lessons learned. >> there are lessons learned, as there are in all things, and this bill is less proscriptive. this is a very regulation-light bill. this is a security bill. this is not a regulatory bill per se. so, -- but in terms just of management and organization, yes, there are some lessons learned. >> great. and i know that a lot of times when we read news media accounts about cybersecurity, and even as we discuss it among ourselves, often times we tend to focus on large companies and breaches that large companies experience. the truth is a lot of small and mid-size companies carry a lot of sensitive information. is dhs working with small to mid-size companies in the way to reach out to them, to talk about best practices or anything like that? >> we conduct a lot of outreach activities will small and medium-sized businesses on a whole host of cyber-related areas. so the answer is yet. >> great. we always want to make sure our small businesses are taken care of, and obviously if they're the weak link in the chain, that's a real problem. >> senator, as i continued to emphasize, when year