,,ii #aafth ,,congress #b;d ,session ,s4 #dgca ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #bd1 #bjbj,ms4 ,rosen 7for herself and ,mr4 ,cornyn7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to require the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to establish cybersecurity guidance for small organizations1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,improving ,cybersecurity of ,small ,organizations ,act of #bjbj4 #b4 ,improving cybersecurity of small organizations 7a7 ,definitions ,in this section3 7#a7 ,administration ,the term ,administration means the ,small ,business ,administration4 7#b7 ,administrator ,the term ,administrator means the ,administrator of the ,administration4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,cybersecurity guidance ,the term cybersecurity guidance means the cybersecurity guidance documented and promoted in the resource maintained under section #c7;a74 7#e7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#f7 ,,nist ,the term ,,nist means the ,national ,institute of ,standards and ,technology4 7#g7 ,secretary ,the term ,secretary means the ,secretary of ,commerce4 7#h7 ,small business ,the term small business has the meaning given the term small business concern in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7#i7 ,small governmental jurisdiction ,the term small governmental jurisdiction has the meaning given the term in section #fja of title #e1 ,united ,states ,code4 7#aj7 ,small nonprofit ,the term small nonprofit has the meaning given the term small organization in section #fja of title #e1 ,united ,states ,code4 7#aa7 ,small organization ,the term small organization means an organization that is unlikely to employ a specialist in cybersecurity1 including-- 7,a7 a small business2 7,b7 a small nonprofit2 and 7,c7 a small governmental jurisdiction4 7b7 ,cybersecurity guidance 7#a7 ,in general ,the ,director shall maintain cybersecurity guidance that documents and promotes evidence-based cybersecurity policies and controls for use by small organizations1 which shall-- 7,a7 include simple1 basic controls that have the most impact in protecting small organizations against common cybersecurity threats and risks2 7,b7 include guidance to address common cybersecurity threats and risks posed by electronic devices that are personal to the employees and contractors of small organizations1 as well as electronic devices that are issued to those employees and contractors by small organizations2 and 7,c7 recommend-- 7i7 measures to improve the cybersecurity of small organizations2 and 7ii7 configurations and settings for some of the most commonly used software that can improve the cybersecurity of small organizations4 7#b7 ,consistency ,the ,director shall ensure the cybersecurity guidance maintained under paragraph 7#a7 is consistent with-- 7,a7 cybersecurity resources developed by ,,nist1 as required by the ,,nist ,small ,business ,cybersecurity ,act 7,public ,law #aae-bcf72 and 7,b7 the most recent version of the ,cybersecurity ,framework1 or successor resource1 maintained by ,,nist4 7#c7 ,guidance for specific types of small organizations ,the ,director may include cybersecurity guidance1 as required under paragraph 7#a71 appropriate for specific types of small organizations in addition to guidance applicable for all small organizations4 7#d7 ,updates 7,a7 ,in general ,the ,director shall review the cybersecurity guidance maintained under paragraph 7#a7 not less frequently than annually and update the cybersecurity guidance as appropriate4 7,b7 ,consultation ,in updating the cybersecurity guidance under subparagraph 7,a71 the ,director shall1 to the degree practicable and as appropriate1 consult with-- 7i7 the ,administrator1 the ,secretary1 and the ,commission2 7ii7 small organizations1 insurers1 ,state governments1 companies that work with small organizations1 and academic and ,federal and non-,federal experts in cybersecurity2 and 7iii7 any other entity as determined by the ,director4 7#e7 ,user interface ,as appropriate1 the ,director shall consult with experts regarding the design of a user interface for the cybersecurity guidance4 7c7 ,promotion of cybersecurity guidance for small businesses 7#a7 ,public availability ,the cybersecurity guidance maintained under subsection 7b77#a7 shall be-- 7,a7 made available1 prominently and free of charge1 on the public website of the ,cybersecurity ,infrastructure ,security ,agency2 and 7,b7 linked to from relevant portions of the websites of the ,administration and the ,minority ,business ,development ,agency4 7#b7 ,promotion generally ,the ,director1 the ,administrator1 and the ,secretary shall1 to the degree practicable1 promote the cybersecurity guidance through relevant resources that are intended for or known to be regularly used by small organizations1 including agency documents1 websites1 and events4 7d7 ,report on incentivizing cybersecurity for small organizations 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall submit to ,congress a report describing methods to incentivize small organizations to improve their cybersecurity1 including through the adoption of policies1 controls1 products and services that have been demonstrated to reduce cybersecurity risk4 7#b7 ,matters to be included ,the report required under paragraph 7#a7 shall-- 7,a7 identify barriers or challenges for small organizations in purchasing or acquiring products and services that promote the cybersecurity2 7,b7 assess market availability1 market pricing1 and affordability of products and services that promote the cybersecurity for small organizations1 with particular attention to identifying high-risk and underserved sectors or regions2 7,c7 estimate the cost of tax breaks1 grants1 subsidies1 or other incentives to increase the adoption of policies and controls or acquisition of products and services that promote the cybersecurity of small organizations2 7,d7 as practicable1 consult the certifications and requirement for cloud services described in the final report of the ,cyberspace ,solarium ,commission established under section #afeb of the ,john ,s4 ,mc,cain ,national ,defense ,authorization ,act for ,fiscal ,year #bjai 7,public ,law #aae-bcb2 #acb ,stat4 #badj72 7,e7 describe evidence-based cybersecurity controls and policies that improve cybersecurity for small organizations2 7,f7 with respect to the incentives described in subparagraph 7,c71 recommend measures that can effectively improve cybersecurity at scale for small organizations2 and 7,g7 include any other matters as the ,secretary determines relevant4 7#c7 ,guidance for specific types of small organizations ,in preparing the report required under paragraph 7#a71 the ,secretary may include matters applicable for specific types of small organizations in addition to matters applicable to all small organizations4 7#d7 ,consultation ,in preparing the report required under paragraph 7#a71 the ,secretary shall consult with-- 7,a7 the ,administrator1 the ,director1 and the ,commission2 and 7,b7 small organizations1 insurers of risks related to cybersecurity1 ,state governments1 cybersecurity and information technology companies that work with small organizations1 and academic and ,federal and non-,federal experts in cybersecurity4 7e7 ,periodic census on state of cybersecurity of small businesses 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act and not less frequently than every #bd months thereafter for not more than #aj years1 the ,administrator shall submit to ,congress and make publicly available data on the state of cybersecurity of small businesses1 including-- 7,a7 adoption of the cybersecurity guidance among small businesses2 7,b7 the most significant and widespread cybersecurity threats facing small businesses2 7,c7 the amount small businesses spend on cybersecurity products and services2 and 7,d7 the personnel small businesses dedicate to cybersecurity 7including the amount of total personnel time1 whether by employees or contractors1 dedicated to cybersecurity efforts74 7#b7 ,form ,the report required under paragraph 7#a7 shall be produced in unclassified form but may contain a classified annex4 7#c7 ,consultation ,in preparing the report required under paragraph 7#a71 the ,administrator shall consult with-- 7,a7 the ,secretary1 the ,director1 and the ,commission2 and 7,b7 small businesses1 insurers of risks related to cybersecurity1 cybersecurity and information technology companies that work with small businesses1 and academic and ,federal and non-,federal experts in cybersecurity4