,,ii #aaeth ,,congress #ast ,session ,s4 #ggj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #bi1 #bjag,mr4 ,schatz 7for himself1 ,mr4 ,risch1 ,mr4 ,thune1 ,ms4 ,cantwell1 and ,mr4 ,nelson7 introduced the following bill2 which was read twice and referred to the ,committee on ,commerce1 ,science1 and ,transportation ,a ,,bill ,to require the ,director of the ,national ,institute of ,standards and ,technology to disseminate resources to help reduce small business cybersecurity risks1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,making ,available ,information ,now to ,strengthen ,trust and ,resilience and ,enhance ,enterprise ,technology ,cybersecurity ,act of #bjag or the ,,main ,,street ,cybersecurity ,act of #bjag4 #b4 ,findings ,congress makes the following findings3 7#a7 ,small businesses play a vital role in the economy of the ,united ,states1 accounting for #ed percent of all ,united ,states sales and #ee percent of jobs in the ,united ,states4 7#b7 ,attacks targeting small and medium businesses account for a high percentage of cyberattacks in the ,united ,states4 ,sixty percent of small businesses that suffer a cyberattack are out of business within #f months1 according to the ,national ,cyber ,security ,alliance4 7#c7 ,the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gdba et seq47 calls on the ,national ,institute of ,standards and ,technology to facilitate and support a voluntary public-private partnership to reduce cybersecurity risks to critical infrastructure4 ,such a partnership continues to play a key role in improving the cyber resilience of the ,united ,states and making cyberspace safer4 7#d7 ,there is a need to develop simplified resources that are consistent with the partnership described in paragraph 7#c7 that improves its use by small businesses4 #c4 ,improving cybersecurity of small businesses 7a7 ,definitions ,in this section3 7#a7 ,director ,the term ,director means the ,director of the ,national ,institute of ,standards and ,technology4 7#b7 ,resources ,the term resources means guidelines1 tools1 best practices1 standards1 methodologies1 and other ways of providing information4 7#c7 ,small business concern ,the term small business concern has the meaning given such term in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7b7 ,small business cybersecurity ,section #b7;e77#a77;,a7 of the ,national ,institute of ,standards and ,technology ,act 7#ae ,u4,s4,c4 #bgb7;e77#a77;,a77 is amended-- 7#a7 in clause 7vii71 by striking and at the end2 7#b7 by redesignating clause 7viii7 as clause 7ix72 and 7#c7 by inserting after clause 7vii7 the following3 7viii7 consider small business concerns 7as defined in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb772 and 4 7c7 ,dissemination of resources for small businesses 7#a7 ,in general ,not later than one year after the date of the enactment of this ,act1 the ,director1 in carrying out section #b7;e77#a77;,a77viii7 of the ,national ,institute of ,standards and ,technology ,act1 as added by subsection 7b7 of this ,act1 in consultation with the heads of such other ,federal agencies as the ,director considers appropriate1 shall disseminate clear and concise resources for small business concerns to help reduce their cybersecurity risks4 7#b7 ,requirements ,the ,director shall ensure that the resources disseminated pursuant to paragraph 7#a7-- 7,a7 are effective and usable by small business concerns2 7,b7 vary with the nature and size of the implementing small business concern1 and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing small business concern2 7,c7 include elements1 such as simple1 basic controls1 to assist small business concerns in defending against common cybersecurity risks2 7,d7 are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf2 and 7,e7 are based on international standards to the extent possible1 and are consistent with the ,stevenson-,wydler ,technology ,innovation ,act of #aihj 7#ae ,u4,s4,c4 #cgja et seq474 7#c7 ,national cybersecurity awareness and education program ,the ,director shall ensure that the resources disseminated under paragraph 7#a7 are consistent with the efforts of the ,director under section #dja of the ,cybersecurity ,enhancement ,act of #bjad 7#ae ,u4,s4,c4 #gdea74 7#d7 ,small business development center cyber strategy ,in carrying out paragraph 7#a71 the ,director1 to the extent practicable1 shall consider any methods included in the ,small ,business ,development ,center ,cyber ,strategy developed under section #ahda7;a77#c77;,b7 of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjag 7,public ,law #aad-cbh74 7#e7 ,voluntary resources ,the use of the resources disseminated under paragraph 7#a7 shall be considered voluntary4 7#f7 ,updates ,the ,director shall review and1 if necessary1 update the resources disseminated under paragraph 7#a74 7#g7 ,public availability ,the ,director and such heads of other ,federal agencies as the ,director considers appropriate shall each make prominently available to the public on the ,director's or head's ,internet website1 as the case may be1 information about the resources disseminated under paragraph 7#a74 ,the ,director and the heads shall each ensure that the information they respectively make prominently available is consistent1 clear1 and concise4 7d7 ,consistency of resources published by ,federal agencies ,if a ,federal agency publishes resources to help small business concerns reduce their cybersecurity risks1 the head of such ,federal agency1 to the degree practicable1 shall make such resources consistent with the resources disseminated under subsection 7c77#a74 7e7 ,other ,federal cybersecurity requirements ,nothing in this section may be construed to supersede1 alter1 or otherwise affect any cybersecurity requirements applicable to ,federal agencies4