(c) DISSEMINATION
OF RESOURCES
FOR SMALL 
BUSINESSES.— 
(1) IN
GENERAL.—Not later than one year 
after the date of the enactment of this Act, the Di-
rector, in carrying out section 2(e)(1)(A)(viii) of the 
National Institute of Standards and Technology Act, 
as added by subsection (b) of this Act, in consulta-
tion with the heads of other appropriate Federal 
agencies, shall disseminate clear and concise re-
sources to help small business concerns identify, as-
sess, manage, and reduce their cybersecurity risks. 
(2) REQUIREMENTS.—The Director shall en-
sure that the resources disseminated pursuant to 
paragraph (1)— 
(A) are generally applicable and usable by 
a wide range of small business concerns; 
(B) vary with the nature and size of the 
implementing small business concern, and the 
nature and sensitivity of the data collected or 
stored on the information systems or devices of 
the implementing small business concern; 
(C) include elements, that promote aware-
ness of simple, basic controls, a workplace cy-
bersecurity culture, and third-party stakeholder
relationships, to assist small business concerns 
in mitigating common cybersecurity risks; 
(D) include case studies of practical appli-
cation; 
(E) are technology-neutral and can be im-
plemented using technologies that are commer-
cial and off-the-shelf; and 
(F) are based on international standards 
to the extent possible, and are consistent with 
the Stevenson-Wydler Technology Innovation 
Act of 1980 (15 U.S.C. 3701 et seq.). 
(3) NATIONAL
CYBERSECURITY
AWARENESS 
AND EDUCATION PROGRAM.—The Director shall en-
sure that the resources disseminated under para-
graph (1) are consistent with the efforts of the Di-
rector under section 401 of the Cybersecurity En-
hancement Act of 2014 (15 U.S.C. 7451). 
(4) SMALL BUSINESS DEVELOPMENT CENTER 
CYBER STRATEGY.—In carrying out paragraph (1), 
the Director, to the extent practicable, shall consider 
any methods included in the Small Business Devel-
opment Center Cyber Strategy developed under sec-
tion 1841(a)(3)(B) of the National Defense Author-
ization Act for Fiscal Year 2017 (Public Law 114– 
328).
(5) VOLUNTARY RESOURCES.—The use of the 
resources disseminated under paragraph (1) shall be 
considered voluntary. 
(6) UPDATES.—The Director shall review and, 
if necessary, update the resources disseminated 
under paragraph (1) in accordance with the require-
ments under paragraph (2). 
(7) PUBLIC AVAILABILITY.—The Director and 
the head of each Federal agency that so elects shall 
make prominently available on the respective agen-
cy’s public Internet website information about the 
resources and updates to the resources disseminated 
under paragraph (1). The Director and the heads 
shall each ensure that the information they respec-
tively make prominently available is consistent, clear, 
and concise. 
(d) OTHER FEDERAL CYBERSECURITY REQUIRE-
MENTS.—Nothing in this section may be construed to su-
persede, alter, or otherwise affect any cybersecurity re-
quirements applicable to Federal agencies. 
(e) FUNDING.—This Act shall be carried out using 
funds otherwise authorized to be appropriated or made
available to the National Institute of Standards and Tech-
nology. 
Passed the House of Representatives October 11, 
2017. 
Attest: 
Clerk.
115TH CONGRESS 
1ST SESSION 
H. R. 2105 
AN ACT 
To require the Director of the National Institute of 
Standards and Technology to disseminate guid-
ance to help reduce small business cybersecurity 
risks, and for other purposes.