[House Report 115-654]
[From the U.S. Government Publishing Office]


115th Congress    }                                   {         Report
                        HOUSE OF REPRESENTATIVES
 2d Session       }                                   {        115-654

======================================================================



 
     SMALL BUSINESS ADVANCED CYBERSECURITY ENHANCEMENTS ACT OF 2017

                                _______
                                

 April 25, 2018.--Committed to the Committee of the Whole House on the 
              State of the Union and ordered to be printed

                                _______
                                

    Mr. Chabot, from the Committee on Small Business, submitted the 
                               following

                              R E P O R T

                        [To accompany H.R. 4668]

    The Committee on Small Business, to whom was referred the 
bill (H.R. 4668) to amend the Small Business Act to provide for 
the establishment of an enhanced cybersecurity assistance and 
protections for small businesses, and for other purposes, 
having considered the same, report favorably thereon with an 
amendment and recommend that the bill as amended do pass.

                                CONTENTS

                                                                   Page
   I. Amendment.......................................................1
  II. Purpose and Bill Summary........................................4
 III. Need for Legislation............................................4
  IV. Hearings........................................................5
   V. Committee Consideration.........................................6
  VI. Committee Votes.................................................6
 VII. Section-by-Section of H.R. 4668, as Amended.....................8
VIII. Congressional Budget Office Cost Estimate.......................9
  IX. Unfunded Mandates...............................................9
   X. New Budget Authority, Entitlement Authority, and Tax Expenditure9
  XI. Oversight Findings..............................................9
 XII. Statement of Constitutional Authority...........................9
XIII. Congressional Accountability Act...............................10
 XIV. Federal Advisory Committee Act Statement.......................10
  XV. Statement of No Earmarks.......................................10
 XVI. Statement of Duplication of Federal Programs...................10
XVII. Disclosure of Directed Rule Makings............................10
XVIII.Performance Goals and Objectives...............................10

 XIX. Changes in Existing Law, Made by the Bill, as Reported.........10

                              I. Amendment

    The amendment is as follows:
  Strike all after the enacting clause and insert the 
following:

SECTION 1. SHORT TITLE.

  This Act may be cited as the ``Small Business Advanced Cybersecurity 
Enhancements Act of 2017''.

SEC. 2. FINDINGS.

  Congress finds the following:
          (1) Small businesses represent more than 97 percent of total 
        businesses in the United States and make up an essential part 
        of the supply chain to some of the largest companies, many of 
        which are in critical infrastructure sectors, from financial 
        and transportation organizations to power, water, and 
        healthcare suppliers.
          (2) Many small businesses do not have dedicated information 
        technology (``IT'') departments and must outsource IT functions 
        or assign these duties to an employee as a secondary function.
          (3) The Internet Crime Complaint Center within the United 
        States Department of Justice recorded 298,728 cybersecurity-
        related complaints in its 2016 report.
          (4) There has been steady increases of cybersecurity-related 
        complaints year over year since the year 2000, totaling 
        3,762,348.
          (5) Seventy-one percent of cyber attacks occurred in 
        businesses with fewer than 100 employees.
          (6) Only 14 percent of small- and medium-sized businesses 
        believe they have the ability to effectively mitigate cyber 
        risks and vulnerabilities.
          (7) Small businesses risk theft and manipulation of sensitive 
        data if they lack adequate cybersecurity measures.
          (8) The Better Business Bureau found that half of small 
        businesses could remain profitable for only one month if they 
        lost essential data.
          (9) Cyber crime is growing rapidly and the annual costs to 
        the global economy are estimated to reach over 
        $2,000,000,000,000 by 2019.
          (10) Cybersecurity is a global challenge where the security 
        threat, attacks, and techniques continually evolve and no 
        company, individual, or Federal agency is immune from these 
        threats.
          (11) Strong collaboration between the public and private 
        sector is essential in the fight against cyber crime.
          (12) There is a reluctance among small businesses to 
        voluntarily share information with government entities, and the 
        Federal Government should work proactively to incentivize and 
        encourage voluntary information sharing to improve the Nation's 
        cybersecurity posture.

SEC. 3. ENHANCED CYBERSECURITY ASSISTANCE AND PROTECTIONS FOR SMALL 
                    BUSINESSES.

  Section 21(a) of the Small Business Act (15 U.S.C. 648(a)) is amended 
by adding at the end the following new paragraph:
          ``(9) Small business cybersecurity assistance and 
        protections.--
                  ``(A) Establishment of small business cybersecurity 
                assistance units.--The Administrator of the Small 
                Business Administration, in coordination with the 
                Secretary of Commerce, and in consultation with the 
                Secretary of Homeland Security and the Attorney 
                General, shall establish--
                          ``(i) in the Administration, a central small 
                        business cybersecurity assistance unit; and
                          ``(ii) within each small business development 
                        center, a regional small business cybersecurity 
                        assistance unit.
                  ``(B) Duties of the central small business 
                cybersecurity assistance unit.--
                          ``(i) In general.--The central small business 
                        cybersecurity assistance unit established under 
                        subparagraph (A)(i) shall serve as the primary 
                        interface for small business concerns to 
                        receive and share cyber threat indicators and 
                        defensive measures with the Federal Government.
                          ``(ii) Use of capability and processes.--The 
                        central small business cybersecurity assistance 
                        unit shall use the capability and process 
                        certified pursuant to section 105(c)(2)(A) of 
                        the Cybersecurity Information Sharing Act of 
                        2015 (6 U.S.C. 1504(c)(2)(A)) to receive cyber 
                        threat indicators or defensive measures from 
                        small business concerns.
                          ``(iii) Application of cisa.--A small 
                        business concern that receives or shares cyber 
                        threat indicators and defensive measures with 
                        the Federal Government through the central 
                        small business cybersecurity assistance unit 
                        established under subparagraph (A)(i), or with 
                        any appropriate entity pursuant to section 
                        103(c) of the Cybersecurity Information Sharing 
                        Act of 2015 (6 U.S.C. 1503(c)), shall receive 
                        the protections and exemptions provided in such 
                        Act and this paragraph.
                  ``(C) Relation to nccic.--
                          ``(i) Central small business cybersecurity 
                        assistance unit.--The central small business 
                        cybersecurity assistance unit established under 
                        subparagraph (A)(i) shall be collocated with 
                        the national cybersecurity and communications 
                        integration center.
                          ``(ii) Access to information.--The national 
                        cybersecurity and communications integration 
                        center shall have access to all cyber threat 
                        indicators or defensive measures shared with 
                        the central small cybersecurity assistance unit 
                        established under subparagraph (A)(i) through 
                        the use of the capability and process described 
                        in subparagraph (B)(ii).
                  ``(D) Cybersecurity assistance for small 
                businesses.--The central small business cybersecurity 
                assistance unit established under subparagraph (A)(i) 
                shall--
                          ``(i) work with each regional small business 
                        cybersecurity assistance unit established under 
                        subparagraph (A)(ii) to provide cybersecurity 
                        assistance to small business concerns;
                          ``(ii) leverage resources from the 
                        Administration, the Department of Commerce, the 
                        Department of Homeland Security, the Department 
                        of Justice, the Department of the Treasury, the 
                        Department of State, and any other Federal 
                        department or agency the Administrator 
                        determines appropriate, in order to help 
                        improve the cybersecurity posture of small 
                        business concerns;
                          ``(iii) coordinate with the Department of 
                        Homeland Security to identify and disseminate 
                        information to small business concerns in a 
                        form that is accessible and actionable by small 
                        business concerns;
                          ``(iv) coordinate with the National Institute 
                        of Standards and Technology to identify and 
                        disseminate information to small business 
                        concerns on the most cost-effective methods for 
                        implementing elements of the cybersecurity 
                        framework of the National Institute of 
                        Standards and Technology applicable to 
                        improving the cybersecurity posture of small 
                        business concerns;
                          ``(v) seek input from the Office of Advocacy 
                        of the Administration to ensure that any 
                        policies or procedures adopted by any 
                        department, agency, or instrumentality of the 
                        Federal Government do not unduly add regulatory 
                        burdens to small business concerns in a manner 
                        that will hamper the improvement of the 
                        cybersecurity posture of such small business 
                        concerns; and
                          ``(vi) leverage resources and relationships 
                        with representatives and entities involved in 
                        the national cybersecurity and communications 
                        integration center to publicize the capacity of 
                        the Federal Government to assist small business 
                        concerns in improving cybersecurity practices.
                  ``(E) Enhanced cybersecurity protections for small 
                businesses.--
                          ``(i) In general.--Notwithstanding any other 
                        provision of law, no cause of action shall lie 
                        or be maintained in any court against any small 
                        business concern, and such action shall be 
                        promptly dismissed, if such action related to 
                        or arises out of--
                                  ``(I) any activity authorized under 
                                this paragraph or the Cybersecurity 
                                Information Sharing Act of 2015 (6 
                                U.S.C. 1501 et seq.); or
                                  ``(II) any action or inaction in 
                                response to any cyber threat indicator, 
                                defensive measure, or other information 
                                shared or received pursuant to this 
                                paragraph or the Cybersecurity 
                                Information Sharing Act of 2015 (6 
                                U.S.C. 1501 et seq.).
                          ``(ii) Application.--The exception provided 
                        in section 105(d)(5)(D)(ii)(I) of the 
                        Cybersecurity Information Sharing Act of 2015 
                        (6 U.S.C. 1504(d)(5)(D)(ii)(I)) shall not apply 
                        to any cyber threat indicator or defensive 
                        measure shared or received by small business 
                        concerns pursuant to this paragraph or the 
                        Cybersecurity Information Sharing Act of 2015 
                        (6 U.S.C. 1501 et seq.).
                          ``(iii) Rule of construction.--Nothing in 
                        this subparagraph shall be construed to affect 
                        the applicability or merits of any defense, 
                        motion, or argument in any cause of action in a 
                        court brought against an entity that is not a 
                        small business concern.
                  ``(F) Definitions.--In this paragraph:
                          ``(i) CISA definitions.--The terms `cyber 
                        threat indicator' and `defensive measure' have 
                        the meanings given such terms in section 102 of 
                        the Cybersecurity Information Sharing Act of 
                        2015 (6 U.S.C. 1501).
                          ``(ii) National cybersecurity and 
                        communications integration center.--The term 
                        `national cybersecurity and communications 
                        integration center' means the national 
                        cybersecurity and communications integration 
                        center established under section 227 of the 
                        Homeland Security Act of 2002 (6 U.S.C. 
                        148).''.

