; and (ii) marketed and sold primarily to consumers; and (B) does not include— (i) devices that are marketed and sold for use primarily in industrial, business, or enterprise settings; or (ii) smartphones, tablets, personal computers, or devices leased to consumers by multichannel video programming distributors. (2) Cybersecurity threat The term cybersecurity threat has the meaning given to the term in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ). (3) Security vulnerability The term security vulnerability has the meaning given to the term in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ). (b) Development of educational cybersecurity resources Not later than 1 year after the date of enactment of this Act, the Federal Trade Commission shall, in coordination with the National Institute of Standards and Technology and relevant private sector stakeholders and experts, develop voluntary educational cybersecurity resources for consumers relating to the practices of consumers with respect to the protection and use of covered devices, including citing evidence of consumer attitudes and expectations. (c) Elements The voluntary resources developed under subsection (b) shall be technology-neutral and include guidance, best practices, and advice for consumers to protect against, mitigate, and recover from cybersecurity threats or security vulnerabilities, where technically feasible, including— (1) the scope of possible security support from a vendor post-purchase; (2) how to initiate or set up a covered device for use; (3) the use of passwords, available security tools and settings, appropriate physical controls, and avoidance of steps that can defeat security; (4) updates to the software of a covered device during operation or use if applicable; (5) the recovery of compromised devices