I 

116TH CONGRESS 

2D SESSION H. R. 8379 

To require the Director of the Cybersecurity and Infrastructure Security 

Agency to establish cybersecurity guidance for small organizations, and 

for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

SEPTEMBER 24, 2020 

Ms. ESHOO (for herself and Mr. KATKO) introduced the following bill; which 

was referred to the Committee on Small Business, and in addition to the 

Committee on Homeland Security, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions 

as fall within the jurisdiction of the committee concerned 

A BILL 

To require the Director of the Cybersecurity and Infrastructure Security Agency to establish cybersecurity guidance 

for small organizations, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Improving Cybersecu5 rity of Small Organizations Act of 2020’’. 

6 SEC. 2. IMPROVING CYBERSECURITY OF SMALL ORGANIZA7 TIONS. 

8 (a) DEFINITIONS.—In this section: 


pamtmann on DSKBC07HB2PROD with BILLS
2 

•HR 8379 IH

1 (1) ADMINISTRATION.—The term ‘‘Administra2 tion’’ means the Small Business Administration. 

3 (2) ADMINISTRATOR.—The term ‘‘Adminis4 trator’’ means the Administrator of the Administra5 tion. 

6 (3) COMMISSION.—The term ‘‘Commission’’ 

7 means the Federal Trade Commission. 

8 (4) CYBERSECURITY GUIDANCE.—The term 

9 ‘‘cybersecurity guidance’’ means the cybersecurity 

10 guidance documented and promoted in the resource 

11 maintained under section 3(a). 

12 (5) DIRECTOR.—The term ‘‘Director’’ means 

13 the Director of the Cybersecurity and Infrastructure 

14 Security Agency. 

15 (6) NIST.—The term ‘‘NIST’’ means the Na16 tional Institute of Standards and Technology. 

17 (7) SECRETARY.—The term ‘‘Secretary’’ means 

18 the Secretary of Commerce. 

19 (8) SMALL BUSINESS.—The term ‘‘small busi20 ness’’ has the meaning given the term ‘‘small busi21 ness concern’’ under section 3 of the Small Business 

22 Act (15 U.S.C. 632). 

23 (9) SMALL GOVERNMENTAL JURISDICTION.— 

24 The term ‘‘small governmental jurisdiction’’ has the 


pamtmann on DSKBC07HB2PROD with BILLS
3 

•HR 8379 IH

1 meaning given the term in section 601 of title 5, 

2 United States Code. 

3 (10) SMALL NONPROFIT.—The term ‘‘small 

4 nonprofit’’ has the meaning given the term ‘‘small 

5 organization’’ in section 601 of title 5, United States 

6 Code. 

7 (11) SMALL ORGANIZATION.—The term ‘‘small 

8 organization’’ means an organization that is unlikely 

9 to employ a specialist in cybersecurity, including— 

10 (A) a small business; 

11 (B) a small nonprofit; and 

12 (C) a small governmental jurisdiction. 

13 (b) CYBERSECURITY GUIDANCE.— 

14 (1) IN GENERAL.—The Director shall maintain 

15 cybersecurity guidance that documents and promotes 

16 evidence-based cybersecurity policies and controls for 

17 use by small organizations, which shall— 

18 (A) include simple, basic controls that have 

19 the most impact in protecting small organiza20 tions against common cybersecurity threats and 

21 risks; 

22 (B) include guidance to address common 

23 cybersecurity threats and risks posed by elec24 tronic devices that are personal to the employ25 ees and contractors of small organizations, as 


pamtmann on DSKBC07HB2PROD with BILLS
4 

•HR 8379 IH

1 well as electronic devices that are issued to 

2 those employees and contractors by small orga3 nizations; and 

4 (C) recommend— 

5 (i) measures to improve the cybersecu6 rity of small organizations; and 

7 (ii) configurations and settings for 

8 some of the most commonly used software 

9 that can improve the cybersecurity of small 

10 organizations. 

11 (2) CONSISTENCY.—The Director shall ensure 

12 the cybersecurity guidance maintained under para13 graph (1) is consistent with— 

14 (A) cybersecurity resources developed by 

15 NIST, as required by the NIST Small Business 

16 Cybersecurity Act (Public Law 115–236); and 

17 (B) the most recent version of the Cyberse18 curity Framework, or successor resource, main19 tained by NIST. 

20 (3) GUIDANCE FOR SPECIFIC TYPES OF SMALL

21 ORGANIZATIONS.—The Director may include cyber22 security guidance, as required under paragraph (1), 

23 appropriate for specific types of small organizations 

24 in addition to guidance applicable for all small orga25 nizations. 


pamtmann on DSKBC07HB2PROD with BILLS
5 

•HR 8379 IH

1 (4) UPDATES.— 

2 (A) IN GENERAL.—The Director shall re3 view the cybersecurity guidance maintained 

4 under paragraph (1) not less frequently than 

5 annually and update as appropriate. 

6 (B) CONSULTATION.—In updating the cy7 bersecurity guidance under subparagraph (A), 

8 the Director shall, to the degree practicable and 

9 as appropriate, consult with— 

10 (i) the Administrator, the Secretary, 

11 and the Commission; 

12 (ii) small organizations, insurers, 

13 State governments, companies that work 

14 with small organizations, and academic 

15 and Federal and non-Federal experts in 

16 cybersecurity; and 

17 (iii) any other entity as determined by 

18 the Director. 

