Small Business Advanced Cybersecurity Enhancements Act of 2019

I 116TH CONGRESS 1ST SESSION H. R. 1648 To amend the Small Business Act to provide for the establishment of an enhanced cybersecurity assistance and protections for small businesses, and for other purposes. IN THE HOUSE OF REPRESENTATIVES MARCH 8, 2019 Mr. CHABOT (for himself and Ms. VELA´ZQUEZ) introduced the following bill; which was referred to the Committee on Small Business A BILL To amend the Small Business Act to provide for the estab- lishment of an enhanced cybersecurity assistance and protections for small businesses, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Small Business Ad- 4 vanced Cybersecurity Enhancements Act of 2019’’. 5 SEC. 2. FINDINGS. 6 Congress finds the following: 7 (1) Small businesses represent more than 97 8 percent of total businesses in the United States and 9 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 2 •HR 1648 IH make up an essential part of the supply chain to 1 some of the largest companies, many of which are in 2 critical infrastructure sectors, from financial and 3 transportation organizations to power, water, and 4 healthcare suppliers. 5 (2) Many small businesses do not have dedi- 6 cated information technology (‘‘IT’’) departments 7 and must outsource IT functions or assign these du- 8 ties to an employee as a secondary function. 9 (3) The Internet Crime Complaint Center with- 10 in the United States Department of Justice recorded 11 298,728 cybersecurity-related complaints in its 2016 12 report. 13 (4) There has been steady increases of cyberse- 14 curity-related complaints year over year since the 15 year 2000, totaling 3,762,348. 16 (5) Seventy-one percent of cyber attacks oc- 17 curred in businesses with fewer than 100 employees. 18 (6) Only 14 percent of small- and medium-sized 19 businesses believe they have the ability to effectively 20 mitigate cyber risks and vulnerabilities. 21 (7) Small businesses risk theft and manipula- 22 tion of sensitive data if they lack adequate cyberse- 23 curity measures. 24 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 3 •HR 1648 IH (8) The Better Business Bureau found that 1 half of small businesses could remain profitable for 2 only one month if they lost essential data. 3 (9) Cyber crime is growing rapidly and the an- 4 nual costs to the global economy are estimated to 5 reach over $2,000,000,000,000 by 2019. 6 (10) Cybersecurity is a global challenge where 7 the security threat, attacks, and techniques contin- 8 ually evolve and no company, individual, or Federal 9 agency is immune from these threats. 10 (11) Strong collaboration between the public 11 and private sector is essential in the fight against 12 cyber crime. 13 (12) There is a reluctance among small busi- 14 nesses to voluntarily share information with govern- 15 ment entities, and the Federal Government should 16 work proactively to incentivize and encourage vol- 17 untary information sharing to improve the Nation’s 18 cybersecurity posture. 19 SEC. 3. ENHANCED CYBERSECURITY ASSISTANCE AND PRO- 20 TECTIONS FOR SMALL BUSINESSES. 21 Section 21(a) of the Small Business Act (15 U.S.C. 22 648(a)) is amended by adding at the end the following 23 new paragraph: 24 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 4 •HR 1648 IH ‘‘(9) SMALL BUSINESS CYBERSECURITY ASSIST- 1 ANCE AND PROTECTIONS.— 2 ‘‘(A) ESTABLISHMENT OF SMALL BUSI- 3 NESS CYBERSECURITY ASSISTANCE UNITS.— 4 The Administrator of the Small Business Ad- 5 ministration, in coordination with the Secretary 6 of Commerce, and in consultation with the Sec- 7 retary of Homeland Security and the Attorney 8 General, shall establish— 9 ‘‘(i) in the Administration, a central 10 small business cybersecurity assistance 11 unit; and 12 ‘‘(ii) within each small business devel- 13 opment center, a regional small business 14 cybersecurity assistance unit. 15 ‘‘(B) DUTIES OF THE CENTRAL SMALL 16 BUSINESS CYBERSECURITY ASSISTANCE UNIT.— 17 ‘‘(i) IN GENERAL.