    [House Hearing, 117 Congress]
    [From the U.S. Government Publishing Office]

                    STRENGTHENING THE CYBERSECURITY POSTURE
                     OF AMERICA'S SMALL BUSINESS COMMUNITY

    =======================================================================

                                    HEARING

                                    BEFORE THE

                          COMMITTEE ON SMALL BUSINESS
                                 UNITED STATES
                            HOUSE OF REPRESENTATIVES

                        ONE HUNDRED SEVENTEENTH CONGRESS

                                 FIRST SESSION

                                   __________

                                  HEARING HELD
                                 JULY 20, 2021

                                   __________

    [GRAPHIC NOT AVAILABLE IN TIFF FORMAT]

                Small Business Committee Document Number 117-026
                 Available via the GPO Website: www.govinfo.gov

                                   __________

                        U.S. GOVERNMENT PUBLISHING OFFICE
    45-122                     WASHINGTON : 2021

    -----------------------------------------------------------------------------------

                       HOUSE COMMITTEE ON SMALL BUSINESS

                     NYDIA VELAZQUEZ, New York, Chairwoman
                              JARED GOLDEN, Maine
                              JASON CROW, Colorado
                             SHARICE DAVIDS, Kansas
                             KWEISI MFUME, Maryland
                            DEAN PHILLIPS, Minnesota
                             MARIE NEWMAN, Illinois
                           CAROLYN BOURDEAUX, Georgia
                             TROY CARTER, Louisiana
                              JUDY CHU, California
                           DWIGHT EVANS, Pennsylvania
                           ANTONIO DELGADO, New York
                         CHRISSY HOULAHAN, Pennsylvania
                              ANDY KIM, New Jersey
                             ANGIE CRAIG, Minnesota
                  BLAINE LUETKEMEYER, Missouri, Ranking Member
                             ROGER WILLIAMS, Texas
                            JIM HAGEDORN, Minnesota
                            PETE STAUBER, Minnesota
                            DAN MEUSER, Pennsylvania
                            CLAUDIA TENNEY, New York
                           ANDREW GARBARINO, New York
                             YOUNG KIM, California
                             BETH VAN DUYNE, Texas
                             BYRON DONALDS, Florida
                             MARIA SALAZAR, Florida
                          SCOTT FITZGERALD, Wisconsin

                     Melissa Jung, Majority Staff Director
                Ellen Harrington, Majority Deputy Staff Director
                         David Planning, Staff Director

                                C O N T E N T S

                               OPENING STATEMENTS

                                                                       Page
    Hon. Nydia Velaquez..............................................     1
    Hon. Blaine Luetkemeyer..........................................     2

                                   WITNESSES

    Ms. Tasha Cornish, Executive Director, Cybersecurity Association
      of Maryland, Inc., Baltimore, MD...............................     5
    Ms. Sharon Nichols, State Director, Mississippi Small Business
      Development Center, University, MS.............................     7
    Ms. Kiersten Todt, Managing Director, Cyber Readiness Institute,
      New York City, NY..............................................     8
    Mr. Graham Dufault, Senior Director for Public Policy, ACT/The
      App Association, Washington, DC................................    10

                                    APPENDIX

    Prepared Statements:
        Ms. Tasha Cornish, Executive Director, Cybersecurity
          Association of Maryland, Inc., Baltimore, MD...............    43
        Ms. Sharon Nichols, State Director, Mississippi Small
          Business Development Center, University, MS................    45
        Ms. Kiersten Todt, Managing Director, Cyber Readiness
          Institute, New York City, NY...............................    51
        Mr. Graham Dufault, Senior Director for Public Policy, ACT/
          The App Association, Washington, DC........................    58
    Questions for the Record:
        None.
    Answers for the Record:
        None.
    Additional Material for the Record:
        National Association of Federally-Insured Credit Unions
          (NAFCU)....................................................    74
        The National Cybersecurity Society...........................    77

                        STRENGTHENING THE CYBERSECURITY
                 POSTURE OF AMERICA'S SMALL BUSINESS COMMUNITY

                                  ----------

                             TUESDAY, JULY 20, 2021

                      House of Representatives,
                   Committee on Small Business,
                                                        Washington, DC.
        The Committee met, pursuant to call, at 10:01 a.m., in Room
    2360 Rayburn House Office Building and via Zoom, Hon. Nydia
    Velazquez [chairwoman of the Committee] presiding.
        Present: Representatives Velazquez, Crow, Davids, Mfume,
    Phillips, Newman, Carter, Bourdeaux, Delgado, Houlahan, Mr.
    Kim, Craig, Luetkemeyer, Williams, Hagedorn, Stauber, Meuser,
    Tenney, Garbarino, Ms. Young Kim, Van Duyne, Donalds, and
    Fitzgerald.
        Chairwoman VELAZQUEZ. Good morning. I call this hearing to
    order.
        Without objection, the Chair is authorized to declare a
    recess at any time.
        Let me begin by saying that standing House and Committee
    rules and practice will continue to apply during hybrid
    proceedings. All Members are reminded that they are expected to
    adhere to these standing rules including decorum.
        House regulations require Members to be visible through a
    video connection throughout the proceeding, so please keep your
    cameras on. Also, please remember to remain muted until you are
    recognized to minimize background noise. If you have to
    participate in another proceeding, please exit this one and log
    back in later.
        In the event a Member encounters technical issues that
    prevent them from being recognized for their questioning, I
    will move to the next available Member of the same party and I
    will recognize that Member at the next appropriate time slot
    provided they have returned to the proceeding.
        For those Members and staff physically present in the
    Committee today, we will continue to follow the most recent OAP
    guidance. Masks are no longer required in our meeting space for
    Members and staff who have been fully vaccinated. All Members
    and staff who have not been fully vaccinated are still required
    to wear masks and socially distance.
        As new technology has made America more dependent on
    digital tools, malicious actors have been launching more
    frequent and severe cyber attacks. In the early months of 2021,
    we have seen a wide array of headlines detailing attacks on
    institutions like large corporations and municipal governments.
        Just yesterday, the Biden administration acknowledged that
    hackers affiliated with the Chinese government were responsible
    for hacking Microsoft email systems, compromising tens of
    thousands of computers worldwide and exposing reams of
    sensitive data. The fallout of the attack is still being
    evaluated, but it is estimated the hack could have affected
    hundreds of thousands of small businesses. Episodes like this
    exhibit the significant threat cyber attacks pose to small
    businesses.
        This risk has increased in recent years as small businesses
    have begun to rely more heavily on digital technologies.
    According to the Connected Commerce Council, 72 percent of
    small firms increased use of digital tools during the pandemic.
        Unfortunately, as digital adoption has increased,
    investment in security measures has not kept pace. Small
    businesses often do not have the resources to invest in an
    adequate cyber defense system or hire a dedicated specialist.
    Guarding against cyber attacks often comes with high
    implementation costs and substantial investments of time and
    resources. Many are already operating on thin margins and slim
    human resources.
        Failing to prepare for a cyber attack can have disastrous
    impacts. Damage to information systems, regulatory fines, lost
    customer trust, decreased productivity, and lost income are all
    potential consequences of a cyber breach.
        Because of their structural importance to the overall
    economy, attacks on small firms can have severe impacts on
    larger enterprises and governments connected to them through
    the supply chain. Given the greater risk cyber attacks pose to
    small employers and their limited capacity to protect against
    them, this Committee must find ways to help entrepreneurs
    strengthen their cybersecurity posture.
        Today's hearing gives us the chance to examine how existing
    cyber resources can be enhanced and integrated into small
    business support mechanisms.
        I also look forward to discussing new initiatives that can
    alleviate the financial burden of cybersecurity preparedness.
    Small businesses are the foundation of our economy, so their
    vulnerability is our nation's vulnerability. Investment in
    their security will make us all more secure.
        I would now like to yield to the Ranking Member for his
    opening statement.
        Mr. LUETKEMEYER. Thank you, Madam Chairwoman.
        In preparing for today's hearing, I am reminded of how
    pervasive the use of the internet and information technology
    has become in our society in such a short period of time. We
    bank online, we work online, for the past year, we have held
    many congressional hearings online. Our growing dependency on
    constantly evolving information technology is fundamentally
    altering the way we live, and the way businesses of all size
    operate.
        Although benefits springing from the utilization and
    adoption of new technologies are incalculable, we are forced to
    contend with a new threat, specifically, the explosive growth
    of a criminal industry seeking to steal valuable data and
    manipulate critical systems for financial gain.
        As the world continues to embrace new technology, we
    increase the attack surfaces through which cybercriminals can
    infiltrate and wreak havoc to a devastating effect.
        These attacks are not without consequence. The cost of
    cybercrime is absolutely overwhelming. Experts estimate global
    damages totaling $6 trillion this year alone, projected to
    reach a staggering $10.5 trillion annually by 2025.
        Because small businesses are the intended targets of
    cybercriminals approximately half the time, the damage
    inflicted upon small businesses is catastrophic. These attacks
    push many to the brink with one in six businesses reporting the
    financial impact materially threatening the company's future.
    In addition to financial costs, many are unable to recovery
    from the loss of their intellectual property, resources, and
    reputation following a cyber-attack.
        During my time with this Committee as a member and now as
    Ranking Member, I have had the privilege to speak with many
    small businesses in my district and beyond, and I say with
    certainty that many small businesses do not have the resources,
    knowledge, and awareness to properly defend against such
    attacks which is precisely what makes them attractive targets.
    Many lack insufficient inhouse expertise to deal with these
    breaches, leaving it up to the small business owners themselves
    to handle the matter with predictable results.
        Make no mistake; this is asymmetrical warfare.
    Cybercriminals expend little effort targeting small businesses
    that often have fragile to nonexistent cybersecurity defenses,
    while small businesses must allocate valuable time and precious
    resources to defend against this faceless enemy. While attacks
    against large businesses consistently make frontpage news,
    small businesses must not be disregarded. The new reality is
    that large organizations are merely sprawling networks of
    interconnected business partners consisting of all sizes of
    companies including small businesses, each a viable vector for
    attack.
        And one of the most effective means of shoring up
    cybersecurity defenses is knowledge. Knowledge is power and we
    need to empower small businesses with the tools they need to
    protect themselves, and by extension, the wider network of
    businesses and organizations they touch.
        A critical component to knowledge is the need for
    information sharing among the public and private sectors. As
    fast as cybersecurity systems are established and patched,
    cybercriminals are already looking for and in many cases
    successfully finding new creative ways to infiltrate
    organizations' internal networks. Having a robust information
    sharing system is fundamental for a strong and effective
    cybersecurity defense not just for small businesses but for our
    country as a whole.
        Unfortunately, small businesses experience significant
    resistance to participating in cybersecurity information
    sharing activities for a variety of reasons. They may be
    reluctant to risk exposure to potential legal liabilities
    resulting from the disclosure and they may harbor doubts
    regarding the government's ability to adequately protect
    reported data and privacy information.
        The federal government recognizes these concerns and has
    made significant strides towards alleviating these fears.
    However, these effects must continue to improve in order to
    make the most impact on small businesses which derive the
    digital economy's growth, innovation, and job creation.
        To that end, there are several pieces of bipartisan
    legislation introduced by my colleagues on this Committee which
    attempt to begin resolving some of the issues and reservations
    small businesses have. I hope we will engage in a fruitful
    dialogue with our witnesses about this legislation today.
    Combatting cyber threats is a vastly complicated issue that
    will require largescale coordination across the entire federal
    government and private sectors.
        We must not let that complexity deter us from our goal.
    Rather, we must redouble our efforts towards strengthening the
    cybersecurity of our country starting with small businesses. I
    look forward to hearing the testimony of the witnesses.
        And with that, Madam Chair, I yield back.
        Chairwoman VELAZQUEZ. Thank you, Mr. Luetkemeyer. The
    gentleman yields back.
        I would like to take a moment to explain how this hearing
    will proceed. Each witness will have 5 minutes to provide a
    statement and each Committee Member will have 5 minutes for
    questions. Please ensure that your microphone is on when you
    begin speaking and that you return to mute when finished.
        With that, I would like to introduce our witnesses.
        Our first witness is Ms. Tasha Cornish, the Executive
    Director of the Cybersecurity Association of Maryland known as
    CAMI, located in Baltimore, Maryland. CAMI is dedicated to
    enhancing the local cybersecurity ecosystem by offering
    training, cyber career networking, and the Cyber SWAT team
    which is a free cybersecurity incident hotline. Ms. Cornish has
    nearly a decade of nonprofit leadership experience and she
    earned her master's degree at Johns Hopkins Bloomberg School of
    Public Health and holds a bachelor's degree in neuroscience
    from Cedar Crest College. Welcome, Ms. Cornish.
        Our next witness is Ms. Sharon Nichols, the State Director
    for the Mississippi SBDC. The state's SBDC network provides
    business services at 15 centers and sites, including the
    Mississippi State University Center for Cyber Innovation. The
    MSU SBDC hosts a cybersecurity project to help small businesses
    with data protection in the wake of COVID-19. Before coming to
    Mississippi, Ms. Nichols spent 10 years working for the
    Oklahoma SBDC. Ms. Nichols has an MBA from the Northeastern
    State University and a bachelor's degree from the University of
    Central Oklahoma. The Mississippi SBDC was named Resource
    Partner of the Year for 2020. Congratulations, and welcome, Ms.
    Nichols.
        Our third witness is Ms. Kiersten Todt, the Managing
    Director of the Cyber Readiness Institute known as CRI located
    in New York City. CRI provides prescriptive, accessible, and
    free content and tools to improve the resilience and readiness
    of small and medium-sized enterprises. Ms. Todt has a master's
    in public policy from the John F. Kennedy School of Government
    at Harvard University and earned her bachelor's degree at
    Princeton University. We appreciate your time and expertise,
    Ms. Todt.
        Now I yield to the Ranking Member to introduce our final
    witness.
        Mr. LUETKEMEYER. Thank you, Madam Chair.
        I would like to welcome our final witness, Mr. Graham
    Dufault. Mr. Dufault is the Senior Director for Public Policy
    at ACT/The App Association, representing more than 5,000 app
    makers and connected device companies in the mobile economy.
    The app association gives voice to small technology companies
    and its mission is to help members promote an environment that
    inspires and rewards innovation while providing resources to
    help them raise capital, create jobs, and continue developing
    incredible technology. Mr. Dufault is no stranger to Capitol
    Hill having served as counsel for the House Energy and Commerce
    Committee. He now leads a number of critical public policy
    initiatives on behalf of The App Association members. He earned
    his JD with a concentration in communications law from George
    Mason University and a bachelor's degree in Economics from
    Emory University. Mr. Dufault, welcome back to the Hill. And
    thank you for your participation today. We look forward to your
    testimony. And you are parking at a very good spot along the
    street this morning by the way, right across from my apartment.
    So anyway, thank you, Mr. Dufault for being here. I yield back.
        Chairwoman VELAZQUEZ. The gentleman yields back.
        Ms. Cornish, you are now recognized for 5 minutes.

