Improving Cybersecurity of Small Businesses, Nonprofits, and Local Governments Act of 2021

To require the Director of the Cybersecurity and Infrastructure Security Agency to establish cybersecurity guidance for small organizations, and for other purposes. 1. Short title This Act may be cited as the Improving Cybersecurity of Small Organizations Act of 2021 2. Improving cybersecurity of small organizations (a) Definitions In this section: (1) Administration The term Administration (2) Administrator The term Administrator (3) Commission The term Commission (4) Connected device The term connected device (A) primarily designed for or marketed to consumers; (B) capable of connecting to the internet or another communication network; and (C) capable of sending, receiving, or processing personal information. (5) Cybersecurity guidance The term cybersecurity guidance (6) Director The term Director (7) NIST The term NIST (8) Secretary The term Secretary (9) Small business The term small business small business concern 15 U.S.C. 632 (10) Small governmental jurisdiction The term small governmental jurisdiction (11) Small nonprofit The term small nonprofit small organization (12) Small organization The term small organization (A) a small business; (B) a small nonprofit; and (C) a small governmental jurisdiction. (b) Cybersecurity guidance (1) In general The Director shall maintain cybersecurity guidance that documents and promotes evidence-based cybersecurity policies and controls for use by small organizations, which shall— (A) include simple, basic controls that have the most impact in protecting small organizations against common cybersecurity threats and risks; (B) include guidance to address common cybersecurity threats and risks posed by connected devices that are personal to the employees and contractors of small organizations, as well as connected devices that are issued to those employees and contractors by small organizations; and (C) recommend— (i) measures to improve the cybersecurity of small organizations; and (ii) configurations and settings for some of the most commonly used software that can improve the cybersecurity of small organizations. (2) Consistency The Director shall ensure the cybersecurity guidance maintained under paragraph (1) is consistent with— (A) cybersecurity resources developed by NIST, as required by the NIST Small Business Cybersecurity Act ( Public Law 115–236 (B) the most recent version of the Cybersecurity Framework, or successor resource, maintained by NIST. (3) Guidance for specific types of small organizations The Director may include cybersecurity guidance, as required under paragraph (1), appropriate for specific types of small organizations in addition to guidance applicable for all small organizations. (4) Updates (A) In general The Director shall review the cybersecurity guidance maintained under paragraph (1) not less frequently than annually and update the cybersecurity guidance as appropriate. (B) Consultation In updating the cybersecurity guidance under subparagraph (A), the Director shall, to the degree practicable and as appropriate, consult with— (i) the Administrator, the Secretary, and the Commission; (ii) small organizations, insurers, State governments, companies that work with small organizations, and academic and Federal and non-Federal experts in cybersecurity; and (iii) any other entity as determined by the Director. (5) User interface As appropriate, the Director shall consult with experts regarding the design of a user interface for the cybersecurity guidance. (c) Promotion of cybersecurity guidance for small businesses (1) Public availability The cybersecurity guidance maintained under subsection (b)(1) shall be— (A) made available, prominently and free of charge, on the public website of the Cybersecurity Infrastructure Security Agency; and (B) linked to from relevant portions of the websites of the Administration and the Minority Business Development Agency. (2) Promotion generally The Director, the Administrator, and the Secretary shall, to the degree practicable, promote the cybersecurity guidance through relevant resources that are intended for or known to be regularly used by small organizations, including agency documents, websites, and events. (d) Report on incentivizing cybersecurity for small organizations (1) In general Not later than 1 year after the date of enactment of this Act, the Secretary shall submit to Congress a report describing methods to incentivize small organizations to improve their cybersecurity, including through the adoption of policies, controls, products and services that have been demonstrated to reduce cybersecurity risk. (2) Matters to be included The report required under paragraph (1) shall— (A) identify barriers or challenges for small organizations in purchasing or acquiring products and services that promote the cybersecurity; (B) assess market availability, market pricing, and affordability of products and services that promote the cybersecurity for small organizations, with particular attention to identifying high-risk and underserved sectors or regions; (C) estimate the cost of tax breaks, grants, subsidies, or other incentives to increase the adoption of policies and controls or acquisition of products and services that promote the cybersecurity of small organizations; (D) as practicable, consult the certifications and requirement for cloud services described in the final report of the Cyberspace Solarium Commission established under section 1652 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 ( Public Law 115–232 (E) describe evidence-based cybersecurity controls and policies that improve cybersecurity for small organizations; (F) with respect to the incentives described in subparagraph (C), recommend measures that can effectively improve cybersecurity at scale for small organizations; and (G) include any other matters as the Secretary determines relevant. (3) Guidance for specific types of small organizations In preparing the report required under paragraph (1), the Secretary may include