II 

118TH CONGRESS 

1ST SESSION S. 2740 

To help small businesses prepare for and combat cybersecurity threats, and 

for other purposes. 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 7, 2023 

Mr. RISCH (for himself, Mrs. SHAHEEN, Mr. CRAPO, and Ms. CORTEZ

MASTO) introduced the following bill; which was read twice and referred 

to the Committee on Small Business and Entrepreneurship 

A BILL 

To help small businesses prepare for and combat 

cybersecurity threats, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Small Business Cyber 

5 Resiliency Act’’. 

6 SEC. 2. SMALL BUSINESS CYBERSECURITY. 

7 (a) IN GENERAL.—The Small Business Act (15 

8 U.S.C. 631 et seq.) is amended— 

9 (1) by redesignating section 49 (15 U.S.C. 631 

10 note) as section 52; and 


pbinns on DSKJLVW7X2PROD with $$_JOB
2 

•S 2740 IS

1 (2) by inserting after section 48 (15 U.S.C. 

2 657u) the following: 

3 ‘‘SEC. 49. SMALL BUSINESS CYBERSECURITY. 

4 ‘‘(a) DEFINITIONS.—In this section: 

5 ‘‘(1) CYBERSECURITY RISK; CYBER THREAT IN6 DICATOR; DEFENSIVE MEASURE; INCIDENT.—The 

7 terms ‘cybersecurity risk’, ‘cyber threat indicator’, 

8 ‘defense measure’, and ‘incident’ have the meanings 

9 given those terms in section 2200 of the Homeland 

10 Security Act of 2002 (6 U.S.C. 650). 

11 ‘‘(2) RESOURCE PARTNER.—The term ‘resource 

12 partner’ means— 

13 ‘‘(A) a small business development center; 

14 ‘‘(B) a women’s business center described 

15 in section 29; and 

16 ‘‘(C) a chapter of the Service Corps of Re17 tired Executives described in section 8(a)(1)(A). 

18 ‘‘(b) INTERAGENCY AGREEMENT.—The Administra19 tion shall enter into an interagency agreement with the 

20 Cybersecurity and Infrastructure Security Agency to col21 laborate and increase information sharing with the Admin22 istration to improve cybersecurity resources and defenses 

23 for small business concerns, including cybersecurity prod24 ucts tailored to the needs of small business concerns. 


pbinns on DSKJLVW7X2PROD with $$_JOB
3 

•S 2740 IS

1 ‘‘(c) ASSISTANCE THROUGH RESOURCE PART2 NERS.— 

3 ‘‘(1) IN GENERAL.—The Department of Home4 land Security, and any other Federal agency in co5 ordination with the Department of Homeland Secu6 rity, shall leverage resource partners to provide as7 sistance to small business concerns with cybersecu8 rity tools, such as the Cyber Security Evaluation 

9 Tool and the Cyber Resilience Review, and by dis10 seminating information relating to cybersecurity 

11 risks and other homeland security matters to help 

12 small business concerns in developing or enhancing 

13 cybersecurity infrastructure, awareness of cyber 

14 threat indicators, cybersecurity incident response 

15 planning, and cyber training programs for employ16 ees. 

17 ‘‘(2) ANNUAL PUBLICATION.—Not later than 1 

18 year after the date of enactment of the Small Busi19 ness Cyber Resiliency Act and annually thereafter, 

20 the Administrator shall publish on the website of the 

21 Administration the number of small business con22 cerns that resource partners assisted in providing 

23 assistance described in paragraph (1) during the 

24 year covered by the publication. 


pbinns on DSKJLVW7X2PROD with $$_JOB
4 

•S 2740 IS

1 ‘‘(d) CENTRAL SMALL BUSINESS CYBERSECURITY

2 ASSISTANCE UNIT.— 

3 ‘‘(1) ESTABLISHMENT.—The Administrator, in 

4 coordination with the Secretary of Commerce, and in 

5 consultation with the Secretary of Homeland Secu6 rity and the Attorney General, shall establish a cen7 tral small business cybersecurity assistance unit 

8 within the Administration, which shall serve as a 

9 central clearinghouse for cybersecurity resources for 

10 small business concerns across the Federal Govern11 ment, such as those developed by the Department of 

12 Homeland Security. 

13 ‘‘(2) DUTIES.—The central small business cy14 bersecurity assistance unit established under para15 graph (1) shall— 

16 ‘‘(A) coordinate internal cybersecurity ef17 forts within the Administration to reduce dupli18 cation of effort and resources; 

19 ‘‘(B) establish and maintain a publicly 

20 available website that is a clearinghouse of cy21 bersecurity information for small business con22 cerns, including information on— 