SEC. 4. PROHIBITION ON NEW APPROPRIATIONS.

  (a) In General.--No additional funds are authorized to be 
appropriated to carry out this Act and the amendments made by this Act.
  (b) Existing Funding.--This Act and the amendments made by this Act 
shall be carried out using amounts made available under section 
21(a)(4)(C)(viii) of the Small Business Act (15 U.S.C. 
648(a)(4)(viii)).
  (c) Technical and Conforming Amendment.--Section 21(a)(4)(C)(viii) of 
the Small Business Act (15 U.S.C.648(a)(4)(C)(viii)) is amended to read 
as follows:
                          ``(viii) Limitation.--
                                  ``(I) Cybersecurity assistance.--From 
                                the funds appropriated pursuant to 
                                clause (vii), the Administration shall 
                                reserve not less than $1,000,000 in 
                                each fiscal year to develop 
                                cybersecurity assistance units at small 
                                business development centers under 
                                paragraph (9).
                                  ``(II) Portable assistance.--
                                          ``(aa) In general.--Any funds 
                                        appropriated pursuant to clause 
                                        (vii) that are remaining after 
                                        reserving amounts under 
                                        subclause (I) may be used for 
                                        portable assistance for startup 
                                        and sustainability non-matching 
                                        grant programs to be conducted 
                                        by eligible small business 
                                        development centers in 
                                        communities that are 
                                        economically challenged as a 
                                        result of a business or 
                                        government facility down sizing 
                                        or closing, which has resulted 
                                        in the loss of jobs or small 
                                        business instability.
                                          ``(bb) Grant amount and 
                                        use.--A non-matching grant 
                                        under this subclause shall not 
                                        exceed $100,000, and shall be 
                                        used for small business 
                                        development center personnel 
                                        expenses and related small 
                                        business programs and 
                                        services.''.

                      II. Purpose and Bill Summary

    The purpose of H.R. 4668, the ``Small Business Advanced 
Cybersecurity Enhancements Act of 2017,'' is to amend the Small 
Business Act (the Act)\1\ to encourage small businesses to work 
with the federal government by providing them additional 
resources. In order to combat small businesses' reluctance to 
engage with the federal government, this legislation encourages 
their collaboration in the following ways:
---------------------------------------------------------------------------
    \1\Originally, title II of the Act of July 30, 1953, 67 Stat. 232, 
was designated as the Small Business Act of 1953. A plethora of 
amendments in subsequent Congresses led to a rewrite in 1958. Pub. L. 
No. 85-536, Sec. 1, 72 Stat. 384 (1958). The Act is codified at 15 
U.S.C. Sec. Sec. 631-657s.
---------------------------------------------------------------------------
    It establishes Small Business Administration (SBA) Small 
Business Development Centers (SBDCs) as the primary interface 
for federal information sharing for small businesses; ensures 
small businesses that share cyber indicators through SBDCs 
receive the same protections and exemptions provided in the 
Cybersecurity Information Sharing Act of 2015; ensures that any 
policies or rulemaking adopted by any federal agency as a 
result of small business cyber information sharing do not 
unfairly burned small businesses; and, expands liability 
protections for small businesses that engage with the federal 
government in good faith.

                       III. Need for Legislation

    H.R. 4668 was introduced by Chairman Steve Chabot and 
Ranking Member Nydia Velazquez on December 17, 2017, after 
significant hearings, examination of cybersecurity threats 
facing small businesses, and consideration of possible 
solutions to strengthen the American cybersecurity 
infrastructure by the Committee for several years. The 
Committee determined that the broad deficit of information 
sharing between public and private sectors serves as a 
detriment to the overall cybersecurity posture of the United 
States. A major reason for the lack of information sharing, 
particularly among small businesses, is a lack of resources and 
liability concerns.

                              IV. Hearings

    In the 115th Congress, the Committee held four hearings 
that looked at the issues covered by H.R. 4668. On November 8, 
2017, the Committee on Small Business met for a hearing titled, 
``Federal Government and Small Businesses: Promoting Greater 
Information Sharing for Stronger Cybersecurity.''\2\ The 
hearing examined how federal agencies can encourage greater 
information sharing with small businesses and provide timely 
assistance and resources when a cyber attack occurs. 
Additionally, the hearing examined the policies that discourage 
small businesses from engaging with federal agencies for 
cybersecurity assistance. The witness panel discussed the 
importance of information sharing between small businesses and 
the federal government while also acknowledging that 
information sharing policies could be improved. One witness 
discussed some of the needs and challenges surrounding cyber 
information sharing, including fragmentation, overuse of 
classification, and improving the collection and dissemination 
of information. Another witness testified that small 
businesses' reluctance to share cybersecurity information could 
be reduced by expanding Cybersecurity Information Sharing Act 
(CISA) protections for small businesses and providing tax 
incentives. Witnesses also testified that the federal 
government could better protect small businesses in three ways: 
improving information sharing activities; making cybersecurity 
frameworks and best practices more workable for small 
businesses; and ensuring a legal and policy environment that 
enhances small businesses' abilities to manage cyber risks. A 
fourth witness discussed a few of the federal information 
sharing programs currently available to small businesses 
through agencies such as the Department of Homeland Security 
(DHS). He also made recommendations to improve cybersecurity 
for small businesses, such as moving to the cloud and 
encouraging cyber insurance for small businesses.
---------------------------------------------------------------------------
    \2\Federal Government and Small Businesses: Promoting Greater 
Information Sharing for Stronger Cybersecurity: Hearing Before the H. 
Comm. On Small Bus., 115th Cong. (2017).
---------------------------------------------------------------------------
    On January 30, 2018, the Committee on Small Business met 
for a hearing titled, ``Small Business Information Sharing: 
Combating Foreign Cyber Threats.''\3\ The hearing examined H.R. 
4668, the Small Business Advanced Cybersecurity Enhancements 
Act of 2017, and discussed how federal agencies are 
facilitating greater information sharing with small businesses 
that are vulnerable to foreign-backed cyber attacks. The 
Committee heard directly from the Federal Bureau of 
Investigations (FBI) and DHS.
---------------------------------------------------------------------------
    \3\Small Business Information Sharing: Combating Foreign Cyber 
Threats: Hearing Before the H. Comm. On Small Bus., 115th Cong. (2018).
---------------------------------------------------------------------------
    The panel discussed the importance of increasing 
cybersecurity awareness for small businesses, as they can 
easily fall victim to foreign cyber attacks. The FBI witness 
testified that both the number and sophistication of cyber 
threats is on the rise. They listed a number of prevalent cyber 
threats that are specific to small businesses, including 
business email compromise, ransomware, and the Internet of 
Things. The FBI witness also testified that their Cyber 
Division regularly coordinates initiatives for engagement with 
private sector partners with the goal of ultimately closing 
intelligence gaps. DHS echoed much of the FBI's perspective by 
testifying that cyber threats remain one of the most 
significant risks for small businesses. They discussed DHS' 
resources for assisting small businesses, including the 
National Cybersecurity and Communications Integration Center, 
or NCCIC. DHS also testified that they have been working with 
SBA to develop a strategy to effectively respond to small 
businesses' cybersecurity needs, as directed by the National 
Defense Authorization Act for Fiscal Year 2017.\4\ Both 
agencies also endorsed H.R. 4668, testifying that it would 
provide small businesses with greater access to cybersecurity 
information and ultimately encourage further information 
sharing between the public and private sectors.
---------------------------------------------------------------------------
    \4\Pub. L. No. 114-328, 130 Stat. 2662.
---------------------------------------------------------------------------

