NIST Small Business Cybersecurity Act

Bill: 115-s-770
Sponsor: full_name: Sen. Schatz, Brian [D-HI]
Introduced: 2017-03-29
Policy area: Science, Technology, Communications
Subjects: Computer security and identity theft

Government information and archives

Infrastructure development

Small business
Latest action: action_date: 2018-08-14
text: Became Public Law No: 115-236.

Summaries:
action_date: 2017-03-29
action_desc: Introduced in Senate
text: <p><b>Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017</b></p> <p>This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.</p> <p>NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014.</p> <p>Other federal agencies that NIST considers appropriate must also publish the resources on their own websites. </p>

action_date: 2017-09-11
action_desc: Reported to Senate with amendment(s)
text: <p><strong>Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017</strong></p> <p>(Sec. 3) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure. </p> <p>NIST must consult with other federal agencies to disseminate, and publish on its website, resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must: (1) be generally applicable and usable by a wide range of small businesses; (2) vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on its information systems or devices; (3) include elements that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third party stakeholder relationships; (4) be technology-neutral; and (5) be based on international standards to the extent possible and consistent with the Stevenson-Wydler Technology Innovation Act of 1980.</p> <p>Other federal agencies that NIST considers appropriate must also publish the resources on their own websites. </p>

action_date: 2017-09-28
action_desc: Passed Senate amended
text: <p><b>Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017</b></p> <p>(Sec. 3) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.</p> <p>NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014.</p> <p>Other federal agencies that NIST considers appropriate must also publish the resources on their own websites. </p>

action_date: 2018-07-25
action_desc: Passed House amended
text: <p class="MsoNormal" style="margin-bottom: 0.0001pt; line-height: normal;"><b>NIST Small Business Cybersecurity Act</b></p> <p class="MsoNormal" style="line-height: normal;">(Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.</p> <p class="MsoNormal" style="line-height: normal;">NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014. Additionally, the resources must include case studies of practical application.</p> <p class="MsoNormal" style="line-height: normal;">Other federal agencies may also elect to publish the resources on their own websites. </p>

action_date: 2018-08-01
action_desc: Senate agreed to House amendment without amendment
text: <div><b><br /></b></div> <div><b>NIST Small Business Cybersecurity Act</b></div> <p class="MsoNormal" style="line-height: normal;">(Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.</p> <p class="MsoNormal" style="line-height: normal;">NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014. Additionally, the resources must include case studies of practical application.</p> <p class="MsoNormal" style="line-height: normal;">Other federal agencies may also elect to publish the resources on their own websites. </p>

action_date: 2018-08-14
action_desc: Public Law
text: <div><b><br /></b></div> <div><b>NIST Small Business Cybersecurity Act</b></div> <p class="MsoNormal" style="line-height: normal;">(Sec. 2) This bill amends the National Institute of Standards and Technology Act to require the National Institute of Standards and Technology (NIST) to consider small businesses when it facilitates and supports the development of voluntary, consensus-based, industry-led guidelines and procedures to cost-effectively reduce cyber risks to critical infrastructure.</p> <p class="MsoNormal" style="line-height: normal;">NIST must disseminate, and publish on its website, standard and method resources that small business may use voluntarily to help identify, assess, manage, and reduce their cybersecurity risks. The resources must be: (1) technology-neutral, (2) based on international standards to the extent possible, (3) able to vary with the nature and size of the implementing small business and the sensitivity of the data collected or stored on the information systems, and (4) consistent with the national cybersecurity awareness and education program under the Cybersecurity Enhancement Act of 2014. Additionally, the resources must include case studies of practical application.</p> <p class="MsoNormal" style="line-height: normal;">Other federal agencies may also elect to publish the resources on their own websites. </p>

tv_txt: II 115th CONGRESS 1st Session S. 770 IN THE SENATE OF THE UNITED STATES March 29, 2017 Mr. Schatz (for himself, Mr. Risch , Mr. Thune , Ms. Cantwell , and Mr. Nelson ) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation A BILL To require the Director of the National Institute of Standards and Technology to disseminate resources to help reduce small business cybersecurity risks, and for other purposes.

