,,ii  #aaf? ,,congress  #b;d ,session   
,s4 #dgca  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,septemb] #bd1         
#bjbj,ms4 ,ros5 7= h]self & ,mr4        
,cornyn7 introduc$ ! foll[+ bill2 :i* 0 
read twice & ref]r$ to ! ,committee on  
,homel& ,security & ,gov]nm5tal ,affairs
  ,a ,,bill  ,to require ! ,director ( !
 ,cyb]security & ,infra/ructure         
,security ,ag5cy to e/abli% cyb]security
 guidance = small organizations1 & = o!r
 purposes4  #a4 ,%ort title ,?is ,act   
may be cit$ z ! ,improv+ ,cyb]security (
 ,small ,organizations ,act ( #bjbj4    
#b4 ,improv+ cyb]security ( small       
organizations  7a7 ,def9itions ,9 ?is   
section3 7#a7 ,adm9i/ration ,! t]m      
,adm9i/ration means ! ,small ,bus9ess   
,adm9i/ration4  7#b7 ,adm9i/rator ,! t]m
 ,adm9i/rator means ! ,adm9i/rator ( !  
,adm9i/ration4  7#c7 ,commission ,! t]m 
,commission means ! ,f$]al ,trade       
,commission4  7#d7 ,cyb]security        
guidance ,! t]m cyb]security guidance   
means ! cyb]security guidance docum5t$ &

 promot$ 9 ! res\rce ma9ta9$ "u section 
#c7;a74  7#e7 ,director ,! t]m ,director
 means ! ,director ( ! ,cyb]security &  
,infra/ructure ,security ,ag5cy4  7#f7  
,,ni/ ,! t]m ,,ni/ means ! ,national    
,in/itute ( ,/&>ds & ,te*nology4  7#g7  
,secret>y ,! t]m ,secret>y means !      
,secret>y ( ,comm]ce4  7#h7 ,small      
bus9ess ,! t]m small bus9ess has ! mean+
 giv5 ! t]m small bus9ess conc]n 9      
section #c ( ! ,small ,bus9ess ,act 7#ae
 ,u4,s4,c4 #fcb74  7#i7 ,small          
gov]nm5tal jurisdiction ,! t]m small    
gov]nm5tal jurisdiction has ! mean+ giv5
 ! t]m 9 section #fja ( title #e1 ,unit$
 ,/ates ,code4  7#aj7 ,small nonpr(it ,!
 t]m small nonpr(it has ! mean+ giv5 !  
t]m small organization 9 section #fja ( 
title #e1 ,unit$ ,/ates ,code4  7#aa7   
,small organization ,! t]m small        
organization means an organization t is 
unlikely to employ a speciali/ 9        
cyb]security1 includ+-- 7,a7 a small    
bus9ess2  7,b7 a small nonpr(it2 &  7,c7
 a small gov]nm5tal jurisdiction4  7b7  

,cyb]security guidance  7#a7 ,9 g5]al ,!
 ,director %all ma9ta9 cyb]security     
guidance t docum5ts & promotes          
evid5ce-bas$ cyb]security policies &    
controls = use by small organizations1  
:i* %all-- 7,a7 include simple1 basic   
controls t h ! mo/ impact 9 protect+    
small organizations aga9/ common        
cyb]security ?reats & risks2  7,b7      
include guidance to address common      
cyb]security ?reats & risks pos$ by     
electronic devices t are p]sonal to !   
employees & contractors ( small         
organizations1 z well z electronic      
devices t are issu$ to ^? employees &   
contractors by small organizations2 &   
7,c7 recomm5d-- 7i7 measures to improve 
! cyb]security ( small organizations2 & 
7ii7 configurations & sett+s = "s ( !   
mo/ commonly us$ s(tw>e t c improve !   
cyb]security ( small organizations4     
7#b7 ,consi/5cy ,! ,director %all ensure
 ! cyb]security guidance ma9ta9$ "u     
p>agraph 7#a7 is consi/5t )-- 7,a7      
cyb]security res\rces develop$ by ,,ni/1

 z requir$ by ! ,,ni/ ,small ,bus9ess   
,cyb]security ,act 7,public ,law        
#aae-bcf72 &  7,b7 ! mo/ rec5t v]sion ( 
! ,cyb]security ,framework1 or successor
 res\rce1 ma9ta9$ by ,,ni/4  7#c7       
,guidance = specific types ( small      
organizations ,! ,director may include  
cyb]security guidance1 z requir$ "u     
p>agraph 7#a71 appropriate = specific   
types ( small organizations 9 addition  
to guidance applicable = all small      
organizations4  7#d7 ,updates  7,a7 ,9  
g5]al ,! ,director %all review !        
cyb]security guidance ma9ta9$ "u        
p>agraph 7#a7 n less frequ5tly ?an      
annually & update ! cyb]security        
guidance z appropriate4  7,b7           
,consultation ,9 updat+ ! cyb]security  
guidance "u subp>agraph 7,a71 !         
,director %all1 to ! degree practicable 
& z appropriate1 consult )-- 7i7 !      
,adm9i/rator1 ! ,secret>y1 & !          
,commission2  7ii7 small organizations1 
insur]s1 ,/ate gov]nm5ts1 companies t "w
 ) small organizations1 & academic &    

