,i #aafth ,,congress #ast ,session ,h4 ,r4 #afdh ,,in ,,the ,,house ,,of ,,representatives ,march #h1 #bjai,mr4 ,chabot 7for himself and ,ms4 ,velzquez7 introduced the following bill2 which was referred to the ,committee on ,small ,business ,a ,,bill ,to amend the ,small ,business ,act to provide for the establishment of an enhanced cybersecurity assistance and protections for small businesses1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,small ,business ,advanced ,cybersecurity ,enhancements ,act of #bjai4 #b4 ,findings ,congress finds the following3 7#a7 ,small businesses represent more than #ig percent of total businesses in the ,united ,states and make up an essential part of the supply chain to some of the largest companies1 many of which are in critical infrastructure sectors1 from financial and transportation organizations to power1 water1 and healthcare suppliers4 7#b7 ,many small businesses do not have dedicated information technology 7,,it7 departments and must outsource ,,it functions or assign these duties to an employee as a secondary function4 7#c7 ,the ,internet ,crime ,complaint ,center within the ,united ,states ,department of ,justice recorded #bih1gbh cybersecurity-related complaints in its #bjaf report4 7#d7 ,there has been steady increases of cybersecurity-related complaints year over year since the year #bjjj1 totaling #c1gfb1cdh4 7#e7 ,seventy-one percent of cyber attacks occurred in businesses with fewer than #ajj employees4 7#f7 ,only #ad percent of small- and medium-sized businesses believe they have the ability to effectively mitigate cyber risks and vulnerabilities4 7#g7 ,small businesses risk theft and manipulation of sensitive data if they lack adequate cybersecurity measures4 7#h7 ,the ,better ,business ,bureau found that half of small businesses could remain profitable for only one month if they lost essential data4 7#i7 ,cyber crime is growing rapidly and the annual costs to the global economy are estimated to reach over #b1jjj1jjj1jjj1jjj by #bjai4 7#aj7 ,cybersecurity is a global challenge where the security threat1 attacks1 and techniques continually evolve and no company1 individual1 or ,federal agency is immune from these threats4 7#aa7 ,strong collaboration between the public and private sector is essential in the fight against cyber crime4 7#ab7 ,there is a reluctance among small businesses to voluntarily share information with government entities1 and the ,federal ,government should work proactively to incentivize and encourage voluntary information sharing to improve the ,nation's cybersecurity posture4 #c4 ,enhanced cybersecurity assistance and protections for small businesses ,section #ba7;a7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fdh7;a77 is amended by adding at the end the following new paragraph3 7#i7 ,small business cybersecurity assistance and protections 7,a7 ,establishment of small business cybersecurity assistance units ,the ,administrator of the ,small ,business ,administration1 in coordination with the ,secretary of ,commerce1 and in consultation with the ,secretary of ,homeland ,security and the ,attorney ,general1 shall establish-- 7i7 in the ,administration1 a central small business cybersecurity assistance unit2 and 7ii7 within each small business development center1 a regional small business cybersecurity assistance unit4 7,b7 ,duties of the central small business cybersecurity assistance unit 7i7 ,in general ,the central small business cybersecurity assistance unit established under subparagraph 7,a77i7 shall serve as the primary interface for small business concerns to receive and share cyber threat indicators and defensive measures with the ,federal ,government4 7ii7 ,use of capability and processes ,the central small business cybersecurity assistance unit shall use the capability and process certified pursuant to section #aje7;c77#b77;,a7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aejd7;c77#b77;,a77 to receive cyber threat indicators or defensive measures from small business concerns4 7iii7 ,application of ,,cisa ,a small business concern that receives or shares cyber threat indicators and defensive measures with the ,federal ,government through the central small business cybersecurity assistance unit established under subparagraph 7,a77i71 or with any appropriate entity pursuant to section #ajc7;c7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aejc7;c771 shall receive the protections and exemptions provided in such ,act and this paragraph4 7,c7 ,relation to ,,nccic 7i7 ,central small business cybersecurity assistance unit ,the central small business cybersecurity assistance unit established under subparagraph 7,a77i7 shall be collocated with the national cybersecurity and communications integration center4 7ii7 ,access to information ,the national cybersecurity and communications integration center shall have access to all cyber threat indicators or defensive measures shared with the central small cybersecurity assistance unit established under subparagraph 7,a77i7 through the use of the capability and process described in subparagraph 7,b77ii74 7,d7 ,cybersecurity assistance for small businesses ,the central small business