I 
115TH CONGRESS 
1ST SESSION H. R. 3010 
To provide for the identification and documentation of best practices for 
cyber hygiene by the National Institute of Standards and Technology, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 22, 2017 
Ms. ESHOO (for herself and Mrs. BROOKS of Indiana) introduced the following 
bill; which was referred to the Committee on Science, Space, and Technology 
A BILL 
To provide for the identification and documentation of best 
practices for cyber hygiene by the National Institute 
of Standards and Technology, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Promoting Good Cyber 
Hygiene Act of 2017’’. 
SEC. 2. CYBER HYGIENE BEST PRACTICES. 
(a) ESTABLISHMENT.—Not later than 1 year after 
the date of enactment of this Act, the National Institute 
of Standards and Technology, in consultation with the 
VerDate Sep 11 2014 
03:54 Jun 29, 2017
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H3010.IH
H3010
SSpencer on DSKBBV9HB2PROD with BILLS
Federal Trade Commission and the Department of Home-
land Security, after notice and an opportunity for public 
comment, shall establish a list of best practices for effec-
tive and usable cyber hygiene for use by the Federal Gov-
ernment, the private sector, and any individual or organi-
zation utilizing an information system or device. Such list 
shall— 
(1) be a list of simple, basic controls that have 
the most impact in defending against common cyber-
security threats and risks; 
(2) utilize technologies that are commercial off- 
the-shelf and based on international standards; and 
(3) to the degree practicable, be based on and 
consistent with the Cybersecurity Framework con-
tained in Executive Order 13636, entitled Improving 
Critical Infrastructure Cybersecurity, issued in Feb-
ruary 2013, or any successor framework. 
(b) VOLUNTARY PRACTICES.—The best practices on 
the list established under this section shall be considered 
voluntary and are not intended to be construed as a list 
of mandatory actions. 
(c) BASELINE.—The best practices on the list estab-
lished under this section are intended as a baseline for 
the Federal Government, the private sector, and any indi-
vidual or organization utilizing an information system or 
VerDate Sep 11 2014 
03:54 Jun 29, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H3010.IH
H3010
SSpencer on DSKBBV9HB2PROD with BILLS
device. Such entities are encouraged to use and improve 
on those best practices. 
(d) UPDATES.—The National Institute of Standards 
and Technology shall review and update the list of best 
practices established under this section on an annual 
basis. 
(e) PUBLIC AVAILABILITY.—The list of best practices 
established under this section shall be published in a clear 
and concise format and made available prominently on the 
public websites of the Federal Trade Commission and the 
Small Business Administration. 
(f) OTHER FEDERAL CYBERSECURITY REQUIRE-
MENTS.—Nothing in this section shall be construed to su-
persede, alter, or otherwise affect any cybersecurity re-
quirements applicable to Federal agencies. 
(g) CONSIDERATIONS.—In carrying out subsection 
(a), the agencies shall consider the benefits, as they per-
tain to cyber hygiene, of emerging technologies and proc-
esses that provide enhanced security protections, including 
multi-factor authentication, data loss prevention, micro- 
segmentation, 
data 
encryption, 
cloud 
services, 
anonymization, software patching and maintenance, 
phishing education, and other standard cybersecurity 
measures to achieve trusted security in the infrastructure. 
VerDate Sep 11 2014 
03:54 Jun 29, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3010.IH
H3010
SSpencer on DSKBBV9HB2PROD with BILLS
(h) STUDY ON EMERGING CONCEPTS TO PROMOTE 
EFFECTIVE CYBER HYGIENE
FOR
THE INTERNET
OF 
THINGS.— 
(1) INTERNET OF THINGS DEFINED.—In this 
subsection, the term ‘‘Internet of Things’’ means the 
set of physical objects embedded with sensors or ac-
tuators and connected to a network. 
(2) STUDY
REQUIRED.—The Secretary of 
Homeland Security, in coordination with the Direc-
tor of the National Institute of Standards and Tech-
nology and the Federal Trade Commission, shall 
conduct a study on cybersecurity threats relating to 
the Internet of Things. 
(3) MATTERS STUDIED.—As part of the study 
required by paragraph (2), the Secretary shall— 
(A) assess cybersecurity threats relating to 
the Internet of Things; 
(B) assess the effect such threats may 
have on the cybersecurity of the information 
systems and networks of the Federal Govern-
ment (except for the information systems and 
networks of the Department of Defense and the 
intelligence community (as defined in section 3 
of the National Security Act of 1947 (50 
U.S.C. 3003))); and 
VerDate Sep 11 2014 
03:54 Jun 29, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3010.IH
H3010
SSpencer on DSKBBV9HB2PROD with BILLS
(C) develop recommendations for address-
ing such threats. 
(4) REPORT TO CONGRESS.—Not later than 1 
year after the date of the enactment of this Act, the 
Secretary shall— 
(A) complete the study required by para-
graph (2); and 
(B) submit to Congress a report that con-
tains the findings of such study and the rec-
ommendations developed. 
Æ 
VerDate Sep 11 2014 
03:54 Jun 29, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H3010.IH
H3010
SSpencer on DSKBBV9HB2PROD with BILLS