1. Short title This Act may be cited as the Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017 . 2. Findings Congress makes the following findings: (1) Small businesses play a vital role in the economy of the United States, accounting for 54 percent of all United States sales and 55 percent of jobs in the United States. (2) Attacks targeting small and medium businesses account for a high percentage of cyberattacks in the United States. Sixty percent of small businesses that suffer a cyberattack are out of business within 6 months, according to the National Cyber Security Alliance. (3) The Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7421 et seq.) calls on the National Institute of Standards and Technology to facilitate and support a voluntary public-private partnership to reduce cybersecurity risks to critical infrastructure. Such a partnership continues to play a key role in improving the cyber resilience of the United States and making cyberspace safer. (4) There is a need to develop simplified resources that are consistent with the partnership described in paragraph (3) that improves its use by small businesses. 3. Improving cybersecurity of small businesses (a) Definitions In this section: (1) Director The term Director means the Director of the National Institute of Standards and Technology. (2) Resources The term resources means guidelines, tools, best practices, standards, methodologies, and other ways of providing information. (3) Small business concern The term small business concern has the meaning given such term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). (b) Small business cybersecurity Section 2(e)(1)(A) of the National Institute of Standards and Technology Act ( 15 U.S.C. 272(e)(1)(A) ) is amended— (1) in clause (vii), by striking and at the end; (2) by redesignating clause (viii) as clause (ix); and (3) by inserting after clause (vii) the following: (viii) consider small business concerns (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )); and . (c) Dissemination of resources for small businesses (1) In general Not later than one year after the date of the enactment of this Act, the Director, in carrying out section 2(e)(1)(A)(viii) of the National Institute of Standards and Technology Act, as added by subsection (b) of this Act, in consultation with the heads of such other Federal agencies as the Director considers appropriate, shall disseminate clear and concise resources for small business concerns to help reduce their cybersecurity risks. (2) Requirements The Director shall ensure that the resources disseminated pursuant to paragraph (1)— (A) are effective and usable by small business concerns; (B) vary with the nature and size of the implementing small business concern, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing small business concern; (C) include elements, such as simple, basic controls, to assist small business concerns in defending against common cybersecurity risks; (D) are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf; and (E) are based on international standards to the extent possible, and are consistent with the Stevenson-Wydler Technology Innovation Act of 1980 ( 15 U.S.C. 3701 et seq.). (3) National cybersecurity awareness and education program The Director shall ensure that the resources disseminated under paragraph (1) are consistent with the efforts of the Director under section 401 of the Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7451 ). (4) Small business development center cyber strategy In carrying out paragraph (1), the Director, to the extent practicable, shall consider any methods included in the Small Business Development Center Cyber Strategy developed under section 1841(a)(3)(B) of the National Defense Authorization Act for Fiscal Year 2017 ( Public Law 114–328 ). (5) Voluntary resources The use of the resources disseminated under paragraph (1) shall be considered voluntary. (6) Updates The Director shall review and, if necessary, update the resources disseminated under paragraph (1). (7) Public availability The Director and such heads of other Federal agencies as the Director considers appropriate shall each make prominently available to the public on the Director's or head's Internet website, as the case may be, information about the resources disseminated under paragraph (1). The Director and the heads shall each ensure that the information they respectively make prominently available is consistent, clear, and concise. (d) Consistency of resources published by Federal agencies If a Federal agency publishes resources to help small business concerns reduce their cybersecurity risks, the head of such Federal agency, to the degree practicable, shall make such resources consistent with the resources disseminated under subsection (c)(1). (e) Other Federal cybersecurity requirements Nothing in this section may be construed to supersede, alter, or otherwise affect any cybersecurity requirements applicable to Federal agencies.

tv_txt: 115th CONGRESS 1st Session S. 770 IN THE SENATE OF THE UNITED STATES AN ACT To require the Director of the National Institute of Standards and Technology to disseminate resources to help reduce small business cybersecurity risks, and for other purposes.

