,,ii ,calendar ,no4 #egc #aagth ,,congress #b;d ,session ,s4 #bdhc ,report ,no4 #aag-bag ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #bg1 #bjba,ms4 ,rosen 7for herself1 ,mr4 ,cornyn1 ,mr4 ,ossoff1 and ,ms4 ,hassan7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,december #e1 #bjbb,reported by ,mr4 ,peters1 with an amendment,strike out all after the enacting clause and insert the part printed in italic ,a ,,bill ,to require the ,director of the ,cybersecurity and ,infrastructure ,security ,agency to establish cybersecurity guidance for small organizations1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,improving ,cybersecurity of ,small ,organizations ,act of #bjba4 #b4 ,improving cybersecurity of small organizations 7a7 ,definitions ,in this section3 7#a7 ,administration ,the term ,administration means the ,small ,business ,administration4 7#b7 ,administrator ,the term ,administrator means the ,administrator of the ,administration4 7#c7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#d7 ,connected device ,the term connected device means any electronic equipment that is-- 7,a7 primarily designed for or marketed to consumers2 7,b7 capable of connecting to the internet or another communication network2 and 7,c7 capable of sending1 receiving1 or processing personal information4 7#e7 ,cybersecurity guidance ,the term cybersecurity guidance means the cybersecurity guidance maintained and promoted under subsections 7b7 and 7c71 respectively4 7#f7 ,director ,the term ,director means the ,director of the ,cybersecurity and ,infrastructure ,security ,agency4 7#g7 ,,nist ,the term ,,nist means the ,national ,institute of ,standards and ,technology4 7#h7 ,secretary ,the term ,secretary means the ,secretary of ,commerce4 7#i7 ,small business ,the term small business has the meaning given the term small business concern in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7#aj7 ,small governmental jurisdiction ,the term small governmental jurisdiction has the meaning given the term in section #fja of title #e1 ,united ,states ,code4 7#aa7 ,small nonprofit ,the term small nonprofit has the meaning given the term small organization in section #fja of title #e1 ,united ,states ,code4 7#ab7 ,small organization ,the term small organization means an organization that is unlikely to employ a specialist in cybersecurity1 including-- 7,a7 a small business2 7,b7 a small nonprofit2 and 7,c7 a small governmental jurisdiction4 7b7 ,cybersecurity guidance 7#a7 ,in general ,the ,director shall maintain cybersecurity guidance that documents and promotes evidence-based cybersecurity policies and controls for use by small organizations1 which shall-- 7,a7 include simple1 basic controls that have the most impact in protecting small organizations against common cybersecurity threats and risks2 7,b7 include guidance to address common cybersecurity threats and risks posed by connected devices that are personal to the employees and contractors of small organizations1 as well as connected devices that are issued to those employees and contractors by small organizations2 and 7,c7 recommend-- 7i7 measures to improve the cybersecurity of small organizations2 and 7ii7 configurations and settings for some of the most commonly used software that can improve the cybersecurity of small organizations4 7#b7 ,consistency ,the ,director shall ensure the cybersecurity guidance maintained under paragraph 7#a7 is consistent with-- 7,a7 cybersecurity resources developed by ,,nist1 as required by the ,,nist ,small ,business ,cybersecurity ,act 7,public ,law #aae-bcf72 and 7,b7 the most recent version of the ,cybersecurity ,framework1 or successor resource1 maintained by ,,nist4 7#c7 ,guidance for specific types of small organizations ,the ,director may include cybersecurity guidance1 as required under paragraph 7#a71 appropriate for specific types of small organizations in addition to guidance applicable for all small organizations4 7#d7 ,updates 7,a7 ,in general ,the ,director shall review the cybersecurity guidance maintained under paragraph 7#a7 not less frequently than annually and update the cybersecurity guidance as appropriate4 7,b7 ,consultation ,in updating the cybersecurity guidance under subparagraph 7,a71 the ,director shall1 to the degree practicable and as appropriate1 consult with-- 7i7 the ,administrator1 the ,secretary1 and the ,commission2 7ii7 small organizations1 insurers1 ,state governments1 companies that work with small organizations1 and academic and ,federal and non-,federal experts in cybersecurity2 and 7iii7 any other entity as determined by the ,director4 7#e7 ,user interface ,as appropriate1 the ,director shall consult with experts regarding the design of a user interface for the cybersecurity guidance4 7c7 ,promotion of cybersecurity guidance for small businesses 7#a7 ,public availability ,the cybersecurity guidance maintained