,,ii #aaeth ,,congress #b;d ,session ,s4 #bfff ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,april #ab1 #bjah,mr4 ,coons 7for himself1 ,mr4 ,graham1 and ,mrs4 ,gillibrand7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to improve assistance provided by the ,hollings ,manufacturing ,extension ,partnership to small manufacturers in the defense industrial supply chain on matters relating to cybersecurity1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,enhance ,cybersecurity for ,small ,manufacturers ,act of #bjah4 #b4 ,findings ,congress finds the following3 7#a7 ,according to the ,bureau of ,labor ,statistics1 there are more than #cdg1jjj manufacturing establishments in the ,united ,states1 of which #gb percent have fewer than #bj employees and #ii percent have fewer than #ejj employees4 7#b7 ,independent studies from the ,national ,defense ,industry ,association1 the ,defense ,science ,board1 the ,alliance for ,manufacturing ,foresight1 and the ,mc,kinsey ,global ,institute have highlighted-- 7,a7 the centrality of small manufacturers to ,united ,states manufacturing supply chains for domestic economic growth2 7,b7 the vulnerability of such manufacturers to the defense industrial base for national security2 and 7,c7 the vulnerability of such manufacturers to cybersecurity threats and breaches4 7#c7 ,as of ,december #ca1 #bjag1 ,department of ,defense suppliers must comply with new1 tougher cybersecurity requirements to ensure adequate security to protect controlled unclassified information relevant to defense manufacturing supply chains4 ,the requirements call for defense suppliers to implement and create a plan of action to respond to the guidance developed by the ,national ,institute of ,standards and ,technology4 7#d7 ,the ,department of ,commerce has found significant cybersecurity vulnerability of small manufacturers4 ,a survey of #i1jjj contract facilities documented that #f1fej small facilities lagged behind medium and large firms across a broad range of #bj cybersecurity indicators4 ,for several indicators1 fewer than half of small firms had cybersecurity measures in place4 7#e7 ,over the past #e years the national network of centers operating as part of the ,hollings ,manufacturing ,extension ,partnership has worked closely with the ,department of ,defense to bolster the resilience of the defense industrial base supply chain4 ,since #bjac1 such centers have completed more than #b1ejj projects with #a1fej companies that are suppliers to the ,department of ,defense4 7#f7 ,in #bjag1 the ,hollings ,manufacturing ,extension ,partnership interacted with more than #a1jjj small manufacturers on the cybersecurity requirements of the ,department of ,defense4 ,this work by the ,hollings ,manufacturing ,extension ,partnership has revealed a significant lack of awareness of the ,department of ,defense cybersecurity requirements and a deficiency of financial and technical resources required to manage cybersecurity risks4 ,if cybersecurity vulnerabilities remain unaddressed1 defense supply chains face a higher likelihood of serious and exploitable vulnerabilities1 as well as a substantial reduction in the number of suppliers compliant with ,department of ,defense requirements1 and thereby ineligible to provide products and services to the ,department of ,defense4 7#g7 ,the ,hollings ,manufacturing ,extension ,partnership is well positioned to aid suppliers of the ,department of ,defense in complying with cybersecurity requirements of the ,department to ensure adequate security to protect controlled unclassified information relevant to defense manufacturing supply chains4 #c4 ,assistance for small manufacturers in the defense industrial supply chain on matters relating to cybersecurity 7a7 ,definitions ,in this section3 7#a7 ,center ,the term ,center has the meaning given such term in section #be7;a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bghk7a774 7#b7 ,director ,the term ,director means the ,director of the ,national ,institute of ,standards and ,technology4 7#c7 ,resources ,the term resources means guidelines1 tools1 best practices1 standards1 methodologies1 and other ways of providing information4 7#d7 ,small business concern ,the term small business concern means a small business concern as that term is used in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7#e7 ,small manufacturer ,the term small manufacturer means a small business concern that is a manufacturer4 7#f7 ,state ,the term ,state means each of the several ,states1 ,territories1 and possessions of the ,united ,states1 the ,district of ,columbia1 and the ,commonwealth of ,puerto ,rico4 7b7 ,dissemination of cybersecurity resources 7#a7 ,in general ,the ,director of the ,national ,institute of ,standards and ,technology1 in partnership with the ,secretary of ,defense and acting through the ,hollings ,manufacturing ,extension ,partnership1 shall take such actions as may be necessary to address a widespread lack of awareness of cybersecurity threats among small manufacturers in the defense industrial supply chain4 7#b7 ,national reach ,the ,director shall ensure that efforts to increase awareness under paragraph 7#a7 are carried out in each ,state1 by disseminating clear and concise resources to help reduce cybersecurity risks faced by small manufacturers described in paragraph 7#a74 7#c7 ,sector focus ,the ,director shall carry out this subsection with a focus on such industry sectors as the ,director considers critical1 in consultation with the ,secretary of ,defense4 7#d7 ,outreach events ,under paragraph 7#a71 the ,director shall conduct outreach4 ,such outreach may include live events with a physical presence and outreach conducted through ,internet websites4 7c7 ,voluntary cybersecurity self-,assessments ,the ,director shall provide1 through the ,hollings ,manufacturing ,extension ,partnership1 assistance to help small manufacturers conduct voluntary self-assessments in order to understand operating environments1 cybersecurity requirements1 and existing vulnerabilities4 7d7 ,transfer of research findings and expertise 7#a7 ,in general ,the ,director shall provide for the transfer of technology and techniques developed at the ,national ,institute of ,standards and ,technology to ,centers1 and through such ,centers1 to small manufacturers throughout the ,united ,states to implement security measures that are adequate to protect covered defense information1 including controlled unclassified information4 7#b7 ,use of other ,federal expertise and capabilities ,the ,director shall use1 when appropriate1 the expertise and capabilities that exist in ,federal agencies other than the ,institute1 and federally sponsored laboratories4 7#c7 ,agreements ,in carrying out this subsection1 the ,centers may enter into agreements with private industry1 institutes of higher education1 or a ,state1 ,united ,states territory1 local1 or tribal government to ensure breadth and depth of coverage to the ,united ,states defense industrial base and to leverage resources4 7e7 ,defense acquisition workforce cyber training program ,the ,secretary of ,defense1 in consultation with the ,director1 shall establish a cyber counseling certification program1 or approve a similar existing program1 to certify small business professionals and other relevant acquisition staff within the ,department of ,defense to provide cyber planning assistance to small manufacturers in the defense industrial supply chain4