Small Business Cybersecurity Grants

Section 21 of the Small Business Act (15 U.S.C. 648) is amended by adding at the end the following:

(o)

Cybersecurity Grants

(1)

Definitions

In this section:(A)

Rural area

The term rural area has the meaning given the term in section 343(a) of the Consolidated Farm and Rural Development Act (7 U.S.C. 1991(a)).(B)

Small State

The term small State means any State that is minimally funded by the funding formula of the Small Business Development Center Program under subsection (a)(4)(C).(C)

State

The term State means each of the several States, the District of Columbia, and any territory or possession of the United States.(2)

Grants

(A)

In general

The Administrator shall establish a grant program under which the Administrator may award grants on a noncompetitive basis to small business development centers to support the cybersecurity needs of the small business concerns served by the small business development centers.(B)

Grant criteria

In awarding grants under this subsection, the Administrator may consider the following criteria:(i)The plan of the small business development center for the use of the grant funds, including how funds would benefit small business concerns in rural areas.(ii)Evidence submitted by the small business development center that the grant would increase the cybersecurity of the small business concerns that the small business development center serves, including evidence of past success in offering cybersecurity support to small business concerns.(C)

Applications

To be eligible for a grant under this subsection, a small business development center shall submit to the Administrator an application in such form, at such time, and containing such information as the Administrator determines is appropriate.(D)

Use of Funds

A small business development center may use amounts received under a grant under this subsection to support the cybersecurity of the small business concerns served by the small business development center, including—(i)cybersecurity training for employees of the small business concerns;(ii)reviews of the cybersecurity policies, plans, and procedures used by the small business concerns, including tabletop exercises to test the policies, plans, and procedures;(iii)testing of the cybersecurity standing of the small business concerns, including via penetration testing; and(iv)hiring consultants to support the cybersecurity needs of the small business concerns.(E)

Grant Amount

(i)

Formula

The Administrator shall establish a 3-tier formula for grant funding distribution based on the locations of small business development centers in one of the following categories:(I)Small States.(II)Medium-sized States, as defined by the Administrator.(III)Large States, as defined by the Administrator.(ii)

Maximum Amount

The maximum amount of a grant under this subsection shall be, for a small business development center located in—(I)a small State, $200,000;(II)a medium-sized State, $300,000; or(III)a large State, $400,000.(F)

Duration of Grant

The period of a grant under this subsection shall be 1 fiscal year.(G)

Announcement of Grant Program

The Administrator shall make widely available to the public information on the grant program under this subsection.(3)

Authorization of appropriations

There are authorized to be appropriated to carry out this subsection $20,000,000 for fiscal year 2023 and each fiscal year thereafter, to remain available until expended.