    STATEMENTS OF TASHA CORNISH, EXECUTIVE DIRECTOR, CYBERSECURITY
    ASSOCIATION OF MARYLAND, INC.; SHARON NICHOLS, STATE DIRECTOR,
     MISSISSIPPI SMALL BUSINESS DEVELOPMENT CENTER; KIERSTEN TODT,
     MANAGING DIRECTOR, CYBER READINESS INSTITUTE; GRAHAM DUFAULT,
       SENIOR DIRECTOR FOR PUBLIC POLICY, ACT/THE APP ASSOCIATION

                       STATEMENT OF TASHA CORNISH

        Ms. CORNISH. Great. Thank you again for the invitation to
    be here.
        So CAMI is an approximately 580-member association based in
    Maryland. We were founded in 2015 to grow the industry. About
    80 percent of our members are cyber providers, providing
    products and services to small businesses and the government.
    The other 20 percent supports the industry through cyber
    liability, data privacy law, and other business building
    resources.
        So one of our main roles is to provide business building
    resources to these cyber companies and the other is to educate
    small and medium-sized businesses about cyber hygiene and to
    provide solutions. So I am here specifically to talk about
    that. I am going to cover three of our programs today: our
    Cyber SWAT team; our variety of curated directories of products
    and services; and our advocacy work for financial incentives.
    Additionally, we do collaborative workshops with our business
    partners and chambers of erce and other trade associations, and
    we also do workforce development initiatives to build that
    critical pipeline of IT and other professionals in cyber.
        So our Cyber SWAT team came out of this huge shift to work
    from home that happened last year. As mentioned before, it
    really expanded the threat surface that our small businesses
    experienced. Virtual machines, VPNs and remote access points
    are commonly high targets for threat actors. So we developed
    the Cyber SWAT team in partnership with the State of Maryland
    and it is a coordinated breach response with all components--
    technology providers, cyber providers, cyber insurance, legal
    and compliance, and communication and PR. So businesses who are
    either experiencing a breach or suspected breach can submit
    their request via email and online form or via the phone. So
    within 1 hour, they will receive a call from our triage team.
    We will triage their request to our best fit cyber companies
    based on their size, location, industry, and breach needs.
        So there is no cost to connect with this information,
    resources, or referrals. They get that 1-hour free
    consultation. Of course, if they do choose the services, they
    enter a contract and then pay for those services. But this has
    helped greatly to assist companies in Maryland and beyond
    really with external threats such as phishing campaigns and
    ransomware. And also internal threats, including when
    terminated employees have unauthorized access to systems.
        So moving further upline in the protect and defend section,
    we provide an online directory of all of our member companies
    with relevant designations, including minority-owned small
    businesses, women-owned small businesses, service-disabled
    veteran-owned small businesses, 8(a), et cetera.
        So this is helpful for prime contractors and others looking
    for subs at government agencies, of course, but also private
    sector companies who prioritize diverse vendor pools. We also
    do publications with our local business guides and we are
    launching a program now with Exelon, a Fortune 100 company that
    works in every stage of the energy business. I do not need to
    tell you that there have been some pretty high profile breaches
    within that industry, and typically that is an industry that
    has not had a lot of regulations and compliance. So we are
    working Exelon to connect them through our new database with
    providers in our membership who can help their vendors build
    security programs and complete assessments to really secure
    that supply chain for the energy industry. It is a very highly
    specialized industry so many of these vendors are seeing this
    information for the first time so we are pleased to partner
    with them to do that.
        Additionally, we will be doing something similar for our
    DOD contractors as CMMC or Cybersecurity Maturity Model
    Certifications come down the pipeline to again provide those
    resources to our small businesses who are doing government
    work.
        Lastly, I want to touch on some of the financial incentives
    that we have advocated for. So in 2018, we actively advocated
    for the Buy Maryland Tax Credit which was approved by the
    Maryland General Assembly and signed by Governor Hogan. So it
    offers qualified Maryland businesses fewer than 50 employees to
    receive a tax credit, which is worth 50 percent of the purchase
    price when they buy it from qualified Maryland cyber providers
    of products and services. So qualified sellers are, again,
    small companies or companies owned by the specific
    designations. And this offers up to $4 million worth of tax
    credits each year and has an active directory of about 50
    companies.
        Additionally, there are funds that come down from the
    federal government. So, for example, the Defense Cybersecurity
    Assistance program, which, again, being in Maryland, we have a
    lot of government contractors who do work with the DOD so there
    are specific funds that we help promote that those contractors
    can use for assessments and remediation. Thank you.
        Chairwoman VELAZQUEZ. Thank you, Ms. Cornish.
        Now we recognize Ms. Nichols for 5 minutes.
        Ms. Nichols, you need to unmute yourself, please.

                      STATEMENT OF SHARON NICHOLS

        Ms. NICHOLS. It says that I am unstable. Can you hear me?
        Chairwoman VELAZQUEZ. Yes, we can hear you now. Thank you.
        Ms. NICHOLS. Thank you. Good morning.
        In order to survive the pandemic, many small businesses had
    to quickly pivot to online platforms to sell their product and
    shift to remote work. The small businesses of our nation are at
    high risk for hackers due to the inadequate cybersecurity
    protection for their data and intellectual property as was
    discussed before.
        Why are they at an increased risk? Just like it was said,
    owners simply do not know how to protect their business or they
    lack the funds to do so. Most hackers want money but that is
    not all that is at risk here. No small business wants its
    customers or clients to know that they have been breached and
    it is a fear that they will lose the business or that hard-
    earned trust. And so many go unreported.
        In 2016, it was estimated that 10 to 12 percent of all
    cybercrimes were reported. In Mississippi alone, in the last
    couple of weeks, there was a medical clinic in our small town
    that had to pay a ransom to get their data back. This was never
    reported in the news. Just 2 weeks ago, our own office was hit
    by an email phishing scam and I was given an email yesterday in
    regards to a heating and air company that lost a couple of
    weeks of work due to a scan.
        My name is Sharon Nichols. I am the state director of the
    Mississippi SBDC where we offer connection, education and
    guidance for thousands of businesses across the state.
        In response to the cybersecurity crisis, the MSBDC
    allocated a portion of the CARES Act funds we received to
    develop a cybersecurity center to help Mississippi small
    businesses become cyber aware and more prepared. This center
    that was developed offers training based on the CMM model and
    the CMMC, but we call it the CMM model because we do not do
    certification, offering actionable steps any business owner can
    take. Also, access to trained cybersecurity counselors for
    individual counseling, as well as on-demand cybersecurity
    workshops that are available on our website. Everything that we
    offer is for free.
        The Cybersecurity Maturity Model that we have implemented
    is based on a program initiated by the U.S. Department of
    Defense in order to measure their defense contractors'
    capabilities, readiness, and sophistication in the area of
    cybersecurity. And we have adopted this model because it is a
    tool that can be personalized and expanded to meet each
    business's unique levels. Levels one through three, and there
    are five in the CMMC model, are considered attainable by small
    businesses and are designed to make securing a business
    affordable, yet very effective.
        Please know, again, we do not offer the certification at
    the end of each level but business owners can pursue that on
    their own if they choose.
        Collaboration and connection in all of our organizations is
    key and it is the future. The Mississippi Cyber Initiative we
    call MCI was created to offer a central location for the
    exchange of ideas and beneficial information about the
    cybersecurity. The Air Force Base on the Gulf Coast of
    Mississippi, Mississippi State University, and Mississippi Gulf
    Coast Community College are part of MCI. Our organization, the
    Mississippi SBDC has been invited to explore ways MCI resources
    can be shared with the business community. This is an example
    of collaboration and connection.
        The Mississippi SBDC serves the small businesses of our
    state with connection, education, and guidance. And I would
    like to point out how we have applied these guiding principles
    in response to the cyber crisis. Through connection, we are
    connecting our business owners with valuable cybersecurity
    resources via the MSU Cybersecurity Center and MSI into MCI and
    other collaborations. We are acting as a conduit for the
    Federal, state, and local resources to the small businesses in
    our state.
        In education, we are utilizing the Cybersecurity Center to
    educate business owners so that they can evaluate the threat
    that they have and their threat level and institute measures
    for protection. We will be employing a variety of marketing
    platforms reaching out through videos and PSAs and pushing
    awareness on all six of our social medial channels. We are
    working to dismantle the idea that small business owners are
    powerless to take charge of cybersecurity and make the process
    involved simple, yet effective.
        Finally, through guidance, we actively supply support and
    guidance via our one-on-one counseling with cybersecurity
    counselors at no cost to business owners. By supplying one-on-
    one guidance, business owners can get answers to specific
    questions and solutions unique to their situations. There is no
    putting the genie back in the bottle. Our lives and livelihoods
    are connected via the cyberworld.
        Small businesses play a huge part in the welfare of our
    communities and the nation. We must put cybersecurity and cyber
    safety of our businesses at the forefront of everything that we
    do and equip them with every tool to succeed and protect their
    businesses.
        I very much appreciate the opportunity to be a voice for
    the small businesses of Mississippi, as well as the nation.
    Thank you for inviting me to testify.
        Chairwoman VELAZQUEZ. Thank you, Ms. Nichols.
        Ms. Todt, now you are recognized for 5 minutes.

                       STATEMENT OF KIERSTEN TODT

        Ms. TODT. Thank you, Chairwoman Velazquez, Ranking Member
    Luetkemeyer, and members of the Committee. Thank you for the
    opportunity to testify before you today.
        I currently serve as managing director of the Cyber
    Readiness Institute, a nonprofit effort that convenes senior
    executives of global companies to share resources and best
    practices that inform the development of free cybersecurity
    tools for small businesses, including the Cyber Readiness
    Program, a five-step, self-guided program, several guides all
    based on human behavior.
        In 2016, I served as executive director of President
    Obama's Commission on Cybersecurity, and after the conclusion
    of the Commission, several of the commissioners and myself came
    together to launch this effort. Relevant to the hearing today,
    I also served as a senior staff member on the Senate Homeland
    Security and Governmental Affairs Committee before, during, and
    after 9/11 and helped to draft the legislation to create DHS.
        The assaults on our nation's digital infrastructure,
    particularly over the last 12 months, underscore the urgent
    need to close a critical gap in our nation's cyber defenses.
    When we think about cybersecurity, we tend to think at a
    macrolevel, about state actors and state secrets, hacks of
    millions of online identities, and direct threats to critical
    infrastructure. And when we think about remedies, we tend to
    focus on digital giants and on national or multinational policy
    making. These policy solutions are necessary and appropriate
    but they are not sufficient. The threats we face as a nation
    and as individual consumers and citizens are not restricted to
    the macro level.
        Given that over two-thirds of large businesses outsource a
    portion of their functions and allow third-party access to
    their data, insufficient cyber protection among SMBs can be
    consequential for larger firms, too, as we saw with solar winds
    in Kaseya. SMBs, which are constrained by limited resources and
    unable to invest proportionately in cybersecurity expand our
    risk exposure significantly. Eighty percent of America's
    businesses have fewer than 10 employees, and 95 percent have
    fewer than 100.
        SMBs are the backbone of our economy but they are
    inherently fragile. During the pandemic, according to the SBA
    administrator at the time, a small business was closing every
    hour. These small enterprises lacked the resilience to
    withstand a barrage of cyber attacks. Small businesses do not
    have the safety nets that large businesses do. An attack of any
    size can challenge their viability.
        At the end of 2020 and earlier this year, we experienced
    the impact of several high-profile attacks, with impacts across
    multiple supply chains and critical infrastructure. We have
    been forced to now understand that in addition to physical
    supply chains, all businesses, especially small businesses,
    must pay attention to their IT supply chains.
        These events have brought us to another so-called
    inflection point. So-called because we use this term frequently
    when it comes to cybersecurity, yet we continue to fail to do
    what is necessary to improve America's cyber defenses. These
    events and attacks are symptoms of the challenges we face.
    Policies are not enough, nor can we simply shrink tools and
    techniques employed by major corporations into compact versions
    for SMBs.
        Small businesses need access to cybersecurity resources and
    support from the federal government. They need prescriptive,
    easy to adopt programs that strengthen their everyday
    operations while not pinching their budget. Because a small
    business may not have a department or even a single employee
    solely focused on cybersecurity, approaches grounded in
    creating cultural change through human behavior and education
    are critical to helping small businesses become more resilient.
        Human behavior can be a force multiplier for cybersecurity
    in small businesses and larger ones as well. Small businesses
    must be educated on the threats and the fundamental actions
    that they need to be resilient.
        The federal government can play a critical role. Earlier
    this year, the Cyber Readiness Institute released a white
    paper, The Urgent Need to Strengthen the Cyber Readiness of
    Small and Medium Sized Businesses: A Proposal for the Biden
    Administration, outlining actions to help small businesses.
    Here are five steps from the white paper that the federal
    government can take to improve small business cybersecurity
    defenses.
        My prepared testimony goes into greater detail and I am
    happy to elaborate during our Q&A.
        1. Create a Small Business Cybersecurity Center. Today, no
    single government agency curates cybersecurity resources from
    multiple vetted sources for SMBs. Given the ongoing work to
    support SMBs by the Cybersecurity and Infrastructure Security
    Agency and the recent allocation of additional resources to the
    agency. CISA is a recommended agency to perform this function.
        2.Establish cybersecurity incentives. Tax credits to SMBs
    that invest in cybersecurity can incentivize cybersecurity
    efforts.
        3.Set cybersecurity standards. We need minimum standards
    for cybersecurity that all organizations must follow, including
    small businesses.
        4.Launch national cyber squads. We should amplify the
    existing cyber corps with government-funded cyber squads of
    student interns to help minority-owned SMBs and to fill a
    desperately needed talent pipeline.
        5.Roll out a national cyber readiness education campaign.
    Awareness is critical for small businesses in the entire
    population. We need an effective public service campaign that
    would focus on a single, basic cybersecurity issue, such as
    using multifactor authentication which experts assert would
    reduce cyber attacks significantly.
        Our nation's cybersecurity challenges are diverse. One
    foundational way we can improve our defenses is by supporting
    and investing in the cyber readiness of small businesses.
    America's hundreds of thousands of small businesses can be
    mobilized, educated, and supported to be our resilient
    frontline of cyber defense and to become a great strength for
    our country. This critical investment in building that strong
    defense will pay major dividends for our nation. Thank you.
        Chairwoman VELAZQUEZ. Thank you, Ms. Todt.
        We recognize Mr. Dufault for 5 minutes.

