; (B) assess market availability, market pricing, and affordability of products and services that promote the cybersecurity for small organizations, with particular attention to identifying high-risk and underserved sectors or regions; (C) estimate the cost of tax breaks, grants, subsidies, or other incentives to increase the adoption of policies and controls or acquisition of products and services that promote the cybersecurity, for small organizations; (D) as practicable, consult the certifications and requirement for cloud services described in the final report of the Cyberspace Solarium Commission established under section 1652 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 ( Public Law 115–232 ; 132 Stat. 2140); (E) describe evidence-based cybersecurity controls and policies that improve cybersecurity for small organizations; (F) with respect to the incentives described in subparagraph (C), recommend measures that can effectively improve cybersecurity at scale for small organizations; and (G) include any other matters the Secretary deems relevant. (3) Guidance for specific types of small organizations In preparing the report required under paragraph (1), the Secretary may include matters applicable for specific types of small organizations in addition to matters applicable to all small organizations. (4) Consultation In preparing the report required under paragraph (1), the Secretary shall consult with— (A) the Administrator, the Director, and the Commission