matters applicable for specific types of small organizations in addition to matters applicable to all small organizations. (4) Consultation In preparing the report required under paragraph (1), the Secretary shall consult with— (A) the Administrator, the Director, and the Commission; and (B) small organizations, insurers of risks related to cybersecurity, State governments, cybersecurity and information technology companies that work with small organizations, and academic and Federal and non-Federal experts in cybersecurity. (e) Periodic census on state of cybersecurity of small businesses (1) In general Not later than 1 year after the date of enactment of this Act and not less frequently than every 24 months thereafter for not more than 10 years, the Administrator shall submit to Congress and make publicly available data on the state of cybersecurity of small businesses, including— (A) adoption of the cybersecurity guidance among small businesses; (B) the most significant and widespread cybersecurity threats facing small businesses; (C) the amount small businesses spend on cybersecurity products and services; and (D) the personnel small businesses dedicate to cybersecurity (including the amount of total personnel time, whether by employees or contractors, dedicated to cybersecurity efforts). (2) Form The report required under paragraph (1) shall be produced in unclassified form but may contain a classified annex. (3) Consultation In preparing the report required under paragraph (1), the Administrator shall consult with— (A) the Secretary, the Director, and the Commission; and (B) small businesses, insurers of risks related to cybersecurity, cybersecurity and information technology companies that work with small businesses, and academic and Federal and non-Federal experts in cybersecurity. 1. Short title This Act may be cited as the Improving Cybersecurity of Small Businesses, Nonprofits, and Local Governments Act of 2021 2. Improving cybersecurity of small entities (a) Definitions In this section: (1) Administrator The term Administrator (2) Annual cybersecurity report; small business; small entity; small governmental jurisdiction; small organization The terms annual cybersecurity report small business small entity small governmental jurisdiction small organization (3) CISA The term CISA (4) Commission The term Commission (5) Secretary The term Secretary (b) Annual report (1) Amendment Subtitle A of title XXII of the Homeland Security Act of 2002 ( 6 U.S.C. 651 et seq. 2220D. Annual cybersecurity report for small entities (a) Definitions (1) Administration The term Administration (2) Administrator The term Administrator (3) Annual cybersecurity report The term annual cybersecurity report (4) Commission The term Commission (5) Electronic device The term electronic device (A) used by an employee or contractor of a small entity for the purpose of performing work for the small entity; (B) capable of connecting to the internet or another communication network; and (C) capable of sending, receiving, or processing personal information. (6) NIST The term NIST (7) Small business The term small business small business concern 15 U.S.C. 632 (8) Small entity The term small entity (A) a small business; (B) a small governmental jurisdiction; and (C) a small organization. (9) Small governmental jurisdiction The term small governmental jurisdiction (10) Small organization The term small organization (b) Annual cybersecurity report (1) In general Not later than 180 days after the date of enactment of this section, and not less frequently than annually thereafter, the Director shall publish a report for small entities that documents and promotes evidence-based cybersecurity policies and controls for use by small entities, which shall— (A) include basic controls that have the most impact in protecting small entities against common cybersecurity threats and risks; (B) include protocols and policies to address common cybersecurity threats and risks posed by electronic devices, regardless of whether the electronic devices are— (i) issued by the small entity to employees and contractors of the small entity; or (ii) personal to the employees and contractors of the small entity; and (C) recommend, as practicable— (i) measures to improve the cybersecurity of small entities; and (ii) configurations and settings for some of the most commonly used software that can improve the cybersecurity of small entities. (2) Existing recommendations The Director shall ensure that each annual cybersecurity report published under paragraph (1) incorporates— (A) cybersecurity resources developed by NIST, as required by the NIST Small Business Cybersecurity Act ( Public Law 115–236 (B) the most recent version of the Cybersecurity Framework, or a successor resource, maintained by NIST. (3) Consideration for specific types of small entities The Director may include and prioritize the development of cybersecurity recommendations, as required under paragraph (1), appropriate for specific types of small entities in addition to recommendations applicable for all small entities. (4) Consultation In publishing the annual cybersecurity report under paragraph (1), the Director shall, to the degree practicable and as appropriate, consult with— (A) the Administrator, the Secretary of Commerce, the Commission, and the Director of NIST; (B) small entities, insurers, State governments, companies that work with small entities, and academic and Federal and non-Federal experts in cybersecurity; and (C) any other entity as determined appropriate by the Director. (c) Promotion of annual cybersecurity report for small businesses (1) Publication The annual cybersecurity report, and previous versions of the report as appropriate, published under subsection (b)(1) shall be— (A) made available, prominently and free of charge, on the public website of the Agency; and (B) linked to from relevant portions of the websites of the Administration and the Minority Business Development Agency, as determined by the Administrator and the Director of the Minority