‘‘(G) access to cyber security specialists to 
counsel, assist, and inform small business concern 
clients, in furtherance of the Small Business Devel-
opment Center Cyber Strategy developed under sec-
tion 5(b) of the Improving Small Business Cyber Se-
curity Act of 2016.’’. 
SEC. 3. ADDITIONAL CYBER SECURITY ASSISTANCE FOR 
SMALL BUSINESS DEVELOPMENT CENTERS. 
Section 21(a) of the Small Business Act (15 U.S.C. 
648(a)) is amended by adding at the end the following: 
‘‘(8) CYBER SECURITY ASSISTANCE.—The De-
partment of Homeland Security, and any other Fed-
eral department or agency in coordination with the 
Department of Homeland Security, may leverage 
small business development centers to provide assist-
ance to small businesses by disseminating cyber se-
curity risk information and other homeland security 
information to help small business concerns in devel-
oping or enhancing cyber security infrastructure, 
cyber threat awareness, and cyber training programs 
for employees.’’. 
SEC. 4. CYBER SECURITY OUTREACH FOR SMALL BUSINESS 
DEVELOPMENT CENTERS. 
Section 227 of the Homeland Security Act of 2002 
(6 U.S.C. 148) is amended—
(1) by redesignating subsection (l) as subsection 
(m); and 
(2) by inserting after subsection (k) the fol-
lowing: 
‘‘(l) CYBERSECURITY OUTREACH.— 
‘‘(1) IN GENERAL.—The Secretary may lever-
age small business development centers to provide 
assistance to small business concerns by dissemi-
nating information on cyber threat indicators, defen-
sive measures, cybersecurity risks, incidents, anal-
yses, and warnings to help small business concerns 
in developing or enhancing cybersecurity infrastruc-
ture, cyber threat awareness, and cyber training pro-
grams for employees. 
‘‘(2) DEFINITIONS.—For purposes of this sub-
section, the terms ‘small business concern’ and 
‘small business development center’ have the mean-
ing given such terms, respectively, under section 3 of 
the Small Business Act.’’. 
SEC. 5. GAO STUDY ON SMALL BUSINESS CYBER SUPPORT 
SERVICES AND SMALL BUSINESS DEVELOP-
MENT CENTER CYBER STRATEGY. 
(a) REVIEW
OF CURRENT CYBER SECURITY RE-
SOURCES.—
(1) IN GENERAL.—The Comptroller General of 
the United States shall conduct a review of current 
cyber security resources at the Federal level aimed 
at assisting small business concerns with developing 
or enhancing cyber security infrastructure, cyber 
threat awareness, or cyber training programs for 
employees. 
(2) CONTENT.—The review required under 
paragraph (1) shall include the following: 
(A) An accounting and description of all 
Federal Government programs, projects, and 
activities that currently provide assistance to 
small business concerns in developing or en-
hancing cyber security infrastructure, cyber 
threat awareness, or cyber training programs 
for employees. 
(B) An assessment of how widely utilized 
the resources described under subparagraph (A) 
are by small business concerns and a review of 
whether or not such resources are duplicative of 
other programs and structured in a manner 
that makes them accessible to and supportive of 
small business concerns. 
(3) REPORT.—The Comptroller General shall 
issue a report to the Congress, the Administrator of
the Small Business Administration, the Secretary of 
Homeland Security, and any association recognized 
under section 21(a)(3)(A) of the Small Business Act 
containing all findings and determinations made in 
carrying out the review required under paragraph 
(1). 
(b) SMALL
BUSINESS
DEVELOPMENT
CENTER 
CYBER STRATEGY.— 
(1) IN GENERAL.—Not later than 90 days after 
the issuance of the report under subsection (a)(3), 
the Administrator of the Small Business Administra-
tion and the Secretary of Homeland Security shall 
work collaboratively to develop a Small Business De-
velopment Center Cyber Strategy. 
(2) CONSULTATION.—In developing the strat-
egy under this subsection, the Administrator of the 
Small Business Administration and the Secretary of 
Homeland Security shall consult with entities rep-
resenting the concerns of small business development 
centers, including any association recognized under 
section 21(a)(3)(A) of the Small Business Act. 
(3) CONTENT.—The strategy required under 
paragraph (1) shall include, at minimum, the fol-
lowing:
(A) Plans for leveraging small business de-
velopment centers (SBDCs) to access existing 
cyber programs of the Department of Home-
land Security and other appropriate Federal 
agencies to enhance services and streamline 
cyber assistance to small business concerns. 
(B) To the extent practicable, methods for 
the provision of counsel and assistance to im-
prove a small business concern’s cyber security 
infrastructure, cyber threat awareness, and 
cyber training programs for employees, includ-
ing— 
(I) working to ensure individuals are 
aware of best practices in the areas of 
cyber security, cyber threat awareness, and 
cyber training; 
(ii) working with individuals to de-
velop cost-effective plans for implementing 
best practices in these areas; 
(iii) entering into agreements, where 
practical, with Information Sharing and 
Analysis Centers or similar cyber informa-
tion sharing entities to gain an awareness 
of actionable threat information that may
be beneficial to small business concerns; 
and 
(iv) providing referrals to area special-
ists when necessary. 
(c) An analysis of— 
(I) how Federal Government pro-
grams, projects, and activities identified by 
the Comptroller General in the report 
issued under subsection (a)(1) can be le-
veraged by SBDCs to improve access to 
high-quality cyber support for small busi-
ness concerns; 
(ii) additional resources SBDCs may 
need to effectively carry out their role; and 
(iii) how SBDCs can leverage existing 
partnerships and develop new ones with 
Federal, State, and local government enti-
ties as well as private entities to improve 
the quality of cyber support services to 
small business concerns. 
(4) DELIVERY OF STRATEGY.—Not later than 
180 days after the issuance of the report under sub-
section (a)(3), the Small Business Development Cen-
ter Cyber Strategy shall be issued to the Committees 
on Homeland Security and Small Business of the