I 

115TH CONGRESS 

2D SESSION H. R. 5517 

To improve assistance provided by the Hollings Manufacturing Extension 

Partnership to small manufacturers in the defense industrial supply 

chain on matters relating to cybersecurity, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 13, 2018 

Mr. PANETTA (for himself and Mr. GALLAGHER) introduced the following bill; 

which was referred to the Committee on Science, Space, and Technology, 

and in addition to the Committee on Armed Services, for a period to be 

subsequently determined by the Speaker, in each case for consideration 

of such provisions as fall within the jurisdiction of the committee concerned 

A BILL 

To improve assistance provided by the Hollings Manufacturing Extension Partnership to small manufacturers in 

the defense industrial supply chain on matters relating 

to cybersecurity, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Enhance Cybersecurity 

5 for Small Manufacturers Act of 2018’’. 


SSpencer on DSKBBXCHB2PROD with BILLS
2 

•HR 5517 IH

1 SEC. 2. FINDINGS. 

2 Congress finds the following: 

3 (1) According to the Bureau of Labor Statis4 tics, there are more than 347,000 manufacturing es5 tablishments in the United States, of which 72 per6 cent have fewer than 20 employees and 99 percent 

7 have fewer than 500 employees. 

8 (2) Independent studies from the National De9 fense Industry Association, the Defense Science 

10 Board, the Alliance for Manufacturing Foresight, 

11 and the McKinsey Global Institute have high12 lighted— 

13 (A) the centrality of small manufacturers 

14 to United States manufacturing supply chains 

15 for domestic economic growth; 

16 (B) the vulnerability of such manufactur17 ers to the defense industrial base for national 

18 security; and 

19 (C) the vulnerability of such manufacturers 

20 to cybersecurity threats and breaches. 

21 (3) As of December 31, 2017, Department of 

22 Defense suppliers must comply with new, tougher 

23 cybersecurity requirements to ensure adequate secu24 rity to protect controlled unclassified information 

25 relevant to defense manufacturing supply chains. 

26 The requirements call for defense suppliers to impleVerDate Sep 11 2014 02:07 Apr 18, 2018 Jkt 079200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H5517.IH H5517

SSpencer on DSKBBXCHB2PROD with BILLS
3 

•HR 5517 IH

1 ment and create a plan of action to respond to the 

2 guidance developed by the National Institute of 

3 Standards and Technology. 

4 (4) The Department of Commerce has found 

5 significant cybersecurity vulnerability of small manu6 facturers. A survey of 9,000 contract facilities docu7 mented that 6,650 small facilities lagged behind me8 dium and large firms across a broad range of 20 cy9 bersecurity indicators. For several indicators, fewer 

10 than half of small firms had cybersecurity measures 

11 in place. 

12 (5) Over the past 5 years the national network 

13 of centers operating as part of the Hollings Manu14 facturing Extension Partnership has worked closely 

15 with the Department of Defense to bolster the resil16 ience of the defense industrial base supply chain. 

17 Since 2013, such centers have completed more than 

18 2,500 projects with 1,650 companies that are sup19 pliers to the Department of Defense. 

20 (6) In 2017, the Hollings Manufacturing Ex21 tension Partnership interacted with more than 1,000 

22 small manufacturers on the cybersecurity require23 ments of the Department of Defense. This work by 

24 the Hollings Manufacturing Extension Partnership 

25 has revealed a significant lack of awareness of the 


SSpencer on DSKBBXCHB2PROD with BILLS
4 

•HR 5517 IH

1 Department of Defense cybersecurity requirements 

2 and a deficiency of financial and technical resources 

3 required to manage cybersecurity risks. If cybersecu4 rity vulnerabilities remain unaddressed, defense sup5 ply chains face a higher likelihood of serious and ex6 ploitable vulnerabilities, as well as a substantial re7 duction in the number of suppliers compliant with 

8 Department of Defense requirements, and thereby 

9 ineligible to provide products and services to the De10 partment of Defense. 

11 (7) The Hollings Manufacturing Extension 

12 Partnership is well positioned to aid suppliers of the 

13 Department of Defense in complying with cybersecu14 rity requirements of the Department to ensure ade15 quate security to protect controlled unclassified in16 formation relevant to defense manufacturing supply 

17 chains. 

18 SEC. 3. ASSISTANCE FOR SMALL MANUFACTURERS IN THE 

19 DEFENSE INDUSTRIAL SUPPLY CHAIN ON 

20 MATTERS RELATING TO CYBERSECURITY. 

21 (a) DEFINITIONS.—In this section: 

22 (1) CENTER.—The term ‘‘Center’’ has the 

23 meaning given such term in section 25(a) of the Na24 tional Institute of Standards and Technology Act 

25 (15 U.S.C. 278k(a)). 


