Improving Small Business Cyber Security Act of 2016

Bill: 114-hr-5064
Sponsor: full_name: Rep. Hanna, Richard L. [R-NY-22]
Introduced: 2016-04-26
Policy area: Commerce
Subjects: Business education

Computer security and identity theft

Congressional oversight

Government studies and investigations

Homeland security

Small business
Latest action: action_date: 2016-09-22
text: Received in the Senate.

Summaries:
action_date: 2016-04-26
action_desc: Introduced in House
text: <p><b>Improving Small Business Cyber Security Act of 2016</b></p> <p>This bill requires the Small Business Administration (SBA) and the Department of Homeland Security (DHS) to develop a Small Business Development Center Cyber Strategy after the Government Accountability Office issues a report that reviews federal cybersecurity resources aimed at assisting small businesses. The strategy must include:</p> <ul> <li>plans for incorporating small business development centers (SBDCs) into existing cyber programs to assist small businesses;</li> <li>counsel and assistance to improve small businesses' cyber security infrastructure, threat awareness, and training programs for employees, including agreements with Information Sharing and Analysis Centers to gain awareness of actionable threat information that may be beneficial to small businesses; and</li> <li>an analysis of how SBDCs can leverage federal programs and develop partnerships to improve cyber support services to small businesses.</li> </ul> <p>The Small Business Act is amended to authorize the SBA to make SBDC grants in furtherance of such strategy. SBDCs shall have access to cyber security specialists to counsel their small business clients.</p> <p>The Homeland Security Act of 2002 and the Small Business Act are amended to authorize DHS and other federal agencies coordinating with DHS to assist SBDCs, through the dissemination of cyber security risk information and other homeland security information, to help small businesses in developing such cyber security infrastructure, threat awareness, and employee training programs.</p>

action_date: 2016-07-01
action_desc: Reported to House amended, Part I
text: <p><b>Improving Small Business Cyber Security Act of 2016</b></p> <p>(Sec. 2) This bill amends the Small Business Act to authorize the Small Business Administration (SBA) to make grants to small business development centers (SBDCs) in furtherance of a Small Business Development Center Cyber Strategy to be developed by the SBA and the Department of Homeland Security (DHS) after the Government Accountability Office (GAO) issues a report that reviews federal cybersecurity resources aimed at assisting small businesses. </p> <p>SBDCs shall have access to cybersecurity specialists to counsel their small business clients.</p> <p>(Sec. 3) The Homeland Security Act of 2002 and the Small Business Act are amended to allow DHS and other federal agencies coordinating with DHS to leverage SBDCs to disseminate cybersecurity risk information and other homeland security information to help small businesses in developing cybersecurity infrastructure, threat awareness, and employee training programs.</p> <p>(Sec. 5) The GAO's cyber resources report must include: (1) an accounting, description, and assessment of the utilization of federal programs that provide cybersecurity assistance to small businesses; and (2) an assessment of whether the resources are duplicative of other programs or accessible to small businesses. </p> <p>The strategy must include:</p> <ul> <li>plans for leveraging SBDCs into existing federal cyber programs to assist small businesses;</li> <li>methods for the provision of counsel and assistance to improve small businesses' cyber security infrastructure, threat awareness, and training programs for employees, including agreements with Information Sharing and Analysis Centers to gain awareness of actionable threat information that may be beneficial to small businesses; and</li> <li>an analysis of how SBDCs can leverage federal programs and develop partnerships with federal, state, and local governments and private entities to improve cyber support services to small businesses.</li> </ul> <p>The SBA's and DHS's strategy must be developed in consultation with entities representing SBDC concerns and submitted to Congress.</p>

