Report text available as:

  • TXT
  • PDF   (PDF provides a complete and accurate display of this text.) Tip ?

114th Congress    }                                 {    Rept. 114-654
                        HOUSE OF REPRESENTATIVES
 2d Session       }                                 {           Part 1

======================================================================



 
          IMPROVING SMALL BUSINESS CYBER SECURITY ACT OF 2016

                                _______
                                

                  July 1, 2016.--Ordered to be printed

                                _______
                                

  Mr. McCaul, from the Committee on Homeland Security, submitted the 
                               following

                              R E P O R T

                        [To accompany H.R. 5064]

    The Committee on Homeland Security, to whom was referred 
the bill (H.R. 5064) to amend the Small Business Act to allow 
small business development centers to assist and advise small 
business concerns on relevant cyber security matters, and for 
other purposes, having considered the same, report favorably 
thereon with an amendment and recommend that the bill as 
amended do pass.

                                CONTENTS

                                                                   Page
Purpose and Summary..............................................     3
Background and Need for Legislation..............................     4
Hearings.........................................................     4
Committee Consideration..........................................     4
Committee Votes..................................................     5
Committee Oversight Findings.....................................     5
New Budget Authority, Entitlement Authority, and Tax Expenditures     5
Congressional Budget Office Estimate.............................     5
Statement of General Performance Goals and Objectives............     6
Duplicative Federal Programs.....................................     6
Congressional Earmarks, Limited Tax Benefits, and Limited Tariff 
  Benefits.......................................................     6
Federal Mandates Statement.......................................     6
Preemption Clarification.........................................     6
Disclosure of Directed Rule Makings..............................     6
Advisory Committee Statement.....................................     6
Applicability to Legislative Branch..............................     7
Section-by-Section Analysis of the Legislation...................     7
Changes in Existing Law Made by the Bill, as Reported............     8

    The amendment is as follows:
  Strike all after the enacting clause and insert the 
following:

SECTION 1. SHORT TITLE.

  This Act may be cited as the ``Improving Small Business Cyber 
Security Act of 2016''.

SEC. 2. ROLE OF SMALL BUSINESS DEVELOPMENT CENTERS IN CYBER SECURITY 
                    AND PREPAREDNESS.

  Section 21 of the Small Business Act (15 U.S.C. 648) is amended--
          (1) in subsection (a)(1), by striking ``and providing access 
        to business analysts who can refer small business concerns to 
        available experts:'' and inserting ``providing access to 
        business analysts who can refer small business concerns to 
        available experts; and, to the extent practicable, providing 
        assistance in furtherance of the Small Business Development 
        Center Cyber Strategy developed under section 5(b) of the 
        Improving Small Business Cyber Security Act of 2016:''; and
          (2) in subsection (c)--
                  (A) in paragraph (2)--
                          (i) in subparagraph (E), by striking ``and'' 
                        at the end;
                          (ii) in subparagraph (F), by striking the 
                        period and inserting ``; and''; and
                          (iii) by adding at the end of the following:
          ``(G) access to cyber security specialists to counsel, 
        assist, and inform small business concern clients, in 
        furtherance of the Small Business Development Center Cyber 
        Strategy developed under section 5(b) of the Improving Small 
        Business Cyber Security Act of 2016.''.

SEC. 3. ADDITIONAL CYBER SECURITY ASSISTANCE FOR SMALL BUSINESS 
                    DEVELOPMENT CENTERS.

  Section 21(a) of the Small Business Act (15 U.S.C. 648(a)) is amended 
by adding at the end the following:
          ``(8) Cyber security assistance.--The Department of Homeland 
        Security, and any other Federal department or agency in 
        coordination with the Department of Homeland Security, may 
        leverage small business development centers to provide 
        assistance to small businesses by disseminating cyber security 
        risk information and other homeland security information to 
        help small business concerns in developing or enhancing cyber 
        security infrastructure, cyber threat awareness, and cyber 
        training programs for employees.''.

SEC. 4. CYBER SECURITY OUTREACH FOR SMALL BUSINESS DEVELOPMENT CENTERS.