1. Short title This Act may be cited as the Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017 . 2. Findings Congress makes the following findings: (1) Small businesses play a vital role in the economy of the United States, accounting for 54 percent of all United States sales and 55 percent of jobs in the United States. (2) Attacks targeting small and medium businesses account for a high percentage of cyberattacks in the United States. (3) The Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7421 et seq.) calls on the National Institute of Standards and Technology to facilitate and support a voluntary public-private partnership to reduce cybersecurity risks to critical infrastructure. Such a partnership continues to play a key role in improving the cyber resilience of the United States and making cyberspace safer. (4) There is a need to develop simplified resources that are consistent with the partnership described in paragraph (3) that improves its use by small businesses. 3. Improving cybersecurity of small businesses (a) Definitions In this section: (1) Director The term Director means the Director of the National Institute of Standards and Technology. (2) Resources The term resources means guidelines, tools, best practices, standards, methodologies, and other ways of providing information. (3) Small business concern The term small business concern has the meaning given such term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). (b) Small business cybersecurity Section 2(e)(1)(A) of the National Institute of Standards and Technology Act ( 15 U.S.C. 272(e)(1)(A) ) is amended— (1) in clause (vii), by striking and at the end; (2) by redesignating clause (viii) as clause (ix); and (3) by inserting after clause (vii) the following: (viii) consider small business concerns (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )); and . (c) Dissemination of resources for small businesses (1) In general Not later than one year after the date of the enactment of this Act, the Director, in carrying out section 2(e)(1)(A)(viii) of the National Institute of Standards and Technology Act, as added by subsection (b) of this Act, in consultation with the heads of such other Federal agencies as the Director considers appropriate, shall disseminate clear and concise resources for small business concerns to help reduce their cybersecurity risks. (2) Requirements The Director shall ensure that the resources disseminated pursuant to paragraph (1)— (A) are generally applicable and usable by a wide range of small business concerns; (B) vary with the nature and size of the implementing small business concern, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing small business concern; (C) include elements that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third party stakeholder relationships, to assist small business concerns in mitigating common cybersecurity risks; (D) are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf; and (E) are based on international standards to the extent possible, and are consistent with the Stevenson-Wydler Technology Innovation Act of 1980 ( 15 U.S.C. 3701 et seq.). (3) National cybersecurity awareness and education program The Director shall ensure that the resources disseminated under paragraph (1) are consistent with the efforts of the Director under section 401 of the Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7451 ). (4) Small business development center cyber strategy In carrying out paragraph (1), the Director, to the extent practicable, shall consider any methods included in the Small Business Development Center Cyber Strategy developed under section 1841(a)(3)(B) of the National Defense Authorization Act for Fiscal Year 2017 ( Public Law 114–328 ). (5) Voluntary resources The use of the resources disseminated under paragraph (1) shall be considered voluntary. (6) Updates The Director shall review and, if necessary, update the resources disseminated under paragraph (1) in accordance with the requirements under paragraph (2). (7) Public availability The Director and such heads of other Federal agencies as the Director considers appropriate shall each make prominently available to the public on the Director's or head's Internet website, as the case may be, information about the resources and all updates to them disseminated under paragraph (1). The Director and the heads shall each ensure that the information they respectively make prominently available is consistent, clear, and concise. (d) Consistency of resources published by Federal agencies If a Federal agency publishes resources to help small business concerns reduce their cybersecurity risks, the head of such Federal agency, to the degree practicable, shall make such resources consistent with the resources disseminated under subsection (c)(1). (e) Other Federal cybersecurity requirements Nothing in this section may be construed to supersede, alter, or otherwise affect any cybersecurity requirements applicable to Federal agencies.

