1. Short title This Act may be cited as the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 . 2. NIST mission to address cybersecurity threats Section 20(a)(1) of the National Institute of Standards and Technology Act ( 15 U.S.C. 278g–3(a)(1) ) is amended by inserting , emphasizing the principle that expanding cybersecurity threats require engineering security from the beginning of an information system’s life cycle, building more trustworthy and secure components and systems from the start, and applying well-defined security design principles throughout before the semicolon. 3. Implementation of Cybersecurity Framework The National Institute of Standards and Technology Act ( 15 U.S.C. 271 et seq.) is amended by inserting after section 20 the following: 20A. Framework for Improving Critical Infrastructure Cybersecurity (a) Implementation by Federal agencies (1) In general The Institute shall promote the implementation by Federal agencies of the Framework for Improving Critical Infrastructure Cybersecurity (in this section and section 20B referred to as the Framework ) by providing to the Office of Management and Budget, the Office of Science and Technology Policy, and all other Federal agencies, not later than 6 months after the date of enactment of the NIST Cybersecurity Framework, Assessment, and Auditing Act of 2017 , guidance that Federal agencies may use to incorporate the Framework into their information security risk management efforts, including practices related to compliance with chapter 35 of title 44, United States Code, and any other applicable Federal law. (2) Guidance The guidance required under paragraph (1) shall— (A) describe how the Framework aligns with or augments existing agency practices related to compliance with chapter 35 of title 44, United States Code, and any other applicable Federal law