  Section 227 of the Homeland Security Act of 2002 (6 U.S.C. 148) is 
amended--
          (1) by redesignating subsection (l) as subsection (m); and
          (2) by inserting after subsection (k) the following:
  ``(l) Cybersecurity Outreach.--
          ``(1) In general.--The Secretary may leverage small business 
        development centers to provide assistance to small businesses 
        by disseminating information on cyber threat indicators, 
        defensive measures, cybersecurity risks, incidents, analysis, 
        and warnings to help small business concerns in developing or 
        enhancing cybersecurity infrastructure, cyber threat awareness, 
        and cyber training programs for employees.
          ``(2) Definitions.--For purposes of this subsection, the 
        terms `small business concern' and `small business development 
        center' have the meaning given such terms, respectively, under 
        section 3 of the Small Business Act.''.

SEC. 5. GAO STUDY ON SMALL BUSINESS CYBER SUPPORT SERVICES AND SMALL 
                    BUSINESS DEVELOPMENT CENTER CYBER STRATEGY.

  (a) Review of Current Cyber Security Resources.--
          (1) In general.--The Comptroller General of the United States 
        shall conduct a review of current cyber security resources at 
        the Federal level aimed at assisting small business concerns 
        with developing or enhancing cyber security infrastructure, 
        cyber threat awareness, or cyber training programs for 
        employees.
          (2) Content.--The review required under paragraph (1) shall 
        include the following:
                  (A) An accounting and description of all Federal 
                Government programs, projects, and activities that 
                currently provide assistance to small business concerns 
                in developing or enhancing cyber security 
                infrastructure, cyber threat awareness, or cyber 
                training programs for employees.
                  (B) An assessment of how widely utilized the 
                resources described under subparagraph (A) are by small 
                business concerns and a review of whether or not such 
                resources are duplicative of other programs and 
                structured in a manner that makes them accessible to 
                and supportive of small business concerns.
          (3) Report.--The Comptroller General shall issue a report to 
        the Congress, the Small Business Administrator, the Secretary 
        of Homeland Security, and any association recognized under 
        section 21(a)(3)(A) of the Small Business Act containing all 
        findings and determinations made in carrying out the review 
        required under paragraph (1).
  (b) Small Business Development Center Cyber Strategy.--
          (1) In general.--Not later than 90 days after the issuance of 
        the report under subsection (a)(3), the Small Business 
        Administrator and the Secretary of Homeland Security shall work 
        collaboratively to develop a Small Business Development Center 
        Cyber Strategy.
          (2) Consultation.--In developing the strategy under this 
        subsection, the Small Business Administrator and the Secretary 
        of Homeland Security shall consult with entities representing 
        the concerns of small business development centers, including 
        any association recognized under section 21(a)(3)(A) of the 
        Small Business Act.
          (3) Content.--The strategy required under paragraph (1) shall 
        include, at minimum, the following:
                  (A) Plans for leveraging small business development 
                centers (SBDCs) to access existing cyber programs of 
                the Department of Homeland Security and other 
                appropriate Federal agencies to enhance services and 
                streamline cyber assistance to small business concerns.
                  (B) To the extent practicable, methods for the 
                provision of counsel and assistance to improve a small 
                business concern's cyber security infrastructure, cyber 
                threat awareness, and cyber training programs for 
                employees, including--
                          (i) working to ensure individuals are aware 
                        of best practices in the areas of cyber 
                        security, cyber threat awareness, and cyber 
                        training;
                          (ii) working with individuals to develop 
                        cost-effective plans for implementing best 
                        practices in these areas;
                          (iii) entering into agreements, where 
                        practical, with Information Sharing and 
                        Analysis Centers or similar cyber information 
                        sharing entities to gain an awareness of 
                        actionable threat information that may be 
                        beneficial to small business concerns; and
                          (iv) providing referrals to area specialists 
                        when necessary.
                  (C) An analysis of--
                          (i) how Federal Government programs, 
                        projects, and activities identified by the 
                        Comptroller General in the report issued under 
                        subsection (a)(1) can be leveraged by SBDCs to 
                        improve access to high-quality cyber support 
                        for small business concerns;
                          (ii) additional resources SBDCs may need to 
                        effectively carry out their role; and
                          (iii) how SBDCs can leverage existing 
                        partnerships and develop new ones with Federal, 
                        State, and local government entities as well as 
                        private entities to improve the quality of 
                        cyber support services to small business 
                        concerns.
          (4) Delivery of strategy.--Not later than 180 days after the 
        issuance of the report under subsection (a)(3), the Small 
        Business Development Center Cyber Strategy shall be issued to 
        the Committees on Homeland Security and Small Business of the 
        House of Representatives and the Committees on Homeland 
        Security and Governmental Affairs and Small Business and 
        Entrepreneurship of the Senate.

