42 U.S.C. § 18935 — Dissemination of resources for research institutions

(a) Dissemination of resources for research institutions. (1) Within one year of August 9, 2022, using existing authority under subsections (c)(15) and (e)(1)(A)(ix) of section 272 of title 15, the Director must publish and make public tailored resources helping "qualifying institutions" identify, assess, manage, and reduce cybersecurity risk related to conducting research. (2) The Director must make sure these resources: (A) generally apply and work for a wide range of qualifying institutions; (B) vary with the nature and size of the institution, and the nature and sensitivity of the data on its systems or devices; (C) promote awareness of simple, basic controls, a workplace cybersecurity culture, and third-party stakeholder relationships, to help mitigate common risks; (D) include case studies, examples, and practical scenarios; (E) are outcomes-based and usable with a variety of commercial, off-the-shelf technologies; and (F) are based on international technical standards to the extent practical. (3) The Director must make sure these resources line up with the national cybersecurity awareness and education efforts under section 7443 of title 15. (4) The Director must periodically review and update these resources as the Director thinks appropriate. (5) Using these resources is voluntary. (b) Other Federal cybersecurity requirements. Nothing in this section may be read to replace, change, or otherwise affect any cybersecurity requirements that apply to federal agencies. (c) Definitions. (1) "Qualifying institutions" means colleges and universities awarded more than $50,000,000 per year in total federal research funding. (2) "Resources" means guidelines, tools, best practices, technical standards, methods, and other ways of providing information.