1. Short title This Act may be cited as the American Cybersecurity Literacy Act . 2. Cybersecurity literacy campaign (a) In general The Director of the National Institute of Standards and Technology shall, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, develop and conduct a cybersecurity literacy campaign described in subsection (b), which the Director of the National Institute of Standards and Technology shall make available in multiple languages and formats, if practicable, to increase the knowledge and awareness of citizens of the United States of best practices to reduce cybersecurity risks. (b) Elements In carrying out subsection (a), the Director of the National Institute of Science and Technology, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, shall— (1) educate citizens of the United States with respect to how to prevent and mitigate a cyberattack or cybersecurity risk, including by— (A) instructing citizens of the United States with respect to how to identify— (i) a phishing email or message; and (ii) a secure website; (B) instructing citizens of the United States about the benefits of changing default passwords on any hardware or software technology; (C) encouraging the use of cybersecurity tools, including— (i) multi-factor authentication; (ii) a complex password; (iii) anti-virus software; (iv) patching or updating software and applications; and (v) a virtual private network; (D) identifying a device that could pose possible cybersecurity risks, including— (i) a personal computer; (ii) a smartphone; (iii) a tablet; (iv) a Wi-Fi router; (v) a smart home appliance; (vi) a webcam; (vii) an internet-connected monitor; or (viii) any other device that can be connected to the internet, including any mobile device other than a smartphone or tablet; (E) encouraging citizens of the United States to— (i) regularly review mobile application permissions