; (2) by redesignating clause (ix) as clause (x); and (3) by inserting after clause (viii) the following: (ix) consider institutions of higher education (as defined in section 101 of the Higher Education Act of 1965 ( 20 U.S.C. 1001 )); and . 4. Dissemination of resources for research institutions (a) In general Not later than 90 days after the date of the enactment of this Act, the Director shall, using the authorities of the Director under subsections (c)(15) and (e)(1)(A)(ix) of section 2 of the National Institute of Standards and Technology Act ( 15 U.S.C. 272 ), as amended by section 3, disseminate and make publicly available resources to help research institutions and institutions of higher education identify, assess, manage, and reduce their cybersecurity risk related to conducting research with respect to COVID–19. (b) Requirements The Director shall ensure that the resources disseminated pursuant to subsection (a)— (1) are generally applicable and usable by a wide range of research institutions and institutions of higher education; (2) vary with the nature and size of the implementing research institutions or institutions of higher education, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing research institutions or institutions of higher education; (3) include elements that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third-party stakeholder relationships, to assist research institutions or institutions of higher education in mitigating common cybersecurity risks; (4) include case studies of practical application; (5) are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf