I 
116TH CONGRESS 
2D SESSION 
H. R. 8379 
To require the Director of the Cybersecurity and Infrastructure Security 
Agency to establish cybersecurity guidance for small organizations, and 
for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 24, 2020 
Ms. ESHOO (for herself and Mr. KATKO) introduced the following bill; which 
was referred to the Committee on Small Business, and in addition to the 
Committee on Homeland Security, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To require the Director of the Cybersecurity and Infrastruc-
ture Security Agency to establish cybersecurity guidance 
for small organizations, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Improving Cybersecu-
rity of Small Organizations Act of 2020’’. 
SEC. 2. IMPROVING CYBERSECURITY OF SMALL ORGANIZA-
TIONS. 
(a) DEFINITIONS.—In this section: 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
(1) ADMINISTRATION.—The term ‘‘Administra-
tion’’ means the Small Business Administration. 
(2) ADMINISTRATOR.—The term ‘‘Adminis-
trator’’ means the Administrator of the Administra-
tion. 
(3) COMMISSION.—The term ‘‘Commission’’ 
means the Federal Trade Commission. 
(4) CYBERSECURITY
GUIDANCE.—The term 
‘‘cybersecurity guidance’’ means the cybersecurity 
guidance documented and promoted in the resource 
maintained under section 3(a). 
(5) DIRECTOR.—The term ‘‘Director’’ means 
the Director of the Cybersecurity and Infrastructure 
Security Agency. 
(6) NIST.—The term ‘‘NIST’’ means the Na-
tional Institute of Standards and Technology. 
(7) SECRETARY.—The term ‘‘Secretary’’ means 
the Secretary of Commerce. 
(8) SMALL BUSINESS.—The term ‘‘small busi-
ness’’ has the meaning given the term ‘‘small busi-
ness concern’’ under section 3 of the Small Business 
Act (15 U.S.C. 632). 
(9) SMALL
GOVERNMENTAL
JURISDICTION.— 
The term ‘‘small governmental jurisdiction’’ has the 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
meaning given the term in section 601 of title 5, 
United States Code. 
(10) SMALL
NONPROFIT.—The term ‘‘small 
nonprofit’’ has the meaning given the term ‘‘small 
organization’’ in section 601 of title 5, United States 
Code. 
(11) SMALL ORGANIZATION.—The term ‘‘small 
organization’’ means an organization that is unlikely 
to employ a specialist in cybersecurity, including— 
(A) a small business; 
(B) a small nonprofit; and 
(C) a small governmental jurisdiction. 
(b) CYBERSECURITY GUIDANCE.— 
(1) IN GENERAL.—The Director shall maintain 
cybersecurity guidance that documents and promotes 
evidence-based cybersecurity policies and controls for 
use by small organizations, which shall— 
(A) include simple, basic controls that have 
the most impact in protecting small organiza-
tions against common cybersecurity threats and 
risks; 
(B) include guidance to address common 
cybersecurity threats and risks posed by elec-
tronic devices that are personal to the employ-
ees and contractors of small organizations, as 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
well as electronic devices that are issued to 
those employees and contractors by small orga-
nizations; and 
(C) recommend— 
(i) measures to improve the cybersecu-
rity of small organizations; and 
(ii) configurations and settings for 
some of the most commonly used software 
that can improve the cybersecurity of small 
organizations. 
(2) CONSISTENCY.—The Director shall ensure 
the cybersecurity guidance maintained under para-
graph (1) is consistent with— 
(A) cybersecurity resources developed by 
NIST, as required by the NIST Small Business 
Cybersecurity Act (Public Law 115–236); and 
(B) the most recent version of the Cyberse-
curity Framework, or successor resource, main-
tained by NIST. 
(3) GUIDANCE FOR SPECIFIC TYPES OF SMALL 
ORGANIZATIONS.—The Director may include cyber-
security guidance, as required under paragraph (1), 
appropriate for specific types of small organizations 
in addition to guidance applicable for all small orga-
nizations. 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
(4) UPDATES.— 
(A) IN GENERAL.—The Director shall re-
view the cybersecurity guidance maintained 
under paragraph (1) not less frequently than 
annually and update as appropriate. 
(B) CONSULTATION.—In updating the cy-
bersecurity guidance under subparagraph (A), 
the Director shall, to the degree practicable and 
as appropriate, consult with— 
(i) the Administrator, the Secretary, 
and the Commission; 
(ii) 
small 
organizations, 
insurers, 
State governments, companies that work 
with small organizations, and academic 
and Federal and non-Federal experts in 
cybersecurity; and 
(iii) any other entity as determined by 
the Director. 
