1. Short title This Act may be cited as the Promoting Good Cyber Hygiene Act of 2017 . 2. Cyber hygiene best practices (a) Establishment Not later than 1 year after the date of enactment of this Act, the Director of the National Institute of Standards and Technology shall establish a list of best practices for effective and usable cyber hygiene— (1) in consultation with the Federal Trade Commission and the Secretary of Homeland Security; (2) after notice and an opportunity for public comment; and (3) for use by— (A) the Federal Government; (B) the private sector; and (C) any person utilizing an information system or device. (b) Best practices A best practice on the list established under subsection (a) shall— (1) be a simple, basic control that has the greatest effect in defending against a common cybersecurity threat or risk; (2) utilize a technology that is commercial, off-the-shelf, and based on international standards; and (3) to the degree practicable, be based on and consistent with the Cybersecurity Framework contained in Executive Order 13636, entitled Improving Critical Infrastructure Cybersecurity , issued in February 2013, or any successor framework. (c) Voluntary practices A best practice on the list established under subsection (a) shall be considered voluntary and is not intended to be construed as mandatory. (d) Baseline The Director shall encourage the use of the best practices as the baseline provided by the list established under subsection (a) is encouraged to be not only used but improved upon by any entity including— (1) the Federal Government; (2) the private sector