                       V. Committee Consideration

    The Committee on Small Business met in open session, with a 
quorum being present, on March 14, 2018 and ordered H.R. 4668 
reported, as amended, to the House. During the markup, two 
amendments were offered. The amendments addressed below are in 
the order in which they were considered at the markup.
    Amendment Number One was offered by Mr. Comer (R-KY). This 
amendment makes a technical change to redirect funding from the 
Portable Assistance Grant Program to fund the SBDC's 
cybersecurity assistance unit. The amendment passed by voice 
vote at 11:43 am.
    Amendment Number Two was offered by Mr. Chabot (R-OH). This 
amendment makes a technical change to clarify the intent of 
H.R. 4668 by ensuring that the liability protections being 
provided to small businesses do not imply that Congress intends 
for legal actions to be brought against other entities not 
covered by the enhanced liability protections in this bill. 
This amendment is required because H.R. 4668 aims to increase 
small business information sharing practices and strengthen 
America's overall cybersecurity posture, without jeopardizing 
other entities not covered by this legislation. The amendment 
passed by voice vote at 11:45 am.

                          VI. Committee Votes

    Clause 3(b) of rule XIII of the Rules of the House of 
Representatives requires the Committee to list the recorded 
votes on the motion to report legislation and amendments 
thereto.


            VII. Section-by-Section of H.R. 4668, as Amended


Section 1: Short title

    The short title of this bill is the ``Small Business 
Advanced Cybersecurity Enhancements Act of 2017.''

Section 2: Findings

    This section reports Congressional findings that small 
businesses rely upon strong collaboration between the public 
and private sectors in the fight against cyber crime, yet are 
often reluctant to voluntarily share information with 
government entities.

Section 3: Enhanced cybersecurity assistance and protections for small 
        businesses

    This section amends Section 21(a) of the Small Business Act 
to direct the Administrator of the Small Business 
Administration, in coordination with the Secretary of Commerce, 
Secretary of Homeland Security, and Attorney General, to 
establish a central small business cybersecurity assistance 
unit in the Administration and a regional small business 
cybersecurity assistance unit within each Small Business 
Development Center (SBDC). This section establishes SBDCs as 
the primary interface for small business concerns to receive 
and share cyber threat indicators with the federal government.

Relation to NCCIC and application of CISA

    This section allows cybersecurity assistance units to 
submit any notice of cyber threat indicators received from, or 
defensive measures taken by, small business concerns to the 
National Cybersecurity and Communications Integration Center 
(NCCIC). Small businesses that receive or share cyber threat 
indicators through the SBDC, and therefore the NCCIC, will 
receive the protections and exemptions provided in the 
Cybersecurity Information Sharing Act of 2015 (CISA). This 
section clarifies that the assistance units will work in 
conjunction with, not in place of, the information sharing 
framework established by the Department of Homeland Security 
(DHS) under CISA.

Role of the central small business cybersecurity assistance unit

    This section directs the central assistance unit within the 
Admiration to work with each regional small business 
cybersecurity assistance unit to provide cybersecurity 
assistance; leverage resources from the Administration and 
other federal agencies; coordinate with DHS to identify and 
disseminate information to small businesses in a form that is 
accessible and actionable to small businesses; coordinate with 
the National Institute of Standards and Technology (NIST) to 
determine and implement the most cost-effective methods for 
employing the NIST cybersecurity framework for small 
businesses; and coordinate with the NCCIC to publicize the 
capacity of federal government to assist small business 
concerns in improving cybersecurity practices.

Role of the Office of Advocacy

    This section also directs the central small business 
cybersecurity assistance unit to seek input from the Small 
Business Administration's Office of Advocacy to ensure that any 
policies or rulemaking adopted by any federal agency as a 
result of small business cyber information sharing does not 
unfairly burden small business concerns.

Enhanced protections for small businesses

    This section expands liability protections for small 
businesses. Under this section, no small business that acts, or 
fails to act, in response to a cyber threat indicator or 
defensive measure shared with the federal government can be 
held liable in court pursuant to this section or CISA.

Section 4: Prohibition on new appropriations

    This section prevents additional funds from being 
appropriated to carry out the intentions of this legislation 
and redirects funding from the Portable Assistance Grant 
Program to fund the development of SBDC's cybersecurity 
assistance units.

            VIII. Congressional Budget Office Cost Estimate

    At the time H.R. 4668 was reported to the House, the 
Congressional Budget Office had not provided a cost estimate.

                         IX. Unfunded Mandates

    H.R. 4668 contains no intergovernmental or private-sector 
mandates as defined in the Unfunded Mandates Reform Act, Public 
Law No. 104-4, and would impose no costs on state, local, or 
tribal governments.

  X. New Budget Authority, Entitlement Authority, and Tax Expenditures

    In compliance with clause 3(c)(2) of rule XIII of the Rules 
of the House, the Committee provides the following opinion and 
estimate with respect to new budget authority, entitlement 
authority, and tax expenditures. While the Committee has not 
received an estimate of new budget authority contained in the 
cost estimate prepared by the Director of the Congressional 
Budget Office pursuant to Sec. 402 of the Congressional Budget 
Act of 1974, the Committee does not believe that there will be 
any additional costs attributable to this legislation. H.R. 
4668 does not direct new spending, but instead reallocates 
funding independently authorized and appropriated.

                         XI. Oversight Findings

    In accordance with clause 2(b)(1) of rule X of the Rules of 
the House, the oversight findings and recommendations of the 
Committee on Small Business with respect to the subject matter 
contained in H.R. 4668 are incorporated into the descriptive 
portions of this report.

               XII. Statement of Constitutional Authority

    Pursuant to clause 3(d)(1) of rule XIII of the Rules of the 
House, the Committee finds that the authority for this 
legislation in Art. I, Sec. 8, cl.2; Art. I, Sec. 8, cl. 7; 
and, Art. I, Sec. 8 cl. 12.

                 XIII. Congressional Accountability Act

    H.R. 4668 does not relate to the terms and conditions of 
employment or access to public services or accommodations 
within the meaning of Sec. 102(b)(3) of Public Law No. 104-1.

             XIV. Federal Advisory Committee Act Statement

    H.R. 4668 does not establish or authorize the establishment 
of any new advisory committees as that term is defined in the 
Federal Advisory Committee Act, 5 U.S.C. App. 2.

                      XV. Statement of No Earmarks

    Pursuant to clause 9 of rule XXI, H.R. 4668 does not 
contain any congressional earmarks, limited tax benefits, or 
limited tariff benefits as defined in subsections (d), (e), or 
(f) of clause 9 of rule XXI of the Rules of the House.

           XVI. Statement of Duplication of Federal Programs

    Pursuant to clause 3(c) of the rule XIII of the Rules of 
the House, no provision of H.R. 4668 establishes or 
reauthorizes a program of the federal government known to be 
duplicative of another federal program, a program that was 
included in any report from the United States Government 
Accountability Office pursuant to Sec. 21 of Pub. L. No. 111-
139, or a program related to a program identified in the most 
recent catalog of federal domestic assistance.

               XVII. Disclosure of Directed Rule Makings

    Pursuant to clause 3(c) of rule XIII of the Rules of the 
House, H.R. 4668 does not direct any rulemaking.

                XVIII. Performance Goals and Objectives

    Pursuant to clause 3(c)(4) of rule XIII of the Rules of the 
House, the Committee establishes the following performance-
related goals and objectives for this legislation:

          This legislation contains a number of provisions that 
        increase federal resources to assist small firms in 
        cybersecurity preparedness as well enhanced liability 
        protections to ensure cooperation between small firms 
        and the federal government when responding to a cyber 
        attack.