23 ‘‘(i) how to find guidance material on 

24 best cyber hygiene practices; 


pbinns on DSKJLVW7X2PROD with $$_JOB
5 

•S 2740 IS

1 ‘‘(ii) where to report cybersecurity 

2 breaches or incidents; 

3 ‘‘(iii) how to respond to cybersecurity 

4 breaches or incidents; 

5 ‘‘(iv) the cybersecurity efforts of the 

6 Administration; 

7 ‘‘(v) how to contact the certified em8 ployees described in section 21(o); and 

9 ‘‘(vi) standard incident response pro10 cedures for leading cyber crimes; 

11 ‘‘(C) work with the certified employees de12 scribed in section 21(o) to provide cybersecurity 

13 assistance to small business concerns; 

14 ‘‘(D) coordinate with the Department of 

15 Homeland Security and any other Federal 

16 agency as the Administrator determines appro17 priate to identify and disseminate cybersecurity 

18 information and resources to small business 

19 concerns in a form that is accessible and action20 able by small business concerns; 

21 ‘‘(E) redirect small business cybersecurity 

22 inquiries, such as reporting of cyber threat indi23 cators and defensive measures, to the appro24 priate Federal agencies; 


pbinns on DSKJLVW7X2PROD with $$_JOB
6 

•S 2740 IS

1 ‘‘(F) coordinate with the National Institute 

2 of Standards and Technology to identify and 

3 disseminate information to small business con4 cerns on the most cost-effective methods for im5 plementing elements of the cybersecurity frame6 work of the National Institute of Standards and 

7 Technology applicable to improving the cyberse8 curity posture of small business concerns; 

9 ‘‘(G) coordinate with the Department of 

10 Defense to identify and disseminate information 

11 to small business concerns on satisfying the ap12 plicable requirements of the Cybersecurity Ma13 turity Model Certification of the Department of 

14 Defense or any other successor cybersecurity re15 quirements as established by the Department of 

16 Defense; and 

17 ‘‘(H) seek input from the Office of Advo18 cacy of the Administration to identify any poli19 cies or procedures adopted by any department, 

20 agency, or instrumentality of the Federal Gov21 ernment that will hamper the improvement of 

22 the cybersecurity posture of those small busi23 ness concerns. 

24 ‘‘(3) ENHANCED CYBERSECURITY PROTECTIONS

25 FOR SMALL BUSINESSES.— 


pbinns on DSKJLVW7X2PROD with $$_JOB
7 

•S 2740 IS

1 ‘‘(A) IN GENERAL.—Notwithstanding any 

2 other provision of law, no cause of action shall 

3 lie or be maintained in any court against any 

4 small business concern, and such action shall be 

5 promptly dismissed, if such action is related to 

6 or arises out of— 

7 ‘‘(i) any activity authorized under this 

8 paragraph or the Cybersecurity Informa9 tion Sharing Act of 2015 (6 U.S.C. 1501 

10 et seq.); or 

11 ‘‘(ii) any action or inaction in re12 sponse to any cyber threat indicator, de13 fensive measure, or other information 

14 shared or received pursuant to this para15 graph or the Cybersecurity Information 

16 Sharing Act of 2015 (6 U.S.C. 1501 et 

17 seq.). 

18 ‘‘(B) RULE OF CONSTRUCTION.—Nothing 

19 in this paragraph shall be construed to affect 

20 the applicability or merits of any defense, mo21 tion, or argument in any cause of action in a 

22 court brought against an entity that is not a 

23 small business concern. 

24 ‘‘(e) REPORT.— 


pbinns on DSKJLVW7X2PROD with $$_JOB
8 

•S 2740 IS

1 ‘‘(1) IN GENERAL.—Not later than 1 year after 

2 the date of enactment of the Small Business Cyber 

3 Resiliency Act, and every year thereafter, the Ad4 ministrator and the head of each Federal agency 

5 that collects or shares information under this section 

6 shall submit to the Committee on Small Business 

7 and Entrepreneurship of the Senate and the Com8 mittee on Small Business of the House of Rep9 resentatives a joint report on actions taken by the 

10 Administration and relevant Federal agencies to pro11 tect personally identifiable information, business 

12 identifiable information, sensitive financial informa13 tion, and cybersecurity information received by those 

14 Federal agencies as a result of the requirements 

15 under this section. 

16 ‘‘(2) FORM.—Each report required under para17 graph (1) shall be unclassified, but may include a 

18 classified annex.’’. 

19 (b) PROHIBITION ON NEW APPROPRIATIONS.— 

20 (1) IN GENERAL.—No additional funds are au21 thorized to be appropriated to carry out this section 

22 and the amendments made by this section. 