                      STATEMENT OF GRAHAM DUFAULT

        Mr. DUFAULT. Thank you, Chairwoman Velazquez, Ranking
    Member Luetkemeyer, members of the Committee. My name is Graham
    Dufault, and I am senior director for Public Policy at ACT/The
    App Association. The App Association is the leading trade group
    representing small, connected device and mobile software
    companies in the app economy which is about a $1.7 trillion
    sector globally that supports about 5.9 million jobs in the
    U.S., including in your districts.
        I am here to ask for your help to improve the cybersecurity
    resources for small businesses that are the backbone of your
    districts.
        In Brooklyn, Ali Iberraken founded Chaperone, an app to
    help teachers organize and manage fieldtrips. Jason Oesterly, a
    former IBM and MasterCard developer created WASHMO Media in
    Washington, Missouri. So app economy innovators like Chaperone
    and WASHMO deal with cyber threats all the time. Small
    companies, even in industries associated with a higher level of
    technical expertise, like our members, our favorite target is
    cybercriminals. In fact, about 71 percent of companies
    reporting cyber attacks are small firms. And around 80 percent
    of small firms say they are not prepared for a cyber attack.
    Most of them are reticent to tell anyone about the fact that
    they are victims as you have heard from other testimony today.
        We want to highlight four main things for this hearing.
        1. While recent high-profile ransomware attacks are
    grabbing headlines, it is difficult for small companies to
    share information about threats, incidents, and defensive
    measures they use. Legislation like H.R. 1649 and 1649 from
    last Congress would help create better conditions for
    information sharing and readiness. So we appreciate the
    Committee's work on those pieces of legislation and we are
    pleased to see that at least one of them is being reintroduced
    this week.
        2.Cybersecurity is a team sport in many ways. Small
    companies, especially app makers, leverage the cybersecurity
    capabilities of software platforms such as app stores,
    operating systems, and Cloud services to protect their clients
    and customers. Federal policy should enable these platforms to
    take protective measures and to avoid undue interference with
    them on antitrust and other grounds.
        3.Cybersecurity begins with good defenses. Small companies
    rely on technical protection measures like encryption of data
    in transit and at rest and on devices, so where is the
    Committee to push back on proposals that would weaken
    encryption?
        And a bonus,
        4.I would be remiss if I did not mention the number one
    daily issue my industry faces and that is finding and hiring
    enough qualified people. With about 3.5 million unfilled
    cybersecurity jobs globally, Federal investment in this area is
    necessary. So we support programs like the Master Teacher Corps
    and legislation like the Computer Science for All Act, H.R.
    3602.
        App Association members and our customers have everything
    to lose when it comes to cyber threats. The onslaught of recent
    attacks comes amid a global talent shortage so we cannot simply
    hire our way out of the problem. Therefore, we need your help.
        Cybersecurity for mobile devices is important for everyone.
    For example, Black and Hispanic Americans rely
    disproportionately on mobile devices as opposed to desktop
    computers to access online services. These devices now contain
    our most sensitive personal data, including financial real-time
    location and health information. Therefore, app makers in
    particular must leverage the security features of software
    platforms and Cloud services. Unfortunately, in some proposals
    in Congress and in some states that prohibit these gating
    functions ostensibly to help my member companies and your
    constituents but in truth they would do much more harm than
    good. So we urge you to reject those ideas as the make smart
    devices much less secure and much more attractive targets. Why?
    Because cybercrime is a business after all. And cybercriminals
    benefit also from the silence of their victims.
        If Congress's goal is to make it harder for cybercriminals
    to do business, information sharing plays a key role. We need
    to make it too costly for cybercriminals to target small
    companies with $15,000 ransoms. The attacks we see on small
    firms from real estate investment to neighborhood bike shops
    are often well-designed to ensnare specific kinds of victims.
    The attackers learn the lingo of the sector they target and
    study everyday practices to disguise phishing attempts so that
    they look legitimate. Understanding these shifting forms of
    camouflage requires rapid intelligence sharing and we need to
    counterbalance the potential legal exposure and reputational
    harm of disclosure.
        While small companies often rely on outside support and
    expertise for cybersecurity, it is impossible to contact away
    risk or accountability for security. It is incumbent on small
    companies to develop a level of independent working knowledge
    of cyber threats to their business and information sharing best
    practices.
        The Committee is well-positioned to help improve
    cybersecurity, literacy for small firms, and the conditions for
    information sharing, and we look forward to assisting with
    those efforts.
        Thank you for the opportunity to share our views, and I
    look forward to your questions.
        Chairwoman VELAZQUEZ. Thank you, Mr. Dufault. I will begin
    by recognizing myself for 5 minutes. I just want to say that it
    is kind of scary listening to your stories and your expertise
    regarding the threat of cybersecurity. I would like to ask Ms.
    Todt, based on your own experience having worked for the
    federal government, and now as the CEO of this institution, do
    you think that there is an ongoing education throughout the
    federal government in terms of different agencies as to the
    threat that they are exposed to? How does that trickle down to
    those most vulnerable--in this case, small businesses?
        Ms. TODT. Thank you, Madam Chairwoman.
        There is absolutely an education challenge. And when we
    talked to small businesses, and I think this holds true
    certainly for large businesses, the issue is not that they do
    not know, they do not want to do anything, the issue is that
    they often do not know what they should be doing and where the
    threat is.
        There was a survey done by Apple recently that said that
    many small businesses asked, well, is this not part of my
    software package, the security piece? And so we have to be more
    prescriptive. So when we are looking at the Federal agencies,
    and this is where I think the increase in resources to CISA is
    going to play a significant role as well as the new leadership
    working in collaboration across agencies to create a
    synchronized effort that educates the agencies on the
    priorities and also creates a unified government approach so
    that you do not have agencies looking to others to understand
    what is happening but that there is leadership both within the
    White House and within CISA that helps to streamline what needs
    to happen because the threats are certainly consistent across
    all of our agencies and I think as Chris Inglis, the new
    national cyber director said in the context of the
    international arena but it certainly is in the domestic arena
    as well, in order to get one of us you have to get all of us
    and I think that approach for government needs to hold true.
        Chairwoman VELAZQUEZ. Thank you.
        Ms. Nichols, what were the most common services requested
    by small business owners in the transition to telework because
    of COVID-19?
        Ms. NICHOLS. You know, I would like to say it was
    cybersecurity but that was not it. It was mostly sources of
    capital because they were concerned about how they were going
    to keep their doors open. And confidence to survive, trying to
    find out how to handle their financial projections as well as
    the logistics of employees, Internet connections, suppliers,
    and commitments. Cyber was not that one thing that they
    contacted us about. And so while it was the greatest need, it
    was not what they contacted us about.
        Chairwoman VELAZQUEZ. Ms. Nichols, the SBA rolled out
    several COVID-19 programs in 2020. Did any of these programs
    provide cybersecurity specific guidance?
        Ms. NICHOLS. To my memory, neither the EIDL nor the PPP
    programs provided cybersecurity specific guidance. The PPP was
    primarily for payroll followed by other items, such as rent and
    utilities and the EIDL had an allowance for accounts payable
    and other bills but not specific to cyber unless it was already
    a related expense.
        Chairwoman VELAZQUEZ. Thank you.
        Ms. Cornish, with respect to commerce directly, what is the
    importance of including the designations or certifications
    small businesses may have as part of the company information?
        Ms. CORNISH. Sure. So part of it is for, you know,
    subcontractors and prime contractors and even government
    agencies to better diversify the government contracting
    workforce. Additionally, when our companies are looking at
    their own DEI plans, many of them want to incorporate diverse
    vendors in that pool as well. So we are excited to help support
    those efforts through our designations.
        Chairwoman VELAZQUEZ. Thank you. Do you think that
    including such designations can promote diversity and
    cybersecurity contracting?
        Ms. CORNISH. Absolutely.
        Chairwoman VELAZQUEZ. Mr. Dufault, recent security breaches
    have heightened the importance of continuously monitoring
    against outside threats but the necessary technologies and
    practices are too expensive for small firms. How much on
    average is the cost to secure networks?
        Mr. DUFAULT. That is a great question. It is one of the
    main areas of focus that a lot of our member companies have to
    pay a lot of attention to. I am not sure exactly what the cost
    is per small company. It probably varies as to what kinds of
    tools you want to adopt. One of the observations of one of our
    member companies is that for a lot of really specific
    cybersecurity focused tools that help you manage your threats
    across your supply chain, the number of licenses that you have
    to buy is really high. And so it is kind of you have to buy in
    bulk, and this particular member company just signed up as a
    reseller so they could get access to a smaller number of
    licenses. And so that is potentially a problem and a potential
    area of focus here to provide more Federal resources so that
    companies can buy smaller and not necessarily in bulk access.
        Chairwoman VELAZQUEZ. What can SBA and its resource
    partners do to remove barriers for small firms that want better
    protection?
        Mr. DUFAULT. That is a great question, Chairwoman. There
    are a few things that you guys can do. We were really happy to
    see Congress introduce H.R. 1648 and 1649 last Congress. These
    are bipartisan bills that would help ensure that there are
    liability protections for information sharing with the
    government, but also to provide more resources for small
    companies through the federal government through the SBA to
    have access to cybersecurity counselors. And so that was H.R.
    1649 which has a certification program for SBA employees. So
    access to that through the SBDCs is something that we feel
    would be a great improvement and would help them.
        Chairwoman VELAZQUEZ. Thank you. My time has expired.
        Now we recognize the Ranking Member, Mr. Luetkemeyer.
        Mr. LUETKEMEYER. Thank you, Madam Chair.
        Mr. Dufault, you know, one of the things that is concerning
    to me is the cost to be able to protect the small businesses
    out there. And so it is a two-part question. The first part of
    it is what would be the average cost that a small business
    would have to anticipate occurring to be able to protect
    themselves? And then the problem becomes, well, you have got to
    protect it today but there are a lot of smart guys out there
    that are going to figure out how out how to break into the
    security you have got right now so you are going to have to
    continue to update your security and you are always behind the
    curve, so to speak here in trying to protect yourself. And so
    these ongoing costs are sometimes things that I think deter
    small business from even, they throw their hands up and say,
    well, I probably cannot afford the first set of security
    measures. I sure cannot continue to pay money out the door when
    I think my exposure is small. How would you answer that
    question?
        Mr. DUFAULT. So it is a great question, Congressman. I
    think, you know, one of the member companies described the cost
    of just trying to get penetration testing, which is kind of an
    entry level set of services where an outside firm comes in and
    tests your network. Tests the integrity of the security systems
    that you are using. And that can cost between $10,000 and
    $30,000 according to the member company. And that is just the
    one-time cost. And that is just for that service. So if you
    want to buy the full suite of services it goes up from there.
        Now, we also have member companies that have worked with
    other customers that have had trouble putting together $200 to
    pay for antivirus software which is the lowest, sort of the
    lowest level tool that you can invest in. So it ranges quite a
    bit, I think, depending on the kind of company you have and
    your focus and whether or not you are seeing these threats.
        Another thing I will point to is the IT sector coordinating
    council. So DHS has various sector coordinating councils where
    they focus on cybersecurity in different sectors. The IT sector
    coordinating council did a survey of small businesses, and
    about 38 percent said they do not expect to see a cyber
    incident in the next 2 to 3 years which is a little bit of
    overconfidence I think. And so there is a baseline level of
    sort of an appreciation that you have to have in addition to
    the amount of money that comes along with the basis for
    spending that kind of money on these protective measures. So on
    an ongoing basis as you pointed out, it is even harder.
        Mr. LUETKEMEYER. Thank you.
        Ms. Cornish, you talked about a tax credit that was put
    together by I think the State of Maryland I think you
    indicated, which is intriguing to me. But I was curious, what
    kind of participation rate was there among the small
    businesses? And what was the average cost that they actually
    were able to get a credit for? Or do you know that information
    off the top of your head?
        Ms. CORNISH. Sure. I can speak a little bit to that.
        So it certainly is not utilized to its full potential by
    our small business community. So we know that there is work to
    do on our end to help promote that as well. I think to Graham's
    point, many of the costs range between $5,000 to about $30,000.
    There are ways to do continuous monitoring that is a little bit
    less expensive on the defensive side. So then it only cost
    about $6,000 to $10,000 a year.
        Mr. LUETKEMEYER. One of the things I think, Mr. Dufault, I
    think back to you again. I think somebody else mentioned,
    talked about the number of folks within the industry worth 3.5
    million jobs, people short to be able to fill the number of
    folks. What is the problem here? We just do not have enough
    people interested in the field? The wages are too small to
    attract people into it? Nobody likes to do that kind of work?
    What do you think?
        Mr. DUFAULT. There are a number of different factors. Some
    of it is cultural. There is a lack of, I think, awareness of
    the available jobs. When you are going into college and when I
    was going into college there was not a whole lot of emphasis on
    sort of STEM fields at that time. So there is sort of an
    outreach campaign that can be done to make sure the folks know
    that this is where high-paying jobs are. It is $89,000 median
    salary for this kind of work here in the U.S. across the
    country.
        Mr. LUETKEMEYER. Let me interrupt. My time is about up
    here.
        Is this something that Small Business Administration could
    do? They could entice or enhance or send out information to the
    high schools and folks, colleges, to let them know that there
    is availability of all this? I mean, we have to get the SBA
    engaged in this somehow because this is a small business issue.
        Mr. DUFAULT. I think that is a great idea. I think that
    there is definitely a role for the Small Business
    Administration there. There are other Federal agencies that
    ought to be involved but the Small Business Administration in
    particular because small companies do have trouble finding
    access to qualified folks.
        Mr. LUETKEMEYER. My time is expired. Thank you. I yield
    back.
        Ms. HOULAHAN. The gentleman's time is expired and the
    gentleman yields back.
        The gentleman from Colorado is now recognized for 5
    minutes.
        Mr. CROW. Thank you, Madam Chair.
        For more than 20 years, the SBA Office of the Inspector
    General has listed IT security as one of the most serious
    management and performance challenges facing the SBA. So this
    is not obviously a new thing but it is more acute and becoming
