I 
114TH CONGRESS 
2D SESSION 
H. R. 5064 
To amend the Small Business Act to allow small business development centers 
to assist and advise small business concerns on relevant cyber security 
matters, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 26, 2016 
Mr. HANNA (for himself, Mr. KILMER, Ms. STEFANIK, Ms. CLARKE of New 
York, Mr. CHABOT, Ms. MENG, Mr. KNIGHT, Mr. LOUDERMILK, Mr. 
PAYNE, Ms. VELA´ZQUEZ, Mr. RENACCI, Mr. CURBELO of Florida, and 
Mr. CARNEY) introduced the following bill; which was referred to the 
Committee on Small Business, and in addition to the Committee on 
Homeland Security, for a period to be subsequently determined by the 
Speaker, in each case for consideration of such provisions as fall within 
the jurisdiction of the committee concerned 
A BILL 
To amend the Small Business Act to allow small business 
development centers to assist and advise small business 
concerns on relevant cyber security matters, and for 
other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Improving Small Busi-
ness Cyber Security Act of 2016’’. 
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS
SEC. 2. ROLE OF SMALL BUSINESS DEVELOPMENT CEN-
TERS IN CYBER SECURITY AND PREPARED-
NESS. 
Section 21 of the Small Business Act (15 U.S.C. 648) 
is amended— 
(1) in subsection (a)(1), by striking ‘‘and pro-
viding access to business analysts who can refer 
small business concerns to available experts:’’ and 
inserting ‘‘providing access to business analysts who 
can refer small business concerns to available ex-
perts; and, to the extent practicable, providing as-
sistance in furtherance of the Small Business Devel-
opment Center Cyber Strategy developed under sec-
tion 5(b) of the Improving Small Business Cyber Se-
curity Act of 2016:’’; and 
(2) in subsection (c)— 
(A) in paragraph (2)— 
(i) in subparagraph (E), by striking 
‘‘and’’ at the end; 
(ii) in subparagraph (F), by striking 
the period and inserting ‘‘; and’’; and 
(iii) by adding at the end of the fol-
lowing: 
‘‘(G) access to cyber security specialists to 
counsel, assist, and inform small business concern 
clients, in furtherance of the Small Business Devel-
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS
opment Center Cyber Strategy developed under sec-
tion 5(b) of the Improving Small Business Cyber Se-
curity Act of 2016.’’. 
SEC. 3. ADDITIONAL CYBER SECURITY ASSISTANCE FOR 
SMALL BUSINESS DEVELOPMENT CENTERS. 
Section 21(a) of the Small Business Act (15 U.S.C. 
648(a)) is amended by adding at the end the following: 
‘‘(8) CYBER SECURITY ASSISTANCE.—The De-
partment of Homeland Security, and any other Fed-
eral department or agency in coordination with the 
Department of Homeland Security, may provide as-
sistance to small business development centers, 
through the dissemination of cyber security risk in-
formation and other homeland security information, 
to help small business concerns in developing or en-
hancing cyber security infrastructure, cyber threat 
awareness, and cyber training programs for employ-
ees.’’. 
SEC. 4. CYBER SECURITY OUTREACH FOR SMALL BUSINESS 
DEVELOPMENT CENTERS. 
Section 227 of the Homeland Security Act of 2002 
(6 U.S.C. 148) is amended— 
(1) by redesignating subsection (l) as subsection 
(m); and 
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS
(2) by inserting after subsection (k) the fol-
lowing: 
‘‘(l) CYBER SECURITY OUTREACH.— 
‘‘(1) IN GENERAL.—The Secretary may provide 
assistance to small business development centers, 
through the dissemination of cyber security risk in-
formation and other homeland security information, 
to help small business concerns in developing or en-
hancing cyber security infrastructure, cyber threat 
awareness, and cyber training programs for employ-
ees. 
‘‘(2) DEFINITIONS.—For purposes of this sub-
section, the terms ‘small business concern’ and 
‘small business development center’ have the mean-
ing given such terms, respectively, under section 3 of 
the Small Business Act.’’. 
SEC. 5. GAO STUDY ON SMALL BUSINESS CYBER SUPPORT 
SERVICES AND SMALL BUSINESS DEVELOP-
MENT CENTER CYBER STRATEGY. 
