(8) The Better Business Bureau found that 
half of small businesses could remain profitable for 
only one month if they lost essential data. 
(9) Cyber crime is growing rapidly and the an-
nual costs to the global economy are estimated to 
reach over $2,000,000,000,000 by 2019. 
(10) Cybersecurity is a global challenge where 
the security threat, attacks, and techniques contin-
ually evolve and no company, individual, or Federal 
agency is immune from these threats. 
(11) Strong collaboration between the public 
and private sector is essential in the fight against 
cyber crime. 
(12) There is a reluctance among small busi-
nesses to voluntarily share information with govern-
ment entities, and the Federal Government should 
work proactively to incentivize and encourage vol-
untary information sharing to improve the Nation’s 
cybersecurity posture. 
SEC. 3. ENHANCED CYBERSECURITY ASSISTANCE AND PRO-
TECTIONS FOR SMALL BUSINESSES. 
Section 21(a) of the Small Business Act (15 U.S.C. 
648(a)) is amended by adding at the end the following 
new paragraph: 
VerDate Sep 11 2014 
03:53 Mar 22, 2019
Jkt 089200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1648.IH
H1648
kjohnson on DSK79L0C42 with BILLS
‘‘(9) SMALL BUSINESS CYBERSECURITY ASSIST-
ANCE AND PROTECTIONS.— 
‘‘(A) ESTABLISHMENT
OF
SMALL
BUSI-
NESS
CYBERSECURITY
ASSISTANCE
UNITS.— 
The Administrator of the Small Business Ad-
ministration, in coordination with the Secretary 
of Commerce, and in consultation with the Sec-
retary of Homeland Security and the Attorney 
General, shall establish— 
‘‘(i) in the Administration, a central 
small business cybersecurity assistance 
unit; and 
‘‘(ii) within each small business devel-
opment center, a regional small business 
cybersecurity assistance unit. 
‘‘(B) DUTIES
OF
THE
CENTRAL
SMALL 
BUSINESS CYBERSECURITY ASSISTANCE UNIT.— 
‘‘(i) IN GENERAL.—The central small 
business cybersecurity assistance unit es-
tablished under subparagraph (A)(i) shall 
serve as the primary interface for small 
business concerns to receive and share 
cyber threat indicators and defensive meas-
ures with the Federal Government. 
VerDate Sep 11 2014 
03:53 Mar 22, 2019
Jkt 089200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1648.IH
H1648
kjohnson on DSK79L0C42 with BILLS
‘‘(ii) USE OF CAPABILITY AND PROC-
ESSES.—The central small business cyber-
security assistance unit shall use the capa-
bility and process certified pursuant to sec-
tion 105(c)(2)(A) of the Cybersecurity In-
formation Sharing Act of 2015 (6 U.S.C. 
1504(c)(2)(A)) to receive cyber threat indi-
cators or defensive measures from small 
business concerns. 
‘‘(iii) APPLICATION OF CISA.—A small 
business concern that receives or shares 
cyber threat indicators and defensive meas-
ures with the Federal Government through 
the central small business cybersecurity as-
sistance unit established under subpara-
graph (A)(i), or with any appropriate enti-
ty pursuant to section 103(c) of the Cyber-
security Information Sharing Act of 2015 
(6 U.S.C. 1503(c)), shall receive the pro-
tections and exemptions provided in such 
Act and this paragraph. 
‘‘(C) RELATION TO NCCIC.— 
‘‘(i) CENTRAL
SMALL
BUSINESS
CY-
BERSECURITY
ASSISTANCE
UNIT.—The 
central small business cybersecurity assist-
VerDate Sep 11 2014 
03:53 Mar 22, 2019
Jkt 089200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1648.IH
H1648
kjohnson on DSK79L0C42 with BILLS
ance unit established under subparagraph 
(A)(i) shall be collocated with the national 
cybersecurity and communications integra-
tion center. 
‘‘(ii) ACCESS TO INFORMATION.—The 
national cybersecurity and communications 
integration center shall have access to all 
cyber threat indicators or defensive meas-
ures shared with the central small cyberse-
curity assistance unit established under 
subparagraph (A)(i) through the use of the 
capability and process described in sub-
paragraph (B)(ii). 
‘‘(D) CYBERSECURITY
ASSISTANCE
FOR 
SMALL BUSINESSES.—The central small busi-
ness cybersecurity assistance unit established 
under subparagraph (A)(i) shall— 
‘‘(i) work with each regional small 
business cybersecurity assistance unit es-
tablished under subparagraph (A)(ii) to 
provide cybersecurity assistance to small 
business concerns; 
‘‘(ii) leverage resources from the Ad-
ministration, the Department of Com-
merce, the Department of Homeland Secu-
VerDate Sep 11 2014 
03:53 Mar 22, 2019
Jkt 089200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1648.IH
H1648
kjohnson on DSK79L0C42 with BILLS
rity, the Department of Justice, the De-
partment of the Treasury, the Department 
of State, and any other Federal depart-
ment or agency the Administrator deter-
mines appropriate, in order to help im-
prove the cybersecurity posture of small 
business concerns; 
‘‘(iii) coordinate with the Department 
of Homeland Security to identify and dis-
seminate information to small business 
concerns in a form that is accessible and 
actionable by small business concerns; 
‘‘(iv) coordinate with the National In-
stitute of Standards and Technology to 
identify and disseminate information to 
small business concerns on the most cost- 
effective methods for implementing ele-
ments of the cybersecurity framework of 
the National Institute of Standards and 
Technology applicable to improving the cy-
bersecurity posture of small business con-
cerns; 
‘‘(v) seek input from the Office of Ad-
vocacy of the Administration to ensure 
that any policies or procedures adopted by 
VerDate Sep 11 2014 
03:53 Mar 22, 2019
Jkt 089200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1648.IH
H1648
kjohnson on DSK79L0C42 with BILLS
any department, agency, or instrumentality 
of the Federal Government do not unduly 
add regulatory burdens to small business 
concerns in a manner that will hamper the 
improvement of the cybersecurity posture 
of such small business concerns; and 
‘‘(vi) leverage resources and relation-
ships with representatives and entities in-
volved in the national cybersecurity and 
communications integration center to pub-
licize the capacity of the Federal Govern-
ment to assist small business concerns in 
improving cybersecurity practices. 
‘‘(E) ENHANCED CYBERSECURITY PROTEC-
TIONS FOR SMALL BUSINESSES.— 
‘‘(i) IN
GENERAL.—Notwithstanding 
any other provision of law, no cause of ac-
tion shall lie or be maintained in any court 
against any small business concern, and 
such action shall be promptly dismissed, if 
such action related to or arises out of— 
‘‘(I) 
any 
activity 
authorized 
under this paragraph or the Cyberse-
curity Information Sharing Act of 
2015 (6 U.S.C. 1501 et seq.); or 
VerDate Sep 11 2014 
03:53 Mar 22, 2019
Jkt 089200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1648.IH
H1648
kjohnson on DSK79L0C42 with BILLS