       XIX. Changes in Existing Law Made by the Bill, as Reported

    In compliance with clause (E) of rule XIII of the Rules of 
the House, changes in existing law made by the bill, as 
reported, as shown as follows existing law proposed to be 
omitted is enclosed in black brackets, new matter is printed in 
italic, and existing law in which no change is proposed is 
shown in roman:

         Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italic, and existing law in which no 
change is proposed is shown in roman):

                           SMALL BUSINESS ACT



           *       *       *       *       *       *       *
  Sec. 21. (a)(1) The Administration is authorized to make 
grants (including contracts and cooperative agreements) to any 
State government or any agency thereof, any regional entity, 
any State-chartered development, credit or finance corporation, 
any women's business center operating pursuant to section 29, 
any public or private institution of higher education, 
including but not limited to any land-grant college or 
university, any college or school of business, engineering, 
commerce, or agriculture, community college or junior college, 
or to any entity formed by two or more of the above entities 
(herein referred to as ``applicants'') to assist in 
establishing small business development centers and to any such 
labor for: small business oriented employment or natural 
resources development programs; studies, research, and 
counseling concerning the managing, financing, and operation of 
small business enterprises, management and technical assistance 
regarding small business participation in international 
markets, export promotion and technology transfer; delivery or 
distribution of such services and information; providing access 
to business analysts who can refer small business concerns to 
available experts; and, to the extent practicable, providing 
assistance in furtherance of the Small Business Development 
Center Cyber Strategy developed under section 1841(a) of the 
National Defense Authorization Act for Fiscal Year 2017: 
Provided, That after December 31, 1990, the Administration 
shall not make a grant to any applicant other than an 
institution of higher education or a women's business center 
operating pursuant to section 29 as a Small Business 
Development Center unless the applicant was receiving a grant 
(including a contract or cooperative agreement) on such date. 
The Administration shall require any applicant for a small 
business development center grant with performance commencing 
on or after January 1, 1992 to have its own budget and to 
primarily utilize institutions of higher education and women's 
business centers operating pursuant to section 29 to provide 
services to the small business community. The term of such 
grants shall be made on a calendar year basis or to coincide 
with the Federal fiscal year.
          (2) Cooperation to provide international trade 
        services.--
                  (A) Information and services.--The small 
                business development centers shall work in 
                close cooperation with the Administration's 
                regional and local offices, the Department of 
                Commerce, appropriate Federal, State and local 
                agencies (including State trade agencies), and 
                the small business community to serve as an 
                active information dissemination and service 
                delivery mechanism for existing trade 
                promotion, trade finance, trade adjustment, 
                trade remedy and trade data collection programs 
                of particular utility for small businesses.
                  (B) Cooperation with state trade agencies and 
                export assistance centers.--A small business 
                development center that counsels a small 
                business concern on issues relating to 
                international trade shall--
                          (i) consult with State trade agencies 
                        and Export Assistance Centers to 
                        provide appropriate services to the 
                        small business concern; and
                          (ii) as necessary, refer the small 
                        business concern to a State trade 
                        agency or an Export Assistance Center 
                        for further counseling or assistance.
                  (C) Definition.--In this paragraph, the term 
                ``Export Assistance Center'' has the same 
                meaning as in section 22.
  (3) The Small Business Development Center Program shall be 
under the general management and oversight of the 
Administration for the delivery of programs and services to the 
small business community. Such programs and services shall be 
jointly developed, negotiated, and agreed upon, with full 
participation of both parties, pursuant to an executed 
cooperative agreement between the Small Business Development 
Center applicant and the Administration.
  (A) Small business development centers are authorized to form 
an association to pursue matters of common concern. If more 
than a majority of the small business development centers which 
are operating pursuant to agreements with the Administration 
are members of such an association, the Administration is 
authorized and directed to recognize the existence and 
activities of such an association and to consult with it and 
develop documents (i) announcing the annual scope of activities 
pursuant to this section, (ii) requesting proposals to deliver 
assistance as provided in this section and (iii) governing the 
general operations and administration of the Small Business 
Development Center Program, specifically including the 
development of regulations and a uniform negotiated cooperative 
agreement for use on an annual basis when entering into 
individual negotiated agreements with small business 
development centers.
  (B) Provisions governing audits, cost principles and 
administrative requirements for Federal grants, contracts and 
cooperative agreements which are included in uniform 
requirements of Office of Management and Budget (OMB) Circulars 
shall be incorporated by reference and shall not be set forth 
in summary or other form in regulations.
          (C) Whereas On an annual basis, the Small Business 
        Development Center shall review and coordinate public 
        and private partnerships and cosponsorships with the 
        Administration for the purpose of more efficiently 
        leveraging available resources on a National and a 
        State basis.
  (4) Small business development center program level.--
          (A) In general.--The Administration shall require as 
        a condition of any grant (or amendment or modification 
        thereof) made to an applicant under this section, that 
        a matching amount (excluding any fees collected from 
        recipients of such assistance) equal to the amount of 
        such grant be provided from sources other than the 
        Federal Government, to be comprised of not less than 50 
        percent cash and not more than 50 percent of indirect 
        costs and in-kind contributions.
          (B) Restriction.--The matching amount described in 
        subparagraph (A) shall not include any indirect costs 
        or in-kind contributions derived from any Federal 
        program.
          (C) Funding formula.--
                  (i) In general.--Subject to clause (iii), the 
                amount of a formula grant received by a State 
                under this subparagraph shall be equal to an 
                amount determined in accordance with the 
                following formula:
                          (I) The annual amount made available 
                        under section 20(a) for the Small 
                        Business Development Center Program, 
                        less any reductions made for expenses 
                        authorized by clause (v) of this 
                        subparagraph, shall be divided on a pro 
                        rata basis, based on the percentage of 
                        the population of each State, as 
                        compared to the population of the 
                        United States.
                          (II) If the pro rata amount 
                        calculated under subclause (I) for any 
                        State is less than the minimum funding 
                        level under clause (iii), the 
                        Administration shall determine the 
                        aggregate amount necessary to achieve 
                        that minimum funding level for each 
                        such State.
                          (III) The aggregate amount calculated 
                        under subclause (II) shall be deducted 
                        from the amount calculated under 
                        subclause (I) for States eligible to 
                        receive more than the minimum funding 
                        level. The deductions shall be made on 
                        a pro rata basis, based on the 
                        population of each such State, as 
                        compared to the total population of all 
                        such States.
                          (IV) The aggregate amount deducted 
                        under subclause (III) shall be added to 
                        the grants of those States that are not 
                        eligible to receive more than the 
                        minimum funding level in order to 
                        achieve the minimum funding level for 
                        each such State, except that the 
                        eligible amount of a grant to any State 
                        shall not be reduced to an amount below 
                        the minimum funding level.
                  (ii) Grant determination.--The amount of a 
                grant that a State is eligible to apply for 
                under this subparagraph shall be the amount 
                determined under clause (i), subject to any 
                modifications required under clause (iii), and 
                shall be based on the amount available for the 
                fiscal year in which performance of the grant 
                commences, but not including amounts 
                distributed in accordance with clause (iv). The 
                amount of a grant received by a State under any 
                provision of this subparagraph shall not exceed 
                the amount of matching funds from sources other 
                than the Federal Government, as required under 
                subparagraph (A).
                  (iii) Minimum funding level.--The amount of 
                the minimum funding level for each State shall 
                be determined for each fiscal year based on the 
                amount made available for that fiscal year to 
                carry out this section, as follows:
                          (I) If the amount made available is 
                        not less than $81,500,000 and not more 
                        than $90,000,000, the minimum funding 
                        level shall be $500,000.
                          (II) If the amount made available is 
                        less than $81,500,000, the minimum 
                        funding level shall be the remainder of 
                        $500,000 minus a percentage of $500,000 
                        equal to the percentage amount by which 
                        the amount made available is less than 
                        $81,500,000.
                          (III) If the amount made available is 
                        more than $90,000,000, the minimum 
                        funding level shall be the sum of 
                        $500,000 plus a percentage of $500,000 
                        equal to the percentage amount by which 
                        the amount made available exceeds 
                        $90,000,000.
                  (iv) Distributions.--Subject to clause (iii), 
                if any State does not apply for, or use, its 
                full funding eligibility for a fiscal year, the 
                Administration shall distribute the remaining 
                funds as follows:
                          (I) If the grant to any State is less 
                        than the amount received by that State 
                        in fiscal year 2000, the Administration 
                        shall distribute such remaining funds, 
                        on a pro rata basis, based on the 
                        percentage of shortage of each such 
                        State, as compared to the total amount 
                        of such remaining funds available, to 
                        the extent necessary in order to 
                        increase the amount of the grant to the 
                        amount received by that State in fiscal 
                        year 2000, or until such funds are 
                        exhausted, whichever first occurs.
                          (II) If any funds remain after the 
                        application of subclause (I), the 
                        remaining amount may be distributed as 
                        supplemental grants to any State, as 
                        the Administration determines, in its 
                        discretion, to be appropriate, after 
                        consultation with the association 
                        referred to in subsection (a)(3)(A).
                  (v) Use of amounts.--
                          (I) In general.--Of the amounts made 
