#aaeth ,,congress  #b;d ,session  ,in   
the ,house of ,representatives1 ,u4 ,s41
  ,july #be1 #bjah  ,,amendments3  ,that
 the bill from the ,senate 7,s4 #ggj7   
entitled ,an ,act to require the        
,director of the ,national ,institute of
 ,standards and ,technology to          
disseminate resources to help reduce    
small business cybersecurity risks1 and 
for other purposes41 do pass with the   
following ,strike out all after the     
enacting clause and insert3  #a4 ,short 
title ,this ,act may be cited as the    
,,nist ,small ,business ,cybersecurity  
,act4  #b4 ,improving cybersecurity of  
small businesses  7a7 ,definitions ,in  
this section3  7#a7 ,director ,the term 
,director means the ,director of the    
,national ,institute of ,standards and  
,technology4  7#b7 ,resources ,the term 
resources means guidelines1 tools1 best 
practices1 standards1 methodologies1 and
 other ways of providing information4   
7#c7 ,small business concern ,the term  
small business concern has the meaning  

given such term in section #c of the    
,small ,business ,act 7#ae ,u4,s4,c4    
#fcb74  7b7 ,small business             
cybersecurity ,section #b7;e77#a77;,a7  
of the ,national ,institute of          
,standards and ,technology ,act 7#ae    
,u4,s4,c4 #bgb7;e77#a77;,a77 is         
amended--  7#a7 in clause 7vii71 by     
striking and at the end2  7#b7 by       
redesignating clause 7viii7 as clause   
7ix72 and  7#c7 by inserting after      
clause 7vii7 the following3  7viii7     
consider small business concerns 7as    
defined in section #c of the ,small     
,business ,act 7#ae ,u4,s4,c4 #fcb772   
and  4  7c7 ,dissemination of resources 
for small businesses  7#a7 ,in general  
,not later than one year after the date 
of the enactment of this ,act1 the      
,director1 in carrying out section      
#b7;e77#a77;,a77viii7 of the ,national  
,institute of ,standards and ,technology
 ,act1 as added by subsection 7b7 of    
this ,act1 in consultation with the     
heads of other appropriate ,federal     

agencies1 shall disseminate clear and   
concise resources to help small business
 concerns identify1 assess1 manage1 and 
reduce their cybersecurity risks4  7#b7 
,requirements ,the ,director shall      
ensure that the resources disseminated  
pursuant to paragraph 7#a7--  7,a7 are  
generally applicable and usable by a    
wide range of small business concerns2  
7,b7 vary with the nature and size of   
the implementing small business concern1
 and the nature and sensitivity of the  
data collected or stored on the         
information systems or devices of the   
implementing small business concern2    
7,c7 include elements1 that promote     
awareness of simple1 basic controls1 a  
workplace cybersecurity culture1 and    
third-party stakeholder relationships1  
to assist small business concerns in    
mitigating common cybersecurity risks2  
7,d7 include case studies of practical  
application2  7,e7 are                  
technology-neutral and can be           
implemented using technologies that are 

commercial and off-the-shelf2 and  7,f7 
are based on international standards to 
the extent possible1 and are consistent 
with the ,stevenson-,wydler ,technology 
,innovation ,act of #aihj 7#ae ,u4,s4,c4
 #cgja et seq474  7#c7 ,national        
cybersecurity awareness and education   
program ,the ,director shall ensure that
 the resources disseminated under       
paragraph 7#a7 are consistent with the  
efforts of the ,director under section  
#dja of the ,cybersecurity ,enhancement 
,act of #bjad 7#ae ,u4,s4,c4 #gdea74    
7#d7 ,small ,business ,development      
,center ,cyber ,strategy ,in carrying   
out paragraph 7#a71 the ,director1 to   
the extent practicable1 shall consider  
any methods included in the ,small      
,business ,development ,center ,cyber   
,strategy developed under section       
#ahda7;a77#c77;,b7 of the ,national     
,defense ,authorization ,act for ,fiscal
 ,year #bjag 7,public ,law #aad-cbh74   
7#e7 ,voluntary resources ,the use of   
the resources disseminated under        

paragraph 7#a7 shall be considered      
voluntary4  7#f7 ,updates ,the ,director
 shall review and1 if necessary1 update 
the resources disseminated under        
paragraph 7#a7 in accordance with the   
requirements under paragraph 7#b74  7#g7
 ,public availability ,the ,director and
 the head of each ,federal agency that  
so elects shall make prominently        
available on the respective agency's    
public ,internet website information    
about the resources and updates to the  
resources disseminated under paragraph  
7#a74 ,the ,director and the heads shall
 each ensure that the information they  
respectively make prominently available 
is consistent1 clear1 and concise4  7d7 
,other ,federal cybersecurity           
requirements ,nothing in this section   
may be construed to supersede1 alter1 or
 otherwise affect any cybersecurity     
requirements applicable to ,federal     
agencies4  7e7 ,funding ,this ,act shall
 be carried out using funds otherwise   
authorized to be appropriated or made   

available to the ,national ,institute of
 ,standards and ,technology4  ,amend the
 title so as to read3 ,an ,act to       
require the ,director of the ,national  
,institute of ,standards and ,technology
 to disseminate guidance to help reduce 
small business cybersecurity risks1 and 
for other purposes44  ,clerk4