SSpencer on DSKBBXCHB2PROD with BILLS
5 

•HR 5517 IH

1 (2) DIRECTOR.—The term ‘‘Director’’ means 

2 the Director of the National Institute of Standards 

3 and Technology. 

4 (3) RESOURCES.—The term ‘‘resources’’ means 

5 guidelines, tools, best practices, standards, meth6 odologies, and other ways of providing information. 

7 (4) SMALL BUSINESS CONCERN.—The term 

8 ‘‘small business concern’’ means a small business 

9 concern as that term is used in section 3 of the 

10 Small Business Act (15 U.S.C. 632). 

11 (5) SMALL MANUFACTURER.—The term ‘‘small 

12 manufacturer’’ means a small business concern that 

13 is a manufacturer. 

14 (6) STATE.—The term ‘‘State’’ means each of 

15 the several States, Territories, and possessions of 

16 the United States, the District of Columbia, and the 

17 Commonwealth of Puerto Rico. 

18 (b) DISSEMINATION OF CYBERSECURITY RE19 SOURCES.— 

20 (1) IN GENERAL.—The Director of the National 

21 Institute of Standards and Technology, in partner22 ship with the Secretary of Defense and acting 

23 through the Hollings Manufacturing Extension Part24 nership, shall take such actions as may be necessary 

25 to address a widespread lack of awareness of cyberVerDate Sep 11 2014 02:07 Apr 18, 2018 Jkt 079200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H5517.IH H5517

SSpencer on DSKBBXCHB2PROD with BILLS
6 

•HR 5517 IH

1 security threats among small manufacturers in the 

2 defense industrial supply chain. 

3 (2) NATIONAL REACH.—The Director shall en4 sure that efforts to increase awareness under para5 graph (1) are carried out in each State, by dissemi6 nating clear and concise resources to help reduce cy7 bersecurity risks faced by small manufacturers de8 scribed in paragraph (1). 

9 (3) SECTOR FOCUS.—The Director shall carry 

10 out this subsection with a focus on such industry 

11 sectors as the Director considers critical, in con12 sultation with the Secretary of Defense. 

13 (4) OUTREACH EVENTS.—Under paragraph (1), 

14 the Director shall conduct outreach. Such outreach 

15 may include live events with a physical presence and 

16 outreach conducted through Internet websites. 

17 (c) VOLUNTARY CYBERSECURITY SELF-ASSESS18 MENTS.—The Director shall provide, through the Hollings 

19 Manufacturing Extension Partnership, assistance to help 

20 small manufacturers conduct voluntary self-assessments in 

21 order to understand operating environments, cybersecurity 

22 requirements, and existing vulnerabilities. 

23 (d) TRANSFER OF RESEARCH FINDINGS AND EXPER24 TISE.— 


SSpencer on DSKBBXCHB2PROD with BILLS
7 

•HR 5517 IH

1 (1) IN GENERAL.—The Director shall provide 

2 for the transfer of technology and techniques devel3 oped at the National Institute of Standards and 

4 Technology to Centers, and through such Centers, to 

5 small manufacturers throughout the United States 

6 to implement security measures that are adequate to 

7 protect covered defense information, including con8 trolled unclassified information. 

9 (2) USE OF OTHER FEDERAL EXPERTISE AND

10 CAPABILITIES.—The Director shall use, when appro11 priate, the expertise and capabilities that exist in 

12 Federal agencies other than the Institute, and feder13 ally sponsored laboratories. 

14 (3) AGREEMENTS.—In carrying out this sub15 section, the Centers may enter into agreements with 

16 private industry, institutes of higher education, or a 

17 State, United States territory, local, or tribal gov18 ernment to ensure breadth and depth of coverage to 

19 the United States defense industrial base and to le20 verage resources. 

21 (e) DEFENSE ACQUISITION WORKFORCE CYBER

22 TRAINING PROGRAM.—The Secretary of Defense, in con23 sultation with the Director, shall establish a cyber coun24 seling certification program, or approve a similar existing 

25 program, to certify small business professionals and other 


SSpencer on DSKBBXCHB2PROD with BILLS
8 

•HR 5517 IH

1 relevant acquisition staff within the Department of De2 fense to provide cyber planning assistance to small manu3 facturers in the defense industrial supply chain. 

Æ 


SSpencer on DSKBBXCHB2PROD with BILLS