1. Short title This Act may be cited as the K–12 Cybersecurity Act of 2019 . 2. Findings Congress finds the following: (1) K–12 educational institutions across the United States are facing cyber attacks. (2) Cyber attacks place the information systems of K–12 educational institutions at risk of possible disclosure of sensitive student and employee information, including— (A) grades and information on scholastic development; (B) medical records; (C) family records; and (D) personally identifiable information. (3) Providing K–12 educational institutions with resources to aid cybersecurity efforts will help K–12 educational institutions prevent, detect, and respond to cyber events. 3. K–12 education cybersecurity initiative (a) Definitions In this section: (1) Cybersecurity risk The term cybersecurity risk has the meaning given that term in section 2209 of the Homeland Security Act of 2002 ( 6 U.S.C. 659 ). (2) Director The term Director means the Director of Cybersecurity and Infrastructure Security. (3) Information system The term information system has the meaning given that term in section 3502 of title 44, United States Code. (4) K–12 educational institution The term K–12 educational institution means an elementary school or a secondary school, as defined in section 8101 of the Elementary and Secondary Education Act of 1965 ( 20 U.S.C. 7801 ). (b) Study (1) In general Not later than 1 year after the date of enactment of this Act, the Director, in accordance with subsection (f), shall conduct a study on the cybersecurity risks facing K–12 educational institutions, including the challenges K–12 educational institutions face in securing— (A) information systems owned, leased, or relied upon by K–12 educational institutions