SEC. 2. FINDINGS. 
Congress finds the following: 
(1) According to the Bureau of Labor Statis-
tics, there are more than 347,000 manufacturing es-
tablishments in the United States, of which 72 per-
cent have fewer than 20 employees and 99 percent 
have fewer than 500 employees. 
(2) Independent studies from the National De-
fense Industry Association, the Defense Science 
Board, the Alliance for Manufacturing Foresight, 
and the McKinsey Global Institute have high-
lighted— 
(A) the centrality of small manufacturers 
to United States manufacturing supply chains 
for domestic economic growth; 
(B) the vulnerability of such manufactur-
ers to the defense industrial base for national 
security; and 
(C) the vulnerability of such manufacturers 
to cybersecurity threats and breaches. 
(3) As of December 31, 2017, Department of 
Defense suppliers must comply with new, tougher 
cybersecurity requirements to ensure adequate secu-
rity to protect controlled unclassified information 
relevant to defense manufacturing supply chains. 
The requirements call for defense suppliers to imple-
VerDate Sep 11 2014 
02:07 Apr 18, 2018
Jkt 079200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5517.IH
H5517
SSpencer on DSKBBXCHB2PROD with BILLS
ment and create a plan of action to respond to the 
guidance developed by the National Institute of 
Standards and Technology. 
(4) The Department of Commerce has found 
significant cybersecurity vulnerability of small manu-
facturers. A survey of 9,000 contract facilities docu-
mented that 6,650 small facilities lagged behind me-
dium and large firms across a broad range of 20 cy-
bersecurity indicators. For several indicators, fewer 
than half of small firms had cybersecurity measures 
in place. 
(5) Over the past 5 years the national network 
of centers operating as part of the Hollings Manu-
facturing Extension Partnership has worked closely 
with the Department of Defense to bolster the resil-
ience of the defense industrial base supply chain. 
Since 2013, such centers have completed more than 
2,500 projects with 1,650 companies that are sup-
pliers to the Department of Defense. 
(6) In 2017, the Hollings Manufacturing Ex-
tension Partnership interacted with more than 1,000 
small manufacturers on the cybersecurity require-
ments of the Department of Defense. This work by 
the Hollings Manufacturing Extension Partnership 
has revealed a significant lack of awareness of the 
VerDate Sep 11 2014 
02:07 Apr 18, 2018
Jkt 079200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5517.IH
H5517
SSpencer on DSKBBXCHB2PROD with BILLS
Department of Defense cybersecurity requirements 
and a deficiency of financial and technical resources 
required to manage cybersecurity risks. If cybersecu-
rity vulnerabilities remain unaddressed, defense sup-
ply chains face a higher likelihood of serious and ex-
ploitable vulnerabilities, as well as a substantial re-
duction in the number of suppliers compliant with 
Department of Defense requirements, and thereby 
ineligible to provide products and services to the De-
partment of Defense. 
(7) The Hollings Manufacturing Extension 
Partnership is well positioned to aid suppliers of the 
Department of Defense in complying with cybersecu-
rity requirements of the Department to ensure ade-
quate security to protect controlled unclassified in-
formation relevant to defense manufacturing supply 
chains. 
SEC. 3. ASSISTANCE FOR SMALL MANUFACTURERS IN THE 
DEFENSE INDUSTRIAL SUPPLY CHAIN ON 
MATTERS RELATING TO CYBERSECURITY. 
(a) DEFINITIONS.—In this section: 
(1) CENTER.—The term ‘‘Center’’ has the 
meaning given such term in section 25(a) of the Na-
tional Institute of Standards and Technology Act 
(15 U.S.C. 278k(a)). 
VerDate Sep 11 2014 
02:07 Apr 18, 2018
Jkt 079200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5517.IH
H5517
SSpencer on DSKBBXCHB2PROD with BILLS
(2) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the National Institute of Standards 
and Technology. 
(3) RESOURCES.—The term ‘‘resources’’ means 
guidelines, tools, best practices, standards, meth-
odologies, and other ways of providing information. 
