II 

★(Star Print)

116TH CONGRESS 

2D SESSION S. 4920 

To improve the cybsersecurity of small organizations with respect to 

teleworking, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

NOVEMBER 18, 2020 

Ms. ROSEN (for herself and Mr. MORAN) introduced the following bill; which 

was read twice and referred to the Committee on Homeland Security and 

Governmental Affairs 

A BILL 

To improve the cybsersecurity of small organizations with 

respect to teleworking, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Improving Telework 

5 Cybersecurity for Small Organizations Act’’. 

6 SEC. 2. SMALL ORGANIZATION TELEWORK CYBERSECU7 RITY. 

8 (a) DEFINITIONS.—In this section: 

9 (1) COMMISSION.—The term ‘‘Commission’’ 

10 means the Federal Trade Commission. 


pbinns on DSKJLVW7X2PROD with BILLS
2 

S 4920 IS1S 

1 (2) CORONAVIRUS PUBLIC HEALTH EMER2 GENCY.—The term ‘‘coronavirus public health emer3 gency’’ means the public health emergency declared 

4 by the Secretary of Health and Human Services 

5 pursuant to section 319 of the Public Health Service 

6 Act (42 U.S.C. 247d) on January 31, 2020, as a re7 sult of confirmed cases of COVID–19. 

8 (3) DIRECTOR.—The term ‘‘Director’’ means 

9 the Director of the Cybersecurity and Infrastructure 

10 Security Agency. 

11 (4) SMALL BUSINESS.—The term ‘‘small busi12 ness’’ has the meaning given the term ‘‘small busi13 ness concern’’ in section 3 of the Small Business Act 

14 (15 U.S.C. 632) and any associated regulations pro15 mulgated by the Administrator of the Small Busi16 ness Administration. 

17 (5) SMALL GOVERNMENTAL JURISDICTION.— 

18 The term ‘‘small governmental jurisdiction’’ means 

19 governments of cities, counties, towns, townships, 

20 villages, school districts, or special districts, with a 

21 population of less than 50,000. 

22 (6) SMALL NONPROFIT.—The term ‘‘small non23 profit’’ means any not-for-profit enterprise that is 

24 independently owned and operated and is not domi25 nant in its field. 


pbinns on DSKJLVW7X2PROD with BILLS
3 

S 4920 IS1S 

1 (7) SMALL ORGANIZATION.—The term ‘‘small 

2 organization’’ means organizations unlikely to em3 ploy a specialist in cybersecurity, including— 

4 (A) a small business; 

5 (B) a small nonprofit; and 

6 (C) a small governmental jurisdiction. 

7 (b) CYBERSECURITY AND INFRASTRUCTURE SECU8 RITY AGENCY TELEWORK GUIDANCE FOR SMALL ORGA9 NIZATIONS.— 

10 (1) IN GENERAL.—Not later than 45 days after 

11 the date of enactment of this Act, the Director, in 

12 consultation with the Commission, shall publish a re13 source on the website of the Cybersecurity and In14 frastructure Security Agency describing best prac15 tices a small organization may take to improve cy16 bersecurity with respect to teleworking. 

17 (2) CONTENTS.—The resource required under 

18 paragraph (1) shall— 

19 (A) include basic steps that have the most 

20 impact in improving the security of teleworking 

21 for a small organization; 

22 (B) recommend, as practicable, configura23 tions and settings for commonly used software 

24 that can improve the cybersecurity of small or25 ganizations with increased teleworking; and 


pbinns on DSKJLVW7X2PROD with BILLS
4 

S 4920 IS1S 

1 (C) be consistent with— 

2 (i) relevant standards and guidelines 

3 published by the Director of the National 

4 Institute of Standards and Technology; 

5 (ii) guidance from the Director enti6 tled ‘‘Telework Guidance and Resources’’, 

7 issued on April 24, 2020, or any successor 

8 guidance; and 

9 (iii) Alert (AA20–073A) regarding 

10 Enterprise VPN Security issued by the Di11 rector on March 13, 2020, or any suc12 cessor guidance. 

13 (c) FEDERAL TRADE COMMISSION PROGRAM TO AS14 SIST CYBERSECURITY EFFORTS.—Not later than 30 days 

15 after the publishing of the resource required under sub16 section (b), the Commission, in coordination with the Di17 rector, shall establish a program— 

18 (1) to educate consumers and small organiza19 tions on improving the cybersecurity of the tech20 nologies increasingly used for distance learning, tele21 medicine, and telework as a result of the coronavirus 

22 public health emergency; and 

23 (2) that shall be consistent with the resource 

24 required under subsection (b). 

Æ 


pbinns on DSKJLVW7X2PROD with BILLS