I 

114TH CONGRESS 

2D SESSION H. R. 5064 

To amend the Small Business Act to allow small business development centers 

to assist and advise small business concerns on relevant cyber security 

matters, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 26, 2016 

Mr. HANNA (for himself, Mr. KILMER, Ms. STEFANIK, Ms. CLARKE of New 

York, Mr. CHABOT, Ms. MENG, Mr. KNIGHT, Mr. LOUDERMILK, Mr. 

PAYNE, Ms. VELA ́ZQUEZ, Mr. RENACCI, Mr. CURBELO of Florida, and 

Mr. CARNEY) introduced the following bill; which was referred to the 

Committee on Small Business, and in addition to the Committee on 

Homeland Security, for a period to be subsequently determined by the 

Speaker, in each case for consideration of such provisions as fall within 

the jurisdiction of the committee concerned 

A BILL 

To amend the Small Business Act to allow small business 

development centers to assist and advise small business 

concerns on relevant cyber security matters, and for 

other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Improving Small Busi5 ness Cyber Security Act of 2016’’. 


emcdonald on DSK67QTVN1PROD with BILLS
2 

•HR 5064 IH

1 SEC. 2. ROLE OF SMALL BUSINESS DEVELOPMENT CEN2 TERS IN CYBER SECURITY AND PREPARED3 NESS. 

4 Section 21 of the Small Business Act (15 U.S.C. 648) 

5 is amended— 

6 (1) in subsection (a)(1), by striking ‘‘and pro7 viding access to business analysts who can refer 

8 small business concerns to available experts:’’ and 

9 inserting ‘‘providing access to business analysts who 

10 can refer small business concerns to available ex11 perts; and, to the extent practicable, providing as12 sistance in furtherance of the Small Business Devel13 opment Center Cyber Strategy developed under sec14 tion 5(b) of the Improving Small Business Cyber Se15 curity Act of 2016:’’; and 

16 (2) in subsection (c)— 

17 (A) in paragraph (2)— 

18 (i) in subparagraph (E), by striking 

19 ‘‘and’’ at the end; 

20 (ii) in subparagraph (F), by striking 

21 the period and inserting ‘‘; and’’; and 

22 (iii) by adding at the end of the fol23 lowing: 

24 ‘‘(G) access to cyber security specialists to 

25 counsel, assist, and inform small business concern 

26 clients, in furtherance of the Small Business DevelVerDate Sep 11 2014 03:07 May 03, 2016 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H5064.IH H5064

emcdonald on DSK67QTVN1PROD with BILLS
3 

•HR 5064 IH

1 opment Center Cyber Strategy developed under sec2 tion 5(b) of the Improving Small Business Cyber Se3 curity Act of 2016.’’. 

4 SEC. 3. ADDITIONAL CYBER SECURITY ASSISTANCE FOR 

5 SMALL BUSINESS DEVELOPMENT CENTERS. 

6 Section 21(a) of the Small Business Act (15 U.S.C. 

7 648(a)) is amended by adding at the end the following: 

8 ‘‘(8) CYBER SECURITY ASSISTANCE.—The De9 partment of Homeland Security, and any other Fed10 eral department or agency in coordination with the 

11 Department of Homeland Security, may provide as12 sistance to small business development centers, 

13 through the dissemination of cyber security risk in14 formation and other homeland security information, 

15 to help small business concerns in developing or en16 hancing cyber security infrastructure, cyber threat 

17 awareness, and cyber training programs for employ18 ees.’’. 

19 SEC. 4. CYBER SECURITY OUTREACH FOR SMALL BUSINESS 

20 DEVELOPMENT CENTERS. 

21 Section 227 of the Homeland Security Act of 2002 

22 (6 U.S.C. 148) is amended— 

23 (1) by redesignating subsection (l) as subsection 

24 (m); and 


emcdonald on DSK67QTVN1PROD with BILLS
4 

•HR 5064 IH

1 (2) by inserting after subsection (k) the fol2 lowing: 

3 ‘‘(l) CYBER SECURITY OUTREACH.— 

4 ‘‘(1) IN GENERAL.—The Secretary may provide 

5 assistance to small business development centers, 

6 through the dissemination of cyber security risk in7 formation and other homeland security information, 

8 to help small business concerns in developing or en9 hancing cyber security infrastructure, cyber threat 

10 awareness, and cyber training programs for employ11 ees. 

12 ‘‘(2) DEFINITIONS.—For purposes of this sub13 section, the terms ‘small business concern’ and 

14 ‘small business development center’ have the mean15 ing given such terms, respectively, under section 3 of 

16 the Small Business Act.’’. 

