,i  #aaeth ,,congress  #ast ,session    
,h4 ,r4 #cjaj  ,,in ,,the ,,house ,,of  
,,representatives  ,june #bb1 #bjag,ms4 
,eshoo 7for herself and ,mrs4 ,brooks of
 ,indiana7 introduced the following     
bill2 which was referred to the         
,committee on ,science1 ,space1 and     
,technology  ,a ,,bill  ,to provide for 
the identification and documentation of 
best practices for cyber hygiene by the 
,national ,institute of ,standards and  
,technology1 and for other purposes4    
#a4 ,short title ,this ,act may be cited
 as the ,promoting ,good ,cyber ,hygiene
 ,act of #bjag4  #b4 ,cyber hygiene best
 practices  7a7 ,establishment ,not     
later than #a year after the date of    
enactment of this ,act1 the ,national   
,institute of ,standards and            
,technology1 in consultation with the   
,federal ,trade ,commission and the     
,department of ,homeland ,security1     
after notice and an opportunity for     
public comment1 shall establish a list  
of best practices for effective and     

usable cyber hygiene for use by the     
,federal ,government1 the private       
sector1 and any individual or           
organization utilizing an information   
system or device4 ,such list shall--    
7#a7 be a list of simple1 basic controls
 that have the most impact in defending 
against common cybersecurity threats and
 risks2  7#b7 utilize technologies that 
are commercial off-the-shelf and based  
on international standards2 and  7#c7 to
 the degree practicable1 be based on and
 consistent with the ,cybersecurity     
,framework contained in ,executive      
,order #acfcf1 entitled ,improving      
,critical ,infrastructure               
,cybersecurity1 issued in ,february     
#bjac1 or any successor framework4  7b7 
,voluntary practices ,the best practices
 on the list established under this     
section shall be considered voluntary   
and are not intended to be construed as 
a list of mandatory actions4  7c7       
,baseline ,the best practices on the    
list established under this section are 

intended as a baseline for the ,federal 
,government1 the private sector1 and any
 individual or organization utilizing an
 information system or device4 ,such    
entities are encouraged to use and      
improve on those best practices4  7d7   
,updates ,the ,national ,institute of   
,standards and ,technology shall review 
and update the list of best practices   
established under this section on an    
annual basis4  7e7 ,public availability 
,the list of best practices established 
under this section shall be published in
 a clear and concise format and made    
available prominently on the public     
websites of the ,federal ,trade         
,commission and the ,small ,business    
,administration4  7f7 ,other federal    
cybersecurity requirements ,nothing in  
this section shall be construed to      
supersede1 alter1 or otherwise affect   
any cybersecurity requirements          
applicable to ,federal agencies4  7g7   
,considerations ,in carrying out        
subsection 7a71 the agencies shall      

consider the benefits1 as they pertain  
to cyber hygiene1 of emerging           
technologies and processes that provide 
enhanced security protections1 including
 multi-factor authentication1 data loss 
prevention1 micro-segmentation1 data    
encryption1 cloud services1             
anonymization1 software patching and    
maintenance1 phishing education1 and    
other standard cybersecurity measures to
 achieve trusted security in the        
infrastructure4  7h7 ,study on emerging 
concepts ,to promote effective cyber    
hygiene for the internet of things  7#a7
 ,internet of things defined ,in this   
subsection1 the term ,internet of       
,things means the set of physical       
objects embedded with sensors or        
actuators and connected to a network4   
7#b7 ,study required ,the ,secretary of 
,homeland ,security1 in coordination    
with the ,director of the ,national     
,institute of ,standards and ,technology
 and the ,federal ,trade ,commission1   
shall conduct a study on cybersecurity  

threats relating to the ,internet of    
,things4  7#c7 ,matters studied ,as part
 of the study required by paragraph     
7#b71 the ,secretary shall-- 7,a7 assess
 cybersecurity threats relating to the  
,internet of ,things2  7,b7 assess the  
effect such threats may have on the     
cybersecurity of the information systems
 and networks of the ,federal           
,government 7except for the information 
systems and networks of the ,department 
of ,defense and the intelligence        
community 7as defined in section #c of  
the ,national ,security ,act of #aidg   
7#ej ,u4,s4,c4 #cjjc7772 and  7,c7      
develop recommendations for addressing  
such threats4  7#d7 ,report to congress 
,not later than #a year after the date  
of the enactment of this ,act1 the      
,secretary shall--  7,a7 complete the   
study required by paragraph 7#b72 and   
7,b7 submit to ,congress a report that  
contains the findings of such study and 
the recommendations developed4