I 

115TH CONGRESS 

1ST SESSION H. R. 4668 

To amend the Small Business Act to provide for the establishment of an 

enhanced cybersecurity assistance and protections for small businesses, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

DECEMBER 18, 2017 

Mr. CHABOT (for himself and Ms. VELA ́ZQUEZ) introduced the following bill; 

which was referred to the Committee on Small Business 

A BILL 

To amend the Small Business Act to provide for the establishment of an enhanced cybersecurity assistance and 

protections for small businesses, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Small Business Ad5 vanced Cybersecurity Enhancements Act of 2017’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds the following: 

8 (1) Small businesses represent more than 97 

9 percent of total businesses in the United States and 


sradovich on DSK3GMQ082PROD with BILLS
2 

•HR 4668 IH

1 make up an essential part of the supply chain to 

2 some of the largest companies, many of which are in 

3 critical infrastructure sectors, from financial and 

4 transportation organizations to power, water, and 

5 healthcare suppliers. 

6 (2) Many small businesses do not have dedi7 cated information technology (‘‘IT’’) departments 

8 and must outsource IT functions or assign these du9 ties to an employee as a secondary function. 

10 (3) The Internet Crime Complaint Center with11 in the United States Department of Justice recorded 

12 298,728 cybersecurity-related complaints in its 2016 

13 report. 

14 (4) There has been steady increases of cyberse15 curity-related complaints year over year since the 

16 year 2000, totaling 3,762,348. 

17 (5) Seventy-one percent of cyber attacks oc18 curred in businesses with fewer than 100 employees. 

19 (6) Only 14 percent of small- and medium-sized 

20 businesses believe they have the ability to effectively 

21 mitigate cyber risks and vulnerabilities. 

22 (7) Small businesses risk theft and manipula23 tion of sensitive data if they lack adequate cyberse24 curity measures. 


sradovich on DSK3GMQ082PROD with BILLS
3 

•HR 4668 IH

1 (8) The Better Business Bureau found that 

2 half of small businesses could remain profitable for 

3 only one month if they lost essential data. 

4 (9) Cyber crime is growing rapidly and the an5 nual costs to the global economy are estimated to 

6 reach over $2,000,000,000,000 by 2019. 

7 (10) Cybersecurity is a global challenge where 

8 the security threat, attacks, and techniques contin9 ually evolve and no company, individual, or Federal 

10 agency is immune from these threats. 

11 (11) Strong collaboration between the public 

12 and private sector is essential in the fight against 

13 cyber crime. 

14 (12) There is a reluctance among small busi15 nesses to voluntarily share information with govern16 ment entities, and the Federal Government should 

17 work proactively to incentivize and encourage vol18 untary information sharing to improve the Nation’s 

19 cybersecurity posture. 

20 SEC. 3. ENHANCED CYBERSECURITY ASSISTANCE AND PRO21 TECTIONS FOR SMALL BUSINESSES. 

22 Section 21(a) of the Small Business Act (15 U.S.C. 

23 648(a)) is amended by adding at the end the following 

24 new paragraph: 


sradovich on DSK3GMQ082PROD with BILLS
4 

•HR 4668 IH

1 ‘‘(9) SMALL BUSINESS CYBERSECURITY ASSIST2 ANCE AND PROTECTIONS.— 

3 ‘‘(A) ESTABLISHMENT OF SMALL BUSI4 NESS CYBERSECURITY ASSISTANCE UNITS.— 

5 The Administrator of the Small Business Ad6 ministration, in coordination with the Secretary 

7 of Commerce, and in consultation with the Sec8 retary of Homeland Security and the Attorney 

9 General, shall establish— 

10 ‘‘(i) in the Administration, a central 

11 small business cybersecurity assistance 

12 unit; and 

13 ‘‘(ii) within each small business devel14 opment center, a regional small business 

15 cybersecurity assistance unit. 

16 ‘‘(B) DUTIES OF THE CENTRAL SMALL

17 BUSINESS CYBERSECURITY ASSISTANCE UNIT.— 

18 ‘‘(i) IN GENERAL.—The central small 

19 business cybersecurity assistance unit es20 tablished under subparagraph (A)(i) shall 

21 serve as the primary interface for small 

22 business concerns to receive and share 

23 cyber threat indicators and defensive meas24 ures with the Federal Government. 


sradovich on DSK3GMQ082PROD with BILLS
5 

•HR 4668 IH

1 ‘‘(ii) USE OF CAPABILITY AND PROC2 ESSES.—The central small business cyber3 security assistance unit shall use the capa4 bility and process certified pursuant to sec5 tion 105(c)(2)(A) of the Cybersecurity In6 formation Sharing Act of 2015 (6 U.S.C. 

7 1504(c)(2)(A)) to receive cyber threat indi8 cators or defensive measures from small 

9 business concerns. 

10 ‘‘(iii) APPLICATION OF CISA.—A small 

11 business concern that receives or shares 

12 cyber threat indicators and defensive meas13 ures with the Federal Government through 

14 the central small business cybersecurity as15 sistance unit established under subpara16 graph (A)(i), or with any appropriate enti17 ty pursuant to section 103(c) of the Cyber18 security Information Sharing Act of 2015 

19 (6 U.S.C. 1503(c)), shall receive the pro20 tections and exemptions provided in such 

21 Act and this paragraph. 

22 ‘‘(C) RELATION TO NCCIC.— 

23 ‘‘(i) CENTRAL SMALL BUSINESS CY24 BERSECURITY ASSISTANCE UNIT.—The 

25 central small business cybersecurity assistVerDate Sep 11 2014 03:33 Dec 19, 2017 Jkt 079200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H4668.IH H4668

sradovich on DSK3GMQ082PROD with BILLS
6 

•HR 4668 IH

1 ance unit established under subparagraph 

2 (A)(i) shall be collocated with the national 

3 cybersecurity and communications integra4 tion center. 

