; (2) by redesignating clause (viii) as clause (ix); and (3) by inserting after clause (vii) the following: (viii) consider small business concerns (as defined in section 3 of the Small Business Act ( 15 U.S.C. 632 )); and . (c) Dissemination of resources for small businesses (1) In general Not later than one year after the date of the enactment of this Act, the Director, in carrying out section 2(e)(1)(A)(viii) of the National Institute of Standards and Technology Act, as added by subsection (b) of this Act, in consultation with the heads of other appropriate Federal agencies, shall disseminate clear and concise resources to help small business concerns identify, assess, manage, and reduce their cybersecurity risks. (2) Requirements The Director shall ensure that the resources disseminated pursuant to paragraph (1)— (A) are generally applicable and usable by a wide range of small business concerns; (B) vary with the nature and size of the implementing small business concern, and the nature and sensitivity of the data collected or stored on the information systems or devices of the implementing small business concern; (C) include elements, that promote awareness of simple, basic controls, a workplace cybersecurity culture, and third-party stakeholder relationships, to assist small business concerns in mitigating common cybersecurity risks; (D) are technology-neutral and can be implemented using technologies that are commercial and off-the-shelf