                        available in any fiscal year to carry 
                        out this section--
                                  (aa) not more than $500,000 
                                may be used by the 
                                Administration to pay expenses 
                                enumerated in subparagraphs (B) 
                                through (D) of section 
                                20(a)(1); and
                                  (bb) not more than $500,000 
                                may be used by the 
                                Administration to pay the 
                                examination expenses enumerated 
                                in section 20(a)(1)(E).
                          (II) Limitation.--No funds described 
                        in subclause (I) may be used for 
                        examination expenses under section 
                        20(a)(1)(E) if the usage would reduce 
                        the amount of grants made available 
                        under clause (i)(I) of this 
                        subparagraph to less than $85,000,000 
                        (after excluding any amounts provided 
                        in appropriations Acts, or accompanying 
                        report language, for specific 
                        institutions or for purposes other than 
                        the general small business development 
                        center program) or would further reduce 
                        the amount of such grants below such 
                        amount.
                  (vi) Exclusions.--Grants provided to a State 
                by the Administration or another Federal agency 
                to carry out subsection (a)(6) or (c)(3)(G), or 
                for supplemental grants set forth in clause 
                (iv)(II) of this subparagraph, shall not be 
                included in the calculation of maximum funding 
                for a State under clause (ii) of this 
                subparagraph.
                  (vii) Authorization of appropriations.--There 
                are authorized to be appropriated to carry out 
                this subparagraph--
                          (I) $130,000,000 for fiscal year 
                        2005; and
                          (II) $135,000,000 for fiscal year 
                        2006.
                  [(viii) Limitation.--From the funds 
                appropriated pursuant to clause (vii), the 
                Administration shall reserve not less than 
                $1,000,000 in each fiscal year to develop 
                portable assistance for startup and 
                sustainability non-matching grant programs to 
                be conducted by eligible small business 
                development centers in communities that are 
                economically challenged as a result of a 
                business or government facility down sizing or 
                closing, which has resulted in the loss of jobs 
                or small business instability. A non-matching 
                grant under this clause shall not exceed 
                $100,000, and shall be used for small business 
                development center personnel expenses and 
                related small business programs and services.]
                  (viii) Limitation.--
                          (I) Cybersecurity assistance.--From 
                        the funds appropriated pursuant to 
                        clause (vii), the Administration shall 
                        reserve not less than $1,000,000 in 
                        each fiscal year to develop 
                        cybersecurity assistance units at small 
                        business development centers under 
                        paragraph (9).
                          (II) Portable assistance.--
                                  (aa) In general.--Any funds 
                                appropriated pursuant to clause 
                                (vii) that are remaining after 
                                reserving amounts under 
                                subclause (I) may be used for 
                                portable assistance for startup 
                                and sustainability non-matching 
                                grant programs to be conducted 
                                by eligible small business 
                                development centers in 
                                communities that are 
                                economically challenged as a 
                                result of a business or 
                                government facility down sizing 
                                or closing, which has resulted 
                                in the loss of jobs or small 
                                business instability.
                                  (bb) Grant amount and use.--A 
                                non-matching grant under this 
                                subclause shall not exceed 
                                $100,000, and shall be used for 
                                small business development 
                                center personnel expenses and 
                                related small business programs 
                                and services.
                  (ix) State defined.--In this subparagraph, 
                the term ``State'' means each of the several 
                States, the District of Columbia, the 
                Commonwealth of Puerto Rico, the Virgin 
                Islands, Guam, and American Samoa.
  (5) Federal contracts with small business development 
centers.--
          (A) In general.--Subject to the conditions set forth 
        in subparagraph (B), a small business development 
        center may enter into a contract with a Federal 
        department or agency to provide specific assistance to 
        small business concerns.
          (B) Contract prerequisites.--Before bidding on a 
        contract described in subparagraph (A), a small 
        business development center shall receive approval from 
        the Associate Administrator of the small business 
        development center program of the subject and general 
        scope of the contract. Each approval under subparagraph 
        (A) shall be based upon a determination that the 
        contract will provide assistance to small business 
        concerns and that performance of the contract will not 
        hinder the small business development center in 
        carrying out the terms of the grant received by the 
        small business development center from the 
        Administration.
          (C) Exemption from matching requirement.--A contract 
        under this paragraph shall not be subject to the 
        matching funds or eligibility requirements of paragraph 
        (4).
          (D) Additional provision.--Notwithstanding any other 
        provision of law, a contract for assistance under this 
        paragraph shall not be applied to any Federal 
        department or agency's small business, woman-owned 
        business, or socially and economically disadvantaged 
        business contracting goal under section 15(g).
          (6) Any applicant which is funded by the 
        Administration as a Small Business Development Center 
        may apply for an additional grant to be used solely to 
        assist--
                  (A) with the development and enhancement of 
                exports by small business concerns;
                  (B) in technology transfer; and
                  (C) with outreach, development, and 
                enhancement of minority-owned small business 
                startups or expansions, HUBZone small business 
                concerns, veteran-owned small business startups 
                or expansions, and women-owned small business 
                startups or expansions, in communities impacted 
                by base closings or military or corporate 
                downsizing, or in rural or underserved 
                communities;
        as provided under subparagraphs (B) through (G) of 
        subsection (c)(3). Applicants for such additional 
        grants shall comply with all of the provisions of this 
        section, including providing matching funds, except 
        that funding under this paragraph shall be effective 
        for any fiscal year to the extent provided in advance 
        in appropriations Acts and shall be in addition to the 
        dollar program limitations specified in paragraphs (4) 
        and (5). No recipient of funds under this paragraph 
        shall receive a grant which would exceed its pro rata 
        share of a $15,000,000 program based upon the 
        populations to be served by the Small Business 
        Development Center as compared to the total population 
        of the United States. The minimum amount of eligibility 
        for any State shall be $100,000.
          (7) Privacy requirements.--
                  (A) In general.--A small business development 
                center, consortium of small business 
                development centers, or contractor or agent of 
                a small business development center may not 
                disclose the name, address, or telephone number 
                of any individual or small business concern 
                receiving assistance under this section without 
                the consent of such individual or small 
                business concern, unless--
                          (i) the Administrator is ordered to 
                        make such a disclosure by a court in 
                        any civil or criminal enforcement 
                        action initiated by a Federal or State 
                        agency; or
                          (ii) the Administrator considers such 
                        a disclosure to be necessary for the 
                        purpose of conducting a financial audit 
                        of a small business development center, 
                        but a disclosure under this clause 
                        shall be limited to the information 
                        necessary for such audit.
                  (B) Administrator use of information.--This 
                section shall not--
                          (i) restrict Administrator access to 
                        program activity data; or
                          (ii) prevent the Administrator from 
                        using client information to conduct 
                        client surveys.
                  (C) Regulations.--
                          (i) In general.--The Administrator 
                        shall issue regulations to establish 
                        standards--
                                  (I) for disclosures with 
                                respect to financial audits 
                                under subparagraph (A)(ii); and
                                  (II) for client surveys under 
                                subparagraph (B)(ii), including 
                                standards for oversight of such 
                                surveys and for dissemination 
                                and use of client information.
                          (ii) Maximum privacy protection.--
                        Regulations under this subparagraph, 
                        shall, to the extent practicable, 
                        provide for the maximum amount of 
                        privacy protection.
                          (iii) Inspector general.--Until the 
                        effective date of regulations under 
                        this subparagraph, any client survey 
                        and the use of such information shall 
                        be approved by the Inspector General 
                        who shall include such approval in his 
                        semi-annual report.
          (8) Cybersecurity assistance.--
                  (A) In general.--The Department of Homeland 
                Security, and any other Federal department or 
                agency in coordination with the Department of 
                Homeland Security, may leverage small business 
                development centers to provide assistance to 
                small business concerns by disseminating 
                information relating to cybersecurity risks and 
                other homeland security matters to help small 
                business concerns in developing or enhancing 
                cybersecurity infrastructure, awareness of 
                cyber threat indicators, and cyber training 
                programs for employees.
                  (B) Definitions.--In this paragraph, the 
                terms ``cybersecurity risk'' and ``cyber threat 
                indicator'' have the meanings given such terms, 
                respectively, under section 227(a) of the 
                Homeland Security Act of 2002 (6 U.S.C. 
                148(a)).
          (9) Small business cybersecurity assistance and 
        protections.--
                  (A) Establishment of small business 
                cybersecurity assistance units.--The 
                Administrator of the Small Business 
                Administration, in coordination with the 
                Secretary of Commerce, and in consultation with 
                the Secretary of Homeland Security and the 
                Attorney General, shall establish--
                          (i) in the Administration, a central 
                        small business cybersecurity assistance 