    more of a problem as particularly nation state actors and
    others weaponize the ability to go after our small businesses.
        Recently, I reintroduced the bipartisan SBA Cyber Awareness
    Act which would direct the agency to issue an annual report
    assessing its cybersecurity infrastructure. It also requires
    the SBA to report cyber threats, breaches, and cyber attacks to
    the respective House and Senate Small Business Committees. And
    then to notify affected individuals within 30 days because we
    know that notification is one of the biggest issues, is the
    required notification.
        So that is part of it. But even after the notification then
    there is the issue of what happens next? And in all of your
    testimonies you referenced the challenges particularly facing
    small businesses that just do not have the resources.
        So Ms. Cornish, starting with you, can you describe, flush
    out for me a little bit more what resources are available,
    could have the biggest impact on providing resources or support
    to small businesses particularly in high tech sectors? Like, I
    have a lot of defense, aviation, and aerospace within my
    district and a lot of those are small businesses and they are
    prime targets of hacking and intellectual property theft. What
    is out there and what could make the biggest impact that is not
    out there?
        Ms. CORNISH. Sure. So in the defense industry,
    specifically, there is the Defense Cybersecurity Assistance
    Program which provides funding for assessments, and honestly,
    you know, investing in the assessment and the protection phase
    is really where you are going to get the largest ROI for the
    SBA and others. So I would certainly encourage investment
    there. When companies are breached, you know, definitely it
    varies by the situation, but certainly shoring up interventions
    to improve your chances moving forward are critically important
    there.
        So I would love to see that the DCAP comes down from DOD. I
    would love to see other agencies also do something similar
    through their Office of Small Business work.
        Mr. CROW. Thank you.
        Ms. Todt? Mr. Dufault?
        Ms. TODT. Thank you. One of the key issues that we focus on
    at the Cyber Readiness Institute is human behavior because it
    recognizes that regardless of the sector that you are in or the
    resources that you have you have got to start by creating these
    cultures of behavior. And if we make the analogy to safety,
    creating cultures of safety that we did with businesses
    particularly following 9/11, it helps us to understand that
    while this is all new to us and it is somewhat foreign and
    uncomfortable, we often say security is not convenient, we can
    create those cultures. And by doing so, you have force
    multipliers in your companies when every individual recognizes
    that he or she can be an access point to the network, that he
    or she can be the strength that actually prevents an attack or
    can be the opportunity. And I think that is one of the pieces
    in the education that we have got to be focusing on to help
    employees have that accessibility to those resources and the
    knowledge.
        Mr. DUFAULT. Yeah, Congressman. And I agree 100 percent
    with the comments of Ms. Todt because all it takes is one weak
    point in a company or an organization and that is why you saw
    with some of the recent cyber attacks they used the password
    spray where they try really common passwords on a large number
    of accounts because chances are in an organization of a couple
    hundred people or a couple thousand people somebody will use
    password123. And so creating that culture that Ms. Todt
    described is extremely important. And also understanding which
    kinds of threats are being directed to your specific industry
    because they are kind of, as I said in the oral statement just
    a minute ago, the attackers are studying the everyday habits
    and trying to mimic those and they do a pretty good job of that
    based on specific sectors. So, info sharing within sectors is
    extremely important.
        Mr. CROW. Thank you.
        And Ms. Nichols, to you, and I guess to that last point
    since you are with an SBDC, on the training piece, training of
    employees and others, how can we better do that or assist small
    businesses in conducting the training?
        Ms. NICHOLS. So we are basing our model on the DOD
    cybersecurity model, the CMMC, but just using the CMM portion
    of it. And I liken it to the Maslow's Hierarchy of Needs.
    Basically, on level one through three is basic cyber hygiene,
    and it is all about education and awareness, where also I think
    it is very imperative that we look at what is our consistent
    voice and what is that consistent messaging because there are a
    lot of resources out there and a lot of organizations, and I
    believe that the consistent messaging and education and
    training is very key not only just for employees but for
    potential employees because there needs to be that standard
    base and education.
        Mr. CROW. Thank you. My time is expired. I yield back.
        Ms. HOULAHAN. Thank you. The gentleman's time is expired
    and the gentleman yields back.
        The gentleman from Texas, Representative Roger Williams,
    the Vice Ranking Member of the Committee is now recognized for
    5 minutes.
        Mr. WILLIAMS. Thank you, Madam Chair.
        A 2021 Cybersecurity Trend Report shows that phishing is
    the top cyber threat for small businesses as we have talked
    today. In this type of attack, simply clicking on a link or
    opening an attachment can compromise an entire company's
    network. Rather than target a vulnerability within the cyber
    network, this tactic targets unknowing employees. Regardless of
    what additional resources or best practices are shared to the
    industry, we must ensure that we are not leaving out the
    socially engineered attacks that can occur on untrained
    employees.
        So Ms. Nichols, first of all, Mississippi State has a great
    baseball program.
        Ms. NICHOLS. Yes, they do.
        Mr. WILLIAMS. That is good.
        Secondly, can you discuss the training that SBDCs, and we
    have talked about this a little this morning, have to ensure
    employees are aware that they could be targets of these
    phishing attacks?
        Ms. NICHOLS. Specifically attacking employees, is that what
    you are asking?
        Mr. WILLIAMS. Yes.
        Ms. NICHOLS. Yes. And it is just a matter of awareness.
    Just like I said in my presentation, our organization had been
    phished. And it is raising awareness of that basic, what to be
    ready for and, you know, what are the very basic minimal things
    that you have to look for. And that is what we want to show our
    small businesses is how to prepare their employees to work
    remotely but also keep their intellectual property and their
    information safe. So the social engineering is really the focus
    of most training that is going on right now. And while it is at
    a higher level and you hear about the big ones like the
    pipeline and different things that have happened, it is the
    smaller phishing that is really affecting the smaller
    businesses. So education is key.
        Mr. WILLIAMS. Thank you.
        When small businesses are targeted with cyber attacks, it
    may not make the news like some of the more high-profile cases
    we have seen lately such as the Colonial Pipeline or Microsoft
    attacks. Unfortunately, since many of these smaller companies
    operate on tighter budgets, they are often easier targets and
    then the intruders can go undetected for long periods of time
    than some of the more established businesses.
        So Mr. Dufault, you mentioned in your testimony that
    smaller firms could leverage the cybersecurity capabilities of
    Cloud services. Can you elaborate on the advantages of using
    this service and why it may be a more attractive option for
    smaller firms who do not have as large of a budget to dedicate
    to cyber defense?
        Mr. DUFAULT. Absolutely, Congressman. It is a great
    question.
        As there was testimony earlier this year in the Homeland
    Security Committee where witnesses sort of elaborated on the
    capabilities that Cloud providers have in contradistinction to
    where you are using on-premises hosted servers. Right? Where if
    you have your own servers there at the small business, it is
    incumbent upon you, the small business, to install updates that
    could have security patches. It is also incumbent on you to
    sort of on your own go out and find threat indicators and
    indicators of compromise whereas all that stuff sort of happens
    quickly and efficiently if you are using Cloud-hosted servers
    where the updates are sent automatically, that patch potential
    vulnerabilities, and you also sort of benefit in real time and
    quickly from indicators of compromise that other folks are
    seeing that are using the same Cloud services. And so that is
    sort of what I am referring to when I say the ability to
    leverage those capabilities.
        Mr. WILLIAMS. Very good.
        Cybersecurity breaches are only going to become more common
    as we know and technology continues to advance and criminals
    get more sophisticated. While small businesses do what they can
    to protect themselves from attacks that never happened in the
    first place, it is ultimately the government's responsibility
    to track down and hold these bad actors accountable. If we use
    every tool at our disposal to hold these criminals accountable,
    it will deter these attacks in the future.
        Ms. Cornish, are there any roadblocks that are preventing
    the federal government from more aggressively prosecuting
    cybercrimes?
        Ms. CORNISH. To my understanding, no. But I do----
        Mr. WILLIAMS. You believe that?
        Ms. CORNISH. I am encouraged by the partnership, the
    public-private partnership that we are continuing to discuss
    because I do also believe that that is part of it. But I do not
    feel like I can speak to the roadblocks specifically at the
    Federal level blocking that.
        Mr. WILLIAMS. Well, public-private partnerships only work
    better. No question.
        I yield my time back, Madam Chair. Thank you.
        Ms. HOULAHAN. Thank you. The gentleman's time is expired
    and the gentleman yields back.
        The gentleman from Maryland, Representative Mfume, the
    Chairman of the Subcommittee on Contracting and Infrastructure
    is now recognized for 5 minutes.
        Mr. MFUME. Thank you very much, Madam Chair. Good morning,
    everyone.
        I have got a question for any of you or either of you who
    may know the answer should feel free to address. With respect
    to cyber attacks, what do you estimate the average loss to be
    as a percentage of overall revenues to small businesses
    regardless of their size?
        Ms. TODT. So based on research and studies that we have
    conducted with some of our member partners and the larger
    global companies, we estimate that a cyber breach can cost
    about $4 million per small business. So when you think about
    the revenue that small businesses have, sometimes that does not
    even cover their revenue. And the number of employees, whether
    it is 2, 20, or 200, the significance of that piece. And I
    think the challenge for small businesses is their awareness
    that they are an access point to larger companies but that they
    also hold data. And data a couple years ago surpassed oil as
    the most valuable global commodity. And I think these issues
    for small businesses require the education so that they are not
    in a position where they are paying $4 million to respond
    because the recovery takes quite a long time.
        Mr. MFUME. And so how many small businesses does that wipe
    out on an average per year?
        Ms. TODT. So there are different statistics around this but
    what we saw with the pandemic is that over 65 percent of small
    businesses that suffered a breach did not go back online 6
    months later. So that given a 6 month recovery time, those
    small businesses did not recover.
        And I think one of the things that we have learned again, a
    lot from our large member companies is that the recovery piece
    to this, it is like a hurricane. We get very involved in the
    crisis response. It is on the front page of the paper. We are
    looking to see how everybody is doing. But when you go back 6
    months later into the community, or 12 months later, you are
    seeing long-term and devastating impact. The same is true for
    businesses, particularly with ransomware attacks because of the
    impact it has.
        Mr. MFUME. And what about 5 years ago. What would you have
    said that same dollar amount would have been?
        Ms. TODT. So I would say it would have been a lot less. I
    cannot estimate but I think, you know, and I do not even
    believe that small businesses were the target that they are
    today. What has happened with IOD and the interdependencies of
    the digital economy is that small businesses are such critical
    parts of global supply chains that now to the point that we
    have all discussed, they are a target because they are the
    weakest link.
        Mr. MFUME. And because of that, do any of you know or are
    aware of the number of states that offer the kind of tax credit
    that Ms. Cornish referenced earlier?
        Ms. TODT. I am not aware of others. I do not know if----
        Ms. CORNISH. I am not either.
        Ms. TODT. I do think it is something the federal government
    could look at.
        Mr. MFUME. So let's talk about Maryland since we know about
    that, Ms. Cornish. You said that that tax credit is being
    underutilized.
        Ms. CORNISH. It is.
        Mr. MFUME. Why do you think that is?
        Ms. CORNISH. I think partially there is an under awareness
    among users as well as cybersecurity companies. So we certainly
    have a cybersecurity audience, so we will continue to promote
    among our membership and also among our strategic partners and
    other trade associations and such.
        Mr. MFUME. I think it would have to be an aggressive sort
    of promotion. If you have been around offering a tax credit and
    people are not taking advantage of it and yet they are being
    hit by these attacks that we just heard could just completely
    wipe them out. How are you going to do that over the next few
    months?
        Ms. CORNISH. Yeah. I can certainly reach out to our close
    partners at the Department of Commerce because I do believe it
    is a state-driven approach as well.
        Mr. MFUME. And I do not know how much time I have left but
    what, if any of you think the SBA should be doing to lower the
    threat level? Have you got some concrete suggestions for us?
        Mr. DUFAULT. I will take that one, Congressman. That is a
    great question.
        I think the SBA could, number one, provide personnel and a
    certification program for SBA personnel to get up to speed on
    the latest cyber threats and be in a position to counsel
    companies from SBDCs and then provide some funding for those
    programs on an ongoing basis. That is a great way to do it
    because SBDCs are a great resource that folks use quite a lot.
    And then the SBA could also create sort of a hub for
    information sharing, a little bit like what CISA does through
    NCCIC at the Department of Homeland Security. And so those are
    two ways that small businesses could be better supported and
    help them on a more cost-effective basis deal with----
        Mr. MFUME. Mr. Dufault, I get the sense that you have more
    than two ways to suggest. So could you write those down and
    transmit those to the Committee? I want to specifically try to
    follow up with the SBA to make sure that those sort of
    suggestions get heard outside of this Committee room.
        Mr. DUFAULT. That is excellent. Absolutely. We will do
    that.
        Mr. MFUME. Thank you. I yield back, Madam Chair.
        Ms. HOULAHAN. Thank you. The gentleman's time is expired.
    The gentleman yields back.
        The gentleman from Minnesota, Representative Hagedorn and
    the Ranking Member of the Subcommittee on Underserved,
    Agricultural, and Rural Business Development is now recognized
    for 5 minutes.
        Mr. HAGEDORN. I thank the Chair and the Ranking Member for
    holding this Committee. Thanks to the witnesses. And Mr.
    Dufault, one of your members is in our district in Rochester,
    Minnesota, Southern Minnesota, Advantage Software, and it
    sounds like they have had a great business for going on 40, 50
    years providing farmers with real-time data and inventory and
    doing all sorts of things that production agriculture really
    makes a big difference in that type of thing. So we appreciate
    that work and all the other members that you have going quite
    something. It seems to me this might be one of these areas
    again where big government, some politicians think let's impose
    standards. Let's force the small businesses to do all these
    things to comply in order to do business with the government
    and it becomes unreasonable, the mandates. And then they turn
    around and say, well, let's subsidize it. That is kind of a
    typical pattern that we see.
        But one of the things that bothers me is I am concerned
    that the agencies sometimes require the contractors, the
    smaller businesses to comply and do things that they themselves
    do not do. I mean, I am one of 21 million Americans who had
    their records stolen from OPM. The Communist Chinese, I guess,
    know whatever they want to know about me and yet nobody could
