,,ii #aahth ,,congress #ast ,session ,s4 #bgdj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #g1 #bjbc,mr4 ,risch 7for himself1 ,mrs4 ,shaheen1 ,mr4 ,crapo1 and ,ms4 ,cortez ,masto7 introduced the following bill2 which was read twice and referred to the ,committee on ,small ,business and ,entrepreneurship ,a ,,bill ,to help small businesses prepare for and combat cybersecurity threats1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,small ,business ,cyber ,resiliency ,act4 #b4 ,small business cybersecurity 7a7 ,in general ,the ,small ,business ,act 7#ae ,u4,s4,c4 #fca et seq47 is amended-- 7#a7 by redesignating section #di 7#ae ,u4,s4,c4 #fca note7 as section #eb2 and 7#b7 by inserting after section #dh 7#ae ,u4,s4,c4 #fegu7 the following3 #di4 ,small business cybersecurity 7a7 ,definitions ,in this section3 7#a7 ,cybersecurity risk2 cyber threat indicator2 defensive measure2 incident ,the terms cybersecurity risk1 cyber threat indicator1 defense measure1 and incident have the meanings given those terms in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#b7 ,resource partner ,the term resource partner means-- 7,a7 a small business development center2 7,b7 a women's business center described in section #bi2 and 7,c7 a chapter of the ,service ,corps of ,retired ,executives described in section #h7;a77#a77;,a74 7b7 ,interagency agreement ,the ,administration shall enter into an interagency agreement with the ,cybersecurity and ,infrastructure ,security ,agency to collaborate and increase information sharing with the ,administration to improve cybersecurity resources and defenses for small business concerns1 including cybersecurity products tailored to the needs of small business concerns4 7c7 ,assistance through resource partners 7#a7 ,in general ,the ,department of ,homeland ,security1 and any other ,federal agency in coordination with the ,department of ,homeland ,security1 shall leverage resource partners to provide assistance to small business concerns with cybersecurity tools1 such as the ,cyber ,security ,evaluation ,tool and the ,cyber ,resilience ,review1 and by disseminating information relating to cybersecurity risks and other homeland security matters to help small business concerns in developing or enhancing cybersecurity infrastructure1 awareness of cyber threat indicators1 cybersecurity incident response planning1 and cyber training programs for employees4 7#b7 ,annual publication ,not later than #a year after the date of enactment of the ,small ,business ,cyber ,resiliency ,act and annually thereafter1 the ,administrator shall publish on the website of the ,administration the number of small business concerns that resource partners assisted in providing assistance described in paragraph 7#a7 during the year covered by the publication4 7d7 ,central small business cybersecurity assistance unit 7#a7 ,establishment ,the ,administrator1 in coordination with the ,secretary of ,commerce1 and in consultation with the ,secretary of ,homeland ,security and the ,attorney ,general1 shall establish a central small business cybersecurity assistance unit within the ,administration1 which shall serve as a central clearinghouse for cybersecurity resources for small business concerns across the ,federal ,government1 such as those developed by the ,department of ,homeland ,security4 7#b7 ,duties ,the central small business cybersecurity assistance unit established under paragraph 7#a7 shall-- 7,a7 coordinate internal cybersecurity efforts within the ,administration to reduce duplication of effort and resources2 7,b7 establish and maintain a publicly available website that is a clearinghouse of cybersecurity information for small business concerns1 including information on-- 7i7 how to find guidance material on best cyber hygiene practices2 7ii7 where to report cybersecurity breaches or incidents2 7iii7 how to respond to cybersecurity breaches or incidents2 7iv7 the cybersecurity efforts of the ,administration2 7v7 how to contact the certified employees described in section #ba7o72 and 7vi7 standard incident response procedures for leading cyber crimes2 7,c7 work with the certified employees described in section #ba7o7 to provide cybersecurity assistance to small business concerns2 7,d7 coordinate with the ,department of ,homeland ,security and any other ,federal agency as the ,administrator determines appropriate to identify and disseminate cybersecurity information and resources to small business concerns in a form that is accessible and actionable by small business concerns2 7,e7 redirect small business cybersecurity inquiries1 such as reporting of cyber threat indicators and defensive measures1 to the appropriate ,federal agencies2 7,f7 coordinate with the ,national ,institute of ,standards and ,technology to identify and disseminate information to small business concerns on the most cost-effective methods for implementing elements of the cybersecurity framework of the ,national ,institute of ,standards and ,technology applicable to improving the cybersecurity posture of small business concerns2 7,g7 coordinate with the ,department of ,defense to identify and disseminate information to small business concerns on satisfying the applicable requirements of the ,cybersecurity ,maturity ,model ,certification of the ,department of ,defense or any other successor cybersecurity requirements as established by the ,department of ,defense2 and 7,h7 seek input from the ,office of ,advocacy of the ,administration to identify any policies or procedures adopted by any department1 agency1 