k-12 cybersecurity information exchange

Summary#

This bill directs the director of the Cybersecurity and Infrastructure Security Agency (CISA) to set up a School Cybersecurity Information Exchange and a K‑12 Cybersecurity Technology Improvement Program. The main change is creating a public website, a voluntary incident registry, and a program to deliver cybersecurity tools, services, and training tailored to elementary and secondary schools and related education agencies. The stated goal is to help K–12 entities protect student data, remote learning, and school computer systems from cyber threats.

Key changes:

• Creates the School Cybersecurity Information Exchange, a public website with best practices, training, and a searchable database of federally funded or recommended cybersecurity tools and services.
• Sets up a voluntary Cybersecurity Incident Registry for schools to report cyber incidents; CISA will collect and analyze those reports and publish an annual, de‑identified, aggregate report.
• Establishes a K‑12 Cybersecurity Technology Improvement Program to develop strategies, deploy cybersecurity tools and services (including ransomware protection), and provide training for elementary and secondary schools.
• Requires CISA to consult with federal agencies, state and local education leaders, school staff, parents, and subject‑matter experts when building these resources.
• Authorizes $10 million per year for fiscal years 2027 and 2028 to carry out the law.

What it means for you#

• Schools, school districts, and state education agencies

  • Can use a new public website to find cybersecurity guidance, training, and recommended tools.
  • Will have access to a searchable list of federally funded cybersecurity tools and services and a searchable list of funding opportunities.
  • May opt into a voluntary incident registry to report cyber incidents and receive aggregated analyses and lessons learned.
  • Could be offered services, tools, and training through a CISA program aimed at reducing ransomware and other threats.

• School staff and IT teams

  • May find tailored training and best practices specific to K–12 environments.
  • Could receive technical support or tools through the program, depending on how CISA implements deployment.

• Parents and students

  • May benefit indirectly from improved protection of student data and online learning platforms.
  • Will not have personally identifiable incident data released; annual reports must be de‑identified and aggregated.

• Vendors and cybersecurity organizations

  • May be engaged as partners or listed in databases of tools and services.
  • May be asked to work with CISA and information sharing organizations to support schools.

• General public / taxpayers

  • The law creates a federal program and website intended to improve school cybersecurity. Direct local obligations are limited; participation in the incident registry is voluntary.

Expenses#

Estimated public cost: The bill authorizes $10,000,000 for each of fiscal years 2027 and 2028.

• Direct federal authorization: $10 million per year for two years to carry out the act.
• No further cost details: The bill does not provide a detailed fiscal note, breakdown of how the funds will be spent, or whether additional appropriations will be needed beyond the two years.
• Possible local costs: Schools may face small time or administrative costs if they choose to report incidents or apply for program services.
• Administrative costs: CISA will need staff and partnerships to run the website, incident registry, and technology program; the bill does not specify staffing or contracting details.

Proponents' View#

• The bill appears intended to centralize and tailor cybersecurity resources for K–12 schools, which may have limited technical staff.
• A possible argument for the bill is that a public, searchable hub and voluntary incident registry will help schools learn from each other and from federal analysis.
• Supporters may say the program could improve prevention, detection, and response to ransomware and other cyber threats by providing tools, services, and training specifically designed for schools.
• The authorized funding provides a federal commitment to begin building these resources.

Opponents' View#

• One concern is that the bill leaves many details to the CISA director, such as what incidents must be included, how schools get selected for services, and what specific tools will be deployed; this could limit clarity and consistent implementation.
• The registry is voluntary, so reported data may undercount incidents and produce an incomplete picture of school cyber risks.
• The authorized funding ($10 million per year for two years) may be small relative to nationwide K–12 cybersecurity needs; it is unclear whether this amount will be sufficient to make broad, lasting upgrades.
• There may be privacy and data‑handling questions even with de‑identification; the bill says reports must protect privacy to the extent required by law but leaves practical safeguards for CISA to define.
• The bill relies on partnerships with private organizations and vendors; it is unclear how conflicts of interest will be managed or how recommended tools will be vetted.