action_date: 2016-09-21
action_desc: Passed House amended
text: <p><b>Improving Small Business Cyber Security Act of 2016</b></p> <p>(Sec. 2) This bill amends the Small Business Act to authorize the Small Business Administration (SBA) to make grants to small business development centers (SBDCs) in furtherance of a Small Business Development Center Cyber Strategy to be developed by the SBA and the Department of Homeland Security (DHS) after the Government Accountability Office (GAO) issues a report that reviews federal cybersecurity resources aimed at assisting small businesses. </p> <p>SBDCs shall have access to cybersecurity specialists to counsel their small business clients.</p> <p>(Sec. 3) The Homeland Security Act of 2002 and the Small Business Act are amended to allow DHS and other federal agencies coordinating with DHS to leverage SBDCs to disseminate cybersecurity risk information and other homeland security information to help small businesses in developing cybersecurity infrastructure, threat awareness, and employee training programs.</p> <p>(Sec. 5) The GAO's cyber resources report must include: (1) an accounting, description, and assessment of the utilization of federal programs that provide cybersecurity assistance to small businesses; and (2) an assessment of whether the resources are duplicative of other programs or accessible to small businesses. </p> <p>The strategy must include:</p> <ul> <li>plans for leveraging SBDCs into existing federal cyber programs to assist small businesses;</li> <li>methods for the provision of counsel and assistance to improve small businesses' cyber security infrastructure, threat awareness, and training programs for employees, including agreements with Information Sharing and Analysis Centers to gain awareness of actionable threat information that may be beneficial to small businesses; and</li> <li>an analysis of how SBDCs can leverage federal programs and develop partnerships with federal, state, and local governments and private entities to improve cyber support services to small businesses.</li> </ul> <p>The SBA's and DHS's strategy must be developed in consultation with entities representing SBDC concerns and submitted to Congress.</p>

tv_txt: I 114th CONGRESS 2d Session H. R. 5064 IN THE HOUSE OF REPRESENTATIVES April 26, 2016 Mr. Hanna (for himself, Mr. Kilmer , Ms. Stefanik , Ms. Clarke of New York , Mr. Chabot , Ms. Meng , Mr. Knight , Mr. Loudermilk , Mr. Payne , Ms. Velázquez , Mr. Renacci , Mr. Curbelo of Florida , and Mr. Carney ) introduced the following bill; which was referred to the Committee on Small Business , and in addition to the Committee on Homeland Security , for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned A BILL To amend the Small Business Act to allow small business development centers to assist and advise small business concerns on relevant cyber security matters, and for other purposes.

