NIST Small Business Cybersecurity Act

Bill: 115-s-770
Sponsor: Sen. Schatz, Brian [D-HI]
Introduced: 2017-03-29 in the Senate
Policy area: Science, Technology, Communications
Subjects: Computer security and identity theft
Government information and archives
Infrastructure development
Small business

Summary:
action_date: 2017-03-29
text: 

Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017

 
This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.
 
NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014.
 
Other federal agencies that NIST considers appropriate must also publish the resources on their own websites. 

action_date: 2017-09-11
text: 

Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017

 
(Sec. 3) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure. 
 
NIST must consult with other federal agencies to disseminate, and publish on its website, resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must: (1) be generally applicable and usable by a wide range of small businesses; (2) vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on its information systems or devices; (3) include elements that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third party stakeholder relationships; (4) be technology-neutral; and (5) be based on international standards to the extent possible and consistent with the Stevenson-Wydler Technology Innovation Act of 1980.
 
Other federal agencies that NIST considers appropriate must also publish the resources on their own websites. 

action_date: 2017-09-28
text: 

Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017

 
(Sec. 3) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.
 
NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014.
 
Other federal agencies that NIST considers appropriate must also publish the resources on their own websites. 

action_date: 2018-07-25
text: 

NIST Small Business Cybersecurity Act

 
(Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.
 
NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014. Additionally, the resources must include case studies of practical application.
 
Other federal agencies may also elect to publish the resources on their own websites. 

action_date: 2018-08-01
text: 

 

NIST Small Business Cybersecurity Act

 
(Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.
 
NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014. Additionally, the resources must include case studies of practical application.
 
Other federal agencies may also elect to publish the resources on their own websites. 

action_date: 2018-08-14
text: 

 

NIST Small Business Cybersecurity Act

 
(Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.
 
NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014. Additionally, the resources must include case studies of practical application.
 
Other federal agencies may also elect to publish the resources on their own websites. 


Legislative actions:
action_date: 2018-08-14
text: Became Public Law No: 115-236.
action_date: 2018-08-14
text: Became Public Law No: 115-236.
action_date: 2018-08-14
text: Signed by President.
action_date: 2018-08-14
text: Signed by President.
action_date: 2018-08-03
text: Presented to President.
action_date: 2018-08-03
text: Presented to President.
action_date: 2018-08-02
text: Message on Senate action sent to the House.
action_date: 2018-08-01
text: Senate agreed to the House amendments to S. 770 by Unanimous Consent. (text as Senate agree to the House amendment: CR S5561)
action_date: 2018-08-01
text: Resolving differences -- Senate actions: Senate agreed to the House amendments to S. 770 by Unanimous Consent.(text as Senate agree to the House amendment: CR S5561)
action_date: 2018-07-26
text: Message on House action received in Senate and at desk: House amendments to Senate bill.
action_date: 2018-07-25
text: The title of the measure was amended. Agreed to without objection.
action_date: 2018-07-25
text: Motion to reconsider laid on the table Agreed to without objection.
action_date: 2018-07-25
text: On passage Passed without objection. (text: CR H7201)
action_date: 2018-07-25
text: Passed/agreed to in House: On passage Passed without objection.(text: CR H7201)
action_date: 2018-07-25
text: Considered by unanimous consent. (consideration: CR H7201-7202)
action_date: 2018-07-25
text: Mr. Webster (FL) asked unanimous consent to take from the Speaker's table and consider.
action_date: 2018-04-25
text: Committee on Small Business and Entrepreneurship. Hearings held. Hearings printed: S.Hrg. 115-300.
action_date: 2017-10-02
text: Held at the desk.
action_date: 2017-10-02
text: Received in the House.
action_date: 2017-09-29
text: Message on Senate action sent to the House.
action_date: 2017-09-28
text: Passed Senate with an amendment by Unanimous Consent. (text: CR S6233)
action_date: 2017-09-28
text: Passed/agreed to in Senate: Passed Senate with an amendment by Unanimous Consent.(text: CR S6233)
action_date: 2017-09-28
text: The committee substitute as amended agreed to by Unanimous Consent.
action_date: 2017-09-28
text: Measure laid before Senate by unanimous consent. (consideration: CR S6232-6233)
action_date: 2017-09-11
text: Placed on Senate Legislative Calendar under General Orders. Calendar No. 217.
action_date: 2017-09-11
text: Committee on Commerce, Science, and Transportation. Reported by Senator Thune with an amendment in the nature of a substitute. With written report No. 115-153.
action_date: 2017-09-11
text: Committee on Commerce, Science, and Transportation. Reported by Senator Thune with an amendment in the nature of a substitute. With written report No. 115-153.
action_date: 2017-04-05
text: Committee on Commerce, Science, and Transportation. Ordered to be reported with an amendment in the nature of a substitute favorably.
action_date: 2017-03-29
text: Read twice and referred to the Committee on Commerce, Science, and Transportation.
action_date: 2017-03-29
text: Introduced in Senate

Enacted as: number: 115-236