(5) USER INTERFACE.—As appropriate, the Di-
rector shall consult with experts regarding the de-
sign of a user interface for the cybersecurity guid-
ance. 
(c) PROMOTION OF CYBERSECURITY GUIDANCE FOR 
SMALL BUSINESSES.— 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
(1) PUBLIC AVAILABILITY.—The cybersecurity 
guidance maintained under subsection (b)(1) shall 
be— 
(A) made available, prominently and free 
of charge, on the public website of the Cyberse-
curity Infrastructure Security Agency; and 
(B) linked to from relevant portions of the 
websites of the Administration and the Minority 
Business Development Agency. 
(2) PROMOTION
GENERALLY.—The Director, 
the Administrator, and the Secretary shall, to the 
degree practicable, promote the cybersecurity guid-
ance through relevant resources that are intended 
for or known to be regularly used by small organiza-
tions, including agency documents, websites, and 
events. 
(d) REPORT ON INCENTIVIZING CYBERSECURITY FOR 
SMALL ORGANIZATIONS.— 
(1) IN
GENERAL.—Not later than one year 
after the date of the enactment of this Act, the Sec-
retary shall submit to Congress a report describing 
methods to incentivize small organizations to im-
prove their cybersecurity, including through the 
adoption of policies, controls, products, and services 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
that have been demonstrated to reduce cybersecurity 
risk. 
(2) MATTERS TO BE INCLUDED.—The report 
required under paragraph (1) shall— 
(A) identify barriers or challenges for 
small organizations in purchasing or acquiring 
products and services that promote the cyberse-
curity; 
(B) assess market availability, market pric-
ing, and affordability of products and services 
that promote the cybersecurity for small organi-
zations, with particular attention to identifying 
high-risk and underserved sectors or regions; 
(C) estimate the cost of tax breaks, grants, 
subsidies, or other incentives to increase the 
adoption of policies and controls or acquisition 
of products and services that promote the cy-
bersecurity, for small organizations; 
(D) as practicable, consult the certifi-
cations and requirement for cloud services de-
scribed in the final report of the Cyberspace So-
larium Commission established under section 
1652 of the John S. McCain National Defense 
Authorization Act for Fiscal Year 2019 (Public 
Law 115–232; 132 Stat. 2140); 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
(E) describe evidence-based cybersecurity 
controls and policies that improve cybersecurity 
for small organizations; 
(F) with respect to the incentives described 
in subparagraph (C), recommend measures that 
can effectively improve cybersecurity at scale 
for small organizations; and 
(G) include any other matters the Sec-
retary deems relevant. 
(3) GUIDANCE FOR SPECIFIC TYPES OF SMALL 
ORGANIZATIONS.—In preparing the report required 
under paragraph (1), the Secretary may include 
matters applicable for specific types of small organi-
zations in addition to matters applicable to all small 
organizations. 
(4) CONSULTATION.—In preparing the report 
required under paragraph (1), the Secretary shall 
consult with— 
(A) the Administrator, the Director, and 
the Commission; and 
(B) small organizations, insurers of risks 
related to cybersecurity, State governments, cy-
bersecurity and information technology compa-
nies that work with small organizations, and 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
academic and Federal and non-Federal experts 
in cybersecurity. 
(e) PERIODIC CENSUS ON STATE OF CYBERSECURITY 
OF SMALL BUSINESSES.— 
(1) IN
GENERAL.—Not later than one year 
after the date of enactment of this Act and not less 
frequently than every 24 months thereafter for not 
more than 10 years, the Administrator shall submit 
to Congress and make publicly available data on the 
state of cybersecurity of small businesses, includ-
ing— 
(A) adoption of the cybersecurity guidance 
among small businesses; 
(B) the most significant and widespread 
cybersecurity threats facing small businesses; 
(C) the amount small businesses spend on 
cybersecurity products and services; and 
(D) the personnel small businesses dedi-
cate to cybersecurity (including the amount of 
total personnel time, whether by employees or 
contractors, dedicated to cybersecurity efforts). 
(2) FORM.—The report required under para-
graph (1) shall be produced in unclassified form but 
may contain a classified annex. 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS
(3) CONSULTATION.—In preparing the report 
required under paragraph (1), the Administrator 
shall consult with— 
(A) the Secretary, the Director, and the 
Commission; and 
(B) small businesses, insurers of risks re-
lated to cybersecurity, cybersecurity and infor-
mation technology companies that work with 
small businesses, and academic and Federal 
and non-Federal experts in cybersecurity. 
Æ 
VerDate Sep 11 2014 
18:41 Oct 21, 2020
Jkt 019200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6301
E:\BILLS\H8379.IH
H8379
pamtmann on DSKBC07HB2PROD with BILLS