II 

114TH CONGRESS 

2D SESSION H. R. 5064 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 22, 2016 

Received 

AN ACT 

To amend the Small Business Act to allow small business 

development centers to assist and advise small business 

concerns on relevant cyber security matters, and for 

other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


asabaliauskas on DSK3SPTVN1PROD with BILLS
2 

HR 5064 RDS 

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘Improving Small Busi3 ness Cyber Security Act of 2016’’. 

4 SEC. 2. ROLE OF SMALL BUSINESS DEVELOPMENT CEN5 TERS IN CYBER SECURITY AND PREPARED6 NESS. 

7 Section 21 of the Small Business Act (15 U.S.C. 648) 

8 is amended— 

9 (1) in subsection (a)(1), by striking ‘‘and pro10 viding access to business analysts who can refer 

11 small business concerns to available experts:’’ and 

12 inserting ‘‘providing access to business analysts who 

13 can refer small business concerns to available ex14 perts; and, to the extent practicable, providing as15 sistance in furtherance of the Small Business Devel16 opment Center Cyber Strategy developed under sec17 tion 5(b) of the Improving Small Business Cyber Se18 curity Act of 2016:’’; and 

19 (2) in subsection (c)— 

20 (A) in paragraph (2)— 

21 (i) in subparagraph (E), by striking 

22 ‘‘and’’ at the end; 

23 (ii) in subparagraph (F), by striking 

24 the period and inserting ‘‘; and’’; and 

25 (iii) by adding at the end of the fol26 lowing: 


asabaliauskas on DSK3SPTVN1PROD with BILLS
3 

HR 5064 RDS 

1 ‘‘(G) access to cyber security specialists to 

2 counsel, assist, and inform small business concern 

3 clients, in furtherance of the Small Business Devel4 opment Center Cyber Strategy developed under sec5 tion 5(b) of the Improving Small Business Cyber Se6 curity Act of 2016.’’. 

7 SEC. 3. ADDITIONAL CYBER SECURITY ASSISTANCE FOR 

8 SMALL BUSINESS DEVELOPMENT CENTERS. 

9 Section 21(a) of the Small Business Act (15 U.S.C. 

10 648(a)) is amended by adding at the end the following: 

11 ‘‘(8) CYBER SECURITY ASSISTANCE.—The De12 partment of Homeland Security, and any other Fed13 eral department or agency in coordination with the 

14 Department of Homeland Security, may leverage 

15 small business development centers to provide assist16 ance to small businesses by disseminating cyber se17 curity risk information and other homeland security 

18 information to help small business concerns in devel19 oping or enhancing cyber security infrastructure, 

20 cyber threat awareness, and cyber training programs 

21 for employees.’’. 

22 SEC. 4. CYBER SECURITY OUTREACH FOR SMALL BUSINESS 

23 DEVELOPMENT CENTERS. 

24 Section 227 of the Homeland Security Act of 2002 

25 (6 U.S.C. 148) is amended— 


asabaliauskas on DSK3SPTVN1PROD with BILLS
4 

HR 5064 RDS 

1 (1) by redesignating subsection (l) as subsection 

2 (m); and 

3 (2) by inserting after subsection (k) the fol4 lowing: 

5 ‘‘(l) CYBERSECURITY OUTREACH.— 

6 ‘‘(1) IN GENERAL.—The Secretary may lever7 age small business development centers to provide 

8 assistance to small business concerns by dissemi9 nating information on cyber threat indicators, defen10 sive measures, cybersecurity risks, incidents, anal11 yses, and warnings to help small business concerns 

12 in developing or enhancing cybersecurity infrastruc13 ture, cyber threat awareness, and cyber training pro14 grams for employees. 

15 ‘‘(2) DEFINITIONS.—For purposes of this sub16 section, the terms ‘small business concern’ and 

17 ‘small business development center’ have the mean18 ing given such terms, respectively, under section 3 of 

19 the Small Business Act.’’. 

20 SEC. 5. GAO STUDY ON SMALL BUSINESS CYBER SUPPORT 

21 SERVICES AND SMALL BUSINESS DEVELOP22 MENT CENTER CYBER STRATEGY. 

23 (a) REVIEW OF CURRENT CYBER SECURITY RE24 SOURCES.— 


asabaliauskas on DSK3SPTVN1PROD with BILLS
5 

HR 5064 RDS 

1 (1) IN GENERAL.—The Comptroller General of 

2 the United States shall conduct a review of current 

3 cyber security resources at the Federal level aimed 

4 at assisting small business concerns with developing 

5 or enhancing cyber security infrastructure, cyber 

6 threat awareness, or cyber training programs for 

7 employees. 