                        unit; and
                          (ii) within each small business 
                        development center, a regional small 
                        business cybersecurity assistance unit.
                  (B) Duties of the central small business 
                cybersecurity assistance unit.--
                          (i) In general.--The central small 
                        business cybersecurity assistance unit 
                        established under subparagraph (A)(i) 
                        shall serve as the primary interface 
                        for small business concerns to receive 
                        and share cyber threat indicators and 
                        defensive measures with the Federal 
                        Government.
                          (ii) Use of capability and 
                        processes.--The central small business 
                        cybersecurity assistance unit shall use 
                        the capability and process certified 
                        pursuant to section 105(c)(2)(A) of the 
                        Cybersecurity Information Sharing Act 
                        of 2015 (6 U.S.C. 1504(c)(2)(A)) to 
                        receive cyber threat indicators or 
                        defensive measures from small business 
                        concerns.
                          (iii) Application of cisa.--A small 
                        business concern that receives or 
                        shares cyber threat indicators and 
                        defensive measures with the Federal 
                        Government through the central small 
                        business cybersecurity assistance unit 
                        established under subparagraph (A)(i), 
                        or with any appropriate entity pursuant 
                        to section 103(c) of the Cybersecurity 
                        Information Sharing Act of 2015 (6 
                        U.S.C. 1503(c)), shall receive the 
                        protections and exemptions provided in 
                        such Act and this paragraph.
                  (C) Relation to nccic.--
                          (i) Central small business 
                        cybersecurity assistance unit.--The 
                        central small business cybersecurity 
                        assistance unit established under 
                        subparagraph (A)(i) shall be collocated 
                        with the national cybersecurity and 
                        communications integration center.
                          (ii) Access to information.--The 
                        national cybersecurity and 
                        communications integration center shall 
                        have access to all cyber threat 
                        indicators or defensive measures shared 
                        with the central small cybersecurity 
                        assistance unit established under 
                        subparagraph (A)(i) through the use of 
                        the capability and process described in 
                        subparagraph (B)(ii).
                  (D) Cybersecurity assistance for small 
                businesses.--The central small business 
                cybersecurity assistance unit established under 
                subparagraph (A)(i) shall--
                          (i) work with each regional small 
                        business cybersecurity assistance unit 
                        established under subparagraph (A)(ii) 
                        to provide cybersecurity assistance to 
                        small business concerns;
                          (ii) leverage resources from the 
                        Administration, the Department of 
                        Commerce, the Department of Homeland 
                        Security, the Department of Justice, 
                        the Department of the Treasury, the 
                        Department of State, and any other 
                        Federal department or agency the 
                        Administrator determines appropriate, 
                        in order to help improve the 
                        cybersecurity posture of small business 
                        concerns;
                          (iii) coordinate with the Department 
                        of Homeland Security to identify and 
                        disseminate information to small 
                        business concerns in a form that is 
                        accessible and actionable by small 
                        business concerns;
                          (iv) coordinate with the National 
                        Institute of Standards and Technology 
                        to identify and disseminate information 
                        to small business concerns on the most 
                        cost-effective methods for implementing 
                        elements of the cybersecurity framework 
                        of the National Institute of Standards 
                        and Technology applicable to improving 
                        the cybersecurity posture of small 
                        business concerns;
                          (v) seek input from the Office of 
                        Advocacy of the Administration to 
                        ensure that any policies or procedures 
                        adopted by any department, agency, or 
                        instrumentality of the Federal 
                        Government do not unduly add regulatory 
                        burdens to small business concerns in a 
                        manner that will hamper the improvement 
                        of the cybersecurity posture of such 
                        small business concerns; and
                          (vi) leverage resources and 
                        relationships with representatives and 
                        entities involved in the national 
                        cybersecurity and communications 
                        integration center to publicize the 
                        capacity of the Federal Government to 
                        assist small business concerns in 
                        improving cybersecurity practices.
                  (E) Enhanced cybersecurity protections for 
                small businesses.--
                          (i) In general.--Notwithstanding any 
                        other provision of law, no cause of 
                        action shall lie or be maintained in 
                        any court against any small business 
                        concern, and such action shall be 
                        promptly dismissed, if such action 
                        related to or arises out of--
                                  (I) any activity authorized 
                                under this paragraph or the 
                                Cybersecurity Information 
                                Sharing Act of 2015 (6 U.S.C. 
                                1501 et seq.); or
                                  (II) any action or inaction 
                                in response to any cyber threat 
                                indicator, defensive measure, 
                                or other information shared or 
                                received pursuant to this 
                                paragraph or the Cybersecurity 
                                Information Sharing Act of 2015 
                                (6 U.S.C. 1501 et seq.).
                          (ii) Application.--The exception 
                        provided in section 105(d)(5)(D)(ii)(I) 
                        of the Cybersecurity Information 
                        Sharing Act of 2015 (6 U.S.C. 
                        1504(d)(5)(D)(ii)(I)) shall not apply 
                        to any cyber threat indicator or 
                        defensive measure shared or received by 
                        small business concerns pursuant to 
                        this paragraph or the Cybersecurity 
                        Information Sharing Act of 2015 (6 
                        U.S.C. 1501 et seq.).
                          (iii) Rule of construction.--Nothing 
                        in this subparagraph shall be construed 
                        to affect the applicability or merits 
                        of any defense, motion, or argument in 
                        any cause of action in a court brought 
                        against an entity that is not a small 
                        business concern.
                  (F) Definitions.--In this paragraph:
                          (i) CISA definitions.--The terms 
                        ``cyber threat indicator'' and 
                        ``defensive measure'' have the meanings 
                        given such terms in section 102 of the 
                        Cybersecurity Information Sharing Act 
                        of 2015 (6 U.S.C. 1501).
                          (ii) National cybersecurity and 
                        communications integration center.--The 
                        term ``national cybersecurity and 
                        communications integration center'' 
                        means the national cybersecurity and 
                        communications integration center 
                        established under section 227 of the 
                        Homeland Security Act of 2002 (6 U.S.C. 
                        148).
  (b)(1) Financial assistance shall not be made available to 
any applicant if approving such assistance would be 
inconsistent with a plan for the area involved which has been 
adopted by an agency recognized by the State government as 
authorized to do so and approved by the Administration in 
accordance with the standards and requirements established 
pursuant to this section.
  (2) An applicant may apply to participate in the program by 
submitting to the Administration for approval a plan naming 
those authorized in subsection (a) to participate in the 
program, the geographic area to be served, the services that it 
would provide, the method for delivering services, a budget, 
and any other information and assurances the Administration may 
require to insure that the applicant will carry out the 
activities eligible for assistance. The Administration is 
authorized to approve, conditionally approve or reject a plan 
or combination of plans submitted. In all cases, the 
Administration shall review plans for conformity with the plan 
submitted pursuant to paragraph (1) of this subsection, and 
with a view toward providing small business with the most 
comprehensive and coordinated assistance in the State or part 
thereof to be served.
          (3) Assistance to out-of-state small business 
        concerns.--
                  (A) In general.--At the discretion of the 
                Administration, the Administration is 
                authorized to permit a small business 
                development center to provide advice, 
                information and assistance, as described in 
                subsection (c), to small businesses located 
                outside the State, but only to the extent such 
                businesses are located within close 
                geographical proximity to the small business 
                development center, as determined by the 
                Administration.
                  (B) Disaster recovery assistance.--
                          (i) In general.--At the discretion of 
                        the Administrator, the Administrator 
                        may authorize a small business 
                        development center to provide advice, 
                        information, and assistance, as 
                        described in subsection (c), to a small 
                        business concern located outside of the 
                        State, without regard to geographic 
                        proximity to the small business 
                        development center, if the small 
                        business concern is located in an area 
                        for which the President has declared a 
                        major disaster.
                          (ii) Term.--
                                  (I) In general.--A small 
                                business development center may 
                                provide advice, information, 
                                and assistance to a small 
                                business concern under clause 
                                (i) for a period of not more 
                                than 2 years after the date on 
                                which the President declared a 
                                major disaster for the area in 
                                which the small business 
                                concern is located.
                                  (II) Extension.--The 
                                Administrator may, at the 
                                discretion of the 
                                Administrator, extend the 
                                period described in subclause 
                                (I).
                          (iii) Continuity of services.--A 
                        small business development center that 
                        provides counselors to an area 
                        described in clause (i) shall, to the 
                        maximum extent practicable, ensure 
                        continuity of services in any State in 
