Small Businesses Cybersecurity Act

To provide cybersecurity support for small business concerns through the small business development center program, and for other purposes. 1. Short title This Act may be cited as the Small Businesses Cybersecurity Act 2. Small Business Cybersecurity Grants Section 21 of the Small Business Act ( 15 U.S.C. 648 (o) Cybersecurity Grants (1) Definitions In this section: (A) Rural area The term rural area 7 U.S.C. 1991(a) (B) Small State The term small State (C) State The term State (2) Grants (A) In general The Administrator shall establish a grant program under which the Administrator may award grants on a noncompetitive basis to small business development centers to support the cybersecurity needs of the small business concerns served by the small business development centers. (B) Grant criteria In awarding grants under this subsection, the Administrator may consider the following criteria: (i) The plan of the small business development center for the use of the grant funds, including how funds would benefit small business concerns in rural areas. (ii) Evidence submitted by the small business development center that the grant would increase the cybersecurity of the small business concerns that the small business development center serves, including evidence of past success in offering cybersecurity support to small business concerns. (C) Applications To be eligible for a grant under this subsection, a small business development center shall submit to the Administrator an application in such form, at such time, and containing such information as the Administrator determines is appropriate. (D) Use of Funds A small business development center may use amounts received under a grant under this subsection to support the cybersecurity of the small business concerns served by the small business development center, including— (i) cybersecurity training for employees of the small business concerns; (ii) reviews of the cybersecurity policies, plans, and procedures used by the small business concerns, including tabletop exercises to test the policies, plans, and procedures; (iii) testing of the cybersecurity standing of the small business concerns, including via penetration testing; and (iv) hiring consultants to support the cybersecurity needs of the small business concerns. (E) Grant Amount (i) Formula The Administrator shall establish a 3-tier formula for grant funding distribution based on the locations of small business development centers in one of the following categories: (I) Small States. (II) Medium-sized States, as defined by the Administrator. (III) Large States, as defined by the Administrator. (ii) Maximum Amount The maximum amount of a grant under this subsection shall be, for a small business development center located in— (I) a small State, $200,000; (II) a medium-sized State, $300,000; or (III) a large State, $400,000. (F) Duration of Grant The period of a grant under this subsection shall be 1 fiscal year. (G) Announcement of Grant Program The Administrator shall make widely available to the public information on the grant program under this subsection. (3) Authorization of appropriations There are authorized to be appropriated to carry out this subsection $20,000,000 for fiscal year 2023 and each fiscal year thereafter, to remain available until expended. .

Summary: Small Businesses Cybersecurity Act This bill authorizes the Small Business Administration (SBA) to award grants to Small Business Development Centers (SBDCs) to support the cybersecurity needs of the small businesses served by an SBDC. SBDCs provide counseling and training to small businesses, including working with the SBA to develop and provide informational tools to support business start-ups and existing business expansion.