SEC. 6. PROHIBITION ON ADDITIONAL FUNDS.

  No additional funds are authorized to be appropriated to carry out 
this Act or the amendments made by this Act.

                          Purpose and Summary

    H.R. 5064, the Improving Small Business Cyber Security Act 
of 2016 improves small business cybersecurity by leveraging 
existing Federal programs, as well as the expertise of nearly 
1,000 Small Business Development Centers (SBDCs) around the 
country to streamline cyber support for small businesses.
    In particular, the bill amends the Small Business Act (15 
U.S.C. 631 et seq.; 72 Stat. 384 et seq.) and the Homeland 
Security Act of 2002 (Pub. L. 107-296) to allow the Department 
of Homeland Security (DHS), and any other Federal department or 
agency coordinating with DHS, to provide information on 
cybersecurity risks and other cyber-related assistance to SBDCs 
as they help small businesses develop or enhance cybersecurity 
infrastructure, threat awareness, and training programs. 
Further, the Small Business Administration (SBA) and DHS are 
required to jointly develop a strategy that provides guidance 
to SBDCs on how they can leverage existing Federal resources to 
provide better access to much-needed cyber support services. To 
the extent practicable, SBDCs must offer cybersecurity 
specialists to counsel, assist, and inform small business 
clients, and the SBA Administrator is authorized to award SBDC 
grants in furtherance of the Cyber Strategy.
    Additionally, the bill requires the Government 
Accountability Office (GAO) to review current cybersecurity 
programs at the Federal level aimed at providing assistance to 
small businesses. The review will include an assessment of how 
widely utilized existing resources are by small businesses, 
whether they are duplicative of other resources, and whether 
they could be better structured to improve accessibility and 
effectiveness.

                  Background and Need for Legislation

    In recent years, the frequency of cyber attacks against 
small and medium-sized businesses and increased along with the 
costs of preventing and recovering from such attacks. In a 
recent national survey of small businesses, half of small 
businesses reported having suffered a cyber attack, and the 
average amount of money stolen in such an incident has tripled 
in the past three years--from roughly $8,000 in 2013 to over 
$20,000 in 2015.\1\ With 28 million small businesses in the 
U.S. accounting for 54 percent of annual sales, the damage of 
cyber attacks and thefts--from intellectual property to 
sensitive information--has the potential to ripple throughout 
the American economy.
---------------------------------------------------------------------------
    \1\ National Small Business Association, 2015 Year-End Economic 
Report, available at http://www.nsba.biz/wp-content/uploads/2016/02/
Year-End-Economic-Report-2015.pdf.Small businesses are often not 
prepared to prevent cyberattacks or easily recover from the damages of 
successful intrusions. A recent report by a Internet security firm 
found that 90 percent of small businesses do not use updated protocols 
for protecting sensitive consumer information while a separate study 
conducted by the National Cyber Security Alliance determined that 83 
percent of small businesses do not have a formal cybersecurity plan.
---------------------------------------------------------------------------
    Small Business Development Centers have existed for more 
than 30 years with the purpose of helping small businesses 
remain competitive and navigate an increasingly complex 
domestic and global marketplace. There are nearly 1,000 SBDCs 
nationwide, hosted by universities, colleges, and state 
economic development agencies with a presence in every 
congressional district and nearly every community. SBDCs offer 
no-cost consulting and at-cost training on topics such as 
writing business plans, accessing capital, marketing, and 
technology development. This bill provides this existing 
infrastructure with tools, resources, and expert guidance to 
enable these SBDCs to utilize and leverage existing Federal 
cyber resources in order to more effectively meet the 
information security needs of small businesses and the national 
and economic security needs of the United States.