                        which the small business development 
                        center otherwise provides services.
                          (iv) Access to disaster recovery 
                        facilities.--For purposes of this 
                        subparagraph, the Administrator shall, 
                        to the maximum extent practicable, 
                        permit the personnel of a small 
                        business development center to use any 
                        site or facility designated by the 
                        Administrator for use to provide 
                        disaster recovery assistance.
  (c)(1) Applicants receiving grants under this section shall 
assist small businesses in solving problems concerning 
operations, manufacturing, engineering, technology exchange and 
development, personnel administration, marketing, sales, 
merchandising, finance, accounting, business strategy 
development, and other disciplines required for small business 
growth and expansion, innovation, increased productivity, and 
management improvement, and for decreasing industry economic 
concentrations. Applicants receiving grants under this section 
may also assist small businesses by providing, where 
appropriate, education on the requirements applicable to small 
businesses under the regulations issued under section 38 of the 
Arms Export Control Act (22 U.S.C. 2778) and on compliance with 
those requirements.
  (2) A small business development center shall provide 
services as close as possible to small businesses by providing 
extension services and utilizing satellite locations when 
necessary. The facilities and staff of each Small Business 
Development Center shall be located in such places as to 
provide maximum accessibility and benefits to the small 
businesses which the center is intended to serve. To the extent 
possible, it also shall make full use of other Federal and 
State government programs that are concerned with aiding small 
business. A small business development center shall have--
          (A) a full-time staff, including a full-time director 
        who shall have the authority to make expenditures under 
        the center's budget and who shall manage the program 
        activities;
          (B) access to business analysts to counsel, assist, 
        and inform small business clients;
          (C) access to technology transfer agent to provide 
        state or art technology to small businesses through 
        coupling with national and regional technology data 
        sources;
          (D) access to information specialists to assist in 
        providing information searches and referrals to small 
        business;
          (E) access to part-time professional specialists to 
        conduct research or to provide counseling assistance 
        whenever the need arises;
          (F) access to laboratory and adaptive engineering 
        facilities; and
          (G) access to cybersecurity specialists to counsel, 
        assist, and inform small business concern clients, in 
        furtherance of the Small Business Development Center 
        Cyber Strategy developed under section 1841(a) of the 
        National Defense Authorization Act for Fiscal Year 
        2017.
  (3) Services provided by a small business development center 
shall include, but shall not be limited to--
          (A) furnishing one-to-one individual counseling to 
        small businesses, including--
                  (i) working with individuals to increase 
                awareness of basic credit practices and credit 
                requirements;
                  (ii) working with individuals to develop 
                business plans, financial packages, credit 
                applications, and contract proposals;
                  (iii) working with the Administration to 
                develop and provide informational tools for use 
                in working with individuals on pre-business 
                startup planning, existing business expansion, 
                and export planning; and
                  (iv) working with individuals referred by the 
                local offices of the Administration and 
                Administration participating lenders;
          (B) assisting in technology transfer, research and 
        development, including applied research, and coupling 
        from existing sources to small businesses, including--
                  (i) working to increase the access of small 
                businesses to the capabilities of automated 
                flexible manufacturing systems;
                  (ii) working through existing networks and 
                developing new networks for technology transfer 
                that encourage partnership between the small 
                business and academic communities to help 
                commercialize university-based research and 
                development and introduce university-based 
                engineers and scientists to their counterparts 
                in small technology-based firms; and
                  (iii) exploring the viability of developing 
                shared production facilities, under appropriate 
                circumstances;
          (C) in cooperation with the Department of Commerce 
        and other relevant Federal agencies, actively assisting 
        small businesses in exporting by identifying and 
        developing potential export markets, facilitating 
        export transactions, developing linkages between United 
        States small business firms and prescreened foreign 
        buyers, assisting small businesses to participate in 
        international trade shows, assisting small businesses 
        in obtaining export financing, and facilitating the 
        development or reorientation of marketing and 
        production strategies; where appropriate, the Small 
        Business Development Center and the Administration may 
        work in cooperation with the State to establish a State 
        international trade center for these purposes;
          (D) developing a program in conjunction with the 
        Export-Import Bank and local and regional 
        Administration offices that will enable Small Business 
        Development Centers to serve as an information network 
        and to assist small business applicants for Export-
        Import Bank financing programs, and otherwise identify 
        and help to make available export financing programs to 
        small businesses;
          (E) working closely with the small business 
        community, small business consultants, State agencies, 
        universities and other appropriate groups to make 
        translation services more readily available to small 
        business firms doing business, or attempting to develop 
        business, in foreign markets;
          (F) in providing assistance under this subsection, 
        applicants shall cooperate with the Department of 
        Commerce and other relevant Federal agencies to 
        increase access to available export market information 
        systems, including the CIMS system;
          (G) assisting small businesses to develop and 
        implement strategic business plans to timely and 
        effectively respond to the planned closure (or 
        reduction) of a Department of Defense facility within 
        the community, or actual or projected reductions in 
        such firms' business base due to the actual or 
        projected termination (or reduction) of a Department of 
        Defense program or a contract in support of such 
        program--
                  (i) by developing broad economic assessments 
                of the adverse impacts of--
                          (I) the closure (or reduction) of the 
                        Department of Defense facility on the 
                        small business concerns providing goods 
                        or services to such facility or to the 
                        military and civilian personnel 
                        currently stationed or working at such 
                        facility; and
                          (II) the termination (or reduction) 
                        of a Department of Defense program (or 
                        contracts under such program) on the 
                        small business concerns participating 
                        in such program as a prime contractor, 
                        subcontractor or supplier at any tier;
                  (ii) by developing, in conjunction with 
                appropriate Federal, State, and local 
                governmental entities and other private sector 
                organizations, the parameters of a transition 
                adjustment program adaptable to the needs of 
                individual small business concerns;
                  (iii) by conducting appropriate programs to 
                inform the affected small business community 
                regarding the anticipated adverse impacts 
                identified under clause (i) and the economic 
                adjustment assistance available to such firms; 
                and
                  (iv) by assisting small business concerns to 
                develop and implement an individualized 
                transition business plan.
          (H) maintaining current information concerning 
        Federal, State, and local regulations that affect small 
        businesses and counsel small businesses on methods of 
        compliance. Counseling and technology development shall 
        be provided when necessary to help small businesses 
        find solutions for complying with environmental, 
        energy, health, safety, and other Federal, State, and 
        local regulations;
          (I) coordinating and conducting research into 
        technical and general small business problems for which 
        there are no ready solutions;
          (J) providing and maintaining a comprehensive library 
        that contains current information and statistical data 
        needed by small businesses;
          (K) maintaining a working relationship and open 
        communications with the financial and investment 
        communities, legal associations, local and regional 
        private consultants, and local and regional small 
        business groups and associations in order to help 
        address the various needs of the small business 
        community;
          (L) conducting in-depth surveys for local small 
        business groups in order to develop general information 
        regarding the local economy and general small 
        businesses strengths and weaknesses in the locality;
          (M) in cooperation with the Department of Commerce, 
        the Administration and other relevant Federal agencies, 
        actively assisting rural small businesses in exporting 
        by identifying and developing potential export markets 
        for rural small businesses, facilitating export 
        transactions for rural small businesses, developing 
        linkages between United States' rural small businesses 
        and prescreened foreign buyers, assisting rural small 
        businesses to participate in international trade shows, 
        assisting rural small businesses in obtaining export 
        financing and developing marketing and production 
        strategies;
          (N) assisting rural small businesses--
                  (i) in developing marketing and production 
                strategies that will enable them to better 
                compete in the domestic market--
                  (ii) by providing technical assistance needed 
                by rural small businesses;
                  (iii) by making available managerial 
                assistance to rural small business concerns; 
                and
                  (iv) by providing information and assistance 
                in obtaining financing for business startups 
                and expansion;
          (O) in conjunction with the United States Travel and 
        Tourism Administration, assist rural small business in 
        developing the tourism potential of rural communities 
        by--
                  (i) identifying the cultural, historic, 
                recreational, and scenic resources of such 
                communities;
                  (ii) providing assistance to small businesses 
                in developing tourism marketing and promotion 
                plans relating to tourism in rural areas; and
                  (iii) assisting small business concerns to 
                obtain capital for starting or expanding 
                businesses primarily serving tourists;
          (P) maintaining lists of local and regional private 
        consultants to whom small business can be referred;
          (Q) providing information to small business concerns 
        regarding compliance with regulatory requirements;
          (R) developing informational publications, 
        establishing resource centers of reference materials, 
        and distributing compliance guides published under 
        section 312(a) of the Small Business Regulatory 
        Enforcement Fairness Act of 1996;
          (S) providing small business owners with access to a 
        wide variety of export-related information by 
        establishing on-line computer linkages between small 
        business development centers and an international trade 
        data information network with ties to the Export 
        Assistance Center program; and
          (T) providing information and assistance to small 
        business concerns with respect to establishing drug-
        free workplace programs on or before October 1, 2006.
  (4) A small business development center shall continue to 
