Sponsors (2)
The bill strengthens K–12 cybersecurity by centralizing guidance, data-driven incident support, training, and modest federal funding—improving protection for many schools while raising privacy risks, taxpayer costs, and the possibility of uneven benefits and local dependency.
K–12 schools, teachers, and students will gain stronger, more tailored cybersecurity protections (best practices, tools, and incident guidance) that reduce the risk and disruption of ransomware and other attacks.
Smaller and resource-constrained school districts and their students will get access to cybersecurity services, training, and resources they otherwise could not afford, reducing disparities in school cyber defenses.
Teachers and school IT staff will receive ongoing training and aggregated incident reporting to help prioritize defenses and improve incident detection and response at the local level.
Students, teachers, and schools face heightened privacy and security risks because collecting, aggregating, and storing incident data (even de-identified) creates new federal data holdings that could be misapplied or breached.
Smaller, rural, or resource-limited districts may be unable to implement recommended tools or meaningfully participate in incident reporting, producing uneven cybersecurity improvements and incomplete national-level findings.
Taxpayers face increased federal spending and ongoing maintenance costs (authorized $20 million over two years plus program and database upkeep), which could add to budget pressures if not offset.
Based on analysis of 6 sections of legislative text.
Creates a CISA‑run School Cybersecurity Information Exchange, voluntary incident registry, and improvement program and authorizes $10M per year for 2027–28.
Official title: To direct the Director of the Cybersecurity and Infrastructure Security Agency to establish a School Cybersecurity Improvement Program, and for other purposes.
Introduced July 23, 2026 by Doris Matsui · Last progress July 23, 2026
Creates a CISA-run School Cybersecurity Information Exchange and a voluntary incident registry for elementary and secondary schools, local and state education agencies, and education service agencies. It also establishes a K–12 Cybersecurity Technology Improvement Program to deploy tools, services, and training to help schools prevent and respond to ransomware and other cyber threats. Authorizes $10 million per year for fiscal years 2027 and 2028 to carry out the program and requires annual, de‑identified reporting on trends, services provided, and program impacts. The law relies on partnerships with federal agencies, state and local leaders, information sharing organizations, vendors, and subject-matter experts.