1. Short title This Act may be cited as the Improving Small Business Cyber Security Act of 2016 . 2. Role of small business development centers in cyber security and preparedness Section 21 of the Small Business Act ( 15 U.S.C. 648 ) is amended— (1) in subsection (a)(1), by striking and providing access to business analysts who can refer small business concerns to available experts: and inserting providing access to business analysts who can refer small business concerns to available experts; and, to the extent practicable, providing assistance in furtherance of the Small Business Development Center Cyber Strategy developed under section 5(b) of the Improving Small Business Cyber Security Act of 2016: ; and (2) in subsection (c)— (A) in paragraph (2)— (i) in subparagraph (E), by striking and at the end; (ii) in subparagraph (F), by striking the period and inserting ; and ; and (iii) by adding at the end of the following: (G) access to cyber security specialists to counsel, assist, and inform small business concern clients, in furtherance of the Small Business Development Center Cyber Strategy developed under section 5(b) of the Improving Small Business Cyber Security Act of 2016. . 3. Additional cyber security assistance for small business development centers Section 21(a) of the Small Business Act ( 15 U.S.C. 648(a) ) is amended by adding at the end the following: (8) Cyber security assistance The Department of Homeland Security, and any other Federal department or agency in coordination with the Department of Homeland Security, may provide assistance to small business development centers, through the dissemination of cyber security risk information and other homeland security information, to help small business concerns in developing or enhancing cyber security infrastructure, cyber threat awareness, and cyber training programs for employees. . 4. Cyber security outreach for small business development centers Section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ) is amended— (1) by redesignating subsection (l) as subsection (m); and (2) by inserting after subsection (k) the following: (l) Cyber security outreach (1) In general The Secretary may provide assistance to small business development centers, through the dissemination of cyber security risk information and other homeland security information, to help small business concerns in developing or enhancing cyber security infrastructure, cyber threat awareness, and cyber training programs for employees. (2) Definitions For purposes of this subsection, the terms small business concern and small business development center have the meaning given such terms, respectively, under section 3 of the Small Business Act. . 5. GAO study on small business cyber support services and small business development center cyber strategy (a) Review of current cyber security resources (1) In general The Comptroller General of the United States shall conduct a review of current cyber security resources at the Federal level aimed at assisting small business concerns with developing or enhancing cyber security infrastructure, cyber threat awareness, or cyber training programs for employees. (2) Content The review required under paragraph (1) shall include the following: (A) An accounting and description of all Federal Government programs, projects, and activities that currently provide assistance to small business concerns in developing or enhancing cyber security infrastructure, cyber threat awareness, or cyber training programs for employees. (B) An assessment of how widely utilized the resources described under subparagraph (A) are by small business concerns and a review of whether or not such resources are duplicative of other programs and structured in a manner that makes them accessible to and supportive of small business concerns. (3) Report The Comptroller General shall issue a report to the Congress, the Small Business Administrator, the Secretary of Homeland Security, and any association recognized under section 21(a)(3)(A) of the Small Business Act containing all findings and determinations made in carrying out the review required under paragraph (1). (b) Small business development center cyber strategy (1) In general Not later than 90 days after the issuance of the report under subsection (a)(3), the Small Business Administrator and the Secretary of Homeland Security shall work collaboratively to develop a Small Business Development Center Cyber Strategy. (2) Consultation In developing the strategy under this subsection, the Small Business Administrator and the Secretary of Homeland Security shall consult with entities representing the concerns of small business development centers, including any association recognized under section 21(a)(3)(A) of the Small Business Act. (3) Content The strategy required under paragraph (1) shall include, at minimum, the following: (A) Plans for incorporating small business development centers (SBDCs) into existing cyber programs to enhance services and streamline cyber assistance to small business concerns. (B) To the extent practicable, methods for the provision of counsel and assistance to improve a small business concern’s cyber security infrastructure, cyber threat awareness, and cyber training programs for employees, including— (i) working to ensure individuals are aware of best practices in the areas of cyber security, cyber threat awareness, and cyber training; (ii) working with individuals to develop cost-effective plans for implementing best practices in these areas; (iii) entering into agreements, where practical, with Information Sharing and Analysis Centers or similar cyber information sharing entities to gain an awareness of actionable threat information that may be beneficial to small business concerns; and (iv) providing referrals to area specialists when necessary. (C) An analysis of— (i) how Federal Government programs, projects, and activities identified by the Comptroller General in the report issued under subsection (a)(1) can be leveraged by SBDCs to improve access to high-quality cyber support for small business concerns; (ii) additional resources SBDCs may need to effectively carry out their role; and (iii) how SBDCs can leverage existing partnerships and develop new ones with Federal, State, and local government entities as well as private entities to improve the quality of cyber support services to small business concerns. (4) Delivery of strategy Not later than 180 days after the issuance of the report under subsection (a)(3), the Small Business Development Center Cyber Strategy shall be issued to the Committees on Homeland Security and Small Business of the House of Representatives and the Committees on Homeland Security and Governmental Affairs and Small Business and Entrepreneurship of the Senate. 6. Prohibition on additional funds No additional funds are authorized to be appropriated to carry out this Act or the amendments made by this Act.

tv_txt: I 114th CONGRESS 2d Session H. R. 5064 IN THE HOUSE OF REPRESENTATIVES AN ACT To amend the Small Business Act to allow small business development centers to assist and advise small business concerns on relevant cyber security matters, and for other purposes.

