Improving Cybersecurity of Small Businesses, Nonprofits, and Local Governments Act of 2021

Bill: 117-s-2483
Sponsor: Sen. Rosen, Jacky [D-NV]
Introduced: 2021-07-27 in the Senate
Policy area: Science, Technology, Communications
Subjects: Computer security and identity theft
Computers and information technology
Congressional oversight
Government information and archives
Intergovernmental relations
Internet, web applications, social media
Small business

Summary:
action_date: 2021-07-27
text: 

Improving Cybersecurity of Small Organizations Act of 2021

 
This bill requires the Cybersecurity and Infrastructure Security Agency (CISA) to maintain and promote cybersecurity guidance for use by small organizations. 
 
Specifically, the bill requires CISA to maintain cybersecurity guidance that documents and promotes evidence-based cybersecurity policies and controls for use by small organizations to improve their cybersecurity. This guidance must be publicly available at no cost, and CISA, the Small Business Administration (SBA), and the Department of Commerce must promote the guidance through relevant resources that are regularly used by small organizations.
 
Commerce must report on methods of incentivizing small organizations to improve their cybersecurity, including through the adoption of policies, controls, products, and services that have been demonstrated to reduce cybersecurity risk. Every two years, the SBA must submit and make publicly available specified data on the state of small businesses' cybersecurity. 

action_date: 2022-12-05
text: 

Improving Cybersecurity of Small Businesses, Nonprofits, and Local Governments Act of 2021

 
This bill requires reporting and other efforts to improve the cybersecurity of small entities. These include small businesses, governments (or certain governmental bodies) that represent populations of less than 50,000, and small nonprofits.
 
Specifically, the Cybersecurity and Infrastructure Security Agency (CISA) must periodically report on and make recommendations about cybersecurity policies and controls for small entities. CISA, the Small Business Administration (SBA), and the Minority Business Development Agency must (1) promote the report, including by making it available through their respective websites; and (2) make voluntary training and technical assistance available to employees of small entities concerning cybersecurity recommendations identified in the report.
 
In addition, the Department of Commerce must report to Congress about improving the cybersecurity of small entities. Further, the SBA must collect information from small businesses concerning cybersecurity matters and report to Congress about the cybersecurity of small businesses.


Legislative actions:
action_date: 2022-12-05
text: Placed on Senate Legislative Calendar under General Orders. Calendar No. 573.
action_date: 2022-12-05
text: Committee on Homeland Security and Governmental Affairs. Reported by Senator Peters with an amendment in the nature of a substitute. With written report No. 117-217.
action_date: 2022-12-05
text: Committee on Homeland Security and Governmental Affairs. Reported by Senator Peters with an amendment in the nature of a substitute. With written report No. 117-217.
action_date: 2022-02-02
text: Committee on Homeland Security and Governmental Affairs. Ordered to be reported with an amendment in the nature of a substitute favorably.
action_date: 2021-07-27
text: Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
action_date: 2021-07-27
text: Introduced in Senate