Small Businesses Cybersecurity Act
Bill: S.4701 | Sponsor: Sen. Hassan, Margaret Wood (D-NH)
Policy area: Commerce

Summary:
Small Businesses Cybersecurity Act
This bill authorizes the Small Business Administration (SBA) to award grants to Small Business Development Centers (SBDCs) to support the cybersecurity needs of the small businesses served by an SBDC. SBDCs provide counseling and training to small businesses, including working with the SBA to develop and provide informational tools to support business start-ups and existing business expansion.

To provide cybersecurity support for small business concerns through 
 the small business development center program, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Small Businesses Cybersecurity 
Act''.

SEC. 2. SMALL BUSINESS CYBERSECURITY GRANTS.

    Section 21 of the Small Business Act (15 U.S.C. 648) is amended by 
adding at the end the following:
    ``(o) Cybersecurity Grants.--
            ``(1) Definitions.--In this section:
                    ``(A) Rural area.--The term `rural area' has the 
                meaning given the term in section 343(a) of the 
                Consolidated Farm and Rural Development Act (7 U.S.C. 
                1991(a)).
                    ``(B) Small state.--The term `small State' means 
                any State that is minimally funded by the funding 
                formula of the Small Business Development Center 
                Program under subsection (a)(4)(C).
                    ``(C) State.--The term `State' means each of the 
                several States, the District of Columbia, and any 
                territory or possession of the United States.
            ``(2) Grants.--
                    ``(A) In general.--The Administrator shall 
                establish a grant program under which the Administrator 
                may award grants on a noncompetitive basis to small 
                business development centers to support the 
                cybersecurity needs of the small business concerns 
                served by the small business development centers.
                    ``(B) Grant criteria.--In awarding grants under 
                this subsection, the Administrator may consider the 
                following criteria:
                            ``(i) The plan of the small business 
                        development center for the use of the grant 
                        funds, including how funds would benefit small 
                        business concerns in rural areas.
                            ``(ii) Evidence submitted by the small 
                        business development center that the grant 
                        would increase the cybersecurity of the small 
                        business concerns that the small business 
                        development center serves, including evidence 
                        of past success in offering cybersecurity 
                        support to small business concerns.
                    ``(C) Applications.--To be eligible for a grant 
                under this subsection, a small business development 
                center shall submit to the Administrator an application 
                in such form, at such time, and containing such 
                information as the Administrator determines is 
                appropriate.
                    ``(D) Use of funds.--A small business development 
                center may use amounts received under a grant under 
                this subsection to support the cybersecurity of the 
                small business concerns served by the small business 
                development center, including--
                            ``(i) cybersecurity training for employees 
                        of the small business concerns;
                            ``(ii) reviews of the cybersecurity 
                        policies, plans, and procedures used by the 
                        small business concerns, including tabletop 
                        exercises to test the policies, plans, and 
                        procedures;
                            ``(iii) testing of the cybersecurity 
                        standing of the small business concerns, 
                        including via penetration testing; and
                            ``(iv) hiring consultants to support the 
                        cybersecurity needs of the small business 
                        concerns.
                    ``(E) Grant amount.--
                            ``(i) Formula.--The Administrator shall 
                        establish a 3-tier formula for grant funding 
                        distribution based on the locations of small 
                        business development centers in one of the 
                        following categories:
                                    ``(I) Small States.
                                    ``(II) Medium-sized States, as 
                                defined by the Administrator.
                                    ``(III) Large States, as defined by 
                                the Administrator.
                            ``(ii) Maximum amount.--The maximum amount 
                        of a grant under this subsection shall be, for 
                        a small business development center located 
                        in--
                                    ``(I) a small State, $200,000;
                                    ``(II) a medium-sized State, 
                                $300,000; or
                                    ``(III) a large State, $400,000.
                    ``(F) Duration of grant.--The period of a grant 
                under this subsection shall be 1 fiscal year.
                    ``(G) Announcement of grant program.--The 
                Administrator shall make widely available to the public 
                information on the grant program under this subsection.
            ``(3) Authorization of appropriations.--There are 
        authorized to be appropriated to carry out this subsection 
        $20,000,000 for fiscal year 2023 and each fiscal year 
        thereafter, to remain available until expended.''.
                                 <all>