I 
117TH CONGRESS 
2D SESSION 
H. R. 6541 
To require the Director of the Cybersecurity and Infrastructure Security 
Agency to establish cybersecurity guidance for small organizations, and 
for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 1, 2022 
Ms. ESHOO (for herself, Mr. TIMMONS, Mr. RASKIN, and Mr. CASE) intro-
duced the following bill; which was referred to the Committee on Small 
Business, and in addition to the Committee on Homeland Security, for 
a period to be subsequently determined by the Speaker, in each case for 
consideration of such provisions as fall within the jurisdiction of the com-
mittee concerned 
A BILL 
To require the Director of the Cybersecurity and Infrastruc-
ture Security Agency to establish cybersecurity guidance 
for small organizations, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Improving Cybersecu-
rity of Small Businesses, Nonprofits, and Local Govern-
ments Act’’. 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
SEC. 2. IMPROVING CYBERSECURITY OF SMALL ENTITIES. 
(a) DEFINITIONS.—In this section: 
(1) ADMINISTRATOR.—The term ‘‘Adminis-
trator’’ means the Administrator of the Small Busi-
ness Administration. 
(2) ANNUAL CYBERSECURITY REPORT; SMALL 
BUSINESS; SMALL ENTITY; SMALL GOVERNMENTAL 
JURISDICTION; SMALL
ORGANIZATION.—The terms 
‘‘annual cybersecurity report’’, ‘‘small business’’, 
‘‘small entity’’, ‘‘small governmental jurisdiction’’, 
and ‘‘small organization’’ have the meanings given 
those terms in section 2220D of the Homeland Se-
curity Act of 2002, as added by subsection (b). 
(3) CISA.—The term ‘‘CISA’’ means the Cy-
bersecurity and Infrastructure Security Agency. 
(4) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(5) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Commerce. 
(b) ANNUAL REPORT.— 
(1) AMENDMENT.—Subtitle A of title XXII of 
the Homeland Security Act of 2002 (6 U.S.C. 651 
et seq.) is amended by adding at the end the fol-
lowing: 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
‘‘SEC. 
2220D. 
ANNUAL 
CYBERSECURITY 
REPORT 
FOR 
SMALL ENTITIES. 
‘‘(a) DEFINITIONS.— 
‘‘(1) ADMINISTRATION.—The term ‘Administra-
tion’ means the Small Business Administration. 
‘‘(2) ADMINISTRATOR.—The term ‘Adminis-
trator’ means the Administrator of the Administra-
tion. 
‘‘(3) ANNUAL
CYBERSECURITY
REPORT.—The 
term ‘annual cybersecurity report’ means the annual 
cybersecurity report published and promoted under 
subsections (b) and (c), respectively. 
‘‘(4) COMMISSION.—The term ‘Commission’ 
means the Federal Trade Commission. 
‘‘(5) ELECTRONIC
DEVICE.—The term ‘elec-
tronic device’ means any electronic equipment that 
is— 
‘‘(A) used by an employee or contractor of 
a small entity for the purpose of performing 
work for the small entity; 
‘‘(B) capable of connecting to the internet 
or another communication network; and 
‘‘(C) capable of sending, receiving, or proc-
essing personal information. 
‘‘(6) NIST.—The term ‘NIST’ means the Na-
tional Institute of Standards and Technology. 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
‘‘(7) SMALL BUSINESS.—The term ‘small busi-
ness’ has the meaning given the term ‘small business 
concern’ under section 3 of the Small Business Act 
(15 U.S.C. 632). 
‘‘(8) SMALL ENTITY.—The term ‘small entity’ 
means— 
‘‘(A) a small business; 
‘‘(B) a small governmental jurisdiction; 
and 
‘‘(C) a small organization. 
‘‘(9) SMALL GOVERNMENTAL JURISDICTION.— 
The term ‘small governmental jurisdiction’ means 
governments of cities, counties, towns, townships, 
villages, school districts, or special districts with a 
population of less than 50,000. 
‘‘(10) SMALL ORGANIZATION.—The term ‘small 
organization’ means any not-for-profit enterprise 
that is independently owned and operated and is not 
dominant in its field. 
‘‘(b) ANNUAL CYBERSECURITY REPORT.— 
‘‘(1) IN GENERAL.—Not later than 180 days 
after the date of enactment of this section, and not 
less frequently than annually thereafter, the Director 
shall publish a report for small entities that docu-
ments and promotes evidence-based cybersecurity 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
policies and controls for use by small entities, which 
shall— 
‘‘(A) include basic controls that have the 
most impact in protecting small entities against 
common cybersecurity threats and risks; 
‘‘(B) include protocols and policies to ad-
dress common cybersecurity threats and risks 
posed by electronic devices, regardless of wheth-
er the electronic devices are— 
‘‘(i) issued by the small entity to em-
ployees and contractors of the small entity; 
or 
‘‘(ii) personal to the employees and 
contractors of the small entity; and 
‘‘(C) recommend, as practicable— 
‘‘(i) measures to improve the cyberse-
curity of small entities; and 
‘‘(ii) configurations and settings for 
some of the most commonly used software 
that can improve the cybersecurity of small 
entities. 
