; (B) include guidance to address common cybersecurity threats and risks posed by electronic devices that are personal to the employees and contractors of small organizations, as well as electronic devices that are issued to those employees and contractors by small organizations; and (C) recommend— (i) measures to improve the cybersecurity of small organizations; and (ii) configurations and settings for some of the most commonly used software that can improve the cybersecurity of small organizations. (2) Consistency The Director shall ensure the cybersecurity guidance maintained under paragraph (1) is consistent with— (A) cybersecurity resources developed by NIST, as required by the NIST Small Business Cybersecurity Act ( Public Law 115–236 ); and (B) the most recent version of the Cybersecurity Framework, or successor resource, maintained by NIST. (3) Guidance for specific types of small organizations The Director may include cybersecurity guidance, as required under paragraph (1), appropriate for specific types of small organizations in addition to guidance applicable for all small organizations. (4) Updates (A) In general The Director shall review the cybersecurity guidance maintained under paragraph (1) not less frequently than annually and update as appropriate. (B) Consultation In updating the cybersecurity guidance under subparagraph (A), the Director shall, to the degree practicable and as appropriate, consult with— (i) the Administrator, the Secretary, and the Commission; (ii) small organizations, insurers, State governments, companies that work with small organizations, and academic and Federal and non-Federal experts in cybersecurity