6 U.S.C. § 321l — Guidance and recommendations

(a) In general. The Administrator and the Director of the Cybersecurity and Infrastructure Security Agency (CISA) may — but do not have to — work with the private sector to create guidance, recommendations, and best practices. These are meant to help private businesses with eight things: spotting possible hazards and figuring out the risks and impacts; reducing the harm from many kinds of hazards, including weapons of mass destruction; managing the people and supplies needed for emergency preparedness and response; setting up mutual aid agreements, where organizations agree to help each other; building and keeping up emergency plans and the procedures that go with them; running training and practice exercises to test those plans and procedures; training security guards to carry out those plans and procedures; and creating procedures for responding to questions from the media or the public. (b) Issuance and promotion. The Administrator issues this guidance, and the Secretary promotes it to private businesses. (c) Small business concerns. When creating this guidance, the Administrator and the CISA Director must think about the needs of small businesses — as defined in 15 U.S.C. § 632 — including whether small businesses need their own separate guidance. (d) Rule of construction. Nothing in this section replaces any other legal requirement found elsewhere in the law.