I 

116TH CONGRESS 

2D SESSION H. R. 5669 

To require the Administrator of the Small Business Administration to establish a program to assist small business concerns with purchasing cybersecurity products and services, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

JANUARY 24, 2020 

Ms. FINKENAUER (for herself and Mr. JOYCE of Pennsylvania) introduced the 

following bill; which was referred to the Committee on Small Business 

A BILL 

To require the Administrator of the Small Business Administration to establish a program to assist small business 

concerns with purchasing cybersecurity products and 

services, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Strengthening and En5 hancing Cybersecurity Usage to Reach Every Small Busi6 ness Act’’ or the ‘‘SECURE Small Business Act’’. 


kjohnson on DSK79L0C42PROD with BILLS
2 

•HR 5669 IH

1 SEC. 2. CYBERSECURITY COOPERATIVE MARKETPLACE 

2 PROGRAM. 

3 (a) ESTABLISHMENT.—Not later than 180 days after 

4 the date of the enactment of this Act, the Administrator 

5 of the Small Business Administration, in consultation with 

6 the Director of the National Institute of Standards and 

7 Technology, shall establish a program to assist small busi8 ness concerns with purchasing cybersecurity products and 

9 services. 

10 (b) DUTIES.—In the program established under sub11 section (a), the Administrator shall do the following: 

12 (1) Educate small business concerns about the 

13 types of cybersecurity products and services that are 

14 specific to each covered industry sector. 

15 (2) Provide outreach to covered vendors and 

16 small business concerns to encourage use of the co17 operative marketplace described in subsection (c). 

18 (c) COOPERATIVE MARKETPLACE FOR PURCHASING

19 CYBERSECURITY PRODUCTS AND SERVICES.—The Ad20 ministrator shall— 

21 (1) establish and maintain a website that— 

22 (A) is free to use for small business con23 cerns and covered vendors; and 

24 (B) provides a cooperative marketplace 

25 that facilitates the creation of mutual agree26 ments under which small business concerns coVerDate Sep 11 2014 23:42 Jan 24, 2020 Jkt 099200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H5669.IH H5669

kjohnson on DSK79L0C42PROD with BILLS
3 

•HR 5669 IH

1 operatively purchase cybersecurity products and 

2 services from covered vendors; and 

3 (2) determine whether each covered vendor and 

4 each small business concern that participates in the 

5 marketplace described in this subsection is legiti6 mate, as determined by the Administrator. 

7 (d) SUNSET.—This section ceases to be effective on 

8 September 30, 2024. 

9 SEC. 3. GAO STUDY ON AVAILABLE FEDERAL CYBERSECU10 RITY INITIATIVES. 

11 (a) IN GENERAL.—The Comptroller General of the 

12 United States shall conduct a study that identifies any im13 provements that could be made to Federal initiatives 

14 that— 

15 (1) train small business concerns how to avoid 

16 cybersecurity threats; and 

17 (2) are in effect on the date on which the 

18 Comptroller General commences the study. 

19 (b) REPORT.—Not later than 1 year after the date 

20 of the enactment of this Act, the Comptroller General shall 

21 submit to the Committee on Small Business and Entrepre22 neurship of the Senate and the Committee on Small Busi23 ness of the House of Representatives a report that con24 tains the results of the study required under subsection 

25 (a). 


kjohnson on DSK79L0C42PROD with BILLS
4 

•HR 5669 IH

1 SEC. 4. DEFINITIONS. 

2 In this Act: 

3 (1) ADMINISTRATOR.—The term ‘‘Adminis4 trator’’ means the Administrator of the Small Busi5 ness Administration. 

6 (2) COVERED INDUSTRY SECTOR.—The term 

7 ‘‘covered industry sector’’ means the following indus8 try sectors: 

9 (A) Accommodation and food services. 

10 (B) Agriculture. 

11 (C) Construction. 

12 (D) Healthcare and social assistance. 

13 (E) Retail and wholesale trade. 

14 (F) Transportation and warehousing. 

15 (G) Entertainment and recreation. 

16 (H) Finance and insurance. 

17 (I) Manufacturing. 

18 (J) Information and telecommunications. 

19 (K) Any other industry sector the Adminis20 trator determines to be relevant. 

21 (3) COVERED VENDOR.—The term ‘‘covered 

22 vendor’’ means a vendor of cybersecurity products 

23 and services, including cybersecurity risk insurance. 

24 (4) CYBERSECURITY.—The term ‘‘cybersecu25 rity’’ means— 


kjohnson on DSK79L0C42PROD with BILLS
5 

•HR 5669 IH

1 (A) the art of protecting networks, devices, 

2 and data from unauthorized access or criminal 

3 use; and 

4 (B) the practice of ensuring confidentiality, 

5 integrity, and availability of information. 

6 (5) CYBERSECURITY THREAT.—The term ‘‘cy7 bersecurity threat’’ means the possibility of a mali8 cious attempt to infiltrate, damage, disrupt, or de9 stroy computer networks or systems. 

10 (6) SMALL BUSINESS CONCERN.—The term 

11 ‘‘small business concern’’ has the meaning given 

12 under section 3(a) of the Small Business Act (15 

13 U.S.C. 632(a)). 

Æ 


kjohnson on DSK79L0C42PROD with BILLS