115TH CONGRESS 

1ST SESSION S. 770 

AN ACT 

To require the Director of the National Institute of Standards and Technology to disseminate resources to help 

reduce small business cybersecurity risks, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

†S 770 ES

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Making Available In3 formation Now to Strengthen Trust and Resilience and 

4 Enhance Enterprise Technology Cybersecurity Act of 

5 2017’’ or the ‘‘MAIN STREET Cybersecurity Act of 

6 2017’’. 

7 SEC. 2. FINDINGS. 

8 Congress makes the following findings: 

9 (1) Small businesses play a vital role in the 

10 economy of the United States, accounting for 54 

11 percent of all United States sales and 55 percent of 

12 jobs in the United States. 

13 (2) Attacks targeting small and medium busi14 nesses account for a high percentage of cyberattacks 

15 in the United States. 

16 (3) The Cybersecurity Enhancement Act of 

17 2014 (15 U.S.C. 7421 et seq.) calls on the National 

18 Institute of Standards and Technology to facilitate 

19 and support a voluntary public-private partnership 

20 to reduce cybersecurity risks to critical infrastruc21 ture. Such a partnership continues to play a key role 

22 in improving the cyber resilience of the United 

23 States and making cyberspace safer. 

24 (4) There is a need to develop simplified re25 sources that are consistent with the partnership de-
3 

†S 770 ES

1 scribed in paragraph (3) that improves its use by 

2 small businesses. 

3 SEC. 3. IMPROVING CYBERSECURITY OF SMALL BUSI4 NESSES. 

5 (a) DEFINITIONS.—In this section: 

6 (1) DIRECTOR.—The term ‘‘Director’’ means 

7 the Director of the National Institute of Standards 

8 and Technology. 

9 (2) RESOURCES.—The term ‘‘resources’’ means 

10 guidelines, tools, best practices, standards, meth11 odologies, and other ways of providing information. 

12 (3) SMALL BUSINESS CONCERN.—The term 

13 ‘‘small business concern’’ has the meaning given 

14 such term in section 3 of the Small Business Act 

15 (15 U.S.C. 632). 

16 (b) SMALL BUSINESS CYBERSECURITY.—Section 

17 2(e)(1)(A) of the National Institute of Standards and 

18 Technology Act (15 U.S.C. 272(e)(1)(A)) is amended— 

19 (1) in clause (vii), by striking ‘‘and’’ at the end; 

20 (2) by redesignating clause (viii) as clause (ix); 

21 and 

22 (3) by inserting after clause (vii) the following: 

23 ‘‘(viii) consider small business con24 cerns (as defined in section 3 of the Small 

25 Business Act (15 U.S.C. 632)); and’’. 
4 

†S 770 ES

1 (c) DISSEMINATION OF RESOURCES FOR SMALL

2 BUSINESSES.— 

3 (1) IN GENERAL.—Not later than one year 

4 after the date of the enactment of this Act, the Di5 rector, in carrying out section 2(e)(1)(A)(viii) of the 

6 National Institute of Standards and Technology Act, 

7 as added by subsection (b) of this Act, in consulta8 tion with the heads of such other Federal agencies 

9 as the Director considers appropriate, shall dissemi10 nate clear and concise resources for small business 

11 concerns to help reduce their cybersecurity risks. 

12 (2) REQUIREMENTS.—The Director shall en13 sure that the resources disseminated pursuant to 

14 paragraph (1)— 

15 (A) are generally applicable and usable by 

16 a wide range of small business concerns; 

17 (B) vary with the nature and size of the 

18 implementing small business concern, and the 

19 nature and sensitivity of the data collected or 

20 stored on the information systems or devices of 

21 the implementing small business concern; 

22 (C) include elements that promote aware23 ness of simple, basic controls, a workplace cy24 bersecurity culture, and third party stakeholder 
5 

†S 770 ES

1 relationships, to assist small business concerns 

2 in mitigating common cybersecurity risks; 

3 (D) are technology-neutral and can be im4 plemented using technologies that are commer5 cial and off-the-shelf; and 

6 (E) are based on international standards 

7 to the extent possible, and are consistent with 

8 the Stevenson-Wydler Technology Innovation 

9 Act of 1980 (15 U.S.C. 3701 et seq.). 

10 (3) NATIONAL CYBERSECURITY AWARENESS

11 AND EDUCATION PROGRAM.—The Director shall en12 sure that the resources disseminated under para13 graph (1) are consistent with the efforts of the Di14 rector under section 401 of the Cybersecurity En15 hancement Act of 2014 (15 U.S.C. 7451). 

16 (4) SMALL BUSINESS DEVELOPMENT CENTER

17 CYBER STRATEGY.—In carrying out paragraph (1), 

18 the Director, to the extent practicable, shall consider 

19 any methods included in the Small Business Devel20 opment Center Cyber Strategy developed under sec21 tion 1841(a)(3)(B) of the National Defense Author22 ization Act for Fiscal Year 2017 (Public Law 114– 

23 328). 
6 

†S 770 ES

1 (5) VOLUNTARY RESOURCES.—The use of the 

2 resources disseminated under paragraph (1) shall be 

3 considered voluntary. 

4 (6) UPDATES.—The Director shall review and, 

5 if necessary, update the resources disseminated 

6 under paragraph (1) in accordance with the require7 ments under paragraph (2). 

8 (7) PUBLIC AVAILABILITY.—The Director and 

9 such heads of other Federal agencies as the Director 

10 considers appropriate shall each make prominently 

11 available to the public on the Director’s or head’s 

12 Internet website, as the case may be, information 

13 about the resources and all updates to them dissemi14 nated under paragraph (1). The Director and the 

15 heads shall each ensure that the information they re16 spectively make prominently available is consistent, 

17 clear, and concise. 

18 (d) CONSISTENCY OF RESOURCES PUBLISHED BY

19 FEDERAL AGENCIES.—If a Federal agency publishes re20 sources to help small business concerns reduce their cyber21 security risks, the head of such Federal agency, to the de22 gree practicable, shall make such resources consistent with 

23 the resources disseminated under subsection (c)(1). 

24 (e) OTHER FEDERAL CYBERSECURITY REQUIRE25 MENTS.—Nothing in this section may be construed to su-
7 

†S 770 ES

1 persede, alter, or otherwise affect any cybersecurity re2 quirements applicable to Federal agencies. 

Passed the Senate September 28, 2017. 

Attest: 

Secretary. 
115TH CONGRESS 

1ST SESSION S. 770 

AN ACT 

To require the Director of the National Institute of 

rity risks, and for other purposes. sources to help reduce small business cybersecuStandards and Technology to disseminate re-