cybersecurity assistance unit established under subparagraph 7,a77i7 shall-- 7i7 work with each regional small business cybersecurity assistance unit established under subparagraph 7,a77ii7 to provide cybersecurity assistance to small business concerns2 7ii7 leverage resources from the ,administration1 the ,department of ,commerce1 the ,department of ,homeland ,security1 the ,department of ,justice1 the ,department of the ,treasury1 the ,department of ,state1 and any other ,federal department or agency the ,administrator determines appropriate1 in order to help improve the cybersecurity posture of small business concerns2 7iii7 coordinate with the ,department of ,homeland ,security to identify and disseminate information to small business concerns in a form that is accessible and actionable by small business concerns2 7iv7 coordinate with the ,national ,institute of ,standards and ,technology to identify and disseminate information to small business concerns on the most cost-effective methods for implementing elements of the cybersecurity framework of the ,national ,institute of ,standards and ,technology applicable to improving the cybersecurity posture of small business concerns2 7v7 seek input from the ,office of ,advocacy of the ,administration to ensure that any policies or procedures adopted by any department1 agency1 or instrumentality of the ,federal ,government do not unduly add regulatory burdens to small business concerns in a manner that will hamper the improvement of the cybersecurity posture of such small business concerns2 and 7vi7 leverage resources and relationships with representatives and entities involved in the national cybersecurity and communications integration center to publicize the capacity of the ,federal ,government to assist small business concerns in improving cybersecurity practices4 7,e7 ,enhanced cybersecurity protections for small businesses 7i7 ,in general ,notwithstanding any other provision of law1 no cause of action shall lie or be maintained in any court against any small business concern1 and such action shall be promptly dismissed1 if such action related to or arises out of-- 7,i7 any activity authorized under this paragraph or the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq472 or 7,,ii7 any action or inaction in response to any cyber threat indicator1 defensive measure1 or other information shared or received pursuant to this paragraph or the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq474 7ii7 ,application ,the exception provided in section #aje7;d77#e77;,d77ii77,i7 of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aejd7;d77#e77;,d77ii77,i77 shall not apply to any cyber threat indicator or defensive measure shared or received by small business concerns pursuant to this paragraph or the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq474 7iii7 ,rule of construction ,nothing in this subparagraph shall be construed to affect the applicability or merits of any defense1 motion1 or argument in any cause of action in a court brought against an entity that is not a small business concern4 7,f7 ,definitions ,in this paragraph3 7i7 ,,cisa definitions ,the terms cyber threat indicator and defensive measure have the meanings given such terms in section #ajb of the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja74 7ii7 ,national cybersecurity and communications integration center ,the term national cybersecurity and communications integration center means the national cybersecurity and communications integration center established under section #bbg of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #adh74 4 #d4 ,prohibition on new appropriations 7a7 ,in general ,no additional funds are authorized to be appropriated to carry out this ,act and the amendments made by this ,act4 7b7 ,existing funding ,this ,act and the amendments made by this ,act shall be carried out using amounts made available under section #ba7;a77#d77;,c77viii7 of the ,small ,business ,act 7#ae ,u4,s4,c4 #fdh7;a77#d77viii774 7c7 ,technical and conforming amendment ,section #ba7;a77#d77;,c77viii7 of the ,small ,business ,act 7#ae ,u4,s4,c4#fdh7;a77#d77;,c77viii77 is amended to read as follows3 7viii7 ,limitation 7,i7 ,cybersecurity assistance ,from the funds appropriated pursuant to clause 7vii71 the ,administration shall reserve not less than #a1jjj1jjj in each fiscal year to develop cybersecurity assistance units at small business development centers under paragraph 7#i74 7,,ii7 ,portable assistance 7aa7 ,in general ,any funds appropriated pursuant to clause 7vii7 that are remaining after reserving amounts under subclause 7,i7 may be used for portable assistance for startup and sustainability non-matching grant programs to be conducted by eligible small business development centers in communities that are economically challenged as a result of a business or government facility down sizing or closing1 which has resulted in the loss of jobs or small business instability4 7bb7 ,grant amount and use ,a non-matching grant under this subclause shall not exceed #ajj1jjj1 and shall be used for small business development center personnel expenses and related small business programs and services4 4