IB 

Union Calendar No. 502 

115TH CONGRESS 

2D SESSION H. R. 4668 

[Report No. 115–654] 

To amend the Small Business Act to provide for the establishment of an 

enhanced cybersecurity assistance and protections for small businesses, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 18, 2017 

Mr. CHABOT (for himself and Ms. VELA ́ZQUEZ) introduced the following bill; 

which was referred to the Committee on Small Business 

APRIL 25, 2018 

Additional sponsors: Mr. KING of Iowa, Mrs. RADEWAGEN, Miss GONZA ́LEZCOLO ́N of Puerto Rico, Mr. NORMAN, Mr. CURTIS, Ms. CLARKE of New 

York, Mr. LAWSON of Florida, Mr. EVANS, and Ms. ROSEN

APRIL 25, 2018 

Reported with an amendment, committed to the Committee of the Whole 

House on the State of the Union, and ordered to be printed 

[Strike out all after the enacting clause and insert the part printed in italic] 

[For text of introduced bill, see copy of bill as introduced on December 18, 2017] 


pbinns on DSK79D2C42PROD with BILLS
2 

•HR 4668 RH

A BILL 

To amend the Small Business Act to provide for the establishment of an enhanced cybersecurity assistance and 

protections for small businesses, and for other purposes. 


pbinns on DSK79D2C42PROD with BILLS
3 

•HR 4668 RH

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Small Business Ad5 vanced Cybersecurity Enhancements Act of 2017’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds the following: 

8 (1) Small businesses represent more than 97 per9 cent of total businesses in the United States and make 

10 up an essential part of the supply chain to some of 

11 the largest companies, many of which are in critical 

12 infrastructure sectors, from financial and transpor13 tation organizations to power, water, and healthcare 

14 suppliers. 

15 (2) Many small businesses do not have dedicated 

16 information technology (‘‘IT’’) departments and must 

17 outsource IT functions or assign these duties to an 

18 employee as a secondary function. 

19 (3) The Internet Crime Complaint Center within 

20 the United States Department of Justice recorded 

21 298,728 cybersecurity-related complaints in its 2016 

22 report. 

23 (4) There has been steady increases of cybersecu24 rity-related complaints year over year since the year 

25 2000, totaling 3,762,348. 


pbinns on DSK79D2C42PROD with BILLS
4 

•HR 4668 RH

1 (5) Seventy-one percent of cyber attacks occurred 

2 in businesses with fewer than 100 employees. 

3 (6) Only 14 percent of small- and medium-sized 

4 businesses believe they have the ability to effectively 

5 mitigate cyber risks and vulnerabilities. 

6 (7) Small businesses risk theft and manipulation 

7 of sensitive data if they lack adequate cybersecurity 

8 measures. 

9 (8) The Better Business Bureau found that half 

10 of small businesses could remain profitable for only 

11 one month if they lost essential data. 

12 (9) Cyber crime is growing rapidly and the an13 nual costs to the global economy are estimated to 

14 reach over $2,000,000,000,000 by 2019. 

15 (10) Cybersecurity is a global challenge where 

16 the security threat, attacks, and techniques contin17 ually evolve and no company, individual, or Federal 

18 agency is immune from these threats. 

19 (11) Strong collaboration between the public and 

20 private sector is essential in the fight against cyber 

21 crime. 

22 (12) There is a reluctance among small busi23 nesses to voluntarily share information with govern24 ment entities, and the Federal Government should 

25 work proactively to incentivize and encourage volVerDate Sep 11 2014 20:59 Apr 25, 2018 Jkt 079200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6203 E:\BILLS\H4668.RH H4668

pbinns on DSK79D2C42PROD with BILLS
5 

•HR 4668 RH

1 untary information sharing to improve the Nation’s 

2 cybersecurity posture. 

3 SEC. 3. ENHANCED CYBERSECURITY ASSISTANCE AND PRO4 TECTIONS FOR SMALL BUSINESSES. 

5 Section 21(a) of the Small Business Act (15 U.S.C. 

6 648(a)) is amended by adding at the end the following new 

7 paragraph: 

8 ‘‘(9) SMALL BUSINESS CYBERSECURITY ASSIST9 ANCE AND PROTECTIONS.— 

10 ‘‘(A) ESTABLISHMENT OF SMALL BUSINESS

11 CYBERSECURITY ASSISTANCE UNITS.—The Ad12 ministrator of the Small Business Administra13 tion, in coordination with the Secretary of Com14 merce, and in consultation with the Secretary of 

15 Homeland Security and the Attorney General, 

16 shall establish— 

17 ‘‘(i) in the Administration, a central 

18 small business cybersecurity assistance unit; 

19 and 

20 ‘‘(ii) within each small business devel21 opment center, a regional small business cy22 bersecurity assistance unit. 