(a) REVIEW
OF CURRENT CYBER SECURITY RE-
SOURCES.— 
(1) IN GENERAL.—The Comptroller General of 
the United States shall conduct a review of current 
cyber security resources at the Federal level aimed 
at assisting small business concerns with developing 
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS
or enhancing cyber security infrastructure, cyber 
threat awareness, or cyber training programs for 
employees. 
(2) CONTENT.—The review required under 
paragraph (1) shall include the following: 
(A) An accounting and description of all 
Federal Government programs, projects, and 
activities that currently provide assistance to 
small business concerns in developing or en-
hancing cyber security infrastructure, cyber 
threat awareness, or cyber training programs 
for employees. 
(B) An assessment of how widely utilized 
the resources described under subparagraph (A) 
are by small business concerns and a review of 
whether or not such resources are duplicative of 
other programs and structured in a manner 
that makes them accessible to and supportive of 
small business concerns. 
(3) REPORT.—The Comptroller General shall 
issue a report to the Congress, the Small Business 
Administrator, the Secretary of Homeland Security, 
and any association recognized under section 
21(a)(3)(A) of the Small Business Act containing all 
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS
findings and determinations made in carrying out 
the review required under paragraph (1). 
(b) SMALL
BUSINESS
DEVELOPMENT
CENTER 
CYBER STRATEGY.— 
(1) IN GENERAL.—Not later than 90 days after 
the issuance of the report under subsection (a)(3), 
the Small Business Administrator and the Secretary 
of Homeland Security shall work collaboratively to 
develop a Small Business Development Center Cyber 
Strategy. 
(2) CONSULTATION.—In developing the strat-
egy under this subsection, the Small Business Ad-
ministrator and the Secretary of Homeland Security 
shall consult with entities representing the concerns 
of small business development centers, including any 
association recognized under section 21(a)(3)(A) of 
the Small Business Act. 
(3) CONTENT.—The strategy required under 
paragraph (1) shall include, at minimum, the fol-
lowing: 
(A) Plans for incorporating small business 
development centers (SBDCs) into existing 
cyber programs to enhance services and stream-
line cyber assistance to small business concerns. 
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS
(B) To the extent practicable, methods for 
the provision of counsel and assistance to im-
prove a small business concern’s cyber security 
infrastructure, cyber threat awareness, and 
cyber training programs for employees, includ-
ing— 
(i) working to ensure individuals are 
aware of best practices in the areas of 
cyber security, cyber threat awareness, and 
cyber training; 
(ii) working with individuals to de-
velop cost-effective plans for implementing 
best practices in these areas; 
(iii) entering into agreements, where 
practical, with Information Sharing and 
Analysis Centers or similar cyber informa-
tion sharing entities to gain an awareness 
of actionable threat information that may 
be beneficial to small business concerns; 
and 
(iv) providing referrals to area special-
ists when necessary. 
(C) An analysis of— 
(i) how Federal Government pro-
grams, projects, and activities identified by 
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS
the Comptroller General in the report 
issued under subsection (a)(1) can be le-
veraged by SBDCs to improve access to 
high-quality cyber support for small busi-
ness concerns; 
(ii) additional resources SBDCs may 
need to effectively carry out their role; and 
(iii) how SBDCs can leverage existing 
partnerships and develop new ones with 
Federal, State, and local government enti-
ties as well as private entities to improve 
the quality of cyber support services to 
small business concerns. 
(4) DELIVERY OF STRATEGY.—Not later than 
180 days after the issuance of the report under sub-
section (a)(3), the Small Business Development Cen-
ter Cyber Strategy shall be issued to the Committees 
on Homeland Security and Small Business of the 
House of Representatives and the Committees on 
Homeland Security and Governmental Affairs and 
Small Business and Entrepreneurship of the Senate. 
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS
SEC. 6. PROHIBITION ON ADDITIONAL FUNDS. 
No additional funds are authorized to be appro-
priated to carry out this Act or the amendments made 
by this Act. 
Æ 
VerDate Sep 11 2014 
03:07 May 03, 2016
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H5064.IH
H5064
emcdonald on DSK67QTVN1PROD with BILLS