1. Short title
This Act may be cited as the “Improving Telework Cybersecurity for Small Organizations Act”.
Improving Telework Cybersecurity for Small Organizations Act
A BILL
To improve the cybsersecurity of small organizations with respect to teleworking, and for other purposes.
2. Small organization telework cybersecurity
Definitions— In this section:
Commission— The term Commission means the Federal Trade Commission.
Coronavirus public health emergency— The term coronavirus public health emergency means the public health emergency declared by the Secretary of Health and Human Services pursuant to section 319 of the Public Health Service Act (42 U.S.C. 247d) on January 31, 2020, as a result of confirmed cases of COVID–19.
Director— The term Director means the Director of the Cybersecurity and Infrastructure Security Agency.
Small business— The term small business has the meaning given the term small business concern in section 3 of the Small Business Act (15 U.S.C. 632) and any associated regulations promulgated by the Administrator of the Small Business Administration.
Small governmental jurisdiction— The term small governmental jurisdiction means governments of cities, counties, towns, townships, villages, school districts, or special districts, with a population of less than 50,000.
Small nonprofit— The term small nonprofit means any not-for-profit enterprise that is independently owned and operated and is not dominant in its field.
Small organization— The term small organization means organizations unlikely to employ a specialist in cybersecurity, including—
a small business;
a small nonprofit; and
a small governmental jurisdiction.
Cybersecurity and Infrastructure Security Agency telework guidance for small organizations—
In general— Not later than 45 days after the date of enactment of this Act, the Director, in consultation with the Commission, shall publish a resource on the website of the Cybersecurity and Infrastructure Security Agency describing best practices a small organization may take to improve cybersecurity with respect to teleworking.
Contents— The resource required under paragraph (1) shall—
include basic steps that have the most impact in improving the security of teleworking for a small organization;
recommend, as practicable, configurations and settings for commonly used software that can improve the cybersecurity of small organizations with increased teleworking; and
be consistent with—
relevant standards and guidelines published by the Director of the National Institute of Standards and Technology;
guidance from the Director entitled “Telework Guidance and Resources”, issued on April 24, 2020, or any successor guidance; and
Alert (AA20–073A) regarding Enterprise VPN Security issued by the Director on March 13, 2020, or any successor guidance.
Federal Trade Commission Program To Assist Cybersecurity Efforts— Not later than 30 days after the publishing of the resource required under subsection (b), the Commission, in coordination with the Director, shall establish a program—
to educate consumers and small organizations on improving the cybersecurity of the technologies increasingly used for distance learning, telemedicine, and telework as a result of the coronavirus public health emergency; and
that shall be consistent with the resource required under subsection (b).