                                Hearings

    No hearings were held on H.R. 5064 in the 114th Congress.

                        Committee Consideration

    The Committee met on June 8, 2016, to consider H.R. 5064, 
and ordered the measure to be reported to the House with a 
favorable recommendation, amended, by voice vote. The Committee 
adopted H.R. 5064, as amended, by voice vote. The Committee 
took the following actions:
    The following amendment was offered:

 An en bloc amendment offered by Mr. Richmond (#1); was AGREED 
TO by voice vote.

     Consisting of the following amendments:
     An amendment:
     Page 3, line 11, insert ``leverage small business development 
centers to'' before ``provide''.
     Page 3, line 12, strike ``small business development centers'' and 
insert ``small businesses''.
     Page 3, line 13, strike ``through the dissemination of'' and 
insert ``by disseminating''.
     Page 4, line 4, insert ``leverage small business development 
centers to'' before ``provide''.
     Page 4, line 5, strike ``small business development centers'' and 
insert ``small businesses''.
     Page 4, line 6, strike ``through the dissemination of'' and insert 
``by disseminating''.
     Page 6, line 21, strike ``incorporating small business development 
centers (SBDCs) into'' and insert ``leveraging small business 
development centers (SBDCs) to access''.
     Page 6, line 23, insert ``of the Department of Homeland Security 
and other appropriate Federal agencies'' before ``to enhance''.
     An amendment:
     Page 4, line 6, strike ``of cyber security risk information and 
other homeland security information'' and insert ``information on cyber 
threat indicators, defensive measures, cybersecurity risks, incidents, 
analysis, and warnings''. Page 4, lines 3-9, strike ``cyber security'' 
each place it appears and insert ``cybersecurity''.;

                            Committee Votes

    Clause 3(b) of Rule XIII of the Rules of the House of 
Representatives requires the Committee to list the recorded 
votes on the motion to report legislation and amendments 
thereto.
    No recorded votes were requested during consideration of 
H.R. 5064.

                      Committee Oversight Findings

    Pursuant to clause 3(c)(1) of Rule XIII of the Rules of the 
House of Representatives, the Committee has held oversight 
hearings and made findings that are reflected in this report.

   New Budget Authority, Entitlement Authority, and Tax Expenditures

    In compliance with clause 3(c)(2) of Rule XIII of the Rules 
of the House of Representatives, the Committee finds that H.R. 
5064, the Improving Small Business Cyber Security Act of 2016, 
would result in no new or increased budget authority, 
entitlement authority, or tax expenditures or revenues.

                  Congressional Budget Office Estimate

    Pursuant to clause 3(c)(3) of Rule XIII of the Rules of the 
House of Representatives, a cost estimate provided by the 
Congressional Budget Office pursuant to section 402 of the 
Congressional Budget Act of 1974 was not made available to the 
Committee in time for the filing of this report. The Chairman 
of the Committee shall cause such estimate to be printed in the 
Congressional Record upon its receipt by the Committee.

         Statement of General Performance Goals and Objectives

    Pursuant to clause 3(c)(4) of Rule XIII of the Rules of the 
House of Representatives, H.R. 5064 contains the following 
general performance goals and objectives, including outcome 
related goals and objectives authorized.
    This legislation authorizes the Small Business 
Administration and the Department of Homeland Security to 
assist Small Business Development Centers to better improve the 
cybersecurity of small businesses.

                      Duplicative Federal Programs

    Pursuant to clause 3(c) of Rule XIII, the Committee finds 
that H.R. 5064 does not contain any provision that establishes 
or reauthorizes a program known to be duplicative of another 
Federal program.

   Congressional Earmarks, Limited Tax Benefits, and Limited Tariff 
                                Benefits

    In compliance with Rule XXI of the Rules of the House of 
Representatives, this bill, as reported, contains no 
congressional earmarks, limited tax benefits, or limited tariff 
benefits as defined in clause 9(e), 9(f), or 9(g) of the Rule 
XXI.