    be sued. There was no liability. The government has a different
    standard than they impose to others. Do you think small
    businesses who work in good faith with the government provide
    the information, do what they can in order to protect
    themselves and the business operations? Do you think they
    should have a liability standard similar to the government
    where they are not sued?
        Mr. DUFAULT. Congressman, it is a great question. I think
    it points to two things. One, Federal agencies need to probably
    do a better job when it comes to securing their networks. And I
    think that points then to whether or not my member companies
    and other businesses across the nation are willing to share
    threat data and share sensitive, potentially sensitive
    information that shows what the threats might be with Federal
    agencies. They do not want that information to be breached.
        And then secondly, the other point that you made, whether
    or not there ought to be some sort of liability protection for
    information sharing and other measures that my member companies
    and other companies like them take to make sure that other
    companies are ready and that other folks in the sector are
    ready. Absolutely. I think CISA is a great start. I think that
    other legislation that was introduced last Congress and I think
    hopefully will be introduced again this Congress would ensure
    that there is additional liability protections for small
    businesses because we have to overcome the reputational damage,
    not just as my fellow witnesses pointed out, the initial
    problems.
        Mr. HAGEDORN. I think most businesses have real incentive
    to make sure that they can protect their customers and do work.
    They do not want to lose business. They do not want to go
    broke. They like to be able to continue to build their
    business. So your industry is quite fascinating. You said
    something like $1.7 trillion, all these millions of employees,
    and that there is all these open jobs--3, 4 million open jobs,
    some of which are paying $50,000, $60,000, $70,000, $80,000
    just to get going.
        Can you walk us through what the average person in your
    industry would do in order to be trained up or get education?
    And how are some of the small businesses, are they working with
    them to try to bring them in and pay for some of that?
        Mr. DUFAULT. That is a great question, Congressman.
        Some of our member companies have just developed their own
    training programs because they need access to more folks that
    will write software. And so one of our member companies in
    Denver created a coding academy and they sort of focus on
    cybersecurity measures and secure coding. I think that is one
    of the things that training programs are trying to emphasize
    right now but write software that is secure at the beginning.
    It is sort of like what the Federal Trade Commission says about
    privacy by design. If you are designing a software product,
    build security into it. And so they have developed training
    program that have specific focuses like that. We also have a
    member company, Bit Source in Kentucky that sort of specialized
    in training former coal miners to code so that they would have
    a bigger workforce base.
        Mr. HAGEDORN. So one bill that we have introduced, I have
    introduced, is the American Workforce Empowerment Act which
    would enable people who have 529 education savings accounts to
    use that for an array of different purposes, not just to go to
    a 4-year college or whatever. It seems like there could be
    areas here where folks could utilize those types of money in
    order to get into your industry. So I would encourage folks to
    cosponsor that bill and try to get things moving for you.
    Thanks very much.
        Mr. DUFAULT. Thank you.
        Chairwoman VELAZQUEZ. The gentleman yields back.
        Now we recognize the gentleman, Mr. Phillips from
    Minnesota, Chairman of the Subcommittee on Oversight,
    Investigations, and Regulations for 5 minutes.
        Mr. PHILLIPS. Thank you, Madam Chair.
        Ms. Cornish, you mentioned the DOD program that makes
    funding available to contractors to perform assessments and
    take steps to defend against cyber threats, of course. And we
    all know that large firms like Intel and Google engage in what
    are called bug bounty programs that provide rewards for
    identifying security threats and vulnerabilities on their own
    platforms. And just last month, CISA had launched the first
    Federal Civilian Security Vulnerability Disclosure program--
    boy, that needs an acronym, I think--to work with the hacker
    community to secure its networks. So would you support the
    establishment of a fund at SBA or NIST or CISA to support small
    businesses that want to partner with bug bounty programs and
    identify and repair weaknesses in their cyber defenses?
        Ms. CORNISH. Certainly. That is a wonderful idea.
        Mr. PHILLIPS. I like those easy answers. Thank you.
        Ms. Todt, how do you feel about that notion?
        Ms. TODT. I can continue to make it easy for you.
    Absolutely, because I think small businesses need to be told
    not only what to do but what is going on and the reasons behind
    that. And I think the bug bounty programs help to demonstrate
    where the threats are coming from. And as Graham said earlier,
    if they can understand that approach, then they have a better
    education for their employees, as well as for the businesses
    themselves.
        Mr. PHILLIPS. Wonderful. I appreciate that and happen to
    feel the same.
        Ms. Nichols, I want to thank you for your services that you
    are providing to your community. You are bridging the gap for a
    lot of businesses who need guidance about how to protect
    themselves and their customers from malicious attacks.
        Not long ago I Chaired an Oversight and Investigations
    Subcommittee hearing that examined the challenges facing small
    businesses seeking to adopt a CMMC certification and enter into
    Defense Department contracts. At that hearing, we learned that
    when the initiative is fully implemented, it has the potential,
    the likelihood to shut out small firms who lack the expertise
    or resources to navigate that certification process. So if this
    Committee considers legislation empowering SBDCs to lead
    cybersecurity outreach to small businesses, how would you
    recommend that we instruct SBDCs to incorporate guidance about
    CMMC into their outreach and training?
        Ms. NICHOLS. Thank you for the question.
        So last year, our association embraced the CMM model and we
    recognize that we would not ever provide the certification
    piece of that but we felt that their levels one through three
    is something that we could embrace on the education piece. And
    so we have worked with our association to develop a training
    model to prepare the small businesses so that they will be
    prepared, maybe not just for the DOD or defense contracts or
    contracts with the federal government, but also just the
    general small businesses.
        So to prepare the SBDCs, I think that we are already on
    that pathway because we did recognize that this would be a good
    partnership and I hope that answered that question.
        Mr. PHILLIPS. No, it did. Absolutely.
        And I just want to thank our Chairwoman and Ranking Member
    for holding this hearing. I cannot help but think that this
    issue is going to grow in importance and it is our
    responsibility to ensure that small businesses can defend
    themselves and, of course, their customers.
        So with that, I yield back.
        Chairwoman VELAZQUEZ. The gentleman yields back.
        Now we recognize the gentleman from Pennsylvania, Mr.
    Meuser, Ranking Member of the Subcommittee on Economic Growth,
    Tax, and Capital Access for 5 minutes.
        Mr. MEUSER. Thank you, Madam Chairman. And thank you to our
    Ranking Member.
        So, certainly an interesting conversation. Interesting
    hearing. In 2020, I think it is no surprise to any of us that
    ransomware attacks were up double, over 102 percent. So let me
    ask, let me start with Mr. Dufault, if I can.
        The cyber attack, cybersecurity insurance I understand is
    through the roof as far as expense goes. So is there any group
    plan that any of your organizations perhaps work to try to
    bring down that cost and create that as an opportunity for
    businesses?
        Mr. DUFAULT. I think, absolutely, thank you for the
    question, Congressman. Cybersecurity insurance is very
    expensive. I think Ms. Todt might have a good handle on this as
    well. But for our member companies, they are looking for
    affordable options here and they are looking for--and also as
    Ms. Todt pointed out, $4 million is what it costs a small
    company to have a cyber incident. So the level of investment
    and the frequency with which our member companies are targeted
    kind of leads us to believe that we are going to have to invest
    a little bit more, even though we are small companies. And so I
    will just say that, you know, they are willing to invest a lot
    in cybersecurity insurance and in other measures but we are
    definitely looking for those plans that will be group plans or
    other ways of making the risk pool a little more affordable.
        Ms. TODT. If I may add to that. So I think cyber insurance,
    it is a challenging sector right now. The Cyber Readiness
    Institute has focused a lot on it this year. The challenge is
    that if you are a small business and you do not have cyber
    insurance you are often seen as being negligent. But if you are
    truly evaluating on an ROI perspective, it does not always make
    financial sense.
        There is a great opportunity for the insurance industry to
    step up to say you have to do these basics in order to be
    covered. That will both help the premiums stay down and it will
    also create a momentum shift in doing the basic cyber standards
    without having to talk about regulation or anything like that.
    It is the choice. It is like a good driver discount. If you do
    well by these standards then we will cover you. And I think
    that is where the insurance industry really has an opportunity
    to improve what it is doing.
        Mr. MEUSER. I imagine the IT companies as well would find
    some protection measures by charging for added security. And I
    know that is certainly occurring as well.
        In my district it is not like any other. I have many small
    businesses, medium sized businesses, large businesses getting
    hit, some more than once. Some pay, some do not. And they work
    their ways around it but usually at quite a cost. Sometimes
    just being shut down for 6, 7, 8 days. So it is a serious
    issue.
        I want to just backtrack for a moment. We had a hearing
    with the Department of Defense, Cybersecurity Maturity Model a
    few weeks back and we saw that small businesses that made for
    the defense industry, it was very difficult to get the type of
    levels of security that they wanted. In fact, I have one
    business in my business that spent over $100,000 and they are
    not even exactly sure what level that they are. They think they
    are at level three. So it is discussed in the Mississippi SBDC
    how small businesses would, or I guess my question is, are your
    models helping gain compliance for the DOD?
        Ms. NICHOLS. So ours is through education and training
    because we cannot, and we can also provide guidance so that we
    can say, you know, here is our situation. We can give them some
    information. Again, we cannot provide that certification but
    the education piece, and we have really outlined it so that it
    is very clear. We have created training specifically right now.
    All it is posted is for level one because we believe that is
    basic hygiene. And it is raising that awareness. And to
    reiterate, it is important that they have that basic
    understanding so that they can get that certification. A lot of
    people do not think it is attainable because they do not
    understand. And if you can educate them that it can be very
    simple but yet very effective to get them to that level one
    through level three.
        Mr. MEUSER. Okay. All right. Thanks, Ms. Nichols.
        Ms. TODT. Congressman, if I may just add a quick point to
    that because we are actually working with Cyber Hawaii and the
    Department of Defense to create a primer to help small
    businesses get ready for CMMC. And it is taking that point
    where most small businesses are, which is with no
    understanding, and getting them ready for CMMC. And it is a
    model that we hope to be able to replicate across the country
    because it addresses the points that you are calling out which
    it can be very costly and take a lot of time without the right
    preparation.
        Mr. MEUSER. Last quick question. I am out of time.
        Does cryptocurrency affect this whole situation?
        Ms. TODT. I think an unregulated monetary currency that is
    being used for a malicious and criminal act cannot be expected
    to be a positive force. If we are using cryptocurrency, it
    should be regulated along other international monetary sources.
        Mr. MEUSER. Thank you, Madam Chairwoman, I yield back.
        Chairwoman VELAZQUEZ. The gentleman yields back.
        The gentlelady from Illinois, Ms. Newman, is recognized for
    5 minutes.
        Ms. NEWMAN. Thank you, Madam Chair, and thank you Ranking
    Member for putting this discussion together. Very helpful. And
    thank you to our guests, illuminating and really helping us
    understand the gravity and depth and width of this problem.
        So mine is pretty simple, my line of questioning, and I
    think it is likely for Mr. Dufault or Ms. Todt. So we are
    looking at all these things to help small businesses. I think
    all the suggestions today have been fantastic and we should
    look at it as a Committee for sure to see if there is
    legislation there to support small business.
        My question is the other lane. So deterrence. Right? So how
    is the SBA and all of these organizations represented here
    working with law enforcement, whether it is FBI or CIA, once
    these attacks occur, are they following them? Are they tracking
    them? Are they investigating? What is happening there? And then
    do you have any suggestions around deterrents? And what would
    that model look like?
        I will ask Mr. Dufault first.
        Mr. DUFAULT. Thank you for the question, Congresswoman.
        I think when it comes to the deterrents, one idea that we
    talked about here and some of the witnesses mentioned was sort
    of creating a clearinghouse for information sharing through SBA
    but perhaps co-locating it with Department of Homeland Security
    so that it is rapid intelligence sharing and that the Federal
    agencies are on the same page. With that kind of apparatus that
    kind of says to cybercriminals, well, I guess there is a good
    mechanism in place for folks to learn about what I am trying to
    do to deceive my intended targets. And that, in and of itself,
    can be a little bit of a deterrent because suddenly you are
    talking, back to cybercrime as a business, you are increasing
    the cost of the attack because you might have to do a little
    bit more to try and trick that one person that you need to fool
    to get into the network. So that can go towards deterrence. And
    sort of co-locating the SBA center with DHS can help advance
    threat sharing and SBA's role as just sort of a facilitator of
    information getting to law enforcement agencies is maybe the
    appropriate role for SBA as well.
        Ms. NEWMAN. And then Ms. Todt?
        Ms. TODT. Yes. Building off of that, I think when we can
    share the techniques, tactics, and procedures, the TTPs with
    other businesses then they are aware of what needs to happen.
    And I think that is one of the challenges that we have had, and
    we saw this with Colonial Pipeline when Colonial did not share
    what was going on the government was not able to then
    distribute that TTP that was being used. And, oftentimes, what
    we learn from large businesses we can apply to small
    businesses. And so to Mr. Dufault's point, sharing the TTPs.
        Also, when we talk about deterrence, we have to prosecute
    criminals. The biggest challenge we have right now is that
    ransomware is going to continue to be a very lucrative business
    because you can do it without getting prosecuted and having any
    repercussions. And so particularly for small businesses, this
    is one of the challenges. And this is also why reporting
    incidents and also when there is ransomware that particularly
    small businesses have to pay to stay viable, being able to
    share that with the government so that you can help to
    prosecute the criminals, this gets us to a better place.
    Obviously, we have talked about all the liability protections
    that come with that but we are only going to be better if we
    have better exchange of the attacks that are being used and the
    tactics and the techniques.
        Ms. NEWMAN. So if I may follow up, and either of you can
    answer, is it that companies, small businesses are not
    reporting these? Or is it that when reported they cannot be
    investigated for whatever reason or are not being investigated?
    Is it both or is it either?
        Ms. TODT. You go first.
        Mr. DUFAULT. Yeah, Congresswoman, I think it is both. There
    is a real reluctance I think among small companies to notify
    authorities and to notify maybe others of either an
    unsuccessful or a successful attack, especially the successful
