Federal Trade Commission and the Department of Home-
land Security, after notice and an opportunity for public 
comment, shall establish a list of best practices for effec-
tive and usable cyber hygiene for use by the Federal Gov-
ernment, the private sector, and any individual or organi-
zation utilizing an information system or device. Such list 
shall— 
(1) be a list of simple, basic controls that have 
the most impact in defending against common cyber-
security threats and risks; 
(2) utilize technologies that are commercial off- 
the-shelf and based on international standards; and 
(3) be based on the Cybersecurity Framework 
contained in Executive Order 13636, entitled Im-
proving Critical Infrastructure Cybersecurity, issued 
in February 2013. 
(b) VOLUNTARY PRACTICES.—The best practices on 
the list established under this section shall be considered 
voluntary and are not intended to be construed as a list 
of mandatory actions. 
(c) BASELINE.—The best practices on the list estab-
lished under this section are intended as a baseline for 
the Federal Government, the private sector, and any indi-
vidual or organization utilizing an information system or 
VerDate Sep 11 2014 
18:39 Oct 05, 2015
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3664.IH
H3664
mstockstill on DSK4VPTVN1PROD with BILLS
device. Such entities are encouraged to use and improve 
on those best practices. 
(d) UPDATES.—The National Institute of Standards 
and Technology shall review and update the list of best 
practices established under this section on an annual 
basis. 
(e) PUBLIC AVAILABILITY.—The list of best practices 
established under this section shall be published in a clear 
and concise format and made available prominently on the 
public websites of the Federal Trade Commission and the 
Small Business Administration. 
(f) OTHER FEDERAL CYBERSECURITY REQUIRE-
MENTS.—Nothing in this section shall be construed to su-
persede, alter, or otherwise affect any cybersecurity re-
quirements applicable to Federal agencies. 
(g) EMERGING CONCEPTS TO PROVIDE EFFECTIVE 
CYBER HYGIENE.— 
(1) STUDY.—The Secretary of Homeland Secu-
rity, in coordination with the National Institute of 
Standards and Technology and the Federal Trade 
Commission, shall conduct a study on cybersecurity 
threats relating to mobile devices. 
(2) MATTERS STUDIED.—As part of the study 
required under this subsection, the Secretary shall— 
VerDate Sep 11 2014 
18:39 Oct 05, 2015
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3664.IH
H3664
mstockstill on DSK4VPTVN1PROD with BILLS
(A) assess threats relating to mobile de-
vices; 
(B) assess the effect such threats may 
have on the cybersecurity of the information 
systems and networks of the Federal Govern-
ment (except for the information systems and 
networks of the Department of Defense and the 
Intelligence Community); and 
(C) develop recommendations for address-
ing such threats. 
(3) REPORT TO CONGRESS.—Not later than 1 
year after the date of enactment of this Act, the 
Secretary shall— 
(A) complete the study under this sub-
section; and 
(B) submit a report to Congress that con-
tains the findings of such study and the rec-
ommendations developed. 
(h) DEFINITION.—In this section, the term ‘‘cyber 
hygiene’’ means processes, procedures, and mechanisms 
that help protect information systems or devices against 
cybersecurity threats, including— 
(1) unauthorized access; 
VerDate Sep 11 2014 
18:39 Oct 05, 2015
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3664.IH
H3664
mstockstill on DSK4VPTVN1PROD with BILLS
(2) alteration of information or code running or 
intended to be running on such systems or devices; 
and 
(3) unauthorized denials of service to author-
ized users of these systems or devices. 
Æ 
VerDate Sep 11 2014 
18:39 Oct 05, 2015
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H3664.IH
H3664
mstockstill on DSK4VPTVN1PROD with BILLS