I 

116TH CONGRESS 

1ST SESSION H. R. 1648 

To amend the Small Business Act to provide for the establishment of an 

enhanced cybersecurity assistance and protections for small businesses, 

and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

MARCH 8, 2019 

Mr. CHABOT (for himself and Ms. VELA ́ZQUEZ) introduced the following bill; 

which was referred to the Committee on Small Business 

A BILL 

To amend the Small Business Act to provide for the establishment of an enhanced cybersecurity assistance and 

protections for small businesses, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Small Business Ad5 vanced Cybersecurity Enhancements Act of 2019’’. 

6 SEC. 2. FINDINGS. 

7 Congress finds the following: 

8 (1) Small businesses represent more than 97 

9 percent of total businesses in the United States and 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 1648 IH

1 make up an essential part of the supply chain to 

2 some of the largest companies, many of which are in 

3 critical infrastructure sectors, from financial and 

4 transportation organizations to power, water, and 

5 healthcare suppliers. 

6 (2) Many small businesses do not have dedi7 cated information technology (‘‘IT’’) departments 

8 and must outsource IT functions or assign these du9 ties to an employee as a secondary function. 

10 (3) The Internet Crime Complaint Center with11 in the United States Department of Justice recorded 

12 298,728 cybersecurity-related complaints in its 2016 

13 report. 

14 (4) There has been steady increases of cyberse15 curity-related complaints year over year since the 

16 year 2000, totaling 3,762,348. 

17 (5) Seventy-one percent of cyber attacks oc18 curred in businesses with fewer than 100 employees. 

19 (6) Only 14 percent of small- and medium-sized 

20 businesses believe they have the ability to effectively 

21 mitigate cyber risks and vulnerabilities. 

22 (7) Small businesses risk theft and manipula23 tion of sensitive data if they lack adequate cyberse24 curity measures. 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 1648 IH

1 (8) The Better Business Bureau found that 

2 half of small businesses could remain profitable for 

3 only one month if they lost essential data. 

4 (9) Cyber crime is growing rapidly and the an5 nual costs to the global economy are estimated to 

6 reach over $2,000,000,000,000 by 2019. 

7 (10) Cybersecurity is a global challenge where 

8 the security threat, attacks, and techniques contin9 ually evolve and no company, individual, or Federal 

10 agency is immune from these threats. 

11 (11) Strong collaboration between the public 

12 and private sector is essential in the fight against 

13 cyber crime. 

14 (12) There is a reluctance among small busi15 nesses to voluntarily share information with govern16 ment entities, and the Federal Government should 

17 work proactively to incentivize and encourage vol18 untary information sharing to improve the Nation’s 

19 cybersecurity posture. 

20 SEC. 3. ENHANCED CYBERSECURITY ASSISTANCE AND PRO21 TECTIONS FOR SMALL BUSINESSES. 

22 Section 21(a) of the Small Business Act (15 U.S.C. 

23 648(a)) is amended by adding at the end the following 

24 new paragraph: 


kjohnson on DSK79L0C42 with BILLS
4 

•HR 1648 IH

1 ‘‘(9) SMALL BUSINESS CYBERSECURITY ASSIST2 ANCE AND PROTECTIONS.— 

3 ‘‘(A) ESTABLISHMENT OF SMALL BUSI4 NESS CYBERSECURITY ASSISTANCE UNITS.— 

5 The Administrator of the Small Business Ad6 ministration, in coordination with the Secretary 

7 of Commerce, and in consultation with the Sec8 retary of Homeland Security and the Attorney 

9 General, shall establish— 

10 ‘‘(i) in the Administration, a central 

11 small business cybersecurity assistance 

12 unit; and 

13 ‘‘(ii) within each small business devel14 opment center, a regional small business 

15 cybersecurity assistance unit. 

16 ‘‘(B) DUTIES OF THE CENTRAL SMALL

17 BUSINESS CYBERSECURITY ASSISTANCE UNIT.— 

18 ‘‘(i) IN GENERAL.—The central small 

19 business cybersecurity assistance unit es20 tablished under subparagraph (A)(i) shall 

21 serve as the primary interface for small 

22 business concerns to receive and share 

23 cyber threat indicators and defensive meas24 ures with the Federal Government. 


kjohnson on DSK79L0C42 with BILLS
5 

•HR 1648 IH

1 ‘‘(ii) USE OF CAPABILITY AND PROC2 ESSES.—The central small business cyber3 security assistance unit shall use the capa4 bility and process certified pursuant to sec5 tion 105(c)(2)(A) of the Cybersecurity In6 formation Sharing Act of 2015 (6 U.S.C. 