    attacks because they are sort of an automatic conclusion that
    folks draw fairly or unfairly that the company that is subject
    to a successful breach was not taking the proper measures to
    secure their networks. And so there is a lot of underreporting
    I think.
        Ms. NEWMAN. I think that needs to be a part of any
    communication or kit that any of your organizations put out,
    SBA puts out, and we can follow up. And if you can include
    those recommendations in the recommendations that Congressman
    Mfume talked about, I think that that would be great for the
    Committee to take up as a whole. So I do appreciate your work
    and thank you for sharing today. And I yield back.
        Chairwoman VELAZQUEZ. The gentlelady yields back.
        Now we recognize the gentlelady from New York, Ms. Tenney,
    for 5 minutes.
        Ms. TENNEY. Thank you, Chair Velazquez and Ranking Member
    Luetkemeyer for this, and to our witnesses. I really appreciate
    you being here.
        I have a couple of questions. First, Ms. Cornish, in your
    testimony you described your newest initiative surrounds the
    critical lack of skill diverse cybersecurity professionals to
    protect critical infrastructure and essential services. Do you
    find that this shortage is in urban and rural communities? And
    how can we meet those needs? And I am particularly curious
    because we are looking at rural broadband in our communities
    and trying not do, based on a municipal level, just like we
    have municipal electricity and others, and that is going to be
    particularly interesting to us as we move into that realm. And
    how is that going to be something your taskforce is going to be
    looking into?
        Ms. CORNISH. Certainly. I think that is a huge challenge,
    the lack of broadband, especially in rural communities,
    especially when you are thinking about small and medium-sized
    businesses. And really, how the workforce is distributed;
    right? You want to make sure that your rural areas are still
    competitive for that.
        So our main task in the workforce initiatives is really to
    connect the dots. We have 17 centers of excellence in Maryland
    alone for cybersecurity, yet we have 19,000 unfilled positions.
    So for us, it is really creating comprehensive and wraparound
    services and connecting those who are doing the training with
    those who really need the work. And to the point made already,
    in small businesses it can be really challenging to take on
    that training yourself. It can be challenging to have the
    manpower to do that training and to support that. So we are
    really looking to see how we as an association can take away
    and kind of pool together all of our resources to put less onus
    on the small businesses who really need that workforce.
        Ms. TENNEY. More and more small businesses are going to be
    depending on this rural broadband that we are trying to
    explore, and actually, we have a test site in my own community
    of Sherburne, New York, where we are going to be having
    municipal broadband opportunities which we are trying to do
    anything to minimize the risk of cyber attacks which is my
    concern, and also on this, and I would like to address it to
    the other witnesses. I know that SBA is going to be designated
    as the single Federal entity for the small business
    cybersecurity information sharing.
        I have a concern though. I come from New York State and
    there was a point in time where we consolidated all of our
    services, including all banking and insurance into the New York
    State Department of Financial Services and we felt that that
    could put us at great risk for cyber hacks because the
    government typically does not have, and the taxpayers are
    paying for maintenance of this when banks were spending
    billions of dollars to protect their customers. Because of the
    liability and insurance was referenced before, how can we make
    sure that SBA is going to be able to handle this kind of burden
    and making sure that our small businesses are going to be
    protected when you are consolidating this type of issue? I do
    not know if you want to address it, either Mr. Dufault or----
        Mr. DUFAULT. Sure, Congresswoman. It is a great question.
    That is one of the reasons that you see some hesitancy among
    the member companies and other small companies that are being
    asked to share data with Federal agencies. The question is,
    well, we have seen the recent headlines where other Federal
    agencies and maybe SBA have been the victims of compromise. So
    they want to be assured, basically, that these Federal agencies
    are taking the steps that they need to take to ensure that that
    data is protected adequately and that all of the personnel that
    work at these agencies are observing the proper protocols
    because as we have discussed throughout this hearing, all it
    takes is just the one employee that has the weak password or
    that otherwise makes the wrong move to compromise the network.
    And so, anything that the Committee can do to ensure that there
    are greater resources, more accountability and other levers
    that would ensure that the agency is taking the proper
    precautions, those would help our cause quite a lot.
        Ms. TENNEY. Yeah. Thank you. Because I have concern as a
    small business owner. We obviously spend a lot of money in
    making sure we do not get hacked. We have a lot of heavy data
    downloads in our business. And so to be hacked at some point
    and finding out that it is SBA without any duplication of
    protections or redundant storage areas, where are we going to
    be? And that concerns me.
        I do not know if anyone else wanted to weigh in on it.
        Ms. TODT. If I may, Congresswoman. Yes.
        Ms. TENNEY. I have got 30 seconds left.
        Ms. TODT. Yes. Absolutely. I think certainly when we talk
    about a single point of success, it is also a single point of
    failure. But that is really what the new money and the new
    authorities for CISA are supposed to address. And I believe if
    we look at agencies, SBA is not going to be the only agency
    that has this type of responsibility and this type of
    challenge. And so what we should expect and you are seeing some
    of the beginnings of this happen already, which is looking at
    how CISA will work with the agencies to ensure that there is
    that redundancy and that resilience built in. Because, as we
    know, small businesses cannot afford to not have that safety
    net. But again, with those additional authorities, this is not
    going to be SBA on its own. It will be SBA in collaboration
    with the other cybersecurity infrastructure and the federal
    government.
        Ms. TENNEY. Thank you. I appreciate it. Great testimony.
    Thank you.
        Chairwoman VELAZQUEZ. The gentlelady yields back.
        Now we will recognize the gentlelady from Pennsylvania, Ms.
    Houlahan, for 5 minutes.
        Ms. HOULAHAN. Thank you, Madam Chair. And thank you to
    everybody for joining us today. And I think I would like to
    follow up on many of the different lines of questions that we
    have heard today. They all seem to have a real common thread.
    One is to try to understand how much of all of this has to do
    with just changing culture and changing the ways that people
    perceive their responsibility and their role in cybersecurity
    for their companies. I am trying to cess out, you know, that
    seems to be a very large part of the problem. And then kind of
    the other 20 percent of the problem seems to be what kind of
    software and hardware that you should have and you should
    invest in the types of teams that you should have to be able to
    protect from the rest of the 100 percent of the universe. My
    understanding is that is in the thousands of dollars of range
    in cost. My understanding is that the consequences is in the
    millions of dollars of range in cost. My other understanding
    having run and owned and operated a lot of businesses and been
    responsible for IT is that there is a need for seats or logins
    for some subset of software that people do not have the ability
    to afford. Is there any sort of universe where, imagine a
    cloud, imagine, you know, certified or approved vendors that
    are part of that cloud that the Small Business Administration
    can administer or some other organization can administer that
    would allow you to pick up logins rather than seats so to
    speak, you know, to be able to defray the costs that small
    businesses are experiencing in their cybersecurity? Is that
    something that already exists and I just do not know about it?
    Is that something that could be useful to design is sort of a
    clearinghouse of software that would defray the costs for
    smaller businesses?
        And I guess, Mr. Dufault, you seem to be doing most of the
    conversation on that. And we will start there.
        Mr. DUFAULT. Thanks, Congresswoman.
        It is a good idea. And I think there could be a role for
    SBA there, whether it is providing just a grant program or
    funding or something more hands-on where the agency is sort of
    designing a fulsome sort of program. So I think it is worth
    discussing. It is a good idea and I think we would want to just
    continue to engage on this because it is a need that was
    identified sort of by a couple of our member companies and
    that, you know, I think it is worth further discussion probably
    at this point. Yeah.
        Ms. HOULAHAN. Okay. Thank you.
        Ms. Todt?
        Ms. TODT. Thank you. It is actually something that we are
    hearing from small businesses at the Cyber Readiness Institute
    because we do not advocate for vendors but we are hearing we
    need to have a clearinghouse to know which ones to turn to or
    at least the general categories. And it is something that we
    are looking at this year because we want to be prescriptive and
    not leave everybody in the dark and recognize that when you
    outsource the function as a small business, you still have a
    responsibility and you do not outsource the responsibility.
        If I may address your question about culture. I do think
    this is the 80 percent component of cybersecurity, particularly
    for small businesses. And cultural change takes a lot of time.
    If we think about, we have all heard the analogies, seatbelts.
    It was inconvenient for a long time and then you saw the safety
    requirements. Or if you even make the analogy to physical
    hygiene and health, we are not doctors, but we have learned
    over time from doctors that we should have certain tests taken
    on a regular basis. And so you do not need to be an ID
    specialist to know that these are the basics that need to
    happen.
        And we have talked a lot about workforce training. And to
    your point about culture, I think it is important when we see
    all these cybersecurity positions that people out there
    recognize it is not just about math and science. Cybersecurity
    is interdisciplinary and we need capabilities and
    qualifications in sociology, history, politics, psychology,
    that those all play into this so that the workforce that we are
    talking about for cybersecurity is much larger than I think we
    conceptualize because it is not just math and science.
        Ms. HOULAHAN. Ms. Cornish, anything?
        Ms. CORNISH. Certainly. We have experience curating these
    lists by business protocols and also specific needs. So if you
    would like to speak further about building this clearinghouse,
    I would be happy to answer that more specifically.
        Ms. HOULAHAN. Thank you. I appreciate that.
        And with what is left of my time, I want to focus on a
    piece of legislation that I am a co-sponsor of, the Small
    Business Development Center Cyber Training Act of 2021, which
    would certify 5 or 10 percent of the number of employees of a
    small business development center to provide cybersecurity
    assistance to small businesses. If enacted into law, this
    program would provide expertise to small business owners on the
    proper steps towards cybersecurity.
        With my last remaining seconds, what are some of the best
    practices that SBA could showcase their cybersecurity efforts
    on? Do you know also similarly of best practices that the DOD
    has had? How can we encourage interagency best practice
    sharing?
        Ms. TODT. If I may, this is what the Cyber Readiness
    Program is. We focus on four issues. Strong authentication,
    which is a pass phrase of 15 characters or more. Phishing
    training. Not using USBs but instead looking at the cloud. And
    software updates. Helping individuals understand that every 24
    hours they should actually download the patch. Those are our
    foundation and I am certainly happy to talk to you more about
    that because this is the core of how we can help small
    businesses and I commend the act and the legislation.
        Ms. HOULAHAN. Thank you.
        And with that, I yield back, Madam Chair.
        Chairwoman VELAZQUEZ. The gentlelady yields back.
        Now we recognize the gentlelady from California, Ms. Young
    Kim, Ranking Member of the Subcommittee on Innovation,
    Entrepreneurship, and Workforce Development.
        Ms. KIM of California. Thank you, Chairwoman Velazquez and
    Ranking Member Luetkemeyer for holding this important hearing.
    And I want to thank the witnesses for being with us today to
    discuss the ways of strengthening our cybersecurity for small
    businesses.
        I am very troubled by the increase of cyber attacks. They
    just seem to be designed not only for monetary purposes but
    also to instill distrust in our economic system and our
    institutions. Just between 2019 and 2020, our country saw 400
    percent in cyber intrusions. Successful cyber attacks on our
    small businesses also discourage future entrepreneurs from
    establishing a small business and creating jobs. Some estimate
    that 60 percent of small businesses go out of business within 6
    months of a cyber incident.
        So let's think about that. Cyber attacks are putting 6 out
    of 10 of our entrepreneurs out of business. So given this
    urgency of the moment, I was happy to join my colleague,
    Representative Crow, to introduce the SBA Cyber Awareness Act
    to find ways to improve the SBA's cybersecurity infrastructure
    and share information with Congress if there is a reasonable
    basis to believe that a cybersecurity incident occurred at the
    administration.
        Let me pose the question to all witnesses. Let me start
    with Mr. Dufault.
        In your testimony, you indicated that threat-sharing for
    small companies is complicated because usually they lack the
    resources to join and participate in information sharing at
    analysis centers. Can you elaborate on what can Congress do to
    incentivize higher participation of small businesses in NCCICs?
        Mr. DUFAULT. Thank you, Congresswoman. It is a difficult
    task to create an incentive that would really cause small
    companies to participate in a robust way in these information
    sharing enterprises. One of the ways that we can at least start
    on that task is to provide potentially additional liability
    protections at least, right, because the couple of issues that
    small companies face when they are being asked to share
    information about the threats that they receive or even
    incidents that they are victims of is that, number one, the
    reputational fallout will cost quite a lot of money, over and
    above the cost of actually remediating the breach, and then
    number two, it is just a matter of am I going to be liable for
    anything associated with sharing this information? Whether it
    is a privacy cause of action or just simply that they did not
    take the precautions necessary to protect their networks. And
    therefore, they run afoul of data security laws in the states
    or at the Federal level, the Federal Trade Commission Act. So
    it is the liability and the reputation. And so a good start is
    to help them defray some of that potential liability.
        Ms. YOUNG KIM. Ms. Todt, could you briefly elaborate on
    that, too?
        Ms. TODT. Thank you.
        I think the other piece is that when we look at the supply
    chains that small businesses are a part of, there is a
    responsibility on the larger companies to work with them to
    incentivize because those large companies, as we saw with solar
    winds in Kaseya, can be taken down if the small businesses are
    vulnerable. And there is a better infrastructure of support
    that can happen within supply chains. And I think as we have
    seen the interdependencies grow with the digital economy, this
    is another opportunity to incentivize that engagement, that
    threat sharing. We work with large manufacturing companies and
    one of them has put out very specific efforts and information
    to their small businesses to help them understand where the
    threats are but also to facilitate that sharing because they
    know that as a large company, if their small businesses get
    taken down that will affect them. So there is more
    responsibility and collaboration that can happen across supply
    chains than we have seen before.
        Ms. YOUNG KIM. Thank you very much.
        You know, I am a big proponent of advancing STEM education,
    especially with underrepresented communities to increase our
    21st Century talent pipeline and our economic competitiveness.
    So I am sure you understand the importance of STEM education
    and computer science in training and expending our
    cybersecurity workforce.
        How could our small businesses and our economy benefit from
    increasing the cyber workforce?