23 ‘‘(B) DUTIES OF THE CENTRAL SMALL

24 BUSINESS CYBERSECURITY ASSISTANCE UNIT.— 


pbinns on DSK79D2C42PROD with BILLS
6 

•HR 4668 RH

1 ‘‘(i) IN GENERAL.—The central small 

2 business cybersecurity assistance unit estab3 lished under subparagraph (A)(i) shall serve 

4 as the primary interface for small business 

5 concerns to receive and share cyber threat 

6 indicators and defensive measures with the 

7 Federal Government. 

8 ‘‘(ii) USE OF CAPABILITY AND PROC9 ESSES.—The central small business cyberse10 curity assistance unit shall use the capa11 bility and process certified pursuant to sec12 tion 105(c)(2)(A) of the Cybersecurity Infor13 mation Sharing Act of 2015 (6 U.S.C. 

14 1504(c)(2)(A)) to receive cyber threat indi15 cators or defensive measures from small 

16 business concerns. 

17 ‘‘(iii) APPLICATION OF CISA.—A small 

18 business concern that receives or shares 

19 cyber threat indicators and defensive meas20 ures with the Federal Government through 

21 the central small business cybersecurity as22 sistance unit established under subpara23 graph (A)(i), or with any appropriate enti24 ty pursuant to section 103(c) of the Cyberse25 curity Information Sharing Act of 2015 (6 


pbinns on DSK79D2C42PROD with BILLS
7 

•HR 4668 RH

1 U.S.C. 1503(c)), shall receive the protections 

2 and exemptions provided in such Act and 

3 this paragraph. 

4 ‘‘(C) RELATION TO NCCIC.— 

5 ‘‘(i) CENTRAL SMALL BUSINESS CYBER6 SECURITY ASSISTANCE UNIT.—The central 

7 small business cybersecurity assistance unit 

8 established under subparagraph (A)(i) shall 

9 be collocated with the national cybersecurity 

10 and communications integration center. 

11 ‘‘(ii) ACCESS TO INFORMATION.—The 

12 national cybersecurity and communications 

13 integration center shall have access to all 

14 cyber threat indicators or defensive meas15 ures shared with the central small cyberse16 curity assistance unit established under sub17 paragraph (A)(i) through the use of the ca18 pability and process described in subpara19 graph (B)(ii). 

20 ‘‘(D) CYBERSECURITY ASSISTANCE FOR

21 SMALL BUSINESSES.—The central small business 

22 cybersecurity assistance unit established under 

23 subparagraph (A)(i) shall— 

24 ‘‘(i) work with each regional small 

25 business cybersecurity assistance unit estabVerDate Sep 11 2014 20:59 Apr 25, 2018 Jkt 079200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6203 E:\BILLS\H4668.RH H4668

pbinns on DSK79D2C42PROD with BILLS
8 

•HR 4668 RH

1 lished under subparagraph (A)(ii) to pro2 vide cybersecurity assistance to small busi3 ness concerns; 

4 ‘‘(ii) leverage resources from the Ad5 ministration, the Department of Commerce, 

6 the Department of Homeland Security, the 

7 Department of Justice, the Department of 

8 the Treasury, the Department of State, and 

9 any other Federal department or agency the 

10 Administrator determines appropriate, in 

11 order to help improve the cybersecurity pos12 ture of small business concerns; 

13 ‘‘(iii) coordinate with the Department 

14 of Homeland Security to identify and dis15 seminate information to small business con16 cerns in a form that is accessible and ac17 tionable by small business concerns; 

18 ‘‘(iv) coordinate with the National In19 stitute of Standards and Technology to 

20 identify and disseminate information to 

21 small business concerns on the most cost-ef22 fective methods for implementing elements 

23 of the cybersecurity framework of the Na24 tional Institute of Standards and TechVerDate Sep 11 2014 20:59 Apr 25, 2018 Jkt 079200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6203 E:\BILLS\H4668.RH H4668

pbinns on DSK79D2C42PROD with BILLS
9 

•HR 4668 RH

1 nology applicable to improving the cyberse2 curity posture of small business concerns; 

3 ‘‘(v) seek input from the Office of Ad4 vocacy of the Administration to ensure that 

5 any policies or procedures adopted by any 

6 department, agency, or instrumentality of 

7 the Federal Government do not unduly add 

8 regulatory burdens to small business con9 cerns in a manner that will hamper the im10 provement of the cybersecurity posture of 

11 such small business concerns; and 

12 ‘‘(vi) leverage resources and relation13 ships with representatives and entities in14 volved in the national cybersecurity and 

15 communications integration center to pub16 licize the capacity of the Federal Govern17 ment to assist small business concerns in 

18 improving cybersecurity practices. 