23 (2) EXISTING FUNDING.—This section and the 

24 amendments made by this section shall be carried 

25 out using amounts made available to the Small BusiVerDate Sep 11 2014 00:06 Sep 08, 2023 Jkt 039200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6201 E:\BILLS\S2740.IS S2740

pbinns on DSKJLVW7X2PROD with $$_JOB
9 

•S 2740 IS

1 ness Administration under the heading ‘‘Entrepre2 neurial Development Programs’’. 

3 (c) IMPLEMENTATION.—Not later than 180 days 

4 after the date of enactment of this Act, the Administrator 

5 of the Small Business Administration shall implement this 

6 section and the amendments made by this section. 

7 SEC. 3. STUDY AND REPORT ON CYBERSECURITY RISKS OF 

8 SMALL BUSINESSES. 

9 (a) DEFINITIONS.—In this section: 

10 (1) ADMINISTRATION.—The term ‘‘Administra11 tion’’ means the Small Business Administration. 

12 (2) APPROPRIATE COMMITTEES OF CON13 GRESS.—The term ‘‘appropriate committees of Con14 gress’’ means— 

15 (A) the Committee on Small Business and 

16 Entrepreneurship of the Senate; 

17 (B) the Committee on Homeland Security 

18 and Governmental Affairs of the Senate; 

19 (C) the Committee on Small Business of 

20 the House of Representatives; and 

21 (D) the Committee on Homeland Security 

22 of the House of Representatives. 

23 (3) CYBERSECURITY RISK.—The term ‘‘cyberse24 curity risk’’ has the meaning given the term in secVerDate Sep 11 2014 00:06 Sep 08, 2023 Jkt 039200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\S2740.IS S2740

pbinns on DSKJLVW7X2PROD with $$_JOB
10 

•S 2740 IS

1 tion 2200 of the Homeland Security Act of 2002 (6 

2 U.S.C. 650). 

3 (4) INFORMATION SYSTEM.—The term ‘‘infor4 mation system’’ has the meaning given the term in 

5 section 3502 of title 44, United States Code. 

6 (5) RURAL AREA.—The term ‘‘rural area’’ 

7 means any county or other political subdivision of a 

8 State, the District of Columbia, or a territory or 

9 possession of the United States that is designated as 

10 a rural area by the Bureau of the Census. 

11 (6) SMALL BUSINESS CONCERN.—The term 

12 ‘‘small business concern’’ has the meaning given the 

13 term in section 3 of the Small Business Act (15 

14 U.S.C. 632). 

15 (b) STUDY AND REPORT.—Not later than 1 year 

16 after the date of enactment of this Act, the Chief Counsel 

17 for Advocacy of the Administration and the Comptroller 

18 General of the United States shall— 

19 (1) conduct a joint study assessing the impact 

20 of small business concerns turning to online market21 places as a result of shutdowns imposed by the 

22 COVID–19 pandemic, specifically in regards to the 

23 cybersecurity of those small business concerns; and 

24 (2) submit to the appropriate committees of 

25 Congress and make publicly available a report on— 


pbinns on DSKJLVW7X2PROD with $$_JOB
11 

•S 2740 IS

1 (A) how identified cybersecurity risks spe2 cifically impact small business concerns that es3 tablished an online presence during the period 

4 beginning on February 1, 2020, and ending on 

5 December 31, 2021; 

6 (B) the challenges that the small business 

7 concerns described in subparagraph (A) face 

8 in— 

9 (i) securing updated information sys10 tems; 

11 (ii) implementing cybersecurity proto12 cols; and 

13 (iii) responding to data breaches or 

14 cyber attacks; 

15 (C) the Federal resources that the small 

16 business concerns described in subparagraph 

17 (A) used in establishing the online presence de18 scribed in that paragraph; 

19 (D) as of the date of the report, the cyber20 security status of the small business concerns 

21 described in subparagraph (A) based on a rep22 resentative sample of those small business con23 cerns; 

24 (E) how the Department of Homeland Se25 curity and the Administration can improve their 


pbinns on DSKJLVW7X2PROD with $$_JOB
12 

•S 2740 IS

1 existing partnership to better train small busi2 ness concerns regarding cybersecurity threats; 

3 and 

4 (F) as of the date of the report— 

5 (i) the frequency of each type of cyber 

6 attack suffered by small business concerns 

7 described in subparagraph (A); and 

8 (ii) an estimated average cost to those 

9 small business concerns of each type of 

10 cyber attack. 

Æ 


pbinns on DSKJLVW7X2PROD with $$_JOB