7 1504(c)(2)(A)) to receive cyber threat indi8 cators or defensive measures from small 

9 business concerns. 

10 ‘‘(iii) APPLICATION OF CISA.—A small 

11 business concern that receives or shares 

12 cyber threat indicators and defensive meas13 ures with the Federal Government through 

14 the central small business cybersecurity as15 sistance unit established under subpara16 graph (A)(i), or with any appropriate enti17 ty pursuant to section 103(c) of the Cyber18 security Information Sharing Act of 2015 

19 (6 U.S.C. 1503(c)), shall receive the pro20 tections and exemptions provided in such 

21 Act and this paragraph. 

22 ‘‘(C) RELATION TO NCCIC.— 

23 ‘‘(i) CENTRAL SMALL BUSINESS CY24 BERSECURITY ASSISTANCE UNIT.—The 

25 central small business cybersecurity assistVerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648

kjohnson on DSK79L0C42 with BILLS
6 

•HR 1648 IH

1 ance unit established under subparagraph 

2 (A)(i) shall be collocated with the national 

3 cybersecurity and communications integra4 tion center. 

5 ‘‘(ii) ACCESS TO INFORMATION.—The 

6 national cybersecurity and communications 

7 integration center shall have access to all 

8 cyber threat indicators or defensive meas9 ures shared with the central small cyberse10 curity assistance unit established under 

11 subparagraph (A)(i) through the use of the 

12 capability and process described in sub13 paragraph (B)(ii). 

14 ‘‘(D) CYBERSECURITY ASSISTANCE FOR

15 SMALL BUSINESSES.—The central small busi16 ness cybersecurity assistance unit established 

17 under subparagraph (A)(i) shall— 

18 ‘‘(i) work with each regional small 

19 business cybersecurity assistance unit es20 tablished under subparagraph (A)(ii) to 

21 provide cybersecurity assistance to small 

22 business concerns; 

23 ‘‘(ii) leverage resources from the Ad24 ministration, the Department of Com25 merce, the Department of Homeland SecuVerDate Sep 11 2014 03:53 Mar 22, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\H1648.IH H1648

kjohnson on DSK79L0C42 with BILLS
7 

•HR 1648 IH

1 rity, the Department of Justice, the De2 partment of the Treasury, the Department 

3 of State, and any other Federal depart4 ment or agency the Administrator deter5 mines appropriate, in order to help im6 prove the cybersecurity posture of small 

7 business concerns; 

8 ‘‘(iii) coordinate with the Department 

9 of Homeland Security to identify and dis10 seminate information to small business 

11 concerns in a form that is accessible and 

12 actionable by small business concerns; 

13 ‘‘(iv) coordinate with the National In14 stitute of Standards and Technology to 

15 identify and disseminate information to 

16 small business concerns on the most cost17 effective methods for implementing ele18 ments of the cybersecurity framework of 

19 the National Institute of Standards and 

20 Technology applicable to improving the cy21 bersecurity posture of small business con22 cerns; 

23 ‘‘(v) seek input from the Office of Ad24 vocacy of the Administration to ensure 

25 that any policies or procedures adopted by 


kjohnson on DSK79L0C42 with BILLS
8 

•HR 1648 IH

1 any department, agency, or instrumentality 

2 of the Federal Government do not unduly 

3 add regulatory burdens to small business 

4 concerns in a manner that will hamper the 

5 improvement of the cybersecurity posture 

6 of such small business concerns; and 

7 ‘‘(vi) leverage resources and relation8 ships with representatives and entities in9 volved in the national cybersecurity and 

10 communications integration center to pub11 licize the capacity of the Federal Govern12 ment to assist small business concerns in 

13 improving cybersecurity practices. 