Passed the Senate September 28, 2017. Secretary

tv_txt: II Calendar No. 217 115th CONGRESS 1st Session S. 770 [Report No. 115–153] IN THE SENATE OF THE UNITED STATES March 29, 2017 Mr. Schatz (for himself, Mr. Risch , Mr. Thune , Ms. Cantwell , Mr. Nelson , Mr. Gardner , Ms. Cortez Masto , Ms. Hassan , Mrs. McCaskill , and Mrs. Gillibrand ) introduced the following bill; which was read twice and referred to the Committee on Commerce, Science, and Transportation September 11, 2017 Reported by Mr. Thune , with an amendment Strike out all after the enacting clause and insert the part printed in italic A BILL To require the Director of the National Institute of Standards and Technology to disseminate resources to help reduce small business cybersecurity risks, and for other purposes.

1. Short title This Act may be cited as the Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017 . 2. Findings Congress makes the following findings: (1) Small businesses play a vital role in the economy of the United States, accounting for 54 percent of all United States sales and 55 percent of jobs in the United States. (2) Attacks targeting small and medium businesses account for a high percentage of cyberattacks in the United States. Sixty percent of small businesses that suffer a cyberattack are out of business within 6 months, according to the National Cyber Security Alliance. (3) The Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7421 et seq.) calls on the National Institute of Standards and Technology to facilitate and support a voluntary public-private partnership to reduce cybersecurity risks to critical infrastructure. Such a partnership continues to play a key role in improving the cyber resilience of the United States and making cyberspace safer. (4) There is a need to develop simplified resources that are consistent with the partnership described in paragraph (3) that improves its use by small businesses. 3. Improving cybersecurity of small businesses (a) Definitions In this section: (1) Director The term Director means the Director of the National Institute of Standards and Technology. (2) Resources The term resources means guidelines, tools, best practices, standards, methodologies, and other ways of providing information. (3) Small business concern The term small business concern has the meaning given such term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). (b) Small business cybersecurity Section 2(e)(1)(A) of the National Institute of Standards and Technology Act ( 15 U.S.C. 272(e)(1)(A) ) is amended— (1) in clause (vii), by striking and at the end; (2) by redesignating clause (viii) as clause (ix); and (3) by inserting after clause (vii) the following: (viii) consider small business concerns (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )); and . (c) Dissemination of resources for small businesses (1) In general Not later than one year after the date of the enactment of this Act, the Director, in carrying out section 2(e)(1)(A)(viii) of the National Institute of Standards and Technology Act, as added by subsection (b) of this Act, in consultation with the heads of such other Federal agencies as the Director considers appropriate, shall disseminate clear and concise resources for small business concerns to help reduce their cybersecurity risks. (2) Requirements The Director shall ensure that the resources disseminated pursuant to paragraph (1)— (A) are effective and usable by small business concerns; (B) vary with the nature and size of the implementing small business concern, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing small business concern; (C) include elements, such as simple, basic controls, to assist small business concerns in defending against common cybersecurity risks; (D) are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf; and (E) are based on international standards to the extent possible, and are consistent with the Stevenson-Wydler Technology Innovation Act of 1980 ( 15 U.S.C. 3701 et seq.). (3) National cybersecurity awareness and education program The Director shall ensure that the resources disseminated under paragraph (1) are consistent with the efforts of the Director under section 401 of the Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7451 ). (4) Small business development center cyber strategy In carrying out paragraph (1), the Director, to the extent practicable, shall consider any methods included in the Small Business Development Center Cyber Strategy developed under section 1841(a)(3)(B) of the National Defense Authorization Act for Fiscal Year 2017 ( Public Law 114–328 ). (5) Voluntary resources The use of the resources disseminated under paragraph (1) shall be considered voluntary. (6) Updates The Director shall review and, if necessary, update the resources disseminated under paragraph (1). (7) Public availability The Director and such heads of other Federal agencies as the Director considers appropriate shall each make prominently available to the public on the Director's or head's Internet website, as the case may be, information about the resources disseminated under paragraph (1). The Director and the heads shall each ensure that the information they respectively make prominently available is consistent, clear, and concise. (d) Consistency of resources published by Federal agencies If a Federal agency publishes resources to help small business concerns reduce their cybersecurity risks, the head of such Federal agency, to the degree practicable, shall make such resources consistent with the resources disseminated under subsection (c)(1). (e) Other Federal cybersecurity requirements Nothing in this section may be construed to supersede, alter, or otherwise affect any cybersecurity requirements applicable to Federal agencies.