1. Short title This Act may be cited as the Improving Small Business Cyber Security Act of 2016 . 2. Role of small business development centers in cyber security and preparedness Section 21 of the Small Business Act ( 15 U.S.C. 648 ) is amended— (1) in subsection (a)(1), by striking and providing access to business analysts who can refer small business concerns to available experts: and inserting providing access to business analysts who can refer small business concerns to available experts; and, to the extent practicable, providing assistance in furtherance of the Small Business Development Center Cyber Strategy developed under section 5(b) of the Improving Small Business Cyber Security Act of 2016: ; and (2) in subsection (c)— (A) in paragraph (2)— (i) in subparagraph (E), by striking and at the end; (ii) in subparagraph (F), by striking the period and inserting ; and ; and (iii) by adding at the end of the following: (G) access to cyber security specialists to counsel, assist, and inform small business concern clients, in furtherance of the Small Business Development Center Cyber Strategy developed under section 5(b) of the Improving Small Business Cyber Security Act of 2016. . 3. Additional cyber security assistance for small business development centers Section 21(a) of the Small Business Act ( 15 U.S.C. 648(a) ) is amended by adding at the end the following: (8) Cyber security assistance The Department of Homeland Security, and any other Federal department or agency in coordination with the Department of Homeland Security, may leverage small business development centers to provide assistance to small businesses by disseminating cyber security risk information and other homeland security information to help small business concerns in developing or enhancing cyber security infrastructure, cyber threat awareness, and cyber training programs for employees. . 4. Cyber security outreach for small business development centers Section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ) is amended— (1) by redesignating subsection (l) as subsection (m); and (2) by inserting after subsection (k) the following: (l) Cybersecurity outreach (1) In general The Secretary may leverage small business development centers to provide assistance to small business concerns by disseminating information on cyber threat indicators, defensive measures, cybersecurity risks, incidents, analyses, and warnings to help small business concerns in developing or enhancing cybersecurity infrastructure, cyber threat awareness, and cyber training programs for employees. (2) Definitions For purposes of this subsection, the terms small business concern and small business development center have the meaning given such terms, respectively, under section 3 of the Small Business Act. . 5. GAO study on small business cyber support services and small business development center cyber strategy (a) Review of current cyber security resources (1) In general The Comptroller General of the United States shall conduct a review of current cyber security resources at the Federal level aimed at assisting small business concerns with developing or enhancing cyber security infrastructure, cyber threat awareness, or cyber training programs for employees. (2) Content The review required under paragraph (1) shall include the following: (A) An accounting and description of all Federal Government programs, projects, and activities that currently provide assistance to small business concerns in developing or enhancing cyber security infrastructure, cyber threat awareness, or cyber training programs for employees. (B) An assessment of how widely utilized the resources described under subparagraph (A) are by small business concerns and a review of whether or not such resources are duplicative of other programs and structured in a manner that makes them accessible to and supportive of small business concerns. (3) Report The Comptroller General shall issue a report to the Congress, the Administrator of the Small Business Administration, the Secretary of Homeland Security, and any association recognized under section 21(a)(3)(A) of the Small Business Act containing all findings and determinations made in carrying out the review required under paragraph (1). (b) Small business development center cyber strategy (1) In general Not later than 90 days after the issuance of the report under subsection (a)(3), the Administrator of the Small Business Administration and the Secretary of Homeland Security shall work collaboratively to develop a Small Business Development Center Cyber Strategy. (2) Consultation In developing the strategy under this subsection, the Administrator of the Small Business Administration and the Secretary of Homeland Security shall consult with entities representing the concerns of small business development centers, including any association recognized under section 21(a)(3)(A) of the Small Business Act. (3) Content The strategy required under paragraph (1) shall include, at minimum, the following: (A) Plans for leveraging small business development centers (SBDCs) to access existing cyber programs of the Department of Homeland Security and other appropriate Federal agencies to enhance services and streamline cyber assistance to small business concerns. (B) To the extent practicable, methods for the provision of counsel and assistance to improve a small business concern’s cyber security infrastructure, cyber threat awareness, and cyber training programs for employees, including— (I) working to ensure individuals are aware of best practices in the areas of cyber security, cyber threat awareness, and cyber training; (ii) working with individuals to develop cost-effective plans for implementing best practices in these areas; (iii) entering into agreements, where practical, with Information Sharing and Analysis Centers or similar cyber information sharing entities to gain an awareness of actionable threat information that may be beneficial to small business concerns; and (iv) providing referrals to area specialists when necessary. (c) An analysis of— (I) how Federal Government programs, projects, and activities identified by the Comptroller General in the report issued under subsection (a)(1) can be leveraged by SBDCs to improve access to high-quality cyber support for small business concerns; (ii) additional resources SBDCs may need to effectively carry out their role; and (iii) how SBDCs can leverage existing partnerships and develop new ones with Federal, State, and local government entities as well as private entities to improve the quality of cyber support services to small business concerns. (4) Delivery of strategy Not later than 180 days after the issuance of the report under subsection (a)(3), the Small Business Development Center Cyber Strategy shall be issued to the Committees on Homeland Security and Small Business of the House of Representatives and the Committees on Homeland Security and Governmental Affairs and Small Business and Entrepreneurship of the Senate. (c) Definition The term small business development center has the meaning given such term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). 6. Prohibition on additional funds No additional funds are authorized to be appropriated to carry out the requirements of this Act or the amendments made by this Act. Such requirements shall be carried out using amounts otherwise authorized.