19 ‘‘(E) ENHANCED CYBERSECURITY PROTEC20 TIONS FOR SMALL BUSINESSES.— 

21 ‘‘(i) IN GENERAL.—Notwithstanding 

22 any other provision of law, no cause of ac23 tion shall lie or be maintained in any court 

24 against any small business concern, and 


pbinns on DSK79D2C42PROD with BILLS
10 

•HR 4668 RH

1 such action shall be promptly dismissed, if 

2 such action related to or arises out of— 

3 ‘‘(I) any activity authorized 

4 under this paragraph or the Cybersecu5 rity Information Sharing Act of 2015 

6 (6 U.S.C. 1501 et seq.); or 

7 ‘‘(II) any action or inaction in 

8 response to any cyber threat indicator, 

9 defensive measure, or other information 

10 shared or received pursuant to this 

11 paragraph or the Cybersecurity Infor12 mation Sharing Act of 2015 (6 U.S.C. 

13 1501 et seq.). 

14 ‘‘(ii) APPLICATION.—The exception 

15 provided in section 105(d)(5)(D)(ii)(I) of 

16 the Cybersecurity Information Sharing Act 

17 of 2015 (6 U.S.C. 1504(d)(5)(D)(ii)(I)) 

18 shall not apply to any cyber threat indi19 cator or defensive measure shared or re20 ceived by small business concerns pursuant 

21 to this paragraph or the Cybersecurity In22 formation Sharing Act of 2015 (6 U.S.C. 

23 1501 et seq.). 

24 ‘‘(iii) RULE OF CONSTRUCTION.—Noth25 ing in this subparagraph shall be construed 


pbinns on DSK79D2C42PROD with BILLS
11 

•HR 4668 RH

1 to affect the applicability or merits of any 

2 defense, motion, or argument in any cause 

3 of action in a court brought against an en4 tity that is not a small business concern. 

5 ‘‘(F) DEFINITIONS.—In this paragraph: 

6 ‘‘(i) CISA DEFINITIONS.—The terms 

7 ‘cyber threat indicator’ and ‘defensive meas8 ure’ have the meanings given such terms in 

9 section 102 of the Cybersecurity Informa10 tion Sharing Act of 2015 (6 U.S.C. 1501). 

11 ‘‘(ii) NATIONAL CYBERSECURITY AND

12 COMMUNICATIONS INTEGRATION CENTER.— 

13 The term ‘national cybersecurity and com14 munications integration center’ means the 

15 national cybersecurity and communications 

16 integration center established under section 

17 227 of the Homeland Security Act of 2002 

18 (6 U.S.C. 148).’’. 

19 SEC. 4. PROHIBITION ON NEW APPROPRIATIONS. 

20 (a) IN GENERAL.—No additional funds are authorized 

21 to be appropriated to carry out this Act and the amend22 ments made by this Act. 

23 (b) EXISTING FUNDING.—This Act and the amend24 ments made by this Act shall be carried out using amounts 


pbinns on DSK79D2C42PROD with BILLS
12 

•HR 4668 RH

1 made available under section 21(a)(4)(C)(viii) of the Small 

2 Business Act (15 U.S.C. 648(a)(4)(viii)). 

3 (c) TECHNICAL AND CONFORMING AMENDMENT.—Sec4 tion 21(a)(4)(C)(viii) of the Small Business Act (15 

5 U.S.C.648(a)(4)(C)(viii)) is amended to read as follows: 

6 ‘‘(viii) LIMITATION.— 

7 ‘‘(I) CYBERSECURITY ASSIST8 ANCE.—From the funds appropriated 

9 pursuant to clause (vii), the Adminis10 tration shall reserve not less than 

11 $1,000,000 in each fiscal year to de12 velop cybersecurity assistance units at 

13 small business development centers 

14 under paragraph (9). 

15 ‘‘(II) PORTABLE ASSISTANCE.— 

16 ‘‘(aa) IN GENERAL.—Any 

17 funds appropriated pursuant to 

18 clause (vii) that are remaining 

19 after reserving amounts under 

20 subclause (I) may be used for 

21 portable assistance for startup 

22 and sustainability non-matching 

23 grant programs to be conducted 

24 by eligible small business develop25 ment centers in communities that 


pbinns on DSK79D2C42PROD with BILLS
13 

•HR 4668 RH

1 are economically challenged as a 

2 result of a business or government 

3 facility down sizing or closing, 

4 which has resulted in the loss of 

5 jobs or small business instability. 

6 ‘‘(bb) GRANT AMOUNT AND

7 USE.—A non-matching grant 

8 under this subclause shall not ex9 ceed $100,000, and shall be used 

10 for small business development 

11 center personnel expenses and re12 lated small business programs and 

13 services.’’. 


pbinns on DSK79D2C42PROD with BILLS
Union Calendar No. 502 

115TH CONGRESS 

2D SESSION H. R. 4668 

[Report No. 115–654] 

A BILL 

To amend the Small Business Act to provide for 

and for other purposes. assistance and protections for small businesses, the establishment of an enhanced cybersecurity 

APRIL 25, 2018 

Reported with an amendment, committed to the Comand ordered to be printed mittee of the Whole House on the State of the Union, 


pbinns on DSK79D2C42PROD with BILLS