(4) SMALL
BUSINESS
CONCERN.—The term 
‘‘small business concern’’ means a small business 
concern as that term is used in section 3 of the 
Small Business Act (15 U.S.C. 632). 
(5) SMALL MANUFACTURER.—The term ‘‘small 
manufacturer’’ means a small business concern that 
is a manufacturer. 
(6) STATE.—The term ‘‘State’’ means each of 
the several States, Territories, and possessions of 
the United States, the District of Columbia, and the 
Commonwealth of Puerto Rico. 
(b) 
DISSEMINATION
OF
CYBERSECURITY
RE-
SOURCES.— 
(1) IN GENERAL.—The Director of the National 
Institute of Standards and Technology, in partner-
ship with the Secretary of Defense and acting 
through the Hollings Manufacturing Extension Part-
nership, shall take such actions as may be necessary 
to address a widespread lack of awareness of cyber-
VerDate Sep 11 2014 
02:07 Apr 18, 2018
Jkt 079200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5517.IH
H5517
SSpencer on DSKBBXCHB2PROD with BILLS
security threats among small manufacturers in the 
defense industrial supply chain. 
(2) NATIONAL REACH.—The Director shall en-
sure that efforts to increase awareness under para-
graph (1) are carried out in each State, by dissemi-
nating clear and concise resources to help reduce cy-
bersecurity risks faced by small manufacturers de-
scribed in paragraph (1). 
(3) SECTOR FOCUS.—The Director shall carry 
out this subsection with a focus on such industry 
sectors as the Director considers critical, in con-
sultation with the Secretary of Defense. 
(4) OUTREACH EVENTS.—Under paragraph (1), 
the Director shall conduct outreach. Such outreach 
may include live events with a physical presence and 
outreach conducted through Internet websites. 
(c) VOLUNTARY
CYBERSECURITY
SELF-ASSESS-
MENTS.—The Director shall provide, through the Hollings 
Manufacturing Extension Partnership, assistance to help 
small manufacturers conduct voluntary self-assessments in 
order to understand operating environments, cybersecurity 
requirements, and existing vulnerabilities. 
(d) TRANSFER OF RESEARCH FINDINGS AND EXPER-
TISE.— 
VerDate Sep 11 2014 
02:07 Apr 18, 2018
Jkt 079200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5517.IH
H5517
SSpencer on DSKBBXCHB2PROD with BILLS
(1) IN GENERAL.—The Director shall provide 
for the transfer of technology and techniques devel-
oped at the National Institute of Standards and 
Technology to Centers, and through such Centers, to 
small manufacturers throughout the United States 
to implement security measures that are adequate to 
protect covered defense information, including con-
trolled unclassified information. 
(2) USE OF OTHER FEDERAL EXPERTISE AND 
CAPABILITIES.—The Director shall use, when appro-
priate, the expertise and capabilities that exist in 
Federal agencies other than the Institute, and feder-
ally sponsored laboratories. 
(3) AGREEMENTS.—In carrying out this sub-
section, the Centers may enter into agreements with 
private industry, institutes of higher education, or a 
State, United States territory, local, or tribal gov-
ernment to ensure breadth and depth of coverage to 
the United States defense industrial base and to le-
verage resources. 
(e) DEFENSE
ACQUISITION
WORKFORCE
CYBER 
TRAINING PROGRAM.—The Secretary of Defense, in con-
sultation with the Director, shall establish a cyber coun-
seling certification program, or approve a similar existing 
program, to certify small business professionals and other 
VerDate Sep 11 2014 
02:07 Apr 18, 2018
Jkt 079200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5517.IH
H5517
SSpencer on DSKBBXCHB2PROD with BILLS
relevant acquisition staff within the Department of De-
fense to provide cyber planning assistance to small manu-
facturers in the defense industrial supply chain. 
Æ 
VerDate Sep 11 2014 
02:07 Apr 18, 2018
Jkt 079200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H5517.IH
H5517
SSpencer on DSKBBXCHB2PROD with BILLS