        Mr. DUFAULT. Thank you, Congresswoman.
        One of the most significant problems my member companies
    face is access to folks that are trained in software
    development or computer science more generally. And so my
    member companies would benefit quite a bit I think from
    investments in K-12 education, but also in workforce
    development programs.
        I mentioned earlier that some of our member companies
    developed these training programs on their own but there is a
    role for Federal investment as well and that is why we support
    the Computer Science for All Act and also the Master Teacher
    Corps, which is a training program for K-12 educators to
    provide computer science education.
        Ms. YOUNG KIM. Thank you. I see that my time is up. I yield
    back.
        Chairwoman VELAZQUEZ. The gentlelady yields back.
        Now we recognize the gentleman from Louisiana, Mr. Carter,
    for 5 minutes.
        Mr. Carter, you need to unmute.
        Mr. CARTER. Yes, thank you.
        Madam Chair and Ranking Member, thank you very much for
    giving us this opportunity for this hearing. Much has been said
    and many questions have been answered. But Ms. Cornish, if you
    could perhaps touch on this and any other member, maybe Ms.
    Todt can as well.
        We know that we obviously are concerned about small
    businesses and making sure that they have the security to
    operate their businesses via Internet, and cybersecurity is
    certainly an issue that touches us all. I know my credit card
    has been breached several times with large companies. I will
    not say what the company is but I will say that it has been
    breached. And I know that they have all of the algorithms, all
    of the security known to man to secure them. I know that cities
    have had their systems breached. The City of New Orleans has
    had ransomware. What have we learned from what the large
    companies are doing that we can pass on to our smaller
    businesses, best practices, if you will. Even at their highest
    level of security they have still been caught in ransomware and
    cybersecurity threats.
        Ms. CORNISH. So I would reiterate the importance of human
    behavior and training of our staff and our employers because in
    addition to being our largest threat, they are also our largest
    defenders. So we can empower them to treat data care instead of
    cybersecurity and empower them to protect the data they are
    entrusted with.
        Additionally, I think the thing that has not been belabored
    here a lot but as documented policies and procedures, there are
    many holes that we are missing simply because there are not
    checklists or we do not really understand all of our assets
    that we are managing. So I think documentation and training is
    key in this.
        Mr. CARTER. But could you elaborate? If we talk about the
    larger companies that have a robust security system where they
    are empowered with significant tools to counteract these
    threats, yet they are still caught in the lurch, if you will,
    what can we as Congress, what can SBA, what suggestions would
    you give us that we can aid in this battle? Because obviously,
    on many fronts we are losing.
        Ms. CORNISH. Sure. I think Ms. Todt's outline of the Cyber
    Readiness Institute does a great job of how we can empower our
    employees because, again, that is really our biggest threat.
        Mr. CARTER. Ms. Todd, can you weigh in, please?
        Ms. TODT. Sure. I think, you know, the good news and the
    bad news is that these large companies are getting breached by
    very basic attacks. So when we look at Colonial Pipeline, they
    were breached because they were not using multi-factor
    authentication, and they actually did not need to shut down the
    pipeline. They were just worried about getting paid because
    their payment system shut down. And so that showed the
    interdependency of the systems and the importance of separating
    IT technology with your operations. And so those lessons, the
    sophisticated attack of a nation state adversary is separate
    and distinct, but when we have seen the other issues with solar
    winds and others, those are getting breached through
    authentication. Through network access. And so what we are
    talking about for small businesses, obviously at a smaller
    level, really holds true for the large businesses as well. And
    that is where I think we have learned the most from these
    breaches over the last 6 to 12 months is that we have got to
    create those basic standards in helping businesses do all of
    those. And this is, again, we talked earlier about where I
    think insurance companies can play a role and others to have
    those incentives so that those basics become a requirement for
    further resilience.
        Mr. CARTER. And real quickly before my time expires. As a
    member of Congress with tons of small businesses throughout my
    congressional district, what can we do in the way of Town Hall
    meetings or ways of better educating our small businesses in
    our communities to utilize these resources? Are there leave
    behinds? Are there handouts? Are there things that we can do?
    We often do Town Hall meetings for various issues. This could
    be one that certainly can benefit our small businesses. What
    suggestions would either of you have as to how we could better
    serve and provide resources? You have about 43 seconds.
        Ms. TODT. What we have seen, what we are hoping to see with
    CISA and with SBA is this collaboration of resources focused on
    human behavior. So taking the work of the nonprofits and making
    those available to you so that when you go to these town
    meetings there is a simple, accessible, basic protocol. These
    are the things you need to be doing on your personal devices as
    well as your professional devices, an education campaign that
    does this.
        One of the points in my testimony talks about an awareness
    campaign. If we get every business to use multifactor
    authentication, the decrease in cyber attacks would be
    exponential.
        Chairwoman VELAZQUEZ. The gentleman's time has expired.
        Mr. CARTER. Fantastic. Thank you very much.
        Chairwoman VELAZQUEZ. Now we recognize the gentleman from
    New York, Mr. Garbarino, for 5 minutes.
        Mr. GARBARINO. Thank you, Madam Chair and Mr. Ranker for
    holding this hearing.
        As the Ranking Member on the Cybersecurity Subcommittee,
    Department of Homeland Security Committee, I have learned a lot
    over the last 6 months about cyber attacks and ransomware,
    which is why I have worked on several pieces of legislation.
        Ms. Nichols, this question is for you. Yesterday, I
    introduced H.R. 4515, the Small Business Development Center
    Cyber Training Act. I am honored to have the support of my
    fellow colleagues on the Committee here, Mr. Evans and Ms.
    Houlahan, and I encourage others on the Committee to co-sponsor
    this bipartisan piece of legislation.
        Small businesses often lack the resources or technical
    knowledge to prevent cyber attacks, and with the high cost of
    hiring specialized employees and cybersecurity experts, it can
    be difficult to bridge the sizeable education gap. My bill
    would help small businesses get the information they need to
    implement their own cyber strategy and take appropriate steps
    in the event of a cyber attack against their business.
        Ms. Nichols, given your position as the state director of
    the Mississippi SBDC, would you share your thoughts and provide
    feedback on the bill, the Small Business Development Center
    Training Act, please?
        Ms. NICHOLS. Thank you. I have not reviewed the whole bill.
    I was given a little bit of information this morning in regards
    to that. However, just like Ms. Todt and several of the other
    people said, communication and education and the consistent
    messaging is very key. And I think that raising the awareness
    to be able to be that voice for the small businesses and given
    that information, I think we are at this time where we need to
    create those base standards and create an information--I do not
    want to say an overload--but be very consistent in how we
    provide the information to our small businesses.
        And as an SBDC, we have to serve all 82 counties of
    Mississippi and so it is not just rural. It is every aspect.
    And it does not matter if it is a small business, medium-size
    business, or large business, they are still at risk. And I
    think it is very important and we appreciate that the
    government is passing this legislation or is attempting to in
    proposing these bills because it is so imperative that our
    companies are prepared for cyber.
        Mr. GARBARINO. And we feel that since you already have the
    employees and have been coming up with this program where your
    employees, or at least a number of them are trained to address
    these cyber issues with small businesses, especially ones that
    you are helping develop and create and get started up, that
    this would be very helpful.
        I want to move to Ms. Cornish and Ms. Todt. You talked
    about, in your testimony, Ms. Todt, you talk about doing a tax
    Credit. Ms. Cornish, you run an agency that deals with tax
    credits. One thing I have seen is major corporations and
    governments can spend a lot of money on cybersecurity. Small
    businesses, they cannot. They cannot hire a dedicated person.
    And it is not just about best practices. You know, okay, making
    sure that you change your password. That is one thing that we
    have to do and CISA has been great with that in coming up with
    best practices and what businesses and small governments should
    do, local governments should do. But there is also a cost of
    keeping your system upgraded. You cannot just buy a good piece,
    the best piece of equipment today because 6 months from now or
    3 weeks from now it is going to be outdated. That is a heavy
    cost especially for small businesses. Is a tax credit the best
    way to help offset that cost? What is the best way to do this?
    And Mr. Dufault, you can jump in, too, if you have an answer.
        Ms. CORNISH. For us, it was a great place to start, but
    certainly, I think there needs to be more incentive, financial
    incentive, perhaps I heard some mention of grants, projects to
    get that off the road because, as you mentioned, it does take
    money to maintain it but there is certainly a lot of startup
    costs that that could help defray as well.
        Ms. TODT. Tax incentives are certainly not the only answer.
    One of the things that we were looking at particularly with the
    pandemic was could you use some portion of the PPP loans that
    could turn into a grant if it were used towards cybersecurity.
    And so looking at the tools available to small businesses for
    money to incentivize them to allocate a percentage towards
    cybersecurity. And I think it is a piece of the pie in all of
    this and we have just got to find those tools that together can
    help incentivize small businesses to be motivated to invest and
    to understand why they need to be, the role that they have and
    their vulnerabilities.
        Mr. DUFAULT. I will mention, Congressman, it is a great
    question and we are supportive of H.R. 4515. When we were
    preparing it did not have an H.R. number yet but happy to see
    that. And we are supportive. We were supportive last Congress,
    too, of substantially similar legislation. So tax credit is a
    great idea. I also do not want to underappreciate what our
    member companies rely on when it comes to a software platform.
    So app stores and operating systems and the ways in which they
    harden those systems and ensure that unvetted software is not
    accessing personal data, not accessing device features and
    things like that, these are baseline practices that software
    platforms use and that our member companies sort of rely on at
    this point to ensure that there is protection from threats in
    the mobile space in particular. And so that is a piece that I
    think we want to make sure is on the record here. And so to
    ensure that the Committee is sort of on the lookout for
    proposals that would make it harder for companies to use those
    measures.
        Chairwoman VELAZQUEZ. The gentleman's time has expired.
        Now we recognize the gentlelady from Georgia, Ms.
    Bourdeaux, for 5 minutes.
        Ms. BOURDEAUX. Thank you so much. And thank you to our
    witnesses for joining us to discuss an issue that really is top
    of mine for many small business owners, and large business
    owners, which is cybersecurity.
        In my home state of Georgia, we saw what happens when
    critical infrastructure is not secured from cyber attacks when
    the Colonial Pipeline attack left many of my constituents high
    and dry at the gas pump for several days. But the Colonial
    Pipeline is just one rather extreme result of cyber
    vulnerability. The Department of Homeland Security, Secretary
    Mayorkas said at a recent event that 50 to 70 percent of cyber
    attacks are aimed at small to medium-sized companies, costing
    an estimated $350 million in 2020. And this threat is not going
    anywhere anytime soon. Ransomware attacks against smaller
    businesses have increased 300 percent over the past year.
        Listening to some of the testimony and discussions today,
    it occurs to me that there are several ways that you can
    approach this. And there are a lot of great ideas out there
    about how to change the behaviors of small businesses,
    training, you know, all of that kind of outreach. And that is
    very, very important. But one other way to approach all of this
    is to require the software that is sold to small businesses or
    the products that are sold to them to be more conscious of
    security and ways to protect from breaches.
        Ands o I just wanted to check in with I guess Ms. Todt
    might be a good person to talk on this, are there recommended
    practices for software developers or for people who are selling
    to small businesses to help protect them from cyber attack?
        Ms. TODT. It is an important question and it is something
    that we have spent a lot of time looking at. So to your point,
    right now, the market does not incentivize security. It
    prioritizes first to market, convenience, ease of use, before
    security. As a result, we are seeing software go to market that
    has holes and bugs in it that is not being secure. When you
    look at the research that has been done, it is absolutely
    possible to build secure software but the economic incentives
    are not there.
        So I commend what the Biden administration has done in the
    executive order, which is to look at software transparency, a
    software bill of materials to understand what goes into it, but
    as a nation and as a government, we have to create. This is
    where I do think regulations and standards around building
    secure software need to be discussed because right now if you
    look at where the vulnerabilities are coming from, often it is
    because of holes in the software. The Kaseya attack most
    recently was a result of that. And we have an opportunity to--
    we call it secure by design, choose your phrase--but the idea
    is building that safety and security. Again, if we use the car
    analogy, we would not think about building a car without an
    airbag anymore. And we have got to be thinking about safety and
    security when it comes to software and hardware development.
        Ms. BOURDEAUX. Thank you. It is very, very difficult to
    change individual behavior at massive scale to deal with
    security. It is much quicker if we could catch it early on
    through the product itself.
        Just kind of on that vein, and I do not know, Ms. Todt,
    maybe you would have an answer on this or Ms. Cornish, what has
    been done in terms of the policing side of things? So one of
    the things we see an awful lot of is we have these attacks and
    then, you know, we get out from under it somehow, we deal with
    the ransomware situation, and then what kind of policing
    capacity do we have or do we need to build up in order to bring
    people who do this to justice?
        Ms. TODT. This is a huge gap in our defense right now
    because criminal actors are getting away with a lot of attacks.
    And whether it is a simple lone wolf in the United States or it
    is a nation state, but we have to be able to prosecute
    criminals who are committing these types of actions. If you
    think about Colonial Pipeline again, if someone had put a bomb
    in that pipeline to prevent the gas and jet fuel from going to
    the East Coast, we would have no qualms about what to do with
    that individual. Essentially by shutting down--I live in
    Virginia so I had a similar--we saw the lines a few blocks down
    the road. There was an impact and it was a psychological impact
    because people were afraid. And when we look at that type of
    impact, we have to think about what are the repercussions for
    these types of actions? And I think this is something that the
    United States just should not do by itself. This is where we
    would look to cooperate with our likeminded economic partners,
    our allies, to understand what are the boundaries and the lines
    that are being crossed for criminal actors, and what are the
    consequences for this type of activity? Because even though we
    are not seeing the immediate devastating effect if we look at
    solar winds, the repercussions continue to cascade. And this is
    why we have to create those boundaries and the definitions
    around what is a criminal act and what are the consequences for