Passed the House of Representatives September 21, 2016. Karen L. Haas, Clerk.

tv_txt: II 114th CONGRESS 2d Session H. R. 5064 IN THE SENATE OF THE UNITED STATES September 22, 2016 Received AN ACT To amend the Small Business Act to allow small business development centers to assist and advise small business concerns on relevant cyber security matters, and for other purposes.

1. Short title This Act may be cited as the Improving Small Business Cyber Security Act of 2016 . 2. Role of small business development centers in cyber security and preparedness Section 21 of the Small Business Act ( 15 U.S.C. 648 ) is amended— (1) in subsection (a)(1), by striking and providing access to business analysts who can refer small business concerns to available experts: and inserting providing access to business analysts who can refer small business concerns to available experts; and, to the extent practicable, providing assistance in furtherance of the Small Business Development Center Cyber Strategy developed under section 5(b) of the Improving Small Business Cyber Security Act of 2016: ; and (2) in subsection (c)— (A) in paragraph (2)— (i) in subparagraph (E), by striking and at the end; (ii) in subparagraph (F), by striking the period and inserting ; and ; and (iii) by adding at the end of the following: (G) access to cyber security specialists to counsel, assist, and inform small business concern clients, in furtherance of the Small Business Development Center Cyber Strategy developed under section 5(b) of the Improving Small Business Cyber Security Act of 2016. . 3. Additional cyber security assistance for small business development centers Section 21(a) of the Small Business Act ( 15 U.S.C. 648(a) ) is amended by adding at the end the following: (8) Cyber security assistance The Department of Homeland Security, and any other Federal department or agency in coordination with the Department of Homeland Security, may leverage small business development centers to provide assistance to small businesses by disseminating cyber security risk information and other homeland security information to help small business concerns in developing or enhancing cyber security infrastructure, cyber threat awareness, and cyber training programs for employees. . 4. Cyber security outreach for small business development centers Section 227 of the Homeland Security Act of 2002 ( 6 U.S.C. 148 ) is amended— (1) by redesignating subsection (l) as subsection (m); and (2) by inserting after subsection (k) the following: (l) Cybersecurity outreach (1) In general The Secretary may leverage small business development centers to provide assistance to small business concerns by disseminating information on cyber threat indicators, defensive measures, cybersecurity risks, incidents, analyses, and warnings to help small business concerns in developing or enhancing cybersecurity infrastructure, cyber threat awareness, and cyber training programs for employees. (2) Definitions For purposes of this subsection, the terms small business concern and small business development center have the meaning given such terms, respectively, under section 3 of the Small Business Act. . 5. GAO study on small business cyber support services and small business development center cyber strategy (a) Review of current cyber security resources (1) In general The Comptroller General of the United States shall conduct a review of current cyber security resources at the Federal level aimed at assisting small business concerns with developing or enhancing cyber security infrastructure, cyber threat awareness, or cyber training programs for employees. (2) Content The review required under paragraph (1) shall include the following: (A) An accounting and description of all Federal Government programs, projects, and activities that currently provide assistance to small business concerns in developing or enhancing cyber security infrastructure, cyber threat