Alerts

Federal Law to Address Cybersecurity Risks for K-12 Educational Institutions

October 27, 2021

In response to a recent increase in cyber-crimes targeted at K-12 educational institutions, President Biden signed the K-12 Cybersecurity Act of 2021 (“Act”) into law on Oct. 8, 2021 to better protect the sensitive academic, medical and other personal data held by such institutions. The Act directs the Director of the Cybersecurity and Infrastructure Security Agency (“CISA”) to conduct a study on the cybersecurity risks that K-12 educational institutions face by Feb. 5, 2022, and, based on such study, promulgate cybersecurity guidelines for K-12 educational institutions and develop an online training toolkit designed to educate officials at K-12 educational institutions. The Act expressly provides that compliance by schools with the cybersecurity recommendations developed pursuant to the Act will be voluntary.

The Act provides that the CISA study must include the following:

An analysis of how cybersecurity risks specifically impact K-12 educational institutions;
An evaluation of the challenges that K-12 educational institutions face in securing sensitive or proprietary information; and
An evaluation of the most accessible ways to communicate cybersecurity recommendations and tools to K-12 educational institutions.

The Act also calls for the study to identify cybersecurity challenges relating to remote learning.

In terms of timing, the Director of CISA must promulgate the guidelines no later than 60 days after completion of the study, and the online training toolkit must be developed no later than 120 after the development of the guidelines. Until the guidelines and toolkit are developed, schools should continue to ensure that they follow best practices in protecting their data, including requiring that staff are educated on common cyber threats and how to mitigate the risk of such threats.

Authored by Mark E. Brossman, Edward H. Sadtler, Donna K. Lazarus and Victor Haas.

If you have any questions concerning this Alert, please contact your attorney at Schulte Roth & Zabel or one of the authors.

This communication is issued by Schulte Roth & Zabel LLP for informational purposes only and does not constitute legal advice or establish an attorney-client relationship. In some jurisdictions, this publication may be considered attorney advertising. ©2021 Schulte Roth & Zabel LLP.