[Congressional Bills 115th Congress]
[From the U.S. Government Publishing Office]
[S. 770 Engrossed Amendment House (EAH)]
<DOC>
In the House of Representatives, U. S.,
July 25, 2018.
Resolved, That the bill from the Senate (S. 770) entitled ``An Act
to require the Director of the National Institute of Standards and
Technology to disseminate resources to help reduce small business
cybersecurity risks, and for other purposes.'', do pass with the
following
AMENDMENTS:
Strike out all after the enacting clause and insert:
SECTION 1. SHORT TITLE.
This Act may be cited as the ``NIST Small Business Cybersecurity
Act''.
SEC. 2. IMPROVING CYBERSECURITY OF SMALL BUSINESSES.
(a) Definitions.--In this section:
(1) Director.--The term ``Director'' means the Director of
the National Institute of Standards and Technology.
(2) Resources.--The term ``resources'' means guidelines,
tools, best practices, standards, methodologies, and other ways
of providing information.
(3) Small business concern.--The term ``small business
concern'' has the meaning given such term in section 3 of the
Small Business Act (15 U.S.C. 632).
(b) Small Business Cybersecurity.--Section 2(e)(1)(A) of the
National Institute of Standards and Technology Act (15 U.S.C.
272(e)(1)(A)) is amended--
(1) in clause (vii), by striking ``and'' at the end;
(2) by redesignating clause (viii) as clause (ix); and
(3) by inserting after clause (vii) the following:
``(viii) consider small business concerns
(as defined in section 3 of the Small Business
Act (15 U.S.C. 632)); and''.
(c) Dissemination of Resources for Small Businesses.--
(1) In general.--Not later than one year after the date of
the enactment of this Act, the Director, in carrying out
section 2(e)(1)(A)(viii) of the National Institute of Standards
and Technology Act, as added by subsection (b) of this Act, in
consultation with the heads of other appropriate Federal
agencies, shall disseminate clear and concise resources to help
small business concerns identify, assess, manage, and reduce
their cybersecurity risks.
(2) Requirements.--The Director shall ensure that the
resources disseminated pursuant to paragraph (1)--
(A) are generally applicable and usable by a wide
range of small business concerns;
(B) vary with the nature and size of the
implementing small business concern, and the nature and
sensitivity of the data collected or stored on the
information systems or devices of the implementing
small business concern;
(C) include elements, that promote awareness of
simple, basic controls, a workplace cybersecurity
culture, and third-party stakeholder relationships, to
assist small business concerns in mitigating common
cybersecurity risks;
(D) include case studies of practical application;
(E) are technology-neutral and can be implemented
using technologies that are commercial and off-the-
shelf; and
(F) are based on international standards to the
extent possible, and are consistent with the Stevenson-
Wydler Technology Innovation Act of 1980 (15 U.S.C.
3701 et seq.).
(3) National cybersecurity awareness and education
program.--The Director shall ensure that the resources
disseminated under paragraph (1) are consistent with the
efforts of the Director under section 401 of the Cybersecurity
Enhancement Act of 2014 (15 U.S.C. 7451).
(4) Small business development center cyber strategy.--In
carrying out paragraph (1), the Director, to the extent
practicable, shall consider any methods included in the Small
Business Development Center Cyber Strategy developed under
section 1841(a)(3)(B) of the National Defense Authorization Act
for Fiscal Year 2017 (Public Law 114-328).
(5) Voluntary resources.--The use of the resources
disseminated under paragraph (1) shall be considered voluntary.
(6) Updates.--The Director shall review and, if necessary,
update the resources disseminated under paragraph (1) in
accordance with the requirements under paragraph (2).
(7) Public availability.--The Director and the head of each
Federal agency that so elects shall make prominently available
on the respective agency's public Internet website information
about the resources and updates to the resources disseminated
under paragraph (1). The Director and the heads shall each
ensure that the information they respectively make prominently
available is consistent, clear, and concise.
(d) Other Federal Cybersecurity Requirements.--Nothing in this
section may be construed to supersede, alter, or otherwise affect any
cybersecurity requirements applicable to Federal agencies.
(e) Funding.--This Act shall be carried out using funds otherwise
authorized to be appropriated or made available to the National
Institute of Standards and Technology.
Amend the title so as to read: ``An Act to require the
Director of the National Institute of Standards and Technology to
disseminate guidance to help reduce small business cybersecurity
risks, and for other purposes.''.
Attest:
Clerk.
115th CONGRESS
2d Session
S. 770
_______________________________________________________________________
AMENDMENTS