—The central small 18 business cybersecurity assistance unit es- 19 tablished under subparagraph (A)(i) shall 20 serve as the primary interface for small 21 business concerns to receive and share 22 cyber threat indicators and defensive meas- 23 ures with the Federal Government. 24 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 5 •HR 1648 IH ‘‘(ii) USE OF CAPABILITY AND PROC- 1 ESSES.—The central small business cyber- 2 security assistance unit shall use the capa- 3 bility and process certified pursuant to sec- 4 tion 105(c)(2)(A) of the Cybersecurity In- 5 formation Sharing Act of 2015 (6 U.S.C. 6 1504(c)(2)(A)) to receive cyber threat indi- 7 cators or defensive measures from small 8 business concerns. 9 ‘‘(iii) APPLICATION OF CISA.—A small 10 business concern that receives or shares 11 cyber threat indicators and defensive meas- 12 ures with the Federal Government through 13 the central small business cybersecurity as- 14 sistance unit established under subpara- 15 graph (A)(i), or with any appropriate enti- 16 ty pursuant to section 103(c) of the Cyber- 17 security Information Sharing Act of 2015 18 (6 U.S.C. 1503(c)), shall receive the pro- 19 tections and exemptions provided in such 20 Act and this paragraph. 21 ‘‘(C) RELATION TO NCCIC.— 22 ‘‘(i) CENTRAL SMALL BUSINESS CY- 23 BERSECURITY ASSISTANCE UNIT.—The 24 central small business cybersecurity assist- 25 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 6 •HR 1648 IH ance unit established under subparagraph 1 (A)(i) shall be collocated with the national 2 cybersecurity and communications integra- 3 tion center. 4 ‘‘(ii) ACCESS TO INFORMATION.—The 5 national cybersecurity and communications 6 integration center shall have access to all 7 cyber threat indicators or defensive meas- 8 ures shared with the central small cyberse- 9 curity assistance unit established under 10 subparagraph (A)(i) through the use of the 11 capability and process described in sub- 12 paragraph (B)(ii). 13 ‘‘(D) CYBERSECURITY ASSISTANCE FOR 14 SMALL BUSINESSES.—The central small busi- 15 ness cybersecurity assistance unit established 16 under subparagraph (A)(i) shall— 17 ‘‘(i) work with each regional small 18 business cybersecurity assistance unit es- 19 tablished under subparagraph (A)(ii) to 20 provide cybersecurity assistance to small 21 business concerns; 22 ‘‘(ii) leverage resources from the Ad- 23 ministration, the Department of Com- 24 merce, the Department of Homeland Secu- 25 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 7 •HR 1648 IH rity, the Department of Justice, the De- 1 partment of the Treasury, the Department 2 of State, and any other Federal depart- 3 ment or agency the Administrator deter- 4 mines appropriate, in order to help im- 5 prove the cybersecurity posture of small 6 business concerns; 7 ‘‘(iii) coordinate with the Department 8 of Homeland Security to identify and dis- 9 seminate information to small business 10 concerns in a form that is accessible and 11 actionable by small business concerns; 12 ‘‘(iv) coordinate with the National In- 13 stitute of Standards and Technology to 14 identify and disseminate information to 15 small business concerns on the most cost- 16 effective methods for implementing ele- 17 ments of the cybersecurity framework of 18 the National Institute of Standards and 19 Technology applicable to improving the cy- 20 bersecurity posture of small business con- 21 cerns; 22 ‘‘(v) seek input from the Office of Ad- 23 vocacy of the Administration to ensure 24 that any policies or procedures adopted by 25 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 8 •HR 1648 IH any department, agency, or instrumentality 1 of the Federal Government do not unduly 2 add regulatory burdens to small business 3 concerns in a manner that will hamper the 4 improvement of the cybersecurity posture 5 of such small business concerns; and 6 ‘‘(vi) leverage resources and relation- 7 ships with representatives and entities in- 8 volved in the national cybersecurity and 9 communications integration center to pub- 10 licize the capacity of the Federal Govern- 11 ment to assist small business concerns in 12 improving cybersecurity practices. 13 ‘‘(E) ENHANCED CYBERSECURITY PROTEC- 14 TIONS FOR SMALL BUSINESSES.