II 117th CONGRESS 2d Session S. 4701 IN THE SENATE OF THE UNITED STATES August 2, 2022 Ms. Hassan introduced the following bill; which was read twice and referred to the Committee on Small Business and Entrepreneurship A BILL To provide cybersecurity support for small business concerns through the small business development center program, and for other purposes.

1. Short title This Act may be cited as the Small Businesses Cybersecurity Act . 2. Small Business Cybersecurity Grants Section 21 of the Small Business Act ( 15 U.S.C. 648 ) is amended by adding at the end the following: (o) Cybersecurity Grants (1) Definitions In this section: (A) Rural area The term rural area has the meaning given the term in section 343(a) of the Consolidated Farm and Rural Development Act ( 7 U.S.C. 1991(a) ). (B) Small State The term small State means any State that is minimally funded by the funding formula of the Small Business Development Center Program under subsection (a)(4)(C). (C) State The term State means each of the several States, the District of Columbia, and any territory or possession of the United States. (2) Grants (A) In general The Administrator shall establish a grant program under which the Administrator may award grants on a noncompetitive basis to small business development centers to support the cybersecurity needs of the small business concerns served by the small business development centers. (B) Grant criteria In awarding grants under this subsection, the Administrator may consider the following criteria: (i) The plan of the small business development center for the use of the grant funds, including how funds would benefit small business concerns in rural areas. (ii) Evidence submitted by the small business development center that the grant would increase the cybersecurity of the small business concerns that the small business development center serves, including evidence of past success in offering cybersecurity support to small business concerns. (C) Applications To be eligible for a grant under this subsection, a small business development center shall submit to the Administrator an application in such form, at such time, and containing such information as the Administrator determines is appropriate. (D) Use of Funds A small business development center may use amounts received under a grant under this subsection to support the cybersecurity of the small business concerns served by the small business development center, including— (i) cybersecurity training for employees of the small business concerns; (ii) reviews of the cybersecurity policies, plans, and procedures used by the small business concerns, including tabletop exercises to test the policies, plans, and procedures; (iii) testing of the cybersecurity standing of the small business concerns, including via penetration testing; and (iv) hiring consultants to support the cybersecurity needs of the small business concerns. (E) Grant Amount (i) Formula The Administrator shall establish a 3-tier formula for grant funding distribution based on the locations of small business development centers in one of the following categories: (I) Small States. (II) Medium-sized States, as defined by the Administrator. (III) Large States, as defined by the Administrator. (ii) Maximum Amount The maximum amount of a grant under this subsection shall be, for a small business development center located in— (I) a small State, $200,000; (II) a medium-sized State, $300,000; or (III) a large State, $400,000. (F) Duration of Grant The period of a grant under this subsection shall be 1 fiscal year. (G) Announcement of Grant Program The Administrator shall make widely available to the public information on the grant program under this subsection. (3) Authorization of appropriations There are authorized to be appropriated to carry out this subsection $20,000,000 for fiscal year 2023 and each fiscal year thereafter, to remain available until expended. .