                       Federal Mandates Statement

    An estimate of Federal mandates prepared by the Director of 
the Congressional Budget Office pursuant to section 423 of the 
Unfunded Mandates Reform Act was not made available to the 
Committee in time for the filing of this report. The Chairman 
of the Committee shall cause such estimate to be printed in the 
Congressional Record upon its receipt by the Committee.

                        Preemption Clarification

    In compliance with section 423 of the Congressional Budget 
Act of 1974, requiring the report of any Committee on a bill or 
joint resolution to include a statement on the extent to which 
the bill or joint resolution is intended to preempt State, 
local, or Tribal law, the Committee finds that H.R. 5064 does 
not preempt any State, local, or Tribal law.

                  Disclosure of Directed Rule Makings

    The Committee estimates that H.R. 5064 would require no 
directed rule makings.

                      Advisory Committee Statement

    No advisory committees within the meaning of section 5(b) 
of the Federal Advisory Committee Act were created by this 
legislation.

                  Applicability to Legislative Branch

    The Committee finds that the legislation does not relate to 
the terms and conditions of employment or access to public 
services or accommodations within the meaning of section 
102(b)(3) of the Congressional Accountability Act.

             Section-by-Section Analysis of the Legislation


Section 1.   Short Title.

    This section provides that this bill may be cited as the 
``Improving Small Business Cyber Security Act of 2016''.

Sec. 2.   Role of Small Business Development Centers in Cyber Security 
        and Preparedness.

    This section amends the Small Business Act to authorize the 
SBA to support SBDCs in furtherance of the Small Business 
Development Center Cyber Strategy, which is to be developed 
jointly by DHS and SBA. SBDCs are also directed to provide 
small businesses access to cyber security specialists who can, 
in accordance with the SBDC Cyber Strategy developed under 
section five, counsel, assist, and inform small businesses on 
cyber matters.

Sec. 3.   Additional Cyber Security Assistance for Small Business 
        Development Centers.

    This section authorizes DHS, in addition to any other 
Federal agency working in coordination with DHS, to provide 
assistance to SBDCs by disseminating cybersecurity risk 
information and other homeland security information to help 
small business concerns in developing or enhancing 
cybersecurity, cyber threat awareness, and cyber training 
programs for employees.

Sec. 4.   Cyber Security Outreach for Small Business Development 
        Centers.

    The Committee intends for DHS to work with SBDCs to help 
them leverage the Department's cybersecurity programs and 
services to improve the security of small business networks and 
information systems.

Sec. 5.   GAO Study on Small Business Cyber Support Services and Small 
        Business Development Center Cyber Strategy.

    This section requires the Government Accountability Office 
(GAO) to conduct a review of current cybersecurity programs at 
the Federal level aimed at assisting small business concerns 
with developing or enhancing cybersecurity infrastructure, 
cyber threat awareness, or cyber training programs for 
employees. The review will assess how widely small businesses 
utilize these existing resources, whether they are duplicative 
of other resources, and whether they could be better structured 
to improve accessibility and effectiveness.
    This section also requires the SBA Administrator and the 
DHS Secretary to consult with SBDC stakeholders to jointly 
develop a Small Business Development Center Cyber Strategy 
which must include plans for incorporating SBDCs into existing 
cyber programs, to enhance services and streamline support for 
small businesses in cyber-related matters, and methods for 
counseling and assisting small businesses to improve their 
cybersecurity infrastructure, cyber threat awareness, and 
cybersecurity training. The strategy must further include an 
analysis of how programs identified in the GAO report can be 
leveraged by SBDCs.

Sec. 6.   Prohibition on Additional Funds.

    This section prohibits additional funds from being 
appropriated to carry out this Act.