under subsection 7b77#a7 shall be-- 7,a7 made available1 prominently and free of charge1 on the public website of the ,cybersecurity ,infrastructure ,security ,agency2 and 7,b7 linked to from relevant portions of the websites of the ,administration and the ,minority ,business ,development ,agency4 7#b7 ,promotion generally ,the ,director1 the ,administrator1 and the ,secretary shall1 to the degree practicable1 promote the cybersecurity guidance through relevant resources that are intended for or known to be regularly used by small organizations1 including agency documents1 websites1 and events4 7d7 ,report on incentivizing cybersecurity for small organizations 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,secretary shall submit to ,congress a report describing methods to incentivize small organizations to improve their cybersecurity1 including through the adoption of policies1 controls1 products and services that have been demonstrated to reduce cybersecurity risk4 7#b7 ,matters to be included ,the report required under paragraph 7#a7 shall-- 7,a7 identify barriers or challenges for small organizations in purchasing or acquiring products and services that promote the cybersecurity2 7,b7 assess market availability1 market pricing1 and affordability of products and services that promote the cybersecurity for small organizations1 with particular attention to identifying high-risk and underserved sectors or regions2 7,c7 estimate the cost of tax breaks1 grants1 subsidies1 or other incentives to increase the adoption of policies and controls or acquisition of products and services that promote the cybersecurity of small organizations2 7,d7 as practicable1 consult the certifications and requirement for cloud services described in the final report of the ,cyberspace ,solarium ,commission established under section #afeb of the ,john ,s4 ,mc,cain ,national ,defense ,authorization ,act for ,fiscal ,year #bjai 7,public ,law #aae-bcb2 #acb ,stat4 #badj72 7,e7 describe evidence-based cybersecurity controls and policies that improve cybersecurity for small organizations2 7,f7 with respect to the incentives described in subparagraph 7,c71 recommend measures that can effectively improve cybersecurity at scale for small organizations2 and 7,g7 include any other matters as the ,secretary determines relevant4 7#c7 ,guidance for specific types of small organizations ,in preparing the report required under paragraph 7#a71 the ,secretary may include matters applicable for specific types of small organizations in addition to matters applicable to all small organizations4 7#d7 ,consultation ,in preparing the report required under paragraph 7#a71 the ,secretary shall consult with-- 7,a7 the ,administrator1 the ,director1 and the ,commission2 and 7,b7 small organizations1 insurers of risks related to cybersecurity1 ,state governments1 cybersecurity and information technology companies that work with small organizations1 and academic and ,federal and non-,federal experts in cybersecurity4 7e7 ,periodic census on state of cybersecurity of small businesses 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act and not less frequently than every #bd months thereafter for not more than #aj years1 the ,administrator shall submit to ,congress and make publicly available data on the state of cybersecurity of small businesses1 including-- 7,a7 adoption of the cybersecurity guidance among small businesses2 7,b7 the most significant and widespread cybersecurity threats facing small businesses2 7,c7 the amount small businesses spend on cybersecurity products and services2 and 7,d7 the personnel small businesses dedicate to cybersecurity 7including the amount of total personnel time1 whether by employees or contractors1 dedicated to cybersecurity efforts74 7#b7 ,form ,the report required under paragraph 7#a7 shall be produced in unclassified form but may contain a classified annex4 7#c7 ,consultation ,in preparing the report required under paragraph 7#a71 the ,administrator shall consult with-- 7,a7 the ,secretary1 the ,director1 and the ,commission2 and 7,b7 small businesses1 insurers of risks related to cybersecurity1 cybersecurity and information technology companies that work with small businesses1 and academic and ,federal and non-,federal experts in cybersecurity4 #a4 ,short title ,this ,act may be cited as the ,improving ,cybersecurity of ,small ,businesses1 ,nonprofits1 and ,local ,governments ,act of #bjba4 #b4 ,improving cybersecurity of small entities 7a7 ,definitions ,in this section3 7#a7 ,administrator ,the term ,administrator means the ,administrator of the ,small ,business ,administration4 7#b7 ,annual cybersecurity report2 small business2 small entity2 small governmental jurisdiction2 small organization ,the terms annual cybersecurity report1 small business1 small entity1 small governmental jurisdiction1 and small organization have