‘‘(2) EXISTING RECOMMENDATIONS.—The Di-
rector shall ensure that each annual cybersecurity 
report published under paragraph (1) incorporates— 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
‘‘(A) cybersecurity resources developed by 
NIST, as required by the NIST Small Business 
Cybersecurity Act (Public Law 115–236); and 
‘‘(B) the most recent version of the Cyber-
security Framework, or successor resource, 
maintained by NIST. 
‘‘(3) CONSIDERATION FOR SPECIFIC TYPES OF 
SMALL ENTITIES.—The Director may include and 
prioritize the development of cybersecurity rec-
ommendations, as required under paragraph (1), ap-
propriate for specific types of small entities in addi-
tion to recommendations applicable for all small en-
tities. 
‘‘(4) CONSULTATION.—In publishing the annual 
cybersecurity report under paragraph (1), the Direc-
tor shall, to the degree practicable and as appro-
priate, consult with— 
‘‘(A) the Administrator, the Secretary of 
Commerce, the Commission, and the Director of 
NIST; 
‘‘(B) small entities, insurers, State govern-
ments, companies that work with small entities, 
and academic and Federal and non-Federal ex-
perts in cybersecurity; and 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
‘‘(C) any other entity as determined appro-
priate by the Director. 
‘‘(c) PROMOTION OF ANNUAL CYBERSECURITY RE-
PORT FOR SMALL BUSINESSES.— 
‘‘(1) PUBLICATION.—The annual cybersecurity 
report, and previous versions of the report as appro-
priate, published under subsection (b)(1) shall be— 
‘‘(A) made available, prominently and free 
of charge, on the public website of the Agency; 
and 
‘‘(B) linked to from relevant portions of 
the websites of the Administration and the Mi-
nority Business Development Agency, as deter-
mined by the Administrator and the Director of 
the Minority Business Development Agency, re-
spectively. 
‘‘(2) PROMOTION GENERALLY.—The Director, 
the Administrator, and the Secretary of Commerce 
shall, to the degree practicable, promote the annual 
cybersecurity report through relevant resources that 
are intended for or known to be regularly used by 
small entities, including agency documents, websites, 
and events. 
‘‘(d) TRAINING AND TECHNICAL ASSISTANCE.—The 
Director, the Administrator, and the Director of the Mi-
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
nority Business Development Agency shall make available 
to employees of small entities voluntary training and tech-
nical assistance on how to implement the recommenda-
tions of the annual cybersecurity report.’’. 
(2) TECHNICAL
AND
CONFORMING
AMEND-
MENT.—The table of contents in section 1(b) of the 
Homeland Security Act of 2002 (Public 107–296; 
116 Stat. 2135) is amended by inserting after the 
item relating to section 2220C the following: 
‘‘Sec. 2220D. Annual cybersecurity report for small entities.’’. 
(c) REPORT TO CONGRESS.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of this Act, and annually 
thereafter for 10 years, the Secretary shall submit to 
Congress a report describing methods to improve the 
cybersecurity of small entities, including through the 
adoption of policies, controls, and classes of products 
and services that have been demonstrated to reduce 
cybersecurity risk. 
(2) MATTERS TO BE INCLUDED.—The report 
required under paragraph (1) shall— 
(A) identify barriers or challenges for 
small entities in purchasing or acquiring classes 
of products and services that promote the cy-
bersecurity of small entities; 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
(B) assess market availability, market pric-
ing, and affordability of classes of products and 
services that promote the cybersecurity of small 
entities, with particular attention to identifying 
high-risk and underserved sectors or regions; 
(C) estimate the costs and benefits of poli-
cies that promote the cybersecurity of small en-
tities, including— 
(i) tax breaks; 
(ii) grants and subsidies; and 
(iii) other incentives as determined 
appropriate by the Secretary; 
(D) describe evidence-based cybersecurity 
controls and policies that improve the cyberse-
curity of small entities; 
(E) with respect to the incentives described 
in subparagraph (C), recommend measures that 
can effectively improve cybersecurity at scale 
for small entities; and 
(F) include any other matters as the Sec-
retary determines relevant. 
(3) SPECIFIC SECTORS OF SMALL ENTITIES.— 
In preparing the report required under paragraph 
(1), the Secretary may include matters applicable for 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS
specific sectors of small entities in addition to mat-
ters applicable to all small entities. 
(4) CONSULTATION.—In preparing the report 
required under paragraph (1), the Secretary shall 
consult with— 
(A) the Administrator, the Director of 
CISA, and the Commission; and 
(B) small entities, insurers of risks related 
to cybersecurity, State governments, cybersecu-
rity and information technology companies that 
work with small entities, and academic and 
Federal and non-Federal experts in cybersecu-
rity. 
(d) PERIODIC CENSUS ON STATE OF CYBERSECU-
RITY OF SMALL BUSINESSES.— 
(1) IN GENERAL.—Not later than 1 year after 
the date of enactment of this Act, and not less fre-
quently than every 24 months thereafter for 10 
years, the Administrator shall submit to Congress 
and make publicly available data on the state of cy-
bersecurity of small businesses, including, to the ex-
tent practicable— 
(A) adoption of the cybersecurity rec-
ommendations from the annual cybersecurity 
report among small businesses; 
VerDate Sep 11 2014 
07:23 Feb 02, 2022
Jkt 029200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H6541.IH
H6541
kjohnson on DSK79L0C42PROD with BILLS