SECURE Small Business Act

I 116TH CONGRESS 2D SESSION H. R. 5669 To require the Administrator of the Small Business Administration to estab- lish a program to assist small business concerns with purchasing cyberse- curity products and services, and for other purposes. IN THE HOUSE OF REPRESENTATIVES JANUARY 24, 2020 Ms. FINKENAUER (for herself and Mr. JOYCE of Pennsylvania) introduced the following bill; which was referred to the Committee on Small Business A BILL To require the Administrator of the Small Business Adminis- tration to establish a program to assist small business concerns with purchasing cybersecurity products and services, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Strengthening and En- 4 hancing Cybersecurity Usage to Reach Every Small Busi- 5 ness Act’’ or the ‘‘SECURE Small Business Act’’. 6 VerDate Sep 11 2014 23:42 Jan 24, 2020 Jkt 099200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H5669.IH H5669 kjohnson on DSK79L0C42PROD with BILLS 2 •HR 5669 IH SEC. 2. CYBERSECURITY COOPERATIVE MARKETPLACE 1 PROGRAM. 2 (a) ESTABLISHMENT.—Not later than 180 days after 3 the date of the enactment of this Act, the Administrator 4 of the Small Business Administration, in consultation with 5 the Director of the National Institute of Standards and 6 Technology, shall establish a program to assist small busi- 7 ness concerns with purchasing cybersecurity products and 8 services. 9 (b) DUTIES.—In the program established under sub- 10 section (a), the Administrator shall do the following: 11 (1) Educate small business concerns about the 12 types of cybersecurity products and services that are 13 specific to each covered industry sector. 14 (2) Provide outreach to covered vendors and 15 small business concerns to encourage use of the co- 16 operative marketplace described in subsection (c). 17 (c) COOPERATIVE MARKETPLACE FOR PURCHASING 18 CYBERSECURITY PRODUCTS AND SERVICES.—The Ad- 19 ministrator shall— 20 (1) establish and maintain a website that— 21 (A) is free to use for small business con- 22 cerns and covered vendors; and 23 (B) provides a cooperative marketplace 24 that facilitates the creation of mutual agree- 25 ments under which small business concerns co- 26 VerDate Sep 11 2014 23:42 Jan 24, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H5669.IH H5669 kjohnson on DSK79L0C42PROD with BILLS 3 •HR 5669 IH operatively purchase cybersecurity products and 1 services from covered vendors; and 2 (2) determine whether each covered vendor and 3 each small business concern that participates in the 4 marketplace described in this subsection is legiti- 5 mate, as determined by the Administrator. 6 (d) SUNSET.—This section ceases to be effective on 7 September 30, 2024. 8 SEC. 3. GAO STUDY ON AVAILABLE FEDERAL CYBERSECU- 9 RITY INITIATIVES. 10 (a) IN GENERAL.—The Comptroller General of the 11 United States shall conduct a study that identifies any im- 12 provements that could be made to Federal initiatives 13 that— 14 (1) train small business concerns how to avoid 15 cybersecurity threats; and 16 (2) are in effect on the date on which the 17 Comptroller General commences the study. 18 (b) REPORT.—Not later than 1 year after the date 19 of the enactment of this Act, the Comptroller General shall 20 submit to the Committee on Small Business and Entrepre- 21 neurship of the Senate and the Committee on Small Busi- 22 ness of the House of Representatives a report that con- 23 tains the results of the study required under subsection 24 (a). 25 VerDate Sep 11 2014 23:42 Jan 24, 2020 Jkt 099200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H5669.IH H5669 kjohnson on DSK79L0C42PROD with BILLS 4 •HR 5669 IH SEC. 4. DEFINITIONS. 1 In this Act: 2 (1) ADMINISTRATOR.—The term ‘‘Adminis- 3 trator’’ means the Administrator of the Small Busi- 4 ness Administration. 5 (2) COVERED INDUSTRY SECTOR.—The term 6 ‘‘covered industry sector’’ means the following indus- 7 try sectors: 8 (A) Accommodation and food services. 9 (B) Agriculture. 10 (C) Construction. 11 (D) Healthcare and social assistance. 12 (E) Retail and wholesale trade. 13 (F) Transportation and warehousing. 14 (G) Entertainment and recreation. 15 (H) Finance and insurance. 16 (I) Manufacturing. 17 (J) Information and telecommunications. 18 (K) Any other industry sector the Adminis- 19 trator determines to be relevant. 20 (3) COVERED VENDOR.—The term ‘‘covered 21 vendor’’ means a vendor of cybersecurity products 22 and services, including cybersecurity risk insurance. 23 (4) CYBERSECURITY.—The term ‘‘cybersecu- 24 rity’’ means— 25 VerDate Sep 11 2014 23:42 Jan 24, 2020 Jkt 099200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H5669.IH H5669 kjohnson on DSK79L0C42PROD with BILLS 5 •HR 5669 IH (A) the art of protecting networks, devices, 1 and data from unauthorized access or criminal 2 use; and 3 (B) the practice of ensuring confidentiality, 4 integrity, and availability of information. 5 (5) CYBERSECURITY THREAT.—The term ‘‘cy- 6 bersecurity threat’’ means the possibility of a mali- 7 cious attempt to infiltrate, damage, disrupt, or de- 8 stroy computer networks or systems. 9 (6) SMALL BUSINESS CONCERN.—The term 10 ‘‘small business concern’’ has the meaning given 11 under section 3(a) of the Small Business Act (15 12 U.S.C. 632(a)). 13 Æ VerDate Sep 11 2014 23:42 Jan 24, 2020 Jkt 099200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6301 E:\BILLS\H5669.IH H5669 kjohnson on DSK79L0C42PROD with BILLS