NIST Small Business Cybersecurity Act of 2017

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``NIST Small Business Cybersecurity 
Act''.

SEC. 2. IMPROVING CYBERSECURITY OF SMALL BUSINESSES.

    (a) Definitions.--In this section:
            (1) Director.--The term ``Director'' means the Director of 
        the National Institute of Standards and Technology.
            (2) Resources.--The term ``resources'' means guidelines, 
        tools, best practices, standards, methodologies, and other ways 
        of providing information.
            (3) Small business concern.--The term ``small business 
        concern'' has the meaning given such term in section 3 of the 
        Small Business Act (15 U.S.C. 632).
    (b) Small Business Cybersecurity.--Section 2(e)(1)(A) of the 
National Institute of Standards and Technology Act (15 U.S.C. 
272(e)(1)(A)) is amended--
            (1) in clause (vii), by striking ``and'' at the end;
            (2) by redesignating clause (viii) as clause (ix); and
            (3) by inserting after clause (vii) the following:
                            ``(viii) consider small business concerns 
                        (as defined in section 3 of the Small Business 
                        Act (15 U.S.C. 632)); and''.
    (c) Dissemination of Resources for Small Businesses.--
            (1) In general.--Not later than one year after the date of 
        the enactment of this Act, the Director, in carrying out 
        section 2(e)(1)(A)(viii) of the National Institute of Standards 
        and Technology Act, as added by subsection (b) of this Act, in 
        consultation with the heads of other appropriate Federal 
        agencies, shall disseminate clear and concise resources to help 
        small business concerns identify, assess, manage, and reduce 
        their cybersecurity risks.
            (2) Requirements.--The Director shall ensure that the 
        resources disseminated pursuant to paragraph (1)--
                    (A) are generally applicable and usable by a wide 
                range of small business concerns;
                    (B) vary with the nature and size of the 
                implementing small business concern, and the nature and 
                sensitivity of the data collected or stored on the 
                information systems or devices of the implementing 
                small business concern;
                    (C) include elements, that promote awareness of 
                simple, basic controls, a workplace cybersecurity 
                culture, and third-party stakeholder relationships, to 
                assist small business concerns in mitigating common 
                cybersecurity risks;
                    (D) include case studies of practical application;
                    (E) are technology-neutral and can be implemented 
                using technologies that are commercial and off-the-
                shelf; and
                    (F) are based on international standards to the 
                extent possible, and are consistent with the Stevenson-
                Wydler Technology Innovation Act of 1980 (15 U.S.C. 
                3701 et seq.).
            (3) National cybersecurity awareness and education 
        program.--The Director shall ensure that the resources 
        disseminated under paragraph (1) are consistent with the 
        efforts of the Director under section 401 of the Cybersecurity 
        Enhancement Act of 2014 (15 U.S.C. 7451).
            (4) Small business development center cyber strategy.--In 
        carrying out paragraph (1), the Director, to the extent 
        practicable, shall consider any methods included in the Small 
        Business Development Center Cyber Strategy developed under 
        section 1841(a)(3)(B) of the National Defense Authorization Act 
        for Fiscal Year 2017 (Public Law 114-328).
            (5) Voluntary resources.--The use of the resources 
        disseminated under paragraph (1) shall be considered voluntary.
            (6) Updates.--The Director shall review and, if necessary, 
        update the resources disseminated under paragraph (1) in 
        accordance with the requirements under paragraph (2).
            (7) Public availability.--The Director and the head of each 
        Federal agency that so elects shall make prominently available 
        on the respective agency's public Internet website information 
        about the resources and updates to the resources disseminated 
        under paragraph (1). The Director and the heads shall each 
        ensure that the information they respectively make prominently 
        available is consistent, clear, and concise.
    (d) Other Federal Cybersecurity Requirements.--Nothing in this 
section may be construed to supersede, alter, or otherwise affect any 
cybersecurity requirements applicable to Federal agencies.
    (e) Funding.--This Act shall be carried out using funds otherwise 
authorized to be appropriated or made available to the National 
Institute of Standards and Technology.

            Passed the House of Representatives October 11, 2017.

            Attest:

                                                 KAREN L. HAAS,

                                                                 Clerk.

Summary: NIST Small Business Cybersecurity Act  (Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.  NIST must consult with other federal agencies to disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must: (1) include case studies&nbsp;of practical application, (2) be based on international standards to the extent possible, (3) be able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, (4) be capable of promoting awareness of third-party stakeholder relationships to assist small businesses in mitigating common cybersecurity risks, and (5) be consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014.  Other federal agencies may elect to publish the resources on their own websites.