8 (2) CONTENT.—The review required under 

9 paragraph (1) shall include the following: 

10 (A) An accounting and description of all 

11 Federal Government programs, projects, and 

12 activities that currently provide assistance to 

13 small business concerns in developing or en14 hancing cyber security infrastructure, cyber 

15 threat awareness, or cyber training programs 

16 for employees. 

17 (B) An assessment of how widely utilized 

18 the resources described under subparagraph (A) 

19 are by small business concerns and a review of 

20 whether or not such resources are duplicative of 

21 other programs and structured in a manner 

22 that makes them accessible to and supportive of 

23 small business concerns. 

24 (3) REPORT.—The Comptroller General shall 

25 issue a report to the Congress, the Administrator of 


asabaliauskas on DSK3SPTVN1PROD with BILLS
6 

HR 5064 RDS 

1 the Small Business Administration, the Secretary of 

2 Homeland Security, and any association recognized 

3 under section 21(a)(3)(A) of the Small Business Act 

4 containing all findings and determinations made in 

5 carrying out the review required under paragraph 

6 (1). 

7 (b) SMALL BUSINESS DEVELOPMENT CENTER

8 CYBER STRATEGY.— 

9 (1) IN GENERAL.—Not later than 90 days after 

10 the issuance of the report under subsection (a)(3), 

11 the Administrator of the Small Business Administra12 tion and the Secretary of Homeland Security shall 

13 work collaboratively to develop a Small Business De14 velopment Center Cyber Strategy. 

15 (2) CONSULTATION.—In developing the strat16 egy under this subsection, the Administrator of the 

17 Small Business Administration and the Secretary of 

18 Homeland Security shall consult with entities rep19 resenting the concerns of small business development 

20 centers, including any association recognized under 

21 section 21(a)(3)(A) of the Small Business Act. 

22 (3) CONTENT.—The strategy required under 

23 paragraph (1) shall include, at minimum, the fol24 lowing: 


asabaliauskas on DSK3SPTVN1PROD with BILLS
7 

HR 5064 RDS 

1 (A) Plans for leveraging small business de2 velopment centers (SBDCs) to access existing 

3 cyber programs of the Department of Home4 land Security and other appropriate Federal 

5 agencies to enhance services and streamline 

6 cyber assistance to small business concerns. 

7 (B) To the extent practicable, methods for 

8 the provision of counsel and assistance to im9 prove a small business concern’s cyber security 

10 infrastructure, cyber threat awareness, and 

11 cyber training programs for employees, includ12 ing— 

13 (I) working to ensure individuals are 

14 aware of best practices in the areas of 

15 cyber security, cyber threat awareness, and 

16 cyber training; 

17 (ii) working with individuals to de18 velop cost-effective plans for implementing 

19 best practices in these areas; 

20 (iii) entering into agreements, where 

21 practical, with Information Sharing and 

22 Analysis Centers or similar cyber informa23 tion sharing entities to gain an awareness 

24 of actionable threat information that may 


asabaliauskas on DSK3SPTVN1PROD with BILLS
8 

HR 5064 RDS 

1 be beneficial to small business concerns; 

2 and 

3 (iv) providing referrals to area special4 ists when necessary. 

5 (c) An analysis of— 

6 (I) how Federal Government pro7 grams, projects, and activities identified by 

8 the Comptroller General in the report 

9 issued under subsection (a)(1) can be le10 veraged by SBDCs to improve access to 

11 high-quality cyber support for small busi12 ness concerns; 

13 (ii) additional resources SBDCs may 

14 need to effectively carry out their role; and 

15 (iii) how SBDCs can leverage existing 

16 partnerships and develop new ones with 

17 Federal, State, and local government enti18 ties as well as private entities to improve 

19 the quality of cyber support services to 

20 small business concerns. 

21 (4) DELIVERY OF STRATEGY.—Not later than 

22 180 days after the issuance of the report under sub23 section (a)(3), the Small Business Development Cen24 ter Cyber Strategy shall be issued to the Committees 

25 on Homeland Security and Small Business of the 


asabaliauskas on DSK3SPTVN1PROD with BILLS
9 

HR 5064 RDS 

1 House of Representatives and the Committees on 

2 Homeland Security and Governmental Affairs and 

3 Small Business and Entrepreneurship of the Senate. 

4 (c) DEFINITION.—The term ‘‘small business develop5 ment center’’ has the meaning given such term in section 

6 3 of the Small Business Act (15 U.S.C. 632). 

7 SEC. 6. PROHIBITION ON ADDITIONAL FUNDS. 

8 No additional funds are authorized to be appro9 priated to carry out the requirements of this Act or the 

10 amendments made by this Act. Such requirements shall 

11 be carried out using amounts otherwise authorized. 

Passed the House of Representatives September 21, 

2016. 

Attest: KAREN L. HAAS, 

Clerk. 


asabaliauskas on DSK3SPTVN1PROD with BILLS