upgrade and modify its services, as needed, in order to meet 
the changing and evolving needs of the small business 
community.
  (5) In addition to the methods prescribed in section 
21(c)(2), a small business development center shall utilize and 
compensate as one of its resources qualified small business 
vendors, including but not limited to, private management 
consultants, private consulting engineers and private testing 
laboratories, to provide services as described in this 
subsection to small businesses on behalf of such small business 
development center.
  (6) In any State (A) in which the Administration has not made 
a grant pursuant to paragraph (1) of subsection (a), or (B) in 
which no application for a grant has been made by a Small 
Business Development Center pursuant to paragraph (6) of such 
subsection within 60 days after the effective date of any grant 
under subsection (a)(1) to such center or the date the 
Administration notifies the grantee funded under subsection 
(a)(1) that funds are available for grant applications pursuant 
to subsection (a)(6), whichever date occurs last, the 
Administration may make grants to a non-profit entity in that 
State to carry out the activities specified in paragraph (6) of 
subsection (a). Any such applicants shall comply with the 
matching funds requirement of paragraph (4) of subsection (a). 
Such grants shall be effective for any fiscal year only to the 
extent provided in advance in appropriations Acts, and each 
State shall be limited to the pro rata share provisions of 
paragraph (6) of subsection (a).
          (7) In performing the services identified in 
        paragraph (3), the Small Business Development Centers 
        shall work in close cooperation with the 
        Administration's regional and local offices, the local 
        small business community, and appropriate State and 
        local agencies.
          (8) The Associate Administrator for Small Business 
        Development Centers, in consultation with the Small 
        Business Development Centers, shall develop and 
        implement an information sharing system. Subject to 
        amounts approved in advance in appropriations Acts, the 
        Administration may make grants or enter cooperative 
        agreements with one or more centers to carry out the 
        provisions of this paragraph. Said grants or 
        cooperative agreements shall be awarded for periods of 
        no more than five years duration. The matching funds 
        provisions of subsection (a) shall not be applicable to 
        grants or cooperative agreements under this paragraph. 
        The system shall--
                  (A) allow Small Business Development Centers 
                participating in the program to exchange 
                information about their programs; and
                  (B) provide information central to technology 
                transfer.
  (d) Where appropriate, the Small Business Development Centers 
shall work in conjunction with the relevant State agency and 
the Department of Commerce to develop a comprehensive plan for 
enhancing the export potential of small businesses located 
within the State. This plan may involve the cofunding and 
staffing of a State Office of International Trade within the 
State Small Business Development Center, using joint State and 
Federal funding, and any other appropriate measures directed at 
improving the export performance of small businesses within the 
State.
  (e) Laboratories operated and funded by the Federal 
Government are authorized and directed to cooperate with the 
Administration in developing and establishing programs to 
support small business development centers by making facilities 
and equipment available; providing experiment station 
capabilities in adaptive engineering; providing library and 
technical information processing capabilities; and providing 
professional staff for consulting. The Administration is 
authorized to reimburse the laboratories for such services.
  (f) The National Science Foundation is authorized and 
directed to cooperate with the Administration and with the 
Small Business Development Centers in developing and 
establishing programs to support the centers.
  (g) National Aeronautics and Space Administration and 
Regional Technology Transfer Centers.--The National Aeronautics 
and Space Administration and regional technology transfer 
centers supported by the National Aeronautics and Space 
Administration are authorized and directed to cooperate with 
small business development centers participating in the 
program.
  (h) Associate Administrator for Small Business Development 
Centers.--
          (1) Appointment and compensation.--The Administrator 
        shall appoint an Associate Administrator for Small 
        Business Development Centers who shall report to an 
        official who is not more than one level below the 
        Office of the Administrator and who shall serve without 
        regard to the provisions of title 5, governing 
        appointments in the competitive service, and without 
        regard to chapter 51, and subchapter III of chapter 53 
        of such title relating to classification and General 
        Schedule pay rates, but at a rate not less than the 
        rate of GS-17 of the General Schedule.
          (2) Duties.--
                  (A) In general.--The sole responsibility of 
                the Associate Administrator for Small Business 
                Development Centers shall be to administer the 
                small business development center program. 
                Duties of the position shall include 
                recommending the annual program budget, 
                reviewing the annual budgets submitted by each 
                applicant, establishing appropriate funding 
                levels therefore, selecting applicants to 
                participate in this program, implementing the 
                provisions of this section, maintaining a 
                clearinghouse to provide for the dissemination 
                and exchange of information between small 
                business development centers and conducting 
                audits of recipients of grants under this 
                section.
                  (B) Consultation requirements.--In carrying 
                out the duties described in this subsection, 
                the Associate Administrator shall confer with 
                and seek the advice of the Board established by 
                subsection (i) and Administration officials in 
                areas served by the small business development 
                centers; however, the Associate Administrator 
                shall be responsible for the management and 
                administration of the program and shall not be 
                subject to the approval or concurrence of such 
                Administration officials.
  (i)(1) There is established a National Small Business 
Development Center Advisory Board (herein referred to as 
``Board'') which shall consist of nine members appointed from 
civilian life by the Administrator and who shall be persons of 
outstanding qualifications known to be familiar and sympathetic 
with small business needs and problems. No more than three 
members shall be from universities or their affiliates and six 
shall be from small businesses or associations representing 
small businesses. At the time of the appointment of the Board, 
the Administrator shall designate one-third of the members and 
at least one from each category whose term shall end in two 
years from the date of appointment, a second third whose term 
shall end in three years from the date of appointment, and the 
final third whose term shall end in four years from the date of 
appointment. Succeeding Boards shall have three-year terms, 
with one-third of the Board changing each year.
  (2) The Board shall elect a Chairman and advise, counsel, and 
confer with the Associate Administrator for Small Business 
Development Centers in carrying out the duties described in 
this section. The Board shall meet at least semiannually and at 
the call of the Chairman of the Board. Each member of the Board 
shall be entitled to be compensated at the rate not in excess 
of the per diem equivalent of the highest rate of pay for 
individuals occupying the position under GS-18 of the General 
Schedule for each day engaged in activities of the Board and 
shall be entitled to be reimbursed for expenses as a member of 
the Board.
  (j)(1) Each small business development center shall establish 
an advisory board.
  (2) Each small business development center advisory board 
shall elect a chairman and advise, counsel, and confer with the 
director of the small business development center on all policy 
matters pertaining to the operation of the small business 
development center, including who may be eligible to receive 
assistance from, and how local and regional private consultants 
may participate with the small business development center.
  (k) Program Examination and Accreditation.--
          (1) Examination.--Not later than 180 days after the 
        date of enactment of this subsection, the 
        Administration shall develop and implement a biennial 
        programmatic and financial examination of each small 
        business development center established pursuant to 
        this section.
          (2) Accreditation.--The Administration may provide 
        financial support, by contract or otherwise, to the 
        association authorized by subsection (a)(3)(A) for the 
        purpose of developing a small business development 
        center accreditation program.
          (3) Extension or renewal of cooperative agreements.--
                  (A) In general.--In extending or renewing a 
                cooperative agreement of a small business 
                development center, the Administration shall 
                consider the results of the examination and 
                accreditation program conducted pursuant to 
                paragraphs (1) and (2).
                  (B) Accreditation requirement.--After 
                September 30, 2000, the Administration may not 
                renew or extend any cooperative agreement with 
                a small business development center unless the 
                center has been approved under the 
                accreditation program conducted pursuant to 
                this subsection, except that the Associate 
                Administrator for Small Business Development 
                Centers may waive such accreditation 
                requirement, in the discretion of the Associate 
                Administrator, upon a showing that the center 
                is making a good faith effort to obtain 
                accreditation.
  (l) Contract Authority.--The authority to enter into 
contracts shall be in effect for each fiscal year only to the 
extent and in the amounts as are provided in advance in 
appropriations Acts. After the administration has entered a 
contract, either as a grant or a cooperative agreement, with 
any applicant under this section, it shall not suspend, 
terminate, or fail to renew or extend any such contract unless 
the Administration provides the applicant with written 
notification setting forth the reasons therefore and affording 
the applicant an opportunity for a hearing, appeal, or other 
administrative proceeding under the provisions of chapter 5 of 
title 5, United States Code. If any contract or cooperative 
agreement under this section with an entity that is covered by 
this section is not renewed or extended, any award of a 
successor contract or cooperative agreement under this section 
to another entity shall be made on a competitive basis.
  (m) Prohibition on Certain Fees.--A small business 
development center shall not impose or otherwise collect a fee 
or other compensation in connection with the provision of 
counseling services under this section.
  (n) Veterans Assistance and Services Program.--
          (1) In general.--A small business development center 
        may apply for a grant under this subsection to carry 
        out a veterans assistance and services program.
          (2) Elements of program.--Under a program carried out 
        with a grant under this subsection, a small business 
        development center shall--
                  (A) create a marketing campaign to promote 
                awareness and education of the services of the 
                center that are available to veterans, and to 
                target the campaign toward veterans, service-
                disabled veterans, military units, Federal 
                agencies, and veterans organizations;
                  (B) use technology-assisted online counseling 
                and distance learning technology to overcome 
                the impediments to entrepreneurship faced by 
                veterans and members of the Armed Forces; and
                  (C) increase coordination among organizations 
                that assist veterans, including by establishing 
                virtual integration of service providers and 
                offerings for a one-stop point of contact for 
                veterans who are entrepreneurs or owners of 
                small business concerns.
          (3) Amount of grants.--A grant under this subsection 
        shall be for not less than $75,000 and not more than 
        $250,000.
          (4) Funding.--Subject to amounts approved in advance 
        in appropriations Acts, the Administration may make 
        grants or enter into cooperative agreements to carry 
        out the provisions of this subsection.

           *       *       *       *       *       *       *


                                  [all]