— 15 ‘‘(i) IN GENERAL.—Notwithstanding 16 any other provision of law, no cause of ac- 17 tion shall lie or be maintained in any court 18 against any small business concern, and 19 such action shall be promptly dismissed, if 20 such action related to or arises out of— 21 ‘‘(I) any activity authorized 22 under this paragraph or the Cyberse- 23 curity Information Sharing Act of 24 2015 (6 U.S.C. 1501 et seq.); or 25 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 9 •HR 1648 IH ‘‘(II) any action or inaction in re- 1 sponse to any cyber threat indicator, 2 defensive measure, or other informa- 3 tion shared or received pursuant to 4 this paragraph or the Cybersecurity 5 Information Sharing Act of 2015 (6 6 U.S.C. 1501 et seq.). 7 ‘‘(ii) APPLICATION.—The exception 8 provided in section 105(d)(5)(D)(ii)(I) of 9 the Cybersecurity Information Sharing Act 10 of 2015 (6 U.S.C. 1504(d)(5)(D)(ii)(I)) 11 shall not apply to any cyber threat indi- 12 cator or defensive measure shared or re- 13 ceived by small business concerns pursuant 14 to this paragraph or the Cybersecurity In- 15 formation Sharing Act of 2015 (6 U.S.C. 16 1501 et seq.). 17 ‘‘(iii) RULE OF CONSTRUCTION.— 18 Nothing in this subparagraph shall be con- 19 strued to affect the applicability or merits 20 of any defense, motion, or argument in any 21 cause of action in a court brought against 22 an entity that is not a small business con- 23 cern. 24 ‘‘(F) DEFINITIONS.—In this paragraph: 25 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 10 •HR 1648 IH ‘‘(i) CISA DEFINITIONS.—The terms 1 ‘cyber threat indicator’ and ‘defensive 2 measure’ have the meanings given such 3 terms in section 102 of the Cybersecurity 4 Information Sharing Act of 2015 (6 5 U.S.C. 1501). 6 ‘‘(ii) NATIONAL CYBERSECURITY AND 7 COMMUNICATIONS INTEGRATION CEN- 8 TER.—The term ‘national cybersecurity 9 and communications integration center’ 10 means the national cybersecurity and com- 11 munications integration center established 12 under section 227 of the Homeland Secu- 13 rity Act of 2002 (6 U.S.C. 148).’’. 14 SEC. 4. PROHIBITION ON NEW APPROPRIATIONS. 15 (a) IN GENERAL.—No additional funds are author- 16 ized to be appropriated to carry out this Act and the 17 amendments made by this Act. 18 (b) EXISTING FUNDING.—This Act and the amend- 19 ments made by this Act shall be carried out using amounts 20 made available under section 21(a)(4)(C)(viii) of the Small 21 Business Act (15 U.S.C. 648(a)(4)(viii)). 22 (c) TECHNICAL AND CONFORMING AMENDMENT.— 23 Section 21(a)(4)(C)(viii) of the Small Business Act (15 24 U.S.C.648(a)(4)(C)(viii)) is amended to read as follows: 25 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 11 •HR 1648 IH ‘‘(viii) LIMITATION.— 1 ‘‘(I) CYBERSECURITY ASSIST- 2 ANCE.—From the funds appropriated 3 pursuant to clause (vii), the Adminis- 4 tration shall reserve not less than 5 $1,000,000 in each fiscal year to de- 6 velop cybersecurity assistance units at 7 small business development centers 8 under paragraph (9). 9 ‘‘(II) PORTABLE ASSISTANCE.— 10 ‘‘(aa) IN GENERAL.—Any 11 funds appropriated pursuant to 12 clause (vii) that are remaining 13 after reserving amounts under 14 subclause (I) may be used for 15 portable assistance for startup 16 and sustainability non-matching 17 grant programs to be conducted 18 by eligible small business develop- 19 ment centers in communities that 20 are economically challenged as a 21 result of a business or govern- 22 ment facility down sizing or clos- 23 ing, which has resulted in the 24 VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00011 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS 12 •HR 1648 IH loss of jobs or small business in- 1 stability. 2 ‘‘(bb) GRANT AMOUNT AND 3 USE.—A non-matching grant 4 under this subclause shall not ex- 5 ceed $100,000, and shall be used 6 for small business development 7 center personnel expenses and re- 8 lated small business programs 9 and services.’’. 10 Æ VerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00012 Fmt 6652 Sfmt 6301 E:\BILLS\H1648.IH H1648 kjohnson on DSK79L0C42 with BILLS