I 
115TH CONGRESS 
1ST SESSION H. R. 2105 
To require the Director of the National Institute of Standards and Technology 
to disseminate guidance to help reduce small business cybersecurity risks, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 20, 2017 
Mr. WEBSTER of Florida (for himself, Mr. LIPINSKI, Mr. SMITH of Texas, 
Mrs. COMSTOCK, Ms. ROSEN, Mr. HULTGREN, Mr. KNIGHT, Mr. 
LAHOOD, Mr. MARSHALL, and Mr. POSEY) introduced the following bill; 
which was referred to the Committee on Science, Space, and Technology 
A BILL 
To require the Director of the National Institute of Stand-
ards and Technology to disseminate guidance to help 
reduce small business cybersecurity risks, and for other 
purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘NIST Small Business 
Cybersecurity Act of 2017’’. 
SEC. 2. FINDINGS. 
Congress makes the following findings: 
VerDate Sep 11 2014 
21:37 Apr 20, 2017
Jkt 069200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H2105.IH
H2105
sradovich on DSK3GMQ082PROD with BILLS
(1) Small businesses play a vital role in the 
economy of the United States, accounting for 54 
percent of all United States sales and 55 percent of 
jobs in the United States. 
(2) Attacks targeting small and medium busi-
nesses account for a high percentage of cyberattacks 
in the United States. Sixty percent of small busi-
nesses that suffer a cyberattack are out of business 
within 6 months, according to the National Cyber 
Security Alliance. 
(3) The Cybersecurity Enhancement Act of 
2014 (15 U.S.C. 7421 et seq.) calls on the National 
Institute of Standards and Technology to facilitate 
and support a voluntary public-private partnership 
to reduce cybersecurity risks to critical infrastruc-
ture. Such a partnership continues to play a key role 
in improving the cyber resilience of the United 
States and making cyberspace safer. 
(4) There is a need to develop simplified re-
sources that are consistent with the partnership de-
scribed in paragraph (3) that improves its use by 
small businesses. 
SEC. 3. IMPROVING CYBERSECURITY OF SMALL BUSI-
NESSES. 
(a) DEFINITIONS.—In this section: 
VerDate Sep 11 2014 
21:37 Apr 20, 2017
Jkt 069200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H2105.IH
H2105
sradovich on DSK3GMQ082PROD with BILLS
(1) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the National Institute of Standards 
and Technology. 
(2) RESOURCES.—The term ‘‘resources’’ means 
guidelines, tools, best practices, standards, meth-
odologies, and other ways of providing information. 
(3) SMALL
BUSINESS
CONCERN.—The term 
‘‘small business concern’’ has the meaning given 
such term in section 3 of the Small Business Act 
(15 U.S.C. 632). 
(b) SMALL
BUSINESS
CYBERSECURITY.—Section 
2(e)(1)(A) of the National Institute of Standards and 
Technology Act (15 U.S.C. 272(e)(1)(A)) is amended— 
(1) in clause (vii), by striking ‘‘and’’ at the end; 
(2) by redesignating clause (viii) as clause (ix); 
and 
(3) by inserting after clause (vii) the following: 
‘‘(viii) consider small business con-
cerns (as defined in section 3 of the Small 
Business Act (15 U.S.C. 632)); and’’. 
(c) DISSEMINATION
OF RESOURCES
FOR SMALL 
BUSINESSES.— 
(1) IN
GENERAL.—Not later than one year 
after the date of the enactment of this Act, the Di-
rector, in carrying out section 2(e)(1)(A)(viii) of the 
VerDate Sep 11 2014 
21:37 Apr 20, 2017
Jkt 069200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H2105.IH
H2105
sradovich on DSK3GMQ082PROD with BILLS
National Institute of Standards and Technology Act, 
as added by subsection (b) of this Act, in consulta-
tion with the heads of other appropriate Federal 
agencies, shall disseminate clear and concise re-
sources to help small business concerns identify, as-
sess, manage, and reduce their cybersecurity risks. 
(2) REQUIREMENTS.—The Director shall en-
sure that the resources disseminated pursuant to 
paragraph (1)— 
(A) are generally applicable and usable by 
a wide range of small business concerns; 
(B) vary with the nature and size of the 
implementing small business concern, and the 
nature and sensitivity of the data collected or 
stored on the information systems or devices of 
the implementing small business concern; 
(C) include elements, that promote aware-
ness of simple, basic controls, a workplace cy-
bersecurity culture, and third-party stakeholder 
relationships, to assist small business concerns 
in mitigating common cybersecurity risks; 
(D) are technology-neutral and can be im-
plemented using technologies that are commer-
cial and off-the-shelf; and 
VerDate Sep 11 2014 
21:37 Apr 20, 2017
Jkt 069200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H2105.IH
H2105
sradovich on DSK3GMQ082PROD with BILLS
(E) are based on international standards 
to the extent possible, and are consistent with 
the Stevenson-Wydler Technology Innovation 
Act of 1980 (15 U.S.C. 3701 et seq.). 
(3) NATIONAL
CYBERSECURITY
AWARENESS 
AND EDUCATION PROGRAM.—The Director shall en-
sure that the resources disseminated under para-
graph (1) are consistent with the efforts of the Di-
rector under section 401 of the Cybersecurity En-
hancement Act of 2014 (15 U.S.C. 7451). 
(4) SMALL BUSINESS DEVELOPMENT CENTER 
CYBER STRATEGY.—In carrying out paragraph (1), 
the Director, to the extent practicable, shall consider 
any methods included in the Small Business Devel-
opment Center Cyber Strategy developed under sec-
tion 1841(a)(3)(B) of the National Defense Author-
ization Act for Fiscal Year 2017 (Public Law 114– 
328). 
(5) VOLUNTARY RESOURCES.—The use of the 
resources disseminated under paragraph (1) shall be 
considered voluntary. 
(6) UPDATES.—The Director shall review and, 
if necessary, update the resources disseminated 
under paragraph (1) in accordance with the require-
ments under paragraph (2). 
VerDate Sep 11 2014 
21:37 Apr 20, 2017
Jkt 069200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H2105.IH
H2105
sradovich on DSK3GMQ082PROD with BILLS
(7) PUBLIC AVAILABILITY.—The Director and 
the head of each Federal agency that so elects shall 
make prominently available on the respective agen-
cy’s public Internet website information about the 
resources and updates to the resources disseminated 
under paragraph (1). The Director and the heads 
shall each ensure that the information they respec-
tively make prominently available is consistent, clear, 
and concise. 
(d) OTHER FEDERAL CYBERSECURITY REQUIRE-
MENTS.—Nothing in this section may be construed to su-
persede, alter, or otherwise affect any cybersecurity re-
quirements applicable to Federal agencies. 
(e) FUNDING.—This Act shall be carried out using 
funds otherwise authorized to be appropriated or made 
available to the National Institute of Standards and Tech-
nology. 
Æ 
VerDate Sep 11 2014 
21:37 Apr 20, 2017
Jkt 069200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6301
E:\BILLS\H2105.IH
H2105
sradovich on DSK3GMQ082PROD with BILLS