the meanings given those terms in section #bbbj;,d of the ,homeland ,security ,act of #bjjb1 as added by subsection 7b74 7#c7 ,,cisa ,the term ,,cisa means the ,cybersecurity and ,infrastructure ,security ,agency4 7#d7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#e7 ,secretary ,the term ,secretary means the ,secretary of ,commerce4 7b7 ,annual report 7#a7 ,amendment ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended by adding at the end the following3 #bbbj;,d4 ,annual cybersecurity report for small entities 7a7 ,definitions 7#a7 ,administration ,the term ,administration means the ,small ,business ,administration4 7#b7 ,administrator ,the term ,administrator means the ,administrator of the ,administration4 7#c7 ,annual cybersecurity report ,the term annual cybersecurity report means the annual cybersecurity report published and promoted under subsections 7b7 and 7c71 respectively4 7#d7 ,commission ,the term ,commission means the ,federal ,trade ,commission4 7#e7 ,electronic device ,the term electronic device means any electronic equipment that is-- 7,a7 used by an employee or contractor of a small entity for the purpose of performing work for the small entity2 7,b7 capable of connecting to the internet or another communication network2 and 7,c7 capable of sending1 receiving1 or processing personal information4 7#f7 ,,nist ,the term ,,nist means the ,national ,institute of ,standards and ,technology4 7#g7 ,small business ,the term small business has the meaning given the term small business concern in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7#h7 ,small entity ,the term small entity means-- 7,a7 a small business2 7,b7 a small governmental jurisdiction2 and 7,c7 a small organization4 7#i7 ,small governmental jurisdiction ,the term small governmental jurisdiction means governments of cities1 counties1 towns1 townships1 villages1 school districts1 or special districts with a population of less than #ej1jjj4 7#aj7 ,small organization ,the term small organization means any not-for-profit enterprise that is independently owned and operated and is not dominant in its field4 7b7 ,annual cybersecurity report 7#a7 ,in general ,not later than #ahj days after the date of enactment of this section1 and not less frequently than annually thereafter1 the ,director shall publish a report for small entities that documents and promotes evidence-based cybersecurity policies and controls for use by small entities1 which shall-- 7,a7 include basic controls that have the most impact in protecting small entities against common cybersecurity threats and risks2 7,b7 include protocols and policies to address common cybersecurity threats and risks posed by electronic devices1 regardless of whether the electronic devices are-- 7i7 issued by the small entity to employees and contractors of the small entity2 or 7ii7 personal to the employees and contractors of the small entity2 and 7,c7 recommend1 as practicable-- 7i7 measures to improve the cybersecurity of small entities2 and 7ii7 configurations and settings for some of the most commonly used software that can improve the cybersecurity of small entities4 7#b7 ,existing recommendations ,the ,director shall ensure that each annual cybersecurity report published under paragraph 7#a7 incorporates-- 7,a7 cybersecurity resources developed by ,,nist1 as required by the ,,nist ,small ,business ,cybersecurity ,act 7,public ,law #aae-bcf2 #acb ,stat4 #bddd72 and 7,b7 the most recent version of the ,cybersecurity ,framework1 or a successor resource1 maintained by ,,nist4 7#c7 ,consideration for specific types of small entities ,the ,director may include and prioritize the development of cybersecurity recommendations1 as required under paragraph 7#a71 appropriate for specific types of small entities in addition to recommendations applicable for all small entities4 7#d7 ,consultation ,in publishing the annual cybersecurity report under paragraph 7#a71 the ,director shall1 to the degree practicable and as appropriate1 consult with-- 7,a7 the ,administrator1 the ,secretary of ,commerce1 the ,commission1 and the ,director of ,,nist2 7,b7 small entities1 insurers1 ,state governments1 companies that work with small entities1 and academic and ,federal and non-,federal experts in cybersecurity2 and 7,c7 any other entity as determined appropriate by the ,director4 7c7 ,promotion of annual cybersecurity report for small businesses 7#a7 ,publication ,the annual cybersecurity report1 and previous versions of the report as appropriate1 published under subsection 7b77#a7 shall be-- 7,a7 made available1 prominently and free of charge1 on the public website of the ,agency2 and 7,b7 linked to from relevant portions of the websites of the ,administration and the ,minority ,business ,development ,agency1 as determined by the ,administrator and the ,director of the ,minority ,business ,development ,agency1 