Improving Telework Cybersecurity for Small Organizations Act

II ★(Star Print) 116TH CONGRESS 2D SESSION S. 4920 To improve the cybsersecurity of small organizations with respect to teleworking, and for other purposes. IN THE SENATE OF THE UNITED STATES NOVEMBER 18, 2020 Ms. ROSEN (for herself and Mr. MORAN) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs A BILL To improve the cybsersecurity of small organizations with respect to teleworking, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Improving Telework 4 Cybersecurity for Small Organizations Act’’. 5 SEC. 2. SMALL ORGANIZATION TELEWORK CYBERSECU- 6 RITY. 7 (a) DEFINITIONS.—In this section: 8 (1) COMMISSION.—The term ‘‘Commission’’ 9 means the Federal Trade Commission. 10 VerDate Sep 11 2014 03:30 Dec 09, 2020 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S4920.IS S4920 pbinns on DSKJLVW7X2PROD with BILLS 2 S 4920 IS1S (2) CORONAVIRUS PUBLIC HEALTH EMER- 1 GENCY.—The term ‘‘coronavirus public health emer- 2 gency’’ means the public health emergency declared 3 by the Secretary of Health and Human Services 4 pursuant to section 319 of the Public Health Service 5 Act (42 U.S.C. 247d) on January 31, 2020, as a re- 6 sult of confirmed cases of COVID–19. 7 (3) DIRECTOR.—The term ‘‘Director’’ means 8 the Director of the Cybersecurity and Infrastructure 9 Security Agency. 10 (4) SMALL BUSINESS.—The term ‘‘small busi- 11 ness’’ has the meaning given the term ‘‘small busi- 12 ness concern’’ in section 3 of the Small Business Act 13 (15 U.S.C. 632) and any associated regulations pro- 14 mulgated by the Administrator of the Small Busi- 15 ness Administration. 16 (5) SMALL GOVERNMENTAL JURISDICTION.— 17 The term ‘‘small governmental jurisdiction’’ means 18 governments of cities, counties, towns, townships, 19 villages, school districts, or special districts, with a 20 population of less than 50,000. 21 (6) SMALL NONPROFIT.—The term ‘‘small non- 22 profit’’ means any not-for-profit enterprise that is 23 independently owned and operated and is not domi- 24 nant in its field. 25 VerDate Sep 11 2014 03:30 Dec 09, 2020 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S4920.IS S4920 pbinns on DSKJLVW7X2PROD with BILLS 3 S 4920 IS1S (7) SMALL ORGANIZATION.—The term ‘‘small 1 organization’’ means organizations unlikely to em- 2 ploy a specialist in cybersecurity, including— 3 (A) a small business; 4 (B) a small nonprofit; and 5 (C) a small governmental jurisdiction. 6 (b) CYBERSECURITY AND INFRASTRUCTURE SECU- 7 RITY AGENCY TELEWORK GUIDANCE FOR SMALL ORGA- 8 NIZATIONS.— 9 (1) IN GENERAL.—Not later than 45 days after 10 the date of enactment of this Act, the Director, in 11 consultation with the Commission, shall publish a re- 12 source on the website of the Cybersecurity and In- 13 frastructure Security Agency describing best prac- 14 tices a small organization may take to improve cy- 15 bersecurity with respect to teleworking. 16 (2) CONTENTS.—The resource required under 17 paragraph (1) shall— 18 (A) include basic steps that have the most 19 impact in improving the security of teleworking 20 for a small organization; 21 (B) recommend, as practicable, configura- 22 tions and settings for commonly used software 23 that can improve the cybersecurity of small or- 24 ganizations with increased teleworking; and 25 VerDate Sep 11 2014 03:30 Dec 09, 2020 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S4920.IS S4920 pbinns on DSKJLVW7X2PROD with BILLS 4 S 4920 IS1S (C) be consistent with— 1 (i) relevant standards and guidelines 2 published by the Director of the National 3 Institute of Standards and Technology; 4 (ii) guidance from the Director enti- 5 tled ‘‘Telework Guidance and Resources’’, 6 issued on April 24, 2020, or any successor 7 guidance; and 8 (iii) Alert (AA20–073A) regarding 9 Enterprise VPN Security issued by the Di- 10 rector on March 13, 2020, or any suc- 11 cessor guidance. 12 (c) FEDERAL TRADE COMMISSION PROGRAM TO AS- 13 SIST CYBERSECURITY EFFORTS.—Not later than 30 days 14 after the publishing of the resource required under sub- 15 section (b), the Commission, in coordination with the Di- 16 rector, shall establish a program— 17 (1) to educate consumers and small organiza- 18 tions on improving the cybersecurity of the tech- 19 nologies increasingly used for distance learning, tele- 20 medicine, and telework as a result of the coronavirus 21 public health emergency; and 22 (2) that shall be consistent with the resource 23 required under subsection (b). 24 Æ VerDate Sep 11 2014 03:30 Dec 09, 2020 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\S4920.IS S4920 pbinns on DSKJLVW7X2PROD with BILLS