,i #aagth ,,congress #b;d ,session ,h4 ,r4 #feda ,,in ,,the ,,house ,,of ,,representatives ,february #a1 #bjbb,ms4 ,eshoo 7for herself1 ,mr4 ,timmons1 ,mr4 ,raskin1 and ,mr4 ,case7 introduced the following bill2 which was referred to the ,committee on ,small ,business1 and in addition to the ,committee on ,homeland ,security1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to require the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to establish cybersecurity guidance for small organizations1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,improving ,cybersecurity of ,small ,businesses1 ,nonprofits1 and ,local ,governments ,act4 #b4 ,improving cybersecurity of small entities 7a7 ,definitions ,in this section3 7#a7 ,administrator ,the term ,administrator means the ,administrator of the ,small ,business ,administration4 7#b7 ,annual cybersecurity report2 small business2 small entity2 small governmental jurisdiction2 small organization ,the terms annual cybersecurity report1 small business1 small entity1 small governmental jurisdiction1 and small organization have the meanings given those terms in section #bbbj;,d of the ,homeland ,security ,act of #bjjb1 as added by subsection 7b74 7#c7 ,,cisa ,the term ,,cisa means the ,cybersecurity and ,infrastructure ,security ,agency4 7#d7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#e7 ,secretary ,the term ,secretary means the ,secretary of ,commerce4 7b7 ,annual report 7#a7 ,amendment ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following3 #bbbj;,d4 ,annual cybersecurity report for small entities 7a7 ,definitions 7#a7 ,administration ,the term ,administration means the ,small ,business ,administration4 7#b7 ,administrator ,the term ,administrator means the ,administrator of the ,administration4 7#c7 ,annual cybersecurity report ,the term annual cybersecurity report means the annual cybersecurity report published and promoted under subsections 7b7 and 7c71 respectively4 7#d7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#e7 ,electronic device ,the term electronic device means any electronic equipment that is-- 7,a7 used by an employee or contractor of a small entity for the purpose of performing work for the small entity2 7,b7 capable of connecting to the internet or another communication network2 and 7,c7 capable of sending1 receiving1 or processing personal information4 7#f7 ,,nist ,the term ,,nist means the ,national ,institute of ,standards and ,technology4 7#g7 ,small business ,the term small business has the meaning given the term small business concern under section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7#h7 ,small entity ,the term small entity means-- 7,a7 a small business2 7,b7 a small governmental jurisdiction2 and 7,c7 a small organization4 7#i7 ,small governmental jurisdiction ,the term small governmental jurisdiction means governments of cities1 counties1 towns1 townships1 villages1 school districts1 or special districts with a population of less than #ej1jjj4 7#aj7 ,small organization ,the term small organization means any not-for-profit enterprise that is independently owned and operated and is not dominant in its field4 7b7 ,annual cybersecurity report 7#a7 ,in general ,not later than #ahj days after the date of enactment of this section1 and not less frequently than annually thereafter1 the ,director shall publish a report for small entities that documents and promotes evidence-based cybersecurity policies and controls for use by small entities1 which shall-- 7,a7 include basic controls that have the most impact in protecting small entities against common cybersecurity threats and risks2 7,b7 include protocols and policies to address common cybersecurity threats and risks posed by electronic devices1 regardless of whether the electronic devices are-- 7i7 issued by the small entity to employees and contractors of the small entity2 or 7ii7 personal to the employees and contractors of the small entity2 and 7,c7 recommend1 as practicable-- 7i7 measures to improve the cybersecurity of small entities2 and 7ii7 configurations and settings for some of the most commonly used software that can improve the cybersecurity of small entities4 7#b7 ,existing recommendations ,the ,director shall ensure that each annual cybersecurity report published under paragraph 7#a7 incorporates-- 7,a7 cybersecurity resources developed by ,,nist1 as required by the ,,nist ,small ,business ,cybersecurity ,act 7,public ,law #aae-bcf72 and 7,b7 the most recent version of the ,cybersecurity ,framework1 or successor resource1 maintained by ,,nist4 7#c7 ,consideration for specific types of small entities ,the ,director may include and prioritize the development of cybersecurity recommendations1 as required under paragraph 7#a71 appropriate for specific types of small entities in addition to recommendations applicable for all small entities4 7#d7 ,consultation ,in publishing the annual cybersecurity report under paragraph 7#a71 the ,director shall1 to the degree practicable and as appropriate1 consult with-- 7,a7 the ,administrator1 the ,secretary of ,commerce1 the ,commission1 and the ,director of ,,nist2 7,b7 small entities1 insurers1 ,state governments1 companies that work with small entities1 and academic and ,federal and non-,federal experts in cybersecurity2 and 7,c7 any other entity as determined appropriate by the ,director4 7c7 ,promotion of annual cybersecurity report for small businesses 7#a7 ,publication ,the annual cybersecurity report1 and previous versions of the report as appropriate1 published under subsection 7b77#a7 shall be-- 7,a7 made available1 prominently and free of charge1 on the public website of the ,agency2 and 7,b7 linked to from relevant portions of the websites of the ,administration and the ,minority ,business ,development ,agency1 as determined by the ,administrator and the ,director of the ,minority ,business ,development ,agency1 respectively4 7#b7 ,promotion generally ,the ,director1 the ,administrator1 and the ,secretary of ,commerce shall1 to the degree practicable1 promote the annual cybersecurity report through relevant resources that are intended for or known to be regularly used by small entities1 including agency documents1 websites1 and events4 7d7 ,training and technical assistance ,the ,director1 the ,administrator1 and the ,director of the ,minority ,business ,development ,agency shall make available to employees of small entities voluntary training and technical assistance on how to implement the recommendations of the annual cybersecurity report4 4 7#b7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public #ajg-bif2 #aaf ,stat4 #bace7 is amended by inserting after the item relating to section #bbbj;,c the following3 ,sec4 #bbbj;,d4 ,annual cybersecurity report for small entities4 4 7c7 ,report to ,congress 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 and annually thereafter for #aj years1 the ,secretary shall submit to ,congress a report describing methods to improve the cybersecurity of small entities1 including through the adoption of policies1 controls1 and classes of products and services that have been demonstrated to reduce cybersecurity risk4 7#b7 ,matters to be included ,the report required under paragraph 7#a7 shall-- 7,a7 identify barriers or challenges for small entities in purchasing or acquiring classes of products and services that promote the cybersecurity of small entities2 7,b7 assess market availability1 market pricing1 and affordability of classes of products and services that promote the cybersecurity of small entities1 with particular attention to identifying high-risk and underserved sectors or regions2 7,c7 estimate the costs and benefits of policies that promote the cybersecurity of small entities1 including-- 7i7 tax breaks2 7ii7 grants and subsidies2 and 7iii7 other incentives as determined appropriate by the ,secretary2 7,d7 describe evidence-based cybersecurity controls and policies that improve the cybersecurity of small entities2 7,e7 with respect to the incentives described in subparagraph 7,c71 recommend measures that can effectively improve cybersecurity at scale for small entities2 and 7,f7 include any other matters as the ,secretary determines relevant4 7#c7 ,specific sectors of small entities ,in preparing the report required under paragraph 7#a71 the ,secretary may include matters applicable for specific sectors of small entities in addition to matters applicable to all small entities4 7#d7 ,consultation ,in preparing the report required under paragraph 7#a71 the ,secretary shall consult with-- 7,a7 the ,administrator1 the ,director of ,,cisa1 and the ,commission2 and 7,b7 small entities1 insurers of risks related to cybersecurity1 ,state governments1 cybersecurity and information technology companies that work with small entities1 and academic and ,federal and non-,federal experts in cybersecurity4 7d7 ,periodic census on state of cybersecurity of small businesses 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 and not less frequently than every #bd months thereafter for #aj years1 the ,administrator shall submit to ,congress and make publicly available data on the state of cybersecurity of small businesses1 including1 to the extent practicable-- 7,a7 adoption of the cybersecurity recommendations from the annual cybersecurity report among small businesses2 7,b7 the most significant and widespread cybersecurity threats facing small businesses2 7,c7 the amount small businesses spend on cybersecurity products and services2 and 7,d7 the personnel small businesses dedicate to cybersecurity1 including the amount of total personnel time1 whether by employees or contractors1 dedicated to cybersecurity efforts4 7#b7 ,voluntary participation ,in carrying out paragraph 7#a71 the ,administrator shall collect data from small businesses that participate on a voluntary basis4 7#c7 ,form ,the data required under paragraph 7#a7 shall be produced in unclassified form but may contain a classified annex4 7#d7 ,consultation ,in preparing to collect the data required under paragraph 7#a71 the ,administrator shall consult with-- 7,a7 the ,secretary1 the ,director of ,,cisa1 and the ,commission2 and 7,b7 small businesses1 insurers of risks related to cybersecurity1 cybersecurity and information technology companies that work with small businesses1 and academic and ,federal and non-,federal experts in cybersecurity4 7#e7 ,privacy ,in carrying out this subsection1 the ,administrator shall ensure that any publicly available data is anonymized and does not reveal personally identifiable information4 7e7 ,rule of construction ,nothing in this section or the amendments made by this section shall be construed to provide any additional regulatory authority to ,,cisa4