§18935 Dissemination of Resources for Research Institutions

Summary

The Director must, within one year after August 9, 2022, put out and publish tailored resources to help certain colleges and universities find, check, manage, and lower cybersecurity risks for research. The resources must work for many kinds of schools and match each school’s size and the sensitivity of its data. They must teach basic controls and a security-minded workplace, cover third-party relationships, give case studies and examples, focus on real results that can be done with common commercial technology, and, when possible, follow international technical standards. The Director must use existing authority under federal law, keep the resources consistent with the Director’s other work under section 7443 of title 15, review and update them as needed, and make their use voluntary. Nothing here changes cybersecurity rules that apply to Federal agencies. Qualifying institutions: colleges and universities that get more than $50,000,000 per year in total Federal research funding. Resources: guidelines, tools, best practices, technical standards, methods, and other information materials.