1. Short title This Act may be cited as the Making Available Information Now to Strengthen Trust and Resilience and Enhance Enterprise Technology Cybersecurity Act of 2017 or the MAIN STREET Cybersecurity Act of 2017 . 2. Findings Congress makes the following findings: (1) Small businesses play a vital role in the economy of the United States, accounting for 54 percent of all United States sales and 55 percent of jobs in the United States. (2) Attacks targeting small and medium businesses account for a high percentage of cyberattacks in the United States. Sixty percent of small businesses that suffer a cyberattack are out of business within 6 months, according to the National Cyber Security Alliance. (3) The Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7421 et seq.) calls on the National Institute of Standards and Technology to facilitate and support a voluntary public-private partnership to reduce cybersecurity risks to critical infrastructure. Such a partnership continues to play a key role in improving the cyber resilience of the United States and making cyberspace safer. (4) There is a need to develop simplified resources that are consistent with the partnership described in paragraph (3) that improves its use by small businesses. 3. Improving cybersecurity of small businesses (a) Definitions In this section: (1) Director The term Director means the Director of the National Institute of Standards and Technology. (2) Resources The term resources means guidelines, tools, best practices, standards, methodologies, and other ways of providing information. (3) Small business concern The term small business concern has the meaning given such term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). (b) Small business cybersecurity Section 2(e)(1)(A) of the National Institute of Standards and Technology Act ( 15 U.S.C. 272(e)(1)(A) ) is amended— (1) in clause (vii), by striking and at the end; (2) by redesignating clause (viii) as clause (ix); and (3) by inserting after clause (vii) the following: (viii) consider small business concerns (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )); and . (c) Dissemination of resources for small businesses (1) In general Not later than one year after the date of the enactment of this Act, the Director, in carrying out section 2(e)(1)(A)(viii) of the National Institute of Standards and Technology Act, as added by subsection (b) of this Act, in consultation with the heads of such other Federal agencies as the Director considers appropriate, shall disseminate clear and concise resources for small business concerns to help reduce their cybersecurity risks. (2) Requirements The Director shall ensure that the resources disseminated pursuant to paragraph (1)— (A) are generally applicable and usable by a wide range of small business concerns; (B) vary with the nature and size of the implementing small business concern, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing small business concern; (C) include elements that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third party stakeholder relationships, to assist small business concerns in mitigating common cybersecurity risks; (D) are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf; and (E) are based on international standards to the extent possible, and are consistent with the Stevenson-Wydler Technology Innovation Act of 1980 ( 15 U.S.C. 3701 et seq.). (3) National cybersecurity awareness and education program The Director shall ensure that the resources disseminated under paragraph (1) are consistent with the efforts of the Director under section 401 of the Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7451 ). (4) Small business development center cyber strategy In carrying out paragraph (1), the Director, to the extent practicable, shall consider any methods included in the Small Business Development Center Cyber Strategy developed under section 1841(a)(3)(B) of the National Defense Authorization Act for Fiscal Year 2017 ( Public Law 114–328 ). (5) Voluntary resources The use of the resources disseminated under paragraph (1) shall be considered voluntary. (6) Updates The Director shall review and, if necessary, update the resources disseminated under paragraph (1) in accordance with the requirements under paragraph (2). (7) Public availability The Director and such heads of other Federal agencies as the Director considers appropriate shall each make prominently available to the public on the Director's or head's Internet website, as the case may be, information about the resources and all updates to them disseminated under paragraph (1). The Director and the heads shall each ensure that the information they respectively make prominently available is consistent, clear, and concise. (d) Consistency of resources published by Federal agencies If a Federal agency publishes resources to help small business concerns reduce their cybersecurity risks, the head of such Federal agency, to the degree practicable, shall make such resources consistent with the resources disseminated under subsection (c)(1). (e) Other Federal cybersecurity requirements Nothing in this section may be construed to supersede, alter, or otherwise affect any cybersecurity requirements applicable to Federal agencies.

