,,ii  #aaeth ,,congress  #ast ,session  
,s4 #adge  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,june #bi1     
#bjag,mr4 ,hatch 7for himself and ,mr4  
,markey7 introduced the following bill2 
which was read twice and referred to the
 ,committee on ,commerce1 ,science1 and 
,transportation  ,a ,,bill  ,to provide 
for the identification and documentation
 of best practices for cyber hygiene by 
the ,national ,institute of ,standards  
and ,technology1 and for other purposes4
  #a4 ,short title ,this ,act may be    
cited as the ,promoting ,good ,cyber    
,hygiene ,act of #bjag4  #b4 ,cyber     
hygiene best practices  7a7             
,establishment ,not later than #a year  
after the date of enactment of this     
,act1 the ,director of the ,national    
,institute of ,standards and ,technology
 shall establish a list of best         
practices for effective and usable cyber
 hygiene--  7#a7 in consultation with   
the ,federal ,trade ,commission and the 
,secretary of ,homeland ,security2  7#b7

 after notice and an opportunity for    
public comment2 and  7#c7 for use by--  
7,a7 the ,federal ,government2  7,b7 the
 private sector2 and  7,c7 any person   
utilizing an information system or      
device4  7b7 ,best practices ,a best    
practice on the list established under  
subsection 7a7 shall-- 7#a7 be a simple1
 basic control that has the greatest    
effect in defending against a common    
cybersecurity threat or risk2  7#b7     
utilize a technology that is commercial1
 off-the-shelf1 and based on            
international standards2 and  7#c7 to   
the degree practicable1 be based on and 
consistent with the ,cybersecurity      
,framework contained in ,executive      
,order #acfcf1 entitled ,improving      
,critical ,infrastructure               
,cybersecurity1 issued in ,february     
#bjac1 or any successor framework4  7c7 
,voluntary practices ,a best practice on
 the list established under subsection  
7a7 shall be considered voluntary and is
 not intended to be construed as        

mandatory4  7d7 ,baseline ,the ,director
 shall encourage the use of the best    
practices as the baseline provided by   
the list established under subsection   
7a7 is encouraged to be not only used   
but improved upon by any entity         
including--  7#a7 the ,federal          
,government2  7#b7 the private sector2  
and  7#c7 any person utilizing an       
information system or device4  7e7      
,annual updates ,not less frequently    
than once each year1 the ,director shall
 review and update the list established 
under subsection 7a74  7f7 ,public      
availability  7#a7 ,in general ,the     
,director shall publish the list of best
 practices established under subsection 
7a7 in a clear and concise format4  7#b7
 ,availability ,the ,federal ,trade     
,commission and the ,small ,business    
,administration shall make such list of 
best practices prominently available on 
the public ,internet website of each    
respective agency4  7g7 ,other federal  
cybersecurity requirements ,nothing in  

this section shall be construed to      
supersede1 alter1 or otherwise affect   
any cybersecurity requirements          
applicable to any ,federal agency4  7h7 
,considerations ,in carrying out        
subsection 7a71 the head of each agency 
of the ,federal ,government shall       
consider the benefit1 as pertaining to  
cyber hygiene1 of an emerging technology
 or process capable of providing any    
enhanced security protection1           
including--  7#a7 multi-factor          
authentication2  7#b7 data loss         
prevention2  7#c7 micro-segmentation2   
7#d7 data encryption2  7#e7 cloud       
services2  7#f7 anonymization2  7#g7    
software patching and maintenance2  7#h7
 phishing education2 and  7#i7 other    
standard cybersecurity measures to      
achieve trusted security in the         
infrastructure4  7i7 ,study on emerging 
concepts ,to promote effective cyber    
hygiene for the internet of things  7#a7
 ,internet of ,things defined ,the term 
,internet of ,things means the set of   

physical objects embedded with sensors  
or actuators and connected to a network4
  7#b7 ,study required ,the ,secretary  
of ,homeland ,security1 in coordination 
with the ,director of the ,national     
,institute of ,standards and ,technology
 and the ,federal ,trade ,commission1   
shall conduct a study on cybersecurity  
threats relating to the ,internet of    
,things4  7#c7 ,matters studied ,as part
 of the study required by paragraph     
7#b71 the ,secretary shall-- 7,a7 assess
 cybersecurity threats relating to the  
,internet of ,things2  7,b7 assess the  
effect such threats may have on the     
cybersecurity of the information systems
 and networks of the ,federal           
,government 7except for the information 
systems and networks of the ,department 
of ,defense and the intelligence        
community 7as defined in ,section #c of 
the ,national ,security ,act of #aidg   
7#ej ,u4,s4,c4 #cjjc7772 and  7,c7      
develop recommendations for addressing  
such threats4  7#d7 ,report to congress 

,not later than #a year after the date  
of the enactment of this ,act1 the      
,secretary shall--  7,a7 complete the   
study required by paragraph 7#b72 and   
7,b7 submit to ,congress a report that  
contains the findings of the ,secretary 
with respect to such study and the      
recommendations developed by the        
secretary under paragraph 7#c77;,c74