5 ‘‘(ii) ACCESS TO INFORMATION.—The 

6 national cybersecurity and communications 

7 integration center shall have access to all 

8 cyber threat indicators or defensive meas9 ures shared with the central small cyberse10 curity assistance unit established under 

11 subparagraph (A)(i) through the use of the 

12 capability and process described in sub13 paragraph (B)(ii). 

14 ‘‘(D) CYBERSECURITY ASSISTANCE FOR

15 SMALL BUSINESSES.—The central small busi16 ness cybersecurity assistance unit established 

17 under subparagraph (A)(i) shall— 

18 ‘‘(i) work with each regional small 

19 business cybersecurity assistance unit es20 tablished under subparagraph (A)(ii) to 

21 provide cybersecurity assistance to small 

22 business concerns; 

23 ‘‘(ii) leverage resources from the Ad24 ministration, the Department of Com25 merce, the Department of Homeland SecuVerDate Sep 11 2014 03:33 Dec 19, 2017 Jkt 079200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H4668.IH H4668

sradovich on DSK3GMQ082PROD with BILLS
7 

•HR 4668 IH

1 rity, the Department of Justice, the De2 partment of the Treasury, the Department 

3 of State, and any other Federal depart4 ment or agency the Administrator deter5 mines appropriate, in order to help im6 prove the cybersecurity posture of small 

7 business concerns; 

8 ‘‘(iii) coordinate with the Department 

9 of Homeland Security to identify and dis10 seminate information to small business 

11 concerns in a form that is accessible and 

12 actionable by small business concerns; 

13 ‘‘(iv) coordinate with the National In14 stitute of Standards and Technology to 

15 identify and disseminate information to 

16 small business concerns on the most cost17 effective methods for implementing ele18 ments of the cybersecurity framework of 

19 the National Institute of Standards and 

20 Technology applicable to improving the cy21 bersecurity posture of small business con22 cerns; 

23 ‘‘(v) seek input from the Office of Ad24 vocacy of the Administration to ensure 

25 that any policies or procedures adopted by 


sradovich on DSK3GMQ082PROD with BILLS
8 

•HR 4668 IH

1 any department, agency, or instrumentality 

2 of the Federal Government do not unduly 

3 add regulatory burdens to small business 

4 concerns in a manner that will hamper the 

5 improvement of the cybersecurity posture 

6 of such small business concerns; and 

7 ‘‘(vi) leverage resources and relation8 ships with representatives and entities in9 volved in the national cybersecurity and 

10 communications integration center to pub11 licize the capacity of the Federal Govern12 ment to assist small business concerns in 

13 improving cybersecurity practices. 

14 ‘‘(E) ENHANCED CYBERSECURITY PROTEC15 TIONS FOR SMALL BUSINESSES.— 

16 ‘‘(i) IN GENERAL.—Notwithstanding 

17 any other provision of law, no cause of ac18 tion shall lie or be maintained in any court 

19 against any small business concern, and 

20 such action shall be promptly dismissed, if 

21 such action related to or arises out of— 

22 ‘‘(I) any activity authorized 

23 under this paragraph or the Cyberse24 curity Information Sharing Act of 

25 2015 (6 U.S.C. 1501 et seq.); or 


sradovich on DSK3GMQ082PROD with BILLS
9 

•HR 4668 IH

1 ‘‘(II) any action or inaction in re2 sponse to any cyber threat indicator, 

3 defensive measure, or other informa4 tion shared or received pursuant to 

5 this paragraph or the Cybersecurity 

6 Information Sharing Act of 2015 (6 

7 U.S.C. 1501 et seq.). 

8 ‘‘(ii) APPLICATION.—The exception 

9 provided in section 105(d)(5)(D)(ii)(I) of 

10 the Cybersecurity Information Sharing Act 

11 of 2015 (6 U.S.C. 1504(d)(5)(D)(ii)(I)) 

12 shall not apply to any cyber threat indi13 cator or defensive measure shared or re14 ceived by small business concerns pursuant 

15 to this paragraph or the Cybersecurity In16 formation Sharing Act of 2015 (6 U.S.C. 

17 1501 et seq.). 

18 ‘‘(F) DEFINITIONS.—In this paragraph: 

19 ‘‘(i) CISA DEFINITIONS.—The terms 

20 ‘cyber threat indicator’ and ‘defensive 

21 measure’ have the meanings given such 

22 terms in section 102 of the Cybersecurity 

23 Information Sharing Act of 2015 (6 

24 U.S.C. 1501). 


sradovich on DSK3GMQ082PROD with BILLS
10 

•HR 4668 IH

1 ‘‘(ii) NATIONAL CYBERSECURITY AND

2 COMMUNICATIONS INTEGRATION CEN3 TER.—The term ‘national cybersecurity 

4 and communications integration center’ 

5 means the national cybersecurity and com6 munications integration center established 

7 under section 227 of the Homeland Secu8 rity Act of 2002 (6 U.S.C. 148).’’. 

9 SEC. 4. PROHIBITION ON NEW APPROPRIATIONS. 

10 No additional funds are authorized to be appro11 priated to carry out this Act and the amendments made 

12 by this Act, and this Act and such amendments shall be 

13 carried out using amounts otherwise made available for 

14 such purposes. 

Æ 


sradovich on DSK3GMQ082PROD with BILLS