September 11, 2017 Reported with an amendment

tv_txt: 115th CONGRESS 2d Session In the House of Representatives, U. S., July 25, 2018 AMENDMENTS:

That the bill from the Senate (S. 770) entitled An Act to require the Director of the National Institute of Standards and Technology to disseminate resources to help reduce small business cybersecurity risks, and for other purposes. , do pass with the following Strike out all after the enacting clause and insert: 1. Short title This Act may be cited as the NIST Small Business Cybersecurity Act . 2. Improving cybersecurity of small businesses (a) Definitions In this section: (1) Director The term Director means the Director of the National Institute of Standards and Technology. (2) Resources The term resources means guidelines, tools, best practices, standards, methodologies, and other ways of providing information. (3) Small business concern The term small business concern has the meaning given such term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). (b) Small business cybersecurity Section 2(e)(1)(A) of the National Institute of Standards and Technology Act ( 15 U.S.C. 272(e)(1)(A) ) is amended— (1) in clause (vii), by striking and at the end; (2) by redesignating clause (viii) as clause (ix); and (3) by inserting after clause (vii) the following: (viii) consider small business concerns (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )); and . (c) Dissemination of resources for small businesses (1) In general Not later than one year after the date of the enactment of this Act, the Director, in carrying out section 2(e)(1)(A)(viii) of the National Institute of Standards and Technology Act, as added by subsection (b) of this Act, in consultation with the heads of other appropriate Federal agencies, shall disseminate clear and concise resources to help small business concerns identify, assess, manage, and reduce their cybersecurity risks. (2) Requirements The Director shall ensure that the resources disseminated pursuant to paragraph (1)— (A) are generally applicable and usable by a wide range of small business concerns; (B) vary with the nature and size of the implementing small business concern, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing small business concern; (C) include elements, that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third-party stakeholder relationships, to assist small business concerns in mitigating common cybersecurity risks; (D) include case studies of practical application; (E) are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf; and (F) are based on international standards to the extent possible, and are consistent with the Stevenson-Wydler Technology Innovation Act of 1980 ( 15 U.S.C. 3701 et seq.). (3) National cybersecurity awareness and education program The Director shall ensure that the resources disseminated under paragraph (1) are consistent with the efforts of the Director under section 401 of the Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7451 ). (4) Small Business Development Center Cyber Strategy In carrying out paragraph (1), the Director, to the extent practicable, shall consider any methods included in the Small Business Development Center Cyber Strategy developed under section 1841(a)(3)(B) of the National Defense Authorization Act for Fiscal Year 2017 ( Public Law 114–328 ). (5) Voluntary resources The use of the resources disseminated under paragraph (1) shall be considered voluntary. (6) Updates The Director shall review and, if necessary, update the resources disseminated under paragraph (1) in accordance with the requirements under paragraph (2). (7) Public availability The Director and the head of each Federal agency that so elects shall make prominently available on the respective agency’s public Internet website information about the resources and updates to the resources disseminated under paragraph (1). The Director and the heads shall each ensure that the information they respectively make prominently available is consistent, clear, and concise. (d) Other Federal cybersecurity requirements Nothing in this section may be construed to supersede, alter, or otherwise affect any cybersecurity requirements applicable to Federal agencies. (e) Funding This Act shall be carried out using funds otherwise authorized to be appropriated or made available to the National Institute of Standards and Technology. Amend the title so as to read: An Act to require the Director of the National Institute of Standards and Technology to disseminate guidance to help reduce small business cybersecurity risks, and for other purposes. .