14 ‘‘(E) ENHANCED CYBERSECURITY PROTEC15 TIONS FOR SMALL BUSINESSES.— 

16 ‘‘(i) IN GENERAL.—Notwithstanding 

17 any other provision of law, no cause of ac18 tion shall lie or be maintained in any court 

19 against any small business concern, and 

20 such action shall be promptly dismissed, if 

21 such action related to or arises out of— 

22 ‘‘(I) any activity authorized 

23 under this paragraph or the Cyberse24 curity Information Sharing Act of 

25 2015 (6 U.S.C. 1501 et seq.); or 


kjohnson on DSK79L0C42 with BILLS
9 

•HR 1648 IH

1 ‘‘(II) any action or inaction in re2 sponse to any cyber threat indicator, 

3 defensive measure, or other informa4 tion shared or received pursuant to 

5 this paragraph or the Cybersecurity 

6 Information Sharing Act of 2015 (6 

7 U.S.C. 1501 et seq.). 

8 ‘‘(ii) APPLICATION.—The exception 

9 provided in section 105(d)(5)(D)(ii)(I) of 

10 the Cybersecurity Information Sharing Act 

11 of 2015 (6 U.S.C. 1504(d)(5)(D)(ii)(I)) 

12 shall not apply to any cyber threat indi13 cator or defensive measure shared or re14 ceived by small business concerns pursuant 

15 to this paragraph or the Cybersecurity In16 formation Sharing Act of 2015 (6 U.S.C. 

17 1501 et seq.). 

18 ‘‘(iii) RULE OF CONSTRUCTION.— 

19 Nothing in this subparagraph shall be con20 strued to affect the applicability or merits 

21 of any defense, motion, or argument in any 

22 cause of action in a court brought against 

23 an entity that is not a small business con24 cern. 

25 ‘‘(F) DEFINITIONS.—In this paragraph: 


kjohnson on DSK79L0C42 with BILLS
10 

•HR 1648 IH

1 ‘‘(i) CISA DEFINITIONS.—The terms 

2 ‘cyber threat indicator’ and ‘defensive 

3 measure’ have the meanings given such 

4 terms in section 102 of the Cybersecurity 

5 Information Sharing Act of 2015 (6 

6 U.S.C. 1501). 

7 ‘‘(ii) NATIONAL CYBERSECURITY AND

8 COMMUNICATIONS INTEGRATION CEN9 TER.—The term ‘national cybersecurity 

10 and communications integration center’ 

11 means the national cybersecurity and com12 munications integration center established 

13 under section 227 of the Homeland Secu14 rity Act of 2002 (6 U.S.C. 148).’’. 

15 SEC. 4. PROHIBITION ON NEW APPROPRIATIONS. 

16 (a) IN GENERAL.—No additional funds are author17 ized to be appropriated to carry out this Act and the 

18 amendments made by this Act. 

19 (b) EXISTING FUNDING.—This Act and the amend20 ments made by this Act shall be carried out using amounts 

21 made available under section 21(a)(4)(C)(viii) of the Small 

22 Business Act (15 U.S.C. 648(a)(4)(viii)). 

23 (c) TECHNICAL AND CONFORMING AMENDMENT.— 

24 Section 21(a)(4)(C)(viii) of the Small Business Act (15 

25 U.S.C.648(a)(4)(C)(viii)) is amended to read as follows: 


kjohnson on DSK79L0C42 with BILLS
11 

•HR 1648 IH

1 ‘‘(viii) LIMITATION.— 

2 ‘‘(I) CYBERSECURITY ASSIST3 ANCE.—From the funds appropriated 

4 pursuant to clause (vii), the Adminis5 tration shall reserve not less than 

6 $1,000,000 in each fiscal year to de7 velop cybersecurity assistance units at 

8 small business development centers 

9 under paragraph (9). 

10 ‘‘(II) PORTABLE ASSISTANCE.— 

11 ‘‘(aa) IN GENERAL.—Any 

12 funds appropriated pursuant to 

13 clause (vii) that are remaining 

14 after reserving amounts under 

15 subclause (I) may be used for 

16 portable assistance for startup 

17 and sustainability non-matching 

18 grant programs to be conducted 

19 by eligible small business develop20 ment centers in communities that 

21 are economically challenged as a 

22 result of a business or govern23 ment facility down sizing or clos24 ing, which has resulted in the 


kjohnson on DSK79L0C42 with BILLS
12 

•HR 1648 IH

1 loss of jobs or small business in2 stability. 

3 ‘‘(bb) GRANT AMOUNT AND

4 USE.—A non-matching grant 

5 under this subclause shall not ex6 ceed $100,000, and shall be used 

7 for small business development 

8 center personnel expenses and re9 lated small business programs 

10 and services.’’. 

Æ 


kjohnson on DSK79L0C42 with BILLS