§18935 Dissemination of resources for research institutions

Summary

Not later than one year after August 9, 2022, the Director must publish and share tailored resources to help qualifying colleges and universities find, assess, manage, and reduce cybersecurity risks tied to research. The materials must work for many types of institutions, scale by institution size and the sensitivity of their data, teach simple controls, workplace cybersecurity habits, and how to handle third parties, include real case studies and examples, focus on outcomes and work with commercial off‑the‑shelf technology, and, when practical, follow international technical standards. The resources must align with the Director’s work under section 7443 of title 15, be reviewed and updated periodically, and their use is voluntary. Nothing here changes or overrides cybersecurity rules that apply to Federal agencies. Qualifying institutions means institutions of higher education that get more than $50,000,000 per year in total Federal research funding. Resources means guides, tools, best practices, technical standards, methods, and other ways of providing information.