Karen L. Haas Clerk.

tv_txt: One Hundred Fifteenth Congress of the United States of America 2d Session Begun and held at the City of Washington on Wednesday, the third day of January, two thousand and eighteen S. 770 IN THE SENATE OF THE UNITED STATES AN ACT To require the Director of the National Institute of Standards and Technology to disseminate guidance to help reduce small business cybersecurity risks, and for other purposes.

1. Short title This Act may be cited as the NIST Small Business Cybersecurity Act . 2. Improving cybersecurity of small businesses (a) Definitions In this section: (1) Director The term Director means the Director of the National Institute of Standards and Technology. (2) Resources The term resources means guidelines, tools, best practices, standards, methodologies, and other ways of providing information. (3) Small business concern The term small business concern has the meaning given such term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). (b) Small business cybersecurity Section 2(e)(1)(A) of the National Institute of Standards and Technology Act ( 15 U.S.C. 272(e)(1)(A) ) is amended— (1) in clause (vii), by striking and at the end; (2) by redesignating clause (viii) as clause (ix); and (3) by inserting after clause (vii) the following: (viii) consider small business concerns (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )); and . (c) Dissemination of resources for small businesses (1) In general Not later than one year after the date of the enactment of this Act, the Director, in carrying out section 2(e)(1)(A)(viii) of the National Institute of Standards and Technology Act, as added by subsection (b) of this Act, in consultation with the heads of other appropriate Federal agencies, shall disseminate clear and concise resources to help small business concerns identify, assess, manage, and reduce their cybersecurity risks. (2) Requirements The Director shall ensure that the resources disseminated pursuant to paragraph (1)— (A) are generally applicable and usable by a wide range of small business concerns; (B) vary with the nature and size of the implementing small business concern, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing small business concern; (C) include elements, that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third-party stakeholder relationships, to assist small business concerns in mitigating common cybersecurity risks; (D) include case studies of practical application; (E) are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf; and (F) are based on international standards to the extent possible, and are consistent with the Stevenson-Wydler Technology Innovation Act of 1980 ( 15 U.S.C. 3701 et seq.). (3) National cybersecurity awareness and education program The Director shall ensure that the resources disseminated under paragraph (1) are consistent with the efforts of the Director under section 401 of the Cybersecurity Enhancement Act of 2014 ( 15 U.S.C. 7451 ). (4) Small Business Development Center Cyber Strategy In carrying out paragraph (1), the Director, to the extent practicable, shall consider any methods included in the Small Business Development Center Cyber Strategy developed under section 1841(a)(3)(B) of the National Defense Authorization Act for Fiscal Year 2017 ( Public Law 114–328 ). (5) Voluntary resources The use of the resources disseminated under paragraph (1) shall be considered voluntary. (6) Updates The Director shall review and, if necessary, update the resources disseminated under paragraph (1) in accordance with the requirements under paragraph (2). (7) Public availability The Director and the head of each Federal agency that so elects shall make prominently available on the respective agency’s public Internet website information about the resources and updates to the resources disseminated under paragraph (1). The Director and the heads shall each ensure that the information they respectively make prominently available is consistent, clear, and concise. (d) Other Federal cybersecurity requirements Nothing in this section may be construed to supersede, alter, or otherwise affect any cybersecurity requirements applicable to Federal agencies. (e) Funding This Act shall be carried out using funds otherwise authorized to be appropriated or made available to the National Institute of Standards and Technology.

Speaker of the House of Representatives Vice President of the United States and President of the Senate