Business Development Agency, respectively. (2) Promotion generally The Director, the Administrator, and the Secretary of Commerce shall, to the degree practicable, promote the annual cybersecurity report through relevant resources that are intended for or known to be regularly used by small entities, including agency documents, websites, and events. (d) Training and technical assistance The Director, the Administrator, and the Director of the Minority Business Development Agency shall make available to employees of small entities voluntary training and technical assistance on how to implement the recommendations of the annual cybersecurity report. . (2) Technical and conforming amendment The table of contents in section 1(b) of the Homeland Security Act of 2002 (Public 107–296; 116 Stat. 2135) is amended by inserting after the item relating to section 2220C the following: Sec. 2220D. Annual cybersecurity report for small entities. . (c) Report to Congress (1) In general Not later than 1 year after the date of enactment of this Act, and annually thereafter for 10 years, the Secretary shall submit to Congress a report describing methods to improve the cybersecurity of small entities, including through the adoption of policies, controls, and classes of products and services that have been demonstrated to reduce cybersecurity risk. (2) Matters to be included The report required under paragraph (1) shall— (A) identify barriers or challenges for small entities in purchasing or acquiring classes of products and services that promote the cybersecurity of small entities; (B) assess market availability, market pricing, and affordability of classes of products and services that promote the cybersecurity of small entities, with particular attention to identifying high-risk and underserved sectors or regions; (C) estimate the costs and benefits of policies that promote the cybersecurity of small entities, including— (i) tax breaks; (ii) grants and subsidies; and (iii) other incentives as determined appropriate by the Secretary; (D) describe evidence-based cybersecurity controls and policies that improve the cybersecurity of small entities; (E) with respect to the incentives described in subparagraph (C), recommend measures that can effectively improve cybersecurity at scale for small entities; and (F) include any other matters as the Secretary determines relevant. (3) Specific sectors of small entities In preparing the report required under paragraph (1), the Secretary may include matters applicable for specific sectors of small entities in addition to matters applicable to all small entities. (4) Consultation In preparing the report required under paragraph (1), the Secretary shall consult with— (A) the Administrator, the Director of CISA, and the Commission; and (B) small entities, insurers of risks related to cybersecurity, State governments, cybersecurity and information technology companies that work with small entities, and academic and Federal and non-Federal experts in cybersecurity. (d) Periodic census on state of cybersecurity of small businesses (1) In general Not later than 1 year after the date of enactment of this Act, and not less frequently than every 24 months thereafter for 10 years, the Administrator shall submit to Congress and make publicly available data on the state of cybersecurity of small businesses, including, to the extent practicable— (A) adoption of the cybersecurity recommendations from the annual cybersecurity report among small businesses; (B) the most significant and widespread cybersecurity threats facing small businesses; (C) the amount small businesses spend on cybersecurity products and services; and (D) the personnel small businesses dedicate to cybersecurity, including the amount of total personnel time, whether by employees or contractors, dedicated to cybersecurity efforts. (2) Voluntary participation In carrying out paragraph (1), the Administrator shall collect data from small businesses that participate on a voluntary basis. (3) Form The data required under paragraph (1) shall be produced in unclassified form but may contain a classified annex. (4) Consultation In preparing to collect the data required under paragraph (1), the Administrator shall consult with— (A) the Secretary, the Director of CISA, and the Commission; and (B) small businesses, insurers of risks related to cybersecurity, cybersecurity and information technology companies that work with small businesses, and academic and Federal and non-Federal experts in cybersecurity. (5) Privacy In carrying out this subsection, the Administrator shall ensure that any publicly available data is anonymized and does not reveal personally identifiable information. (e) Rule of construction Nothing in this section or the amendments made by this section shall be construed to provide any additional regulatory authority to CISA. December 5, 2022 Reported with an amendment

Summary: Improving Cybersecurity of Small Businesses, Nonprofits, and Local Governments Act of 2021 This bill requires reporting and other efforts to improve the cybersecurity of small entities. These include small businesses, governments (or certain governmental bodies) that represent populations of less than 50,000, and small nonprofits. Specifically, the Cybersecurity and Infrastructure Security Agency (CISA) must periodically report on and make recommendations about cybersecurity policies and controls for small entities. CISA, the Small Business Administration (SBA), and the Minority Business Development Agency must (1) promote the report, including by making it available through their respective websites; and (2) make voluntary training and technical assistance available to employees of small entities concerning cybersecurity recommendations identified in the report. In addition, the Department of Commerce must report to Congress about improving the cybersecurity of small entities. Further, the SBA must collect information from small businesses concerning cybersecurity matters and report to Congress about the cybersecurity of small businesses.