Small Business Cybersecurity Assistance Act of 2019

II 116TH CONGRESS 1ST SESSION S. 2034 To authorize small business development centers to provide cybersecurity assistance to small business concerns, and for other purposes. IN THE SENATE OF THE UNITED STATES JUNE 27, 2019 Mr. PETERS (for himself and Mr. RUBIO) introduced the following bill; which was read twice and referred to the Committee on Small Business and En- trepreneurship A BILL To authorize small business development centers to provide cybersecurity assistance to small business concerns, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Small Business Cyber- 4 security Assistance Act of 2019’’. 5 VerDate Sep 11 2014 04:13 Jul 03, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034 kjohnson on DSK79L0C42 with BILLS 2 •S 2034 IS SEC. 2. SBA ACTIVITIES TO BOLSTER SMALL BUSINESS DE- 1 VELOPMENT CENTER CYBERSECURITY SUP- 2 PORT FUNCTIONS. 3 (a) IN GENERAL.—Section 21 of the Small Business 4 Act (15 U.S.C. 648) is amended— 5 (1) in subsection (a)— 6 (A) in paragraph (1), by inserting ‘‘man- 7 agement, training, and technical assistance re- 8 garding cybersecurity;’’ after ‘‘technology trans- 9 fer;’’; and 10 (B) in paragraph (8)— 11 (i) by redesignating subparagraph (B) 12 as subparagraph (C); and 13 (ii) by inserting after subparagraph 14 (A) the following: 15 ‘‘(B) CYBERSECURITY CLEARINGHOUSE.— 16 ‘‘(i) IN GENERAL.—In furtherance of 17 the Small Business Development Center 18 Cyber Strategy developed under section 19 1841(a) of the National Defense Author- 20 ization Act for Fiscal Year 2017 (Public 21 Law 114–328; 130 Stat. 2662), not later 22 than 90 days after the date of enactment 23 of the Small Business Cybersecurity As- 24 sistance Act of 2019, the Administrator, in 25 consultation with America’s SBDC (or any 26 VerDate Sep 11 2014 04:13 Jul 03, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034 kjohnson on DSK79L0C42 with BILLS 3 •S 2034 IS subsequent association identified by the 1 Administrator that represents small busi- 2 ness development centers), any federally 3 affiliated small business-focused entity as 4 determined appropriate by the Adminis- 5 trator, and, as appropriate, any other Fed- 6 eral agency, shall advise the Secretary of 7 Homeland Security on the development 8 and maintenance of a Cybersecurity Clear- 9 inghouse platform (in this subparagraph 10 referred to as the ‘Clearinghouse’). 11 ‘‘(ii) MANAGEMENT.—The Adminis- 12 trator and the Secretary of Homeland Se- 13 curity shall jointly manage the content 14 maintained on the Clearinghouse. 15 ‘‘(iii) RESOURCES.—The Clearing- 16 house shall contain public-facing cyberse- 17 curity resources, to the extent possible fo- 18 cused on small business concerns, in a sin- 19 gle location for easy reference by small 20 business development centers, federally af- 21 filiated small-business focused entities, and 22 small business concerns. 23 ‘‘(iv) CONTENTS.—The Clearinghouse 24 shall— 25 VerDate Sep 11 2014 04:13 Jul 03, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034 kjohnson on DSK79L0C42 with BILLS 4 •S 2034 IS ‘‘(I) be publicly available online; 1 and 2 ‘‘(II) contain cybersecurity ref- 3 erence material for small business 4 concerns— 5 ‘‘(aa) developed by entities 6 in the Federal Government; and 7 ‘‘(bb) for any other purpose 8 as determined jointly by the Ad- 9 ministrator and the Secretary of 10 Homeland Security. 11 ‘‘(v) TRAINING.—The Administrator, 12 in consultation with America’s SBDC (or 13 any subsequent association identified by 14 the Administrator that represents small 15 business development centers), any feder- 16 ally affiliated small business-focused entity 17 as determined appropriate by the Adminis- 18 trator, the Department of Homeland Secu- 19 rity, and, as appropriate, any other Fed- 20 eral agency, shall provide periodic training 21 sessions, online or in-person, to employees 22 of small business development centers and 23 other federally affiliated small business-fo- 24 VerDate Sep 11 2014 04:13 Jul 03, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034 kjohnson on DSK79L0C42 with BILLS 5 •S 2034 IS cused entities on the Clearinghouse, includ- 1 ing utilization of the Clearinghouse. 2 ‘‘(vi) EXISTING PLATFORM OR 3 WEBSITE.