; and (B) small organizations, insurers of risks related to cybersecurity, State governments, cybersecurity and information technology companies that work with small organizations, and academic and Federal and non-Federal experts in cybersecurity. (e) Periodic census on state of cybersecurity of small businesses (1) In general Not later than one year after the date of enactment of this Act and not less frequently than every 24 months thereafter for not more than 10 years, the Administrator shall submit to Congress and make publicly available data on the state of cybersecurity of small businesses, including— (A) adoption of the cybersecurity guidance among small businesses; (B) the most significant and widespread cybersecurity threats facing small businesses; (C) the amount small businesses spend on cybersecurity products and services; and (D) the personnel small businesses dedicate to cybersecurity (including the amount of total personnel time, whether by employees or contractors, dedicated to cybersecurity efforts). (2) Form The report required under paragraph (1) shall be produced in unclassified form but may contain a classified annex. (3) Consultation In preparing the report required under paragraph (1), the Administrator shall consult with— (A) the Secretary, the Director, and the Commission; and (B) small businesses, insurers of risks related to cybersecurity, cybersecurity and information technology companies that work with small businesses, and academic and Federal and non-Federal experts in cybersecurity.