19 (5) USER INTERFACE.—As appropriate, the Di20 rector shall consult with experts regarding the de21 sign of a user interface for the cybersecurity guid22 ance. 

23 (c) PROMOTION OF CYBERSECURITY GUIDANCE FOR

24 SMALL BUSINESSES.— 


pamtmann on DSKBC07HB2PROD with BILLS
6 

•HR 8379 IH

1 (1) PUBLIC AVAILABILITY.—The cybersecurity 

2 guidance maintained under subsection (b)(1) shall 

3 be— 

4 (A) made available, prominently and free 

5 of charge, on the public website of the Cyberse6 curity Infrastructure Security Agency; and 

7 (B) linked to from relevant portions of the 

8 websites of the Administration and the Minority 

9 Business Development Agency. 

10 (2) PROMOTION GENERALLY.—The Director, 

11 the Administrator, and the Secretary shall, to the 

12 degree practicable, promote the cybersecurity guid13 ance through relevant resources that are intended 

14 for or known to be regularly used by small organiza15 tions, including agency documents, websites, and 

16 events. 

17 (d) REPORT ON INCENTIVIZING CYBERSECURITY FOR

18 SMALL ORGANIZATIONS.— 

19 (1) IN GENERAL.—Not later than one year 

20 after the date of the enactment of this Act, the Sec21 retary shall submit to Congress a report describing 

22 methods to incentivize small organizations to im23 prove their cybersecurity, including through the 

24 adoption of policies, controls, products, and services 


pamtmann on DSKBC07HB2PROD with BILLS
7 

•HR 8379 IH

1 that have been demonstrated to reduce cybersecurity 

2 risk. 

3 (2) MATTERS TO BE INCLUDED.—The report 

4 required under paragraph (1) shall— 

5 (A) identify barriers or challenges for 

6 small organizations in purchasing or acquiring 

7 products and services that promote the cyberse8 curity; 

9 (B) assess market availability, market pric10 ing, and affordability of products and services 

11 that promote the cybersecurity for small organi12 zations, with particular attention to identifying 

13 high-risk and underserved sectors or regions; 

14 (C) estimate the cost of tax breaks, grants, 

15 subsidies, or other incentives to increase the 

16 adoption of policies and controls or acquisition 

17 of products and services that promote the cy18 bersecurity, for small organizations; 

19 (D) as practicable, consult the certifi20 cations and requirement for cloud services de21 scribed in the final report of the Cyberspace So22 larium Commission established under section 

23 1652 of the John S. McCain National Defense 

24 Authorization Act for Fiscal Year 2019 (Public 

25 Law 115–232; 132 Stat. 2140); 


pamtmann on DSKBC07HB2PROD with BILLS
8 

•HR 8379 IH

1 (E) describe evidence-based cybersecurity 

2 controls and policies that improve cybersecurity 

3 for small organizations; 

4 (F) with respect to the incentives described 

5 in subparagraph (C), recommend measures that 

6 can effectively improve cybersecurity at scale 

7 for small organizations; and 

8 (G) include any other matters the Sec9 retary deems relevant. 

10 (3) GUIDANCE FOR SPECIFIC TYPES OF SMALL

11 ORGANIZATIONS.—In preparing the report required 

12 under paragraph (1), the Secretary may include 

13 matters applicable for specific types of small organi14 zations in addition to matters applicable to all small 

15 organizations. 

16 (4) CONSULTATION.—In preparing the report 

17 required under paragraph (1), the Secretary shall 

18 consult with— 

19 (A) the Administrator, the Director, and 

20 the Commission; and 

21 (B) small organizations, insurers of risks 

22 related to cybersecurity, State governments, cy23 bersecurity and information technology compa24 nies that work with small organizations, and 


pamtmann on DSKBC07HB2PROD with BILLS
9 

•HR 8379 IH

1 academic and Federal and non-Federal experts 

2 in cybersecurity. 

3 (e) PERIODIC CENSUS ON STATE OF CYBERSECURITY

4 OF SMALL BUSINESSES.— 

5 (1) IN GENERAL.—Not later than one year 

6 after the date of enactment of this Act and not less 

7 frequently than every 24 months thereafter for not 

8 more than 10 years, the Administrator shall submit 

9 to Congress and make publicly available data on the 

10 state of cybersecurity of small businesses, includ11 ing— 

12 (A) adoption of the cybersecurity guidance 

13 among small businesses; 

14 (B) the most significant and widespread 

15 cybersecurity threats facing small businesses; 

16 (C) the amount small businesses spend on 

17 cybersecurity products and services; and 

18 (D) the personnel small businesses dedi19 cate to cybersecurity (including the amount of 

20 total personnel time, whether by employees or 

21 contractors, dedicated to cybersecurity efforts). 

22 (2) FORM.—The report required under para23 graph (1) shall be produced in unclassified form but 

24 may contain a classified annex. 


pamtmann on DSKBC07HB2PROD with BILLS
10 

•HR 8379 IH

1 (3) CONSULTATION.—In preparing the report 

2 required under paragraph (1), the Administrator 

3 shall consult with— 

4 (A) the Secretary, the Director, and the 

5 Commission; and 

6 (B) small businesses, insurers of risks re7 lated to cybersecurity, cybersecurity and infor8 mation technology companies that work with 

9 small businesses, and academic and Federal 

10 and non-Federal experts in cybersecurity. 

Æ 


pamtmann on DSKBC07HB2PROD with BILLS