17 SEC. 5. GAO STUDY ON SMALL BUSINESS CYBER SUPPORT 

18 SERVICES AND SMALL BUSINESS DEVELOP19 MENT CENTER CYBER STRATEGY. 

20 (a) REVIEW OF CURRENT CYBER SECURITY RE21 SOURCES.— 

22 (1) IN GENERAL.—The Comptroller General of 

23 the United States shall conduct a review of current 

24 cyber security resources at the Federal level aimed 

25 at assisting small business concerns with developing 


emcdonald on DSK67QTVN1PROD with BILLS
5 

•HR 5064 IH

1 or enhancing cyber security infrastructure, cyber 

2 threat awareness, or cyber training programs for 

3 employees. 

4 (2) CONTENT.—The review required under 

5 paragraph (1) shall include the following: 

6 (A) An accounting and description of all 

7 Federal Government programs, projects, and 

8 activities that currently provide assistance to 

9 small business concerns in developing or en10 hancing cyber security infrastructure, cyber 

11 threat awareness, or cyber training programs 

12 for employees. 

13 (B) An assessment of how widely utilized 

14 the resources described under subparagraph (A) 

15 are by small business concerns and a review of 

16 whether or not such resources are duplicative of 

17 other programs and structured in a manner 

18 that makes them accessible to and supportive of 

19 small business concerns. 

20 (3) REPORT.—The Comptroller General shall 

21 issue a report to the Congress, the Small Business 

22 Administrator, the Secretary of Homeland Security, 

23 and any association recognized under section 

24 21(a)(3)(A) of the Small Business Act containing all 


emcdonald on DSK67QTVN1PROD with BILLS
6 

•HR 5064 IH

1 findings and determinations made in carrying out 

2 the review required under paragraph (1). 

3 (b) SMALL BUSINESS DEVELOPMENT CENTER

4 CYBER STRATEGY.— 

5 (1) IN GENERAL.—Not later than 90 days after 

6 the issuance of the report under subsection (a)(3), 

7 the Small Business Administrator and the Secretary 

8 of Homeland Security shall work collaboratively to 

9 develop a Small Business Development Center Cyber 

10 Strategy. 

11 (2) CONSULTATION.—In developing the strat12 egy under this subsection, the Small Business Ad13 ministrator and the Secretary of Homeland Security 

14 shall consult with entities representing the concerns 

15 of small business development centers, including any 

16 association recognized under section 21(a)(3)(A) of 

17 the Small Business Act. 

18 (3) CONTENT.—The strategy required under 

19 paragraph (1) shall include, at minimum, the fol20 lowing: 

21 (A) Plans for incorporating small business 

22 development centers (SBDCs) into existing 

23 cyber programs to enhance services and stream24 line cyber assistance to small business concerns. 


emcdonald on DSK67QTVN1PROD with BILLS
7 

•HR 5064 IH

1 (B) To the extent practicable, methods for 

2 the provision of counsel and assistance to im3 prove a small business concern’s cyber security 

4 infrastructure, cyber threat awareness, and 

5 cyber training programs for employees, includ6 ing— 

7 (i) working to ensure individuals are 

8 aware of best practices in the areas of 

9 cyber security, cyber threat awareness, and 

10 cyber training; 

11 (ii) working with individuals to de12 velop cost-effective plans for implementing 

13 best practices in these areas; 

14 (iii) entering into agreements, where 

15 practical, with Information Sharing and 

16 Analysis Centers or similar cyber informa17 tion sharing entities to gain an awareness 

18 of actionable threat information that may 

19 be beneficial to small business concerns; 

20 and 

21 (iv) providing referrals to area special22 ists when necessary. 

23 (C) An analysis of— 

24 (i) how Federal Government pro25 grams, projects, and activities identified by 


emcdonald on DSK67QTVN1PROD with BILLS
8 

•HR 5064 IH

1 the Comptroller General in the report 

2 issued under subsection (a)(1) can be le3 veraged by SBDCs to improve access to 

4 high-quality cyber support for small busi5 ness concerns; 

6 (ii) additional resources SBDCs may 

7 need to effectively carry out their role; and 

8 (iii) how SBDCs can leverage existing 

9 partnerships and develop new ones with 

10 Federal, State, and local government enti11 ties as well as private entities to improve 

12 the quality of cyber support services to 

13 small business concerns. 

14 (4) DELIVERY OF STRATEGY.—Not later than 

15 180 days after the issuance of the report under sub16 section (a)(3), the Small Business Development Cen17 ter Cyber Strategy shall be issued to the Committees 

18 on Homeland Security and Small Business of the 

19 House of Representatives and the Committees on 

20 Homeland Security and Governmental Affairs and 

21 Small Business and Entrepreneurship of the Senate. 


emcdonald on DSK67QTVN1PROD with BILLS
9 

•HR 5064 IH

1 SEC. 6. PROHIBITION ON ADDITIONAL FUNDS. 

2 No additional funds are authorized to be appro3 priated to carry out this Act or the amendments made 

4 by this Act. 

Æ 


emcdonald on DSK67QTVN1PROD with BILLS