respectively4 7#b7 ,promotion generally ,the ,director1 the ,administrator1 and the ,secretary of ,commerce shall1 to the degree practicable1 promote the annual cybersecurity report through relevant resources that are intended for or known to be regularly used by small entities1 including agency documents1 websites1 and events4 7d7 ,training and technical assistance ,the ,director1 the ,administrator1 and the ,director of the ,minority ,business ,development ,agency shall make available to employees of small entities voluntary training and technical assistance on how to implement the recommendations of the annual cybersecurity report4 4 7#b7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public #ajg-bif2 #aaf ,stat4 #bace7 is amended by inserting after the item relating to section #bbbj;,c the following3 ,sec4 #bbbj;,d4 ,annual cybersecurity report for small entities4 4 7c7 ,report to ,congress 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 and annually thereafter for #aj years1 the ,secretary shall submit to ,congress a report describing methods to improve the cybersecurity of small entities1 including through the adoption of policies1 controls1 and classes of products and services that have been demonstrated to reduce cybersecurity risk4 7#b7 ,matters to be included ,the report required under paragraph 7#a7 shall-- 7,a7 identify barriers or challenges for small entities in purchasing or acquiring classes of products and services that promote the cybersecurity of small entities2 7,b7 assess market availability1 market pricing1 and affordability of classes of products and services that promote the cybersecurity of small entities1 with particular attention to identifying high-risk and underserved sectors or regions2 7,c7 estimate the costs and benefits of policies that promote the cybersecurity of small entities1 including-- 7i7 tax breaks2 7ii7 grants and subsidies2 and 7iii7 other incentives as determined appropriate by the ,secretary2 7,d7 describe evidence-based cybersecurity controls and policies that improve the cybersecurity of small entities2 7,e7 with respect to the incentives described in subparagraph 7,c71 recommend measures that can effectively improve cybersecurity at scale for small entities2 and 7,f7 include any other matters as the ,secretary determines relevant4 7#c7 ,specific sectors of small entities ,in preparing the report required under paragraph 7#a71 the ,secretary may include matters applicable for specific sectors of small entities in addition to matters applicable to all small entities4 7#d7 ,consultation ,in preparing the report required under paragraph 7#a71 the ,secretary shall consult with-- 7,a7 the ,administrator1 the ,director of ,,cisa1 and the ,commission2 and 7,b7 small entities1 insurers of risks related to cybersecurity1 ,state governments1 cybersecurity and information technology companies that work with small entities1 and academic and ,federal and non-,federal experts in cybersecurity4 7d7 ,periodic census on state of cybersecurity of small businesses 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 and not less frequently than every #bd months thereafter for #aj years1 the ,administrator shall submit to ,congress and make publicly available data on the state of cybersecurity of small businesses1 including1 to the extent practicable-- 7,a7 adoption of the cybersecurity recommendations from the annual cybersecurity report among small businesses2 7,b7 the most significant and widespread cybersecurity threats facing small businesses2 7,c7 the amount small businesses spend on cybersecurity products and services2 and 7,d7 the personnel small businesses dedicate to cybersecurity1 including the amount of total personnel time1 whether by employees or contractors1 dedicated to cybersecurity efforts4 7#b7 ,voluntary participation ,in carrying out paragraph 7#a71 the ,administrator shall collect data from small businesses that participate on a voluntary basis4 7#c7 ,form ,the data required under paragraph 7#a7 shall be produced in unclassified form but may contain a classified annex4 7#d7 ,consultation ,in preparing to collect the data required under paragraph 7#a71 the ,administrator shall consult with-- 7,a7 the ,secretary1 the ,director of ,,cisa1 and the ,commission2 and 7,b7 small businesses1 insurers of risks related to cybersecurity1 cybersecurity and information technology companies that work with small businesses1 and academic and ,federal and non-,federal experts in cybersecurity4 7#e7 ,privacy ,in carrying out this subsection1 the ,administrator shall ensure that any publicly available data is anonymized and does not reveal personally identifiable information4 7e7 ,rule of construction ,nothing in this section or the amendments made by this section shall be construed to provide any additional regulatory authority to ,,cisa4 ,december #e1 #bjbb,reported with an amendment