—The Administrator may main- 4 tain the Clearinghouse on an online plat- 5 form or website in existence as of the date 6 of enactment of the Small Business Cyber- 7 security Assistance Act of 2019. 8 ‘‘(vii) REFERENCE.—The Administra- 9 tion shall include a hyperlink for the public 10 to access the Clearinghouse on the website 11 of the Administration.’’; and 12 (2) in subsection (c)(3)— 13 (A) in subparagraph (T), by striking 14 ‘‘and’’ at the end; 15 (B) in the first subparagraph (U), by 16 striking the period at the end and inserting a 17 semicolon; 18 (C) by redesignating the second subpara- 19 graph (U) as subparagraph (V); 20 (D) in subparagraph (V), as so redesig- 21 nated, by striking the period at the end and in- 22 serting ‘‘; and’’; and 23 (E) by adding at the end the following: 24 VerDate Sep 11 2014 04:13 Jul 03, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034 kjohnson on DSK79L0C42 with BILLS 6 •S 2034 IS ‘‘(W) providing information and assistance to 1 small business concerns with respect to cybersecurity 2 policies, management, or technical strategies.’’. 3 SEC. 3. DEPARTMENT OF HOMELAND SECURITY ACTIVI- 4 TIES TO BOLSTER SMALL BUSINESS DEVEL- 5 OPMENT CENTER CYBERSECURITY SUPPORT 6 FUNCTIONS. 7 (a) DEFINITIONS.—In this section— 8 (1) the term ‘‘Administrator’’ means the Ad- 9 ministrator of the Small Business Administration; 10 (2) the term ‘‘Secretary’’ means the Secretary 11 of Homeland Security; and 12 (3) the terms ‘‘small business concern’’ and 13 ‘‘small business development center’’ has the mean- 14 ings given those terms in section 3 of the Small 15 Business Act (15 U.S.C. 632). 16 (b) PROGRAM.— 17 (1) IN GENERAL.—The Secretary, in consulta- 18 tion with the Administrator, America’s SBDC (or 19 any subsequent association identified by the Admin- 20 istrator that represents small business development 21 centers), any federally affiliated small business-fo- 22 cused entity as determined appropriate by the Ad- 23 ministrator, and, as appropriate, any other Federal 24 agency, shall develop— 25 VerDate Sep 11 2014 04:13 Jul 03, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034 kjohnson on DSK79L0C42 with BILLS 7 •S 2034 IS (A) educational cybersecurity materials for 1 employees of small business development cen- 2 ters, and other federally affiliated small busi- 3 ness-focused entities as determined appropriate 4 by the Administrator, to utilize during cyberse- 5 curity events and counseling sessions with small 6 business concerns, which shall address, at a 7 minimum— 8 (i) cybersecurity policies and proce- 9 dures for small businesses; 10 (ii) cybersecurity defensive strategies 11 for small businesses; and 12 (iii) cybersecurity response strategies 13 for small businesses; and 14 (B) training programs, such as webinars, 15 on-line tools, or software, for employees of small 16 business development centers, and other feder- 17 ally affiliated small business-focused entities as 18 determined appropriate by the Administrator, 19 to utilize during cybersecurity events and coun- 20 seling sessions with small business concerns. 21 (2) TRAINING.—The Secretary shall provide 22 periodic training sessions, online or in-person, to em- 23 ployees of small business development centers, and 24 other federally affiliated small business-focused enti- 25 VerDate Sep 11 2014 04:13 Jul 03, 2019 Jkt 089200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\S2034.IS S2034 kjohnson on DSK79L0C42 with BILLS 8 •S 2034 IS ties as determined appropriate by the Administrator, 1 on the utilization of the materials and training pro- 2 grams described in subparagraphs (A) and (B) of 3 paragraph (1). 4 (3) POSTING OF MATERIAL.—Not later than 5 180 days after the date on which the Administrator 6 establishes the Cybersecurity Clearinghouse required 7 under subparagraph (B) of section 21(a)(8) of the 8 Small Business Act (15 U.S.C. 648(a)(8)), as added 9 by section 2 of this Act— 10 (A) the Secretary shall complete develop- 11 ment of the materials described in paragraph 12 (1)(A) and submit them to the Administrator; 13 and 14 (B) the Administrator or the Secretary 15 shall upload those materials to the Cybersecu- 16 rity Clearinghouse. 17 Æ VerDate Sep 11 2014 04:13 Jul 03, 2019 Jkt 089200 PO 00000 Frm 00008 Fmt 6652 Sfmt 6301 E:\BILLS\S2034.IS S2034 kjohnson on DSK79L0C42 with BILLS