115TH CONGRESS 

1ST SESSION H. R. 2105 

AN ACT 

To require the Director of the National Institute of Standards and Technology to disseminate guidance to help 

reduce small business cybersecurity risks, and for other 

purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 
2 

•HR 2105 EH

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘NIST Small Business 

3 Cybersecurity Act’’. 

4 SEC. 2. IMPROVING CYBERSECURITY OF SMALL BUSI5 NESSES. 

6 (a) DEFINITIONS.—In this section: 

7 (1) DIRECTOR.—The term ‘‘Director’’ means 

8 the Director of the National Institute of Standards 

9 and Technology. 

10 (2) RESOURCES.—The term ‘‘resources’’ means 

11 guidelines, tools, best practices, standards, meth12 odologies, and other ways of providing information. 

13 (3) SMALL BUSINESS CONCERN.—The term 

14 ‘‘small business concern’’ has the meaning given 

15 such term in section 3 of the Small Business Act 

16 (15 U.S.C. 632). 

17 (b) SMALL BUSINESS CYBERSECURITY.—Section 

18 2(e)(1)(A) of the National Institute of Standards and 

19 Technology Act (15 U.S.C. 272(e)(1)(A)) is amended— 

20 (1) in clause (vii), by striking ‘‘and’’ at the end; 

21 (2) by redesignating clause (viii) as clause (ix); 

22 and 

23 (3) by inserting after clause (vii) the following: 

24 ‘‘(viii) consider small business con25 cerns (as defined in section 3 of the Small 

26 Business Act (15 U.S.C. 632)); and’’. 
3 

•HR 2105 EH

1 (c) DISSEMINATION OF RESOURCES FOR SMALL

2 BUSINESSES.— 

3 (1) IN GENERAL.—Not later than one year 

4 after the date of the enactment of this Act, the Di5 rector, in carrying out section 2(e)(1)(A)(viii) of the 

6 National Institute of Standards and Technology Act, 

7 as added by subsection (b) of this Act, in consulta8 tion with the heads of other appropriate Federal 

9 agencies, shall disseminate clear and concise re10 sources to help small business concerns identify, as11 sess, manage, and reduce their cybersecurity risks. 

12 (2) REQUIREMENTS.—The Director shall en13 sure that the resources disseminated pursuant to 

14 paragraph (1)— 

15 (A) are generally applicable and usable by 

16 a wide range of small business concerns; 

17 (B) vary with the nature and size of the 

18 implementing small business concern, and the 

19 nature and sensitivity of the data collected or 

20 stored on the information systems or devices of 

21 the implementing small business concern; 

22 (C) include elements, that promote aware23 ness of simple, basic controls, a workplace cy24 bersecurity culture, and third-party stakeholder 
4 

•HR 2105 EH

1 relationships, to assist small business concerns 

2 in mitigating common cybersecurity risks; 

3 (D) include case studies of practical appli4 cation; 

5 (E) are technology-neutral and can be im6 plemented using technologies that are commer7 cial and off-the-shelf; and 

8 (F) are based on international standards 

9 to the extent possible, and are consistent with 

10 the Stevenson-Wydler Technology Innovation 

11 Act of 1980 (15 U.S.C. 3701 et seq.). 

12 (3) NATIONAL CYBERSECURITY AWARENESS

13 AND EDUCATION PROGRAM.—The Director shall en14 sure that the resources disseminated under para15 graph (1) are consistent with the efforts of the Di16 rector under section 401 of the Cybersecurity En17 hancement Act of 2014 (15 U.S.C. 7451). 

18 (4) SMALL BUSINESS DEVELOPMENT CENTER

19 CYBER STRATEGY.—In carrying out paragraph (1), 

20 the Director, to the extent practicable, shall consider 

21 any methods included in the Small Business Devel22 opment Center Cyber Strategy developed under sec23 tion 1841(a)(3)(B) of the National Defense Author24 ization Act for Fiscal Year 2017 (Public Law 114– 

25 328). 
5 

•HR 2105 EH

1 (5) VOLUNTARY RESOURCES.—The use of the 

2 resources disseminated under paragraph (1) shall be 

3 considered voluntary. 

4 (6) UPDATES.—The Director shall review and, 

5 if necessary, update the resources disseminated 

6 under paragraph (1) in accordance with the require7 ments under paragraph (2). 

8 (7) PUBLIC AVAILABILITY.—The Director and 

9 the head of each Federal agency that so elects shall 

10 make prominently available on the respective agen11 cy’s public Internet website information about the 

12 resources and updates to the resources disseminated 

13 under paragraph (1). The Director and the heads 

14 shall each ensure that the information they respec15 tively make prominently available is consistent, clear, 

16 and concise. 

17 (d) OTHER FEDERAL CYBERSECURITY REQUIRE18 MENTS.—Nothing in this section may be construed to su19 persede, alter, or otherwise affect any cybersecurity re20 quirements applicable to Federal agencies. 

21 (e) FUNDING.—This Act shall be carried out using 

22 funds otherwise authorized to be appropriated or made 
6 

•HR 2105 EH

1 available to the National Institute of Standards and Tech2 nology. 

Passed the House of Representatives October 11, 

2017. 

Attest: 

Clerk. 

115TH CONGRESS 

1ST SESSION H. R. 2105 

AN ACT 

To require the Director of the National Institute of 

risks, and for other purposes. ance to help reduce small business cybersecurity Standards and Technology to disseminate guid-