or instrumentality of the ,federal ,government that will hamper the improvement of the cybersecurity posture of those small business concerns4 7#c7 ,enhanced cybersecurity protections for small businesses 7,a7 ,in general ,notwithstanding any other provision of law1 no cause of action shall lie or be maintained in any court against any small business concern1 and such action shall be promptly dismissed1 if such action is related to or arises out of-- 7i7 any activity authorized under this paragraph or the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq472 or 7ii7 any action or inaction in response to any cyber threat indicator1 defensive measure1 or other information shared or received pursuant to this paragraph or the ,cybersecurity ,information ,sharing ,act of #bjae 7#f ,u4,s4,c4 #aeja et seq474 7,b7 ,rule of construction ,nothing in this paragraph shall be construed to affect the applicability or merits of any defense1 motion1 or argument in any cause of action in a court brought against an entity that is not a small business concern4 7e7 ,report 7#a7 ,in general ,not later than #a year after the date of enactment of the ,small ,business ,cyber ,resiliency ,act1 and every year thereafter1 the ,administrator and the head of each ,federal agency that collects or shares information under this section shall submit to the ,committee on ,small ,business and ,entrepreneurship of the ,senate and the ,committee on ,small ,business of the ,house of ,representatives a joint report on actions taken by the ,administration and relevant ,federal agencies to protect personally identifiable information1 business identifiable information1 sensitive financial information1 and cybersecurity information received by those ,federal agencies as a result of the requirements under this section4 7#b7 ,form ,each report required under paragraph 7#a7 shall be unclassified1 but may include a classified annex4 4 7b7 ,prohibition on new appropriations 7#a7 ,in general ,no additional funds are authorized to be appropriated to carry out this section and the amendments made by this section4 7#b7 ,existing funding ,this section and the amendments made by this section shall be carried out using amounts made available to the ,small ,business ,administration under the heading ,entrepreneurial ,development ,programs4 7c7 ,implementation ,not later than #ahj days after the date of enactment of this ,act1 the ,administrator of the ,small ,business ,administration shall implement this section and the amendments made by this section4 #c4 ,study and report on cybersecurity risks of small businesses 7a7 ,definitions ,in this section3 7#a7 ,administration ,the term ,administration means the ,small ,business ,administration4 7#b7 ,appropriate committees of ,congress ,the term appropriate committees of ,congress means-- 7,a7 the ,committee on ,small ,business and ,entrepreneurship of the ,senate2 7,b7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,c7 the ,committee on ,small ,business of the ,house of ,representatives2 and 7,d7 the ,committee on ,homeland ,security of the ,house of ,representatives4 7#c7 ,cybersecurity risk ,the term cybersecurity risk has the meaning given the term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#d7 ,information system ,the term information system has the meaning given the term in section #cejb of title #dd1 ,united ,states ,code4 7#e7 ,rural area ,the term rural area means any county or other political subdivision of a ,state1 the ,district of ,columbia1 or a territory or possession of the ,united ,states that is designated as a rural area by the ,bureau of the ,census4 7#f7 ,small business concern ,the term small business concern has the meaning given the term in section #c of the ,small ,business ,act 7#ae ,u4,s4,c4 #fcb74 7b7 ,study and ,report ,not later than #a year after the date of enactment of this ,act1 the ,chief ,counsel for ,advocacy of the ,administration and the ,comptroller ,general of the ,united ,states shall-- 7#a7 conduct a joint study assessing the impact of small business concerns turning to online marketplaces as a result of shutdowns imposed by the ,,covid-#ai pandemic1 specifically in regards to the cybersecurity of those small business concerns2 and 7#b7 submit to the appropriate committees of ,congress and make publicly available a report on-- 7,a7 how identified cybersecurity risks specifically impact small business concerns that established an online presence during the period beginning on ,february #a1 #bjbj1 and ending on ,december #ca1 #bjba2 7,b7 the challenges that the small business concerns described in subparagraph 7,a7 face in-- 7i7 securing updated information systems2 7ii7 implementing cybersecurity protocols2 and 7iii7 responding to data breaches or cyber attacks2 7,c7 the ,federal resources that the small business concerns described in subparagraph 7,a7 used in establishing the online presence described in that paragraph2 7,d7 as of the date of the report1 the cybersecurity status of the small business concerns described in subparagraph 7,a7 based on a representative sample of those small business concerns2 7,e7 how the ,department of ,homeland ,security and the ,administration can improve their existing partnership to better train small business concerns regarding cybersecurity threats2 and 7,f7 as of the date of the report-- 7i7 the frequency of each type of cyber attack suffered by small business concerns described in subparagraph 7,a72 and 7ii7 an estimated average cost to those small business concerns of each type of cyber attack4