It authorizes collection of incident details including dates, descriptions, and effects; permits use of registry data for nationwide monitoring, trend analysis, prevention assistance, awareness, and investigations; and requires an annual de-identified aggregate report on incidents affecting elementary and secondary schools.

This section establishes the K–12 Cybersecurity Technology Improvement Program to deploy cybersecurity capabilities to elementary and secondary schools through partnerships with Information Sharing and Analysis Organizations. The program develops tailored strategies and tools, provides services to protect against ransomware and other threats, and offers training on cybersecurity threats and best practices. The Director must publish an annual report on the program’s impact, including capabilities made available, students served, and incidents identified or prevented.