In the House of Representatives, U. S., 

July 25, 2018. 

Resolved, That the bill from the Senate (S. 770) entitled 

‘‘An Act to require the Director of the National Institute of 

Standards and Technology to disseminate resources to help 

reduce small business cybersecurity risks, and for other purposes.’’, do pass with the following 

AMENDMENTS: 

Strike out all after the enacting clause and insert: 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘NIST Small Business 

3 Cybersecurity Act’’. 

4 SEC. 2. IMPROVING CYBERSECURITY OF SMALL BUSI5 NESSES. 

6 (a) DEFINITIONS.—In this section: 

7 (1) DIRECTOR.—The term ‘‘Director’’ means the 

8 Director of the National Institute of Standards and 

9 Technology. 

10 (2) RESOURCES.—The term ‘‘resources’’ means 

11 guidelines, tools, best practices, standards, methodolo12 gies, and other ways of providing information. 

13 (3) SMALL BUSINESS CONCERN.—The term 

14 ‘‘small business concern’’ has the meaning given such 
2 

•S 770 EAH 

1 term in section 3 of the Small Business Act (15 

2 U.S.C. 632). 

3 (b) SMALL BUSINESS CYBERSECURITY.—Section 

4 2(e)(1)(A) of the National Institute of Standards and Tech5 nology Act (15 U.S.C. 272(e)(1)(A)) is amended— 

6 (1) in clause (vii), by striking ‘‘and’’ at the end; 

7 (2) by redesignating clause (viii) as clause (ix); 

8 and 

9 (3) by inserting after clause (vii) the following: 

10 ‘‘(viii) consider small business concerns 

11 (as defined in section 3 of the Small Busi12 ness Act (15 U.S.C. 632)); and’’. 

13 (c) DISSEMINATION OF RESOURCES FOR SMALL BUSI14 NESSES.— 

15 (1) IN GENERAL.—Not later than one year after 

16 the date of the enactment of this Act, the Director, in 

17 carrying out section 2(e)(1)(A)(viii) of the National 

18 Institute of Standards and Technology Act, as added 

19 by subsection (b) of this Act, in consultation with the 

20 heads of other appropriate Federal agencies, shall dis21 seminate clear and concise resources to help small 

22 business concerns identify, assess, manage, and reduce 

23 their cybersecurity risks. 
3 

•S 770 EAH 

1 (2) REQUIREMENTS.—The Director shall ensure 

2 that the resources disseminated pursuant to para3 graph (1)— 

4 (A) are generally applicable and usable by 

5 a wide range of small business concerns; 

6 (B) vary with the nature and size of the im7 plementing small business concern, and the na8 ture and sensitivity of the data collected or 

9 stored on the information systems or devices of 

10 the implementing small business concern; 

11 (C) include elements, that promote aware12 ness of simple, basic controls, a workplace cyber13 security culture, and third-party stakeholder re14 lationships, to assist small business concerns in 

15 mitigating common cybersecurity risks; 

16 (D) include case studies of practical appli17 cation; 

18 (E) are technology-neutral and can be im19 plemented using technologies that are commercial 

20 and off-the-shelf; and 

21 (F) are based on international standards to 

22 the extent possible, and are consistent with the 

23 Stevenson-Wydler Technology Innovation Act of 

24 1980 (15 U.S.C. 3701 et seq.). 
4 

•S 770 EAH 

1 (3) NATIONAL CYBERSECURITY AWARENESS AND

2 EDUCATION PROGRAM.—The Director shall ensure 

3 that the resources disseminated under paragraph (1) 

4 are consistent with the efforts of the Director under 

5 section 401 of the Cybersecurity Enhancement Act of 

6 2014 (15 U.S.C. 7451). 

7 (4) SMALL BUSINESS DEVELOPMENT CENTER

8 CYBER STRATEGY.—In carrying out paragraph (1), 

9 the Director, to the extent practicable, shall consider 

10 any methods included in the Small Business Develop11 ment Center Cyber Strategy developed under section 

12 1841(a)(3)(B) of the National Defense Authorization 

13 Act for Fiscal Year 2017 (Public Law 114–328). 

14 (5) VOLUNTARY RESOURCES.—The use of the re15 sources disseminated under paragraph (1) shall be 

16 considered voluntary. 

17 (6) UPDATES.—The Director shall review and, if 

18 necessary, update the resources disseminated under 

19 paragraph (1) in accordance with the requirements 

20 under paragraph (2). 

21 (7) PUBLIC AVAILABILITY.—The Director and the 

22 head of each Federal agency that so elects shall make 

23 prominently available on the respective agency’s pub24 lic Internet website information about the resources 

25 and updates to the resources disseminated under 
5 

•S 770 EAH 

1 paragraph (1). The Director and the heads shall each 

2 ensure that the information they respectively make 

3 prominently available is consistent, clear, and con4 cise. 

5 (d) OTHER FEDERAL CYBERSECURITY REQUIRE6 MENTS.—Nothing in this section may be construed to super7 sede, alter, or otherwise affect any cybersecurity require8 ments applicable to Federal agencies. 

9 (e) FUNDING.—This Act shall be carried out using 

10 funds otherwise authorized to be appropriated or made 

11 available to the National Institute of Standards and Tech12 nology. 

Amend the title so as to read: ‘‘An Act to require 

the Director of the National Institute of Standards and 

Technology to disseminate guidance to help reduce small 

business cybersecurity risks, and for other purposes.’’. 

Attest: 

Clerk. 
115TH CONGRESS 

2D SESSION S. 770 

AMENDMENTS