awareness, or cyber training programs for employees. (B) An assessment of how widely utilized the resources described under subparagraph (A) are by small business concerns and a review of whether or not such resources are duplicative of other programs and structured in a manner that makes them accessible to and supportive of small business concerns. (3) Report The Comptroller General shall issue a report to the Congress, the Administrator of the Small Business Administration, the Secretary of Homeland Security, and any association recognized under section 21(a)(3)(A) of the Small Business Act containing all findings and determinations made in carrying out the review required under paragraph (1). (b) Small business development center cyber strategy (1) In general Not later than 90 days after the issuance of the report under subsection (a)(3), the Administrator of the Small Business Administration and the Secretary of Homeland Security shall work collaboratively to develop a Small Business Development Center Cyber Strategy. (2) Consultation In developing the strategy under this subsection, the Administrator of the Small Business Administration and the Secretary of Homeland Security shall consult with entities representing the concerns of small business development centers, including any association recognized under section 21(a)(3)(A) of the Small Business Act. (3) Content The strategy required under paragraph (1) shall include, at minimum, the following: (A) Plans for leveraging small business development centers (SBDCs) to access existing cyber programs of the Department of Homeland Security and other appropriate Federal agencies to enhance services and streamline cyber assistance to small business concerns. (B) To the extent practicable, methods for the provision of counsel and assistance to improve a small business concern’s cyber security infrastructure, cyber threat awareness, and cyber training programs for employees, including— (I) working to ensure individuals are aware of best practices in the areas of cyber security, cyber threat awareness, and cyber training; (ii) working with individuals to develop cost-effective plans for implementing best practices in these areas; (iii) entering into agreements, where practical, with Information Sharing and Analysis Centers or similar cyber information sharing entities to gain an awareness of actionable threat information that may be beneficial to small business concerns; and (iv) providing referrals to area specialists when necessary. (c) An analysis of— (I) how Federal Government programs, projects, and activities identified by the Comptroller General in the report issued under subsection (a)(1) can be leveraged by SBDCs to improve access to high-quality cyber support for small business concerns; (ii) additional resources SBDCs may need to effectively carry out their role; and (iii) how SBDCs can leverage existing partnerships and develop new ones with Federal, State, and local government entities as well as private entities to improve the quality of cyber support services to small business concerns. (4) Delivery of strategy Not later than 180 days after the issuance of the report under subsection (a)(3), the Small Business Development Center Cyber Strategy shall be issued to the Committees on Homeland Security and Small Business of the House of Representatives and the Committees on Homeland Security and Governmental Affairs and Small Business and Entrepreneurship of the Senate. (c) Definition The term small business development center has the meaning given such term in section 3 of the Small Business Act ( 15 U.S.C. 632 ). 6. Prohibition on additional funds No additional funds are authorized to be appropriated to carry out the requirements of this Act or the amendments made by this Act. Such requirements shall be carried out using amounts otherwise authorized.

Passed the House of Representatives September 21, 2016. Karen L. Haas, Clerk