    that act?
        Ms. BOURDEAUX. Thank you so much.
        I yield back the balance of my time.
        Chairwoman VELAZQUEZ. The gentlelady yields back.
        Now we recognize the gentleman from Minnesota, Mr. Stauber.
        Mr. STAUBER. Thank you, Madam Chair and Ranking Member
    Luetkemeyer for holding this. And to the panelists who spoke
    with us today. Very informative.
        As we have seen over the last few years, cybercrime is
    becoming more and more common. The cyber attacks affect our
    small businesses both directly and indirectly. Most recently as
    we talked about, the Colonial Pipeline was hacked by the
    Russians and created a huge gas shortage in the nation. Small
    businesses that relied on any sort of transportation or travel
    for daily operations were adversely impacted. While big
    businesses have the capital to proactively protect themselves
    from cyber attacks, as well as recover from them, small
    businesses do not have that same luxury.
        And so to the panelists, what can the federal government do
    to help small businesses protect themselves from and/or recover
    from cyber attacks? And does this assistance need to look
    different for small businesses with 10 employees versus 100
    employees and so on?
        Mr. Dufault, go ahead.
        Mr. DUFAULT. Congressman, that is a great question.
    Congressman Garbarino and Congresswoman Houlahan mentioned a
    bill that they just introduced which urged folks to support
    H.R. 4515, which would require the Small Business
    Administration to develop a certification program for SBA
    employees and then to deploy them to SBDCs (small business
    development centers), and to provide cybersecurity expertise
    and counseling for small companies in the area that they cover.
        That is one thing that the federal government can do, and a
    little can go a long way in that respect because a lot of small
    companies use SBDCs as sort of a clearinghouse for help in a
    number of different ways. Now, if you had personnel there that
    could help with cyber readiness but also, as you said,
    remediating after a breach, that would be very helpful and that
    is something that the federal government can do specifically
    for small companies.
        Mr. STAUBER. And I think that it is important to get that
    small business back up and running as soon as practicable
    because the days, I mean, you are losing a lot of money each
    day.
        If the other two witnesses would like to comment on that
    question, please?
        Ms. TODT. Sure. In addition to the piece of legislation
    that was introduced, which just to reiterate, I think really
    calls upon the resources of the Small Business Administration
    by using SBDCs and the effectiveness of that. One of the things
    that we recommend in a white paper at the Cyber Readiness
    Institute earlier this year was an opportunity to curate the
    resources that are out there. There are a lot of nonprofits, a
    lot of organizations that are looking to help small businesses.
    But if you are a small business, and this goes to another
    question, that has been attacked, you often do not even now who
    the first call should be. Is it an IT provider? Is it the local
    police? And just being able to provide a prescriptive roadmap
    for small businesses on incident response plans as well as what
    to do when attacked, I think that this is something that CISA,
    in coordination with the SBA, could just provide a resource and
    curate those tools to help small businesses.
        Mr. STAUBER. Well said.
        Ma' am?
        Ms. CORNISH. I would just add to that, having a documented
    incident plan as mentioned is not often enough. People are in
    panic. They are not taking the proper channels. So supporting
    something or exploring something like we have in Maryland as a
    Federal Cyber SWAT team or, you know, even organizing it maybe
    at the SBDC level to have a response line to support small
    businesses when they are going through a breach, to connect
    them to the different types of resources they need.
        Mr. STAUBER. Yeah.
        And my last question, and this is specific to
    cybersecurity, specific. What would you caution the government
    from doing?
        Mr. Dufault?
        Mr. DUFAULT. One thing that comes to mind for us is, I
    mentioned this a minute ago where a lot of our member companies
    are specifically concerned with security in the mobile space.
    So what measures are we taking to harden our devices and to
    prevent unwanted software on our mobile devices? Because these
    mobile devices now have very sensitive personal information on
    them. Health care information, financial information, and then
    real-time location data. So all of the measures that software
    platforms take, (software platforms like the app stores and the
    operating systems) to ensure that unvetted software and
    software that has not been reviewed for security flaws is not
    inadvertently downloaded via clickbait or some other vector.
    Those are really important measures to be able to take. So I
    would caution the federal government not to overreach on
    antitrust, for example, because these are companies that are
    larger firms that have a lot of customers and they are sort of
    in the crosshairs right now when it comes to antitrust. There
    are proposals in House Judiciary that would make it illegal to
    take those measures to prevent access to personal data on
    antitrust grounds. And we are very concerned with those.
        Mr. STAUBER. Thank you. My time is up. And thank you very
    much, and I appreciate this opportunity.
        Madam Chair, I yield back.
        Chairwoman VELAZQUEZ. The gentleman yields back.
        The gentlelady from Texas, Ms. Van Duyne, Ranking Member of
    the Subcommittee on Oversight, Investigations, and Regulations,
    is recognized for 5 minutes.
        Ms. VAN DUYNE. Thank you. Thank you much, very much,
    Chairwoman Velazquez and Ranking Member Luetkemeyer.
        Yesterday, the Biden administration announced China was to
    blame for the sweeping cyber attack on Microsoft earlier this
    year that left hundreds of thousands of small businesses
    vulnerable to cyber intrusion. And then just a month ago
    Russian hackers were able to cripple operations at both the
    world's largest meat supplier and one of the largest pipelines
    in the United States. In 2021 alone, cybercrimes could cost $6
    trillion, which would make it the third largest global economy.
        Cybersecurity, for a number of reasons, is very, very
    important for small businesses, both real and rapidly
    intensifying as we have heard today. It is a new way for our
    adversaries to wage war. Companies need to be ready and we must
    determine the appropriate role for the federal government in
    prepping the businesses that we serve as the engine of our
    economy. And while the need for improved cybersecurity is
    clear, adding too many requirements can be overly complicated
    and counterproductive. And one example is the DOD's new
    cybersecurity assessment framework (CMC). Last month, the
    Oversight Committee, which I serve as the Ranking Member, we
    held a hearing to review this program. And one image that just
    stuck in my mind is the sheer amount of paperwork that was
    needed for a small business to complete just be certified. One
    of the witnesses held up this three-ring binder that I swear
    took him two hands to hold up because it was just so intense.
    And pretty much most of their guidance was coming from LinkedIn
    because DOD and SBA simply were not helpful.
        So moving forward, we have to make sure that we have simple
    framework, which is easy to understand, but also , companies
    need to know how they can be secure, who they can turn to for
    help and how to respond when they are attacked.
        I want to thank the witnesses all for being here today, but
    I also want to reiterate my concern that we are discussing such
    a significant small business issue without a representative
    from SBA present. And if we are going to have a collaborative
    solution to address this matter, it is crucial that SBA is here
    to at least demonstrate their willingness to discuss their
    plans. And I hope they can join us in the future.
        Ms. Nichols, in your experience working with small
    businesses, when they have an issue regarding cybersecurity or
    they get breached, who do they typically turn to for help? Is
    it the SBA or a private partner? And who do you believe they
    should turn to?
        Ms. NICHOLS. That is a good question.
        When they get to us, they are really not sure who to talk
    to. They do try to reach to a private industry and to have help
    with that. Because they do not initially think to refer to the
    government, specifically SBA, because they do not know the
    resources that are there and we would like to change that.
        Ms. VAN DUYNE. Okay. That makes a lot of sense.
        In your testimony, you said the average time--and this will
    still be for Ms. Nichols--you said the average time to identify
    and contain breaches is around 120 days. I am sorry, 280 days.
    Can you explain why it takes this long and how Congress can
    help to shorten that period?
        Ms. NICHOLS. Well, it has to do with they have to find it
    and they may not be prepared to figure out how to do that so
    they have to hire and it is very expensive. And it is just like
    any other IT issue. You have to rule out everything that is
    going on. And again, I am going to default to this. I am a
    state director. I do not run the department. And it is very
    challenging because when you deal with a small business who
    knows nothing and they have a data breach, that was not what
    their initial concern is because they are delivering a service.
    They are trying to make money. And so they are trying to still
    stay in business and mitigate that data breach and get past
    that. So that is just going alongside the business. And I am
    looking at this as a business approach. It does take a long
    time because they are not going to shut down while they try to
    deal with this. They are going to try to keep it as far under
    the table as possible and just keep moving forward. And it does
    take time. So it does take time for any other type of disaster.
        Ms. VAN DUYNE. So, no, I was not being critical that it
    took so long. I am asking how can Congress help to shorten that
    period?
        Ms. NICHOLS. Oh, I do not know. I do not know. Any other
    suggestions?
        Ms. VAN DUYNE. Yeah. I was not being critical. This is just
    how long it takes so what can we do to help?
        Mr. Dufault, overall small businesses are unprepared when
    it comes to cybersecurity. A recent report said that 70 percent
    of small businesses are unprepared for a cyber attack and only
    about half are allocating any money towards cybersecurity. With
    small businesses running on such tight margins, especially
    after a pandemic, how can we make it easier for small
    businesses to be prepared without breaking the bank?
        Mr. DUFAULT. It is a great question, Congresswoman. And
    again, I go back to H.R. 4515, which would provide some
    expertise via the Small Business Development Centers for
    cybersecurity. And by creating a certification program inhouse
    at the SBA, you are creating a Federal resource that can be,
    sort of that can reach a lot of small companies via on-the-
    ground folks that are at the SBDCs. And so that would go some
    distance toward helping ensure that folks are aware of the
    current cyber threats but also the best practices that Ms. Todt
    has referred to on authentication, software updates, and just
    training around social engineering and phishing scams. So that
    is what I would point to.
        Chairwoman VELAZQUEZ. The gentlelady's time has expired.
        Now we recognize the gentleman from Wisconsin, Mr.
    Fitzgerald.
        Mr. FITZGERALD. Thank you, Madam Chair. Thank you very
    much.
        I do not want to rehash some of the earlier questions and
    kind of discussions but let me go back to the idea of the cloud
    and the applications associated with it. So maybe, Mr. Dufault,
    you could comment.
        Obviously, when COVID-19 struck, many of the businesses
    moved to remote work and it seemed like the only way for them
    to kind of survive what was going on. But they did switch up
    kind of their cloud applications at the time. And you know, in
    some instances that may have helped them streamline kind of
    their business practices and they may adopt those permanently
    now; right? But it also increased the security risk is the
    assumption that is being made by some, not all, who think maybe
    that is not the case. But you know, do you share those
    concerns? And you know, I think it is something that small
    business specifically struggles with because of not necessarily
    having the resources and the personnel and the ability to kind
    of track this on a regular basis. So I just wanted you to maybe
    comment on that.
        Mr. DUFAULT. Well, thank you for the question, Congressman.
    And it is something that we are concerned about. As more work
    is being done, more education is happening remotely, certainly
    during the pandemic, and as you said, going forward, more
    commerce I think, in general is going to be transacted in the
    cloud and on smart devices. And so it does point to the need as
    I mentioned earlier for us to allow software platforms, like
    the app stores and the operating systems to take measures to
    remove and keep out sideloaded software. That is where you
    click a link accidentally and it downloads something onto your
    devices. Those measures in place to keep that software off of
    the device are really important.
        I would also point to the fact that, for example, we have
    got a member company in the Minneapolis area, Vemos, that
    provides remote services for restaurants. So you can split a
    check just with one click on your handheld device. I think
    there is an assumption that if more of that is happening online
    and over the Internet, that there are more potential attack
    surfaces, and so I think that observation is correct and that
    that should cause us and your Committee to look closely at what
    the opportunities are to ensure that the threats are adequately
    being dealt with and that small businesses are taking
    precautions.
        Mr. FITZGERALD. And some of these managed service
    providers, you know, they are going to have to adapt kind of
    new, standard operating procedures when it comes to cyber
    hygiene; right? So I am just wondering, you know, how far
    behind the 8-ball are we on this stuff? Because it came at us
    so quickly and now trying to adapt to it, it is probably going
    to take a while; right? I mean, we just do not have the ability
    to make this kind of do a 180 like small business is being
    asked to do.
        Mr. DUFAULT. Well, one thing that came up earlier in the
    discussion was, you know, are people at greater risk if they
    are using on-premises servers? And that is not necessarily
    true. And to your point that folks are using the Cloud a little
    bit more, one of the aspects I pointed to in my written
    testimony was the fact that if you are using off-premises Cloud
    services, then you do have access to a faster patches and
    updates, software updates that can address the newest threats
    and the newest vulnerabilities. Whereas, if you have on-
    premises servers, you are manually installing those updates and
    you are trying to keep up with those threats manually and on
    your own. And you also do not have access to sort of the real-
    time updates for indicators of compromise that others are
    experiencing that are using the same Cloud service.
        And so from that perspective, we may be in a little bit
    better of a position to the extent that we are relying more on
    Cloud services because we have better access to real-time
    threat sharing and we have better access to real-time updates
    to software. So that is one dynamic that sort of cuts the other
    way that I wanted to point out.
        Mr. FITZGERALD. Very good. Thanks for being here today. I
    yield back, Madam Chair.
        Chairwoman VELAZQUEZ. The gentleman yields back.
        Well, thank you again to our witnesses for being here today
    to testify on this critical topic. Your words have highlighted
    the significant risks that small businesses face without
    adequate cybersecurity measures. With more entrepreneurs online
    and more bad actors looking for targets, cyber preparedness has
    never been more important. Today's hearing has made it clear
    that Congress must take an aggressive approach to shield small
    businesses from cyber attacks. It is also vital that federal
    agencies and the private sector continue to collaborate on
    resources, training, and technical assistance to understand and
    reduce small businesses' cyber vulnerabilities.
        I look forward to working with my colleagues on both sides
    of the aisle to make this happen as we consider three
    cybersecurity bills at our markup next week.
        I would ask unanimous consent that Members have 5
    legislative days to submit statements and supporting materials
    for the record.
        Without objection, so ordered.
        If there is no further business to come before the
    Committee, we are adjourned. Thank you.
        [Whereupon, at 12:11 p.m., the committee was adjourned.]

                                A P P E N D I X

    [GRAPHICS NOT AVAILABLE IN TIFF FORMAT]

                                     [all]