Small Business Advanced Cybersecurity Enhancements Act of 2021

To amend the Small Business Act to provide for the establishment of an enhanced cybersecurity assistance and protections for small businesses, and for other purposes. 1. Short title This Act may be cited as the Small Business Advanced Cybersecurity Enhancements Act of 2021 2. Enhanced cybersecurity assistance and protections for small businesses Section 21(a) of the Small Business Act ( 15 U.S.C. 648(a) (9) Small business cybersecurity assistance and protections (A) Establishment of small business cybersecurity assistance units The Administrator of the Small Business Administration, in coordination with the Secretary of Commerce, and in consultation with the Secretary of Homeland Security and the Attorney General, shall establish— (i) in the Administration, a central small business cybersecurity assistance unit; and (ii) within each small business development center, a regional small business cybersecurity assistance unit. (B) Duties of the central small business cybersecurity assistance unit (i) In general The central small business cybersecurity assistance unit established under subparagraph (A)(i) shall serve as the primary interface for small business concerns to receive and share cyber threat indicators and defensive measures with the Federal Government. (ii) Use of capability and processes The central small business cybersecurity assistance unit shall use the capability and process certified pursuant to section 105(c)(2)(A) of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1504(c)(2)(A) (iii) Application of CISA A small business concern that receives or shares cyber threat indicators and defensive measures with the Federal Government through the central small business cybersecurity assistance unit established under subparagraph (A)(i), or with any appropriate entity pursuant to section 103(c) of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1503(c) (C) Relation to NCCIC (i) Central small business cybersecurity assistance unit The central small business cybersecurity assistance unit established under subparagraph (A)(i) shall be collocated with the national cybersecurity and communications integration center. (ii) Access to information The national cybersecurity and communications integration center shall have access to all cyber threat indicators or defensive measures shared with the central small cybersecurity assistance unit established under subparagraph (A)(i) through the use of the capability and process described in subparagraph (B)(ii). (D) Cybersecurity assistance for small businesses The central small business cybersecurity assistance unit established under subparagraph (A)(i) shall— (i) work with each regional small business cybersecurity assistance unit established under subparagraph (A)(ii) to provide cybersecurity assistance to small business concerns; (ii) leverage resources from the Administration, the Department of Commerce, the Department of Homeland Security, the Department of Justice, the Department of the Treasury, the Department of State, and any other Federal department or agency the Administrator determines appropriate, in order to help improve the cybersecurity posture of small business concerns; (iii) coordinate with the Department of Homeland Security to identify and disseminate information to small business concerns in a form that is accessible and actionable by small business concerns; (iv) coordinate with the National Institute of Standards and Technology to identify and disseminate information to small business concerns on the most cost-effective methods for implementing elements of the cybersecurity framework of the National Institute of Standards and Technology applicable to improving the cybersecurity posture of small business concerns; (v) seek input from the Office of Advocacy of the Administration to ensure that any policies or procedures adopted by any department, agency, or instrumentality of the Federal Government do not unduly add regulatory burdens to small business concerns in a manner that will hamper the improvement of the cybersecurity posture of such small business concerns; and (vi) leverage resources and relationships with representatives and entities involved in the national cybersecurity and communications integration center to publicize the capacity of the Federal Government to assist small business concerns in improving cybersecurity practices. (E) Enhanced cybersecurity protections for small businesses (i) In general Notwithstanding any other provision of law, no cause of action shall lie or be maintained in any court against any small business concern, and such action shall be promptly dismissed, if such action is related to or arises out of— (I) any activity authorized under this paragraph or the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 et seq. (II) any action or inaction in response to any cyber threat indicator, defensive measure, or other information shared or received pursuant to this paragraph or the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 et seq. (ii) Application The exception provided in section 105(d)(5)(D)(ii)(I) of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1504(d)(5)(D)(ii)(I) 6 U.S.C. 1501 et seq. (iii) Rule of construction Nothing in this subparagraph shall be construed to affect the applicability or merits of any defense, motion, or argument in any cause of action in a court brought against an entity that is not a small business concern. (F) Definitions In this paragraph: (i) CISA definitions The terms cyber threat indicator defensive measure 6 U.S.C. 1501 (ii) National cybersecurity and communications integration center The term national cybersecurity and communications integration center 6 U.S.C. 148 . 3. Prohibition on new appropriations (a) In general No additional funds are authorized to be appropriated to carry out this Act and the amendments made by this Act. (b) Existing funding This Act and the amendments made by this Act shall be carried out using amounts made available under section 21(a)(4)(C)(viii) of the Small Business Act ( 15 U.S.C. 648(a)(4)(viii) (c) Technical and conforming amendment Section 21(a)(4)(C)(viii) of the Small Business Act (15 U.S.C.648(a)(4)(C)(viii)) is amended to read as follows: (viii) Limitation (I) Cybersecurity assistance From the funds appropriated pursuant to clause (vii), the Administration shall reserve not less than $1,000,000 in each fiscal year to develop cybersecurity assistance units at small business development centers under paragraph (9). (II) Portable assistance (aa) In general Any funds appropriated pursuant to clause (vii) that are remaining after reserving amounts under subclause (I) may be used for portable assistance for startup and sustainability non-matching grant programs to be conducted by eligible small business development centers in communities that are economically challenged as a result of a business or government facility down sizing or closing, which has resulted in the loss of jobs or small business instability. (bb) Grant amount and use A non-matching grant under this subclause shall not exceed $100,000, and shall be used for small business development center personnel expenses and related small business programs and services. . October 12, 2021 Committed to the Committee of the Whole House on the State of the Union and ordered to be printed

Summary: Small Business Advanced Cybersecurity Enhancements Act of 2021 This bill requires the Small Business Administration (SBA) to establish a central small business cybersecurity-assistance unit within the SBA and a regional cybersecurity-assistance unit within each small business development center. These units shall serve as the primary means for a small business to communicate cyber threats and defensive measures with the federal government, and the bill prohibits any cause of action against a small business for such communication or for any conduct in response to such communication.