§18935 Dissemination of Resources for Research Institutions

Summary

The Director must, no later than one year after August 9, 2022, publish and share public resources to help qualifying institutions find, assess, manage, and reduce cybersecurity risks in research. The materials must work for many kinds of institutions; adjust for an institution’s size and how sensitive its data is; teach simple controls, a workplace cybersecurity culture, and safe third‑party relationships; include case studies and examples; focus on outcomes and work with common commercial technologies; and, when practical, follow international technical standards. The resources must match the Director’s national cybersecurity awareness and education efforts under section 7443 of title 15 and must be reviewed and updated periodically. Using the resources is voluntary and does not change cybersecurity rules that apply to Federal agencies. Qualifying institutions: colleges or universities that get more than $50,000,000 a year in Federal research funding. Resources: guidelines, tools, best practices, technical standards, methods, and other information.