While I agree a bit that this particular link might miss the mark a little, this isn't the only SMB relevant material from CISA. For example, the Cyber Essenti

While I agree a bit that this particular link might miss the mark a little, this isn't the only SMB relevant material from CISA. For example, the Cyber Essentials (https://www.cisa.gov/cyber-essentials https://www.cisa.gov/cyber-essentials) and Cyber Essentials Starter Kit (https://www.cisa.gov/sites/default/files/publications/Cyber%20Essentials%20Starter%20Kit_03.12.2021_508_0.pdf https://www.cisa.gov/sites/default/files/publications/Cyber%...) both seem structured better. Upfront tells the stakes, a tiny bit of a more holistic view of cybersecurity, then a quick pragmatic checklist things to just do first (backups, MFA, keep up to date with updates/patches), and then diving into the same frameworkey stuff. Greater federal intervention into SMB cybersecurity beyond this type of material and bulletins is politically challenging, particularly given the foundation of cybersecurity if risk assessment. It'd be incredibly challenging for any federal agency to set true baseline requirements for cybersecurity measures (since that would constitute doing part of the risk assessment for SMBs - and that just screams nanny state).