Improving Telework Cybersecurity for Small Organizations Act

To improve the cybsersecurity of small organizations with respect to teleworking, and for other purposes. 1. Short title This Act may be cited as the Improving Telework Cybersecurity for Small Organizations Act 2. Small organization telework cybersecurity (a) Definitions In this section: (1) Commission The term Commission (2) Coronavirus public health emergency The term coronavirus public health emergency 42 U.S.C. 247d (3) Director The term Director (4) Small business The term small business small business concern 15 U.S.C. 632 (5) Small governmental jurisdiction The term small governmental jurisdiction (6) Small nonprofit The term small nonprofit (7) Small organization The term small organization (A) a small business; (B) a small nonprofit; and (C) a small governmental jurisdiction. (b) Cybersecurity and Infrastructure Security Agency telework guidance for small organizations (1) In general Not later than 45 days after the date of enactment of this Act, the Director, in consultation with the Commission, shall publish a resource on the website of the Cybersecurity and Infrastructure Security Agency describing best practices a small organization may take to improve cybersecurity with respect to teleworking. (2) Contents The resource required under paragraph (1) shall— (A) include basic steps that have the most impact in improving the security of teleworking for a small organization; (B) recommend, as practicable, configurations and settings for commonly used software that can improve the cybersecurity of small organizations with increased teleworking; and (C) be consistent with— (i) relevant standards and guidelines published by the Director of the National Institute of Standards and Technology; (ii) guidance from the Director entitled Telework Guidance and Resources (iii) Alert (AA20–073A) regarding Enterprise VPN Security issued by the Director on March 13, 2020, or any successor guidance. (c) Federal Trade Commission Program To Assist Cybersecurity Efforts Not later than 30 days after the publishing of the resource required under subsection (b), the Commission, in coordination with the Director, shall establish a program— (1) to educate consumers and small organizations on improving the cybersecurity of the technologies increasingly used for distance learning, telemedicine, and telework as a result of the coronavirus public health emergency; and (2) that shall be consistent with the resource required under subsection (b).

Summary: Improving Telework Cybersecurity for Small Organizations Act This bill requires the Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Trade Commission (FTC) to take certain actions related to improving telework cybersecurity for small organizations. Specifically, CISA must publish a resource on its website describing best practices a small organization may take to improve cybersecurity with respect to teleworking. The FTC must establish a program consistent with this resource to educate consumers and small organizations on improving the cybersecurity of technologies used for distance learning, telemedicine, and telework as a result of the COVID-19 (i.e., coronavirus disease 2019) public health emergency.