,f$]al & non-,f$]al exp]ts 9            
cyb]security2 &  7iii7 any o!r entity z 
det]m9$ by ! ,director4  7#e7 ,us]      
int]face ,z appropriate1 ! ,director    
%all consult ) exp]ts reg>d+ ! design ( 
a us] int]face = ! cyb]security         
guidance4  7c7 ,promotion ( cyb]security
 guidance = small bus9esses  7#a7       
,public availability ,! cyb]security    
guidance ma9ta9$ "u subsection 7b77#a7  
%all be-- 7,a7 made available1 prom95tly
 & free ( *>ge1 on ! public website ( ! 
,cyb]security ,infra/ructure ,security  
,ag5cy2 &  7,b7 l9k$ to f relevant      
portions ( ! websites ( ! ,adm9i/ration 
& ! ,m9ority ,bus9ess ,developm5t       
,ag5cy4  7#b7 ,promotion g5]ally ,!     
,director1 ! ,adm9i/rator1 & ! ,secret>y
 %all1 to ! degree practicable1 promote 
! cyb]security guidance ?r\gh relevant  
res\rces t are int5d$ = or kn[n to be   
regul>ly us$ by small organizations1    
includ+ ag5cy docum5ts1 websites1 &     
ev5ts4  7d7 ,report on inc5tiviz+       
cyb]security = small organizations  7#a7

 ,9 g5]al ,n lat] ?an #a ye> aft] ! date
 ( enactm5t ( ?is ,act1 ! ,secret>y %all
 submit to ,congress a report describ+  
me?ods to inc5tivize small organizations
 to improve _! cyb]security1 includ+    
?r\gh ! adoption ( policies1 controls1  
products & s]vices t h be5 demon/rat$ to
 r$uce cyb]security risk4  7#b7 ,matt]s 
to be includ$ ,! report requir$ "u      
p>agraph 7#a7 %all-- 7,a7 id5tify b>ri]s
 or *all5ges = small organizations 9    
pur*as+ or acquir+ products & s]vices t 
promote ! cyb]security2  7,b7 assess    
m>ket availability1 m>ket pric+1 &      
af=dability ( products & s]vices t      
promote ! cyb]security = small          
organizations1 ) p>ticul> att5tion to   
id5tify+ high-risk & und]s]v$ sectors or
 regions2  7,c7 e/imate ! co/ ( tax     
breaks1 grants1 subsidies1 or o!r       
inc5tives to increase ! adoption (      
policies & controls or acquisition (    
products & s]vices t promote !          
cyb]security ( small organizations2     
7,d7 z practicable1 consult !           

c]tifications & requirem5t = cl\d       
s]vices describ$ 9 ! f9al report ( !    
,cyb]space ,sol>ium ,commission e/abli%$
 "u section #afeb ( ! ,john ,s4 ,mc,cain
 ,national ,def5se ,au?orization ,act = 
,fiscal ,ye> #bjai 7,public ,law        
#aae-bcb2 #acb ,/at4 #badj72  7,e7      
describe evid5ce-bas$ cyb]security      
controls & policies t improve           
cyb]security = small organizations2     
7,f7 ) respect to ! inc5tives describ$ 9
 subp>agraph 7,c71 recomm5d measures t c
 effectively improve cyb]security at    
scale = small organizations2 &  7,g7    
include any o!r matt]s z ! ,secret>y    
det]m9es relevant4  7#c7 ,guidance =    
specific types ( small organizations ,9 
prep>+ ! report requir$ "u p>agraph     
7#a71 ! ,secret>y may include matt]s    
applicable = specific types ( small     
organizations 9 addition to matt]s      
applicable to all small organizations4  
7#d7 ,consultation ,9 prep>+ ! report   
requir$ "u p>agraph 7#a71 ! ,secret>y   
%all consult )-- 7,a7 ! ,adm9i/rator1 ! 

,director1 & ! ,commission2 &  7,b7     
small organizations1 insur]s ( risks    
relat$ to cyb]security1 ,/ate gov]nm5ts1
 cyb]security & in=mation te*nology     
companies t "w ) small organizations1 & 
academic & ,f$]al & non-,f$]al exp]ts 9 
cyb]security4  7e7 ,p]iodic c5sus on    
/ate ( cyb]security ( small bus9esses   
7#a7 ,9 g5]al ,n lat] ?an #a ye> aft] ! 
date ( enactm5t ( ?is ,act & n less     
frequ5tly ?an e #bd mon?s !reaft] = n m 
?an #aj ye>s1 ! ,adm9i/rator %all submit
 to ,congress & make publicly available 
data on ! /ate ( cyb]security ( small   
bus9esses1 includ+-- 7,a7 adoption ( !  
cyb]security guidance among small       
bus9esses2  7,b7 ! mo/ significant &    
widespread cyb]security ?reats fac+     
small bus9esses2  7,c7 ! am\nt small    
bus9esses sp5d on cyb]security products 
& s]vices2 &  7,d7 ! p]sonnel small     
bus9esses d$icate to cyb]security       
7includ+ ! am\nt ( total p]sonnel "t1   
:e!r by employees or contractors1       
d$icat$ to cyb]security ef=ts74  7#b7   

,=m ,! report requir$ "u p>agraph 7#a7  
%all be produc$ 9 unclassifi$ =m b may  
conta9 a classifi$ annex4  7#c7         
,consultation ,9 prep>+ ! report requir$
 "u p>agraph 7#a71 ! ,adm9i/rator %all  
consult )-- 7,a7 ! ,secret>y1 !         
,director1 & ! ,commission2 &  7,b7     
small bus9esses1 insur]s ( risks relat$ 
to cyb]security1 cyb]security &         
in=mation te*nology companies t "w )    
small bus9esses1 & academic & ,f$]al &  
non-,f$]al exp]ts 9 cyb]security4