         Changes in Existing Law Made by the Bill, as Reported

  In compliance with clause 3(e) of rule XIII of the Rules of 
the House of Representatives, changes in existing law made by 
the bill, as reported, are shown as follows (existing law 
proposed to be omitted is enclosed in black brackets, new 
matter is printed in italics, and existing law in which no 
change is proposed is shown in roman):

SMALL BUSINESS ACT

           *       *       *       *       *       *       *


  Sec. 21. (a)(1) The Administration is authorized to make 
grants (including contracts and cooperative agreements) to any 
State government or any agency thereof, any regional entity, 
any State-chartered development, credit or finance corporation, 
any women's business center operating pursuant to section 29, 
any public or private institution of higher education, 
including but not limited to any land-grant college or 
university, any college or school of business, engineering, 
commerce, or agriculture, community college or junior college, 
or to any entity formed by two or more of the above entities 
(herein referred to as ``applicants'') to assist in 
establishing small business development centers and to any such 
labor for: small business oriented employment or natural 
resources development programs; studies, research, and 
counseling concerning the managing, financing, and operation of 
small business enterprises, management and technical assistance 
regarding small business participation in international 
markets, export promotion and technology transfer; delivery or 
distribution of such services and information; [and providing 
access to business analysts who can refer small business 
concerns to available experts:] providing access to business 
analysts who can refer small business concerns to available 
experts; and, to the extent practicable, providing assistance 
in furtherance of the Small Business Development Center Cyber 
Strategy developed under section 5(b) of the Improving Small 
Business Cyber Security Act of 2016: Provided, That after 
December 31, 1990, the Administration shall not make a grant to 
any applicant other than an institution of higher education or 
a women's business center operating pursuant to section 29 as a 
Small Business Development Center unless the applicant was 
receiving a grant (including a contract or cooperative 
agreement) on such date. The Administration shall require any 
applicant for a small business development center grant with 
performance commencing on or after January 1, 1992 to have its 
own budget and to primarily utilize institutions of higher 
education and women's business centers operating pursuant to 
section 29 to provide services to the small business community. 
The term of such grants shall be made on a calendar year basis 
or to coincide with the Federal fiscal year.
          (2) Cooperation to provide international trade 
        services.--
                  (A) Information and services.--The small 
                business development centers shall work in 
                close cooperation with the Administration's 
                regional and local offices, the Department of 
                Commerce, appropriate Federal, State and local 
                agencies (including State trade agencies), and 
                the small business community to serve as an 
                active information dissemination and service 
                delivery mechanism for existing trade 
                promotion, trade finance, trade adjustment, 
                trade remedy and trade data collection programs 
                of particular utility for small businesses.
                  (B) Cooperation with state trade agencies and 
                export assistance centers.--A small business 
                development center that counsels a small 
                business concern on issues relating to 
                international trade shall--
                          (i) consult with State trade agencies 
                        and Export Assistance Centers to 
                        provide appropriate services to the 
                        small business concern; and
                          (ii) as necessary, refer the small 
                        business concern to a State trade 
                        agency or an Export Assistance Center 
                        for further counseling or assistance.
                  (C) Definition.--In this paragraph, the term 
                ``Export Assistance Center'' has the same 
                meaning as in section 22.
  (3) The Small Business Development Center Program shall be 
under the general management and oversight of the 
Administration for the delivery of programs and services to the 
small business community. Such programs and services shall be 
jointly developed, negotiated, and agreed upon, with full 
participation of both parties, pursuant to an executed 
cooperative agreement between the Small Business Development 
Center applicant and the Administration.
  (A) Small business development centers are authorized to form 
an association to pursue matters of common concern. If more 
than a majority of the small business development centers which 
are operating pursuant to agreements with the Administration 
are members of such an association, the Administration is 
authorized and directed to recognize the existence and 
activities of such an association and to consult with it and 
develop documents (i) announcing the annual scope of activities 
pursuant to this section, (ii) requesting proposals to deliver 
assistance as provided in this section and (iii) governing the 
general operations and administration of the Small Business 
Development Center Program, specifically including the 
development of regulations and a uniform negotiated cooperative 
agreement for use on an annual basis when entering into 
individual negotiated agreements with small business 
development centers.
  (B) Provisions governing audits, cost principles and 
administrative requirements for Federal grants, contracts and 
cooperative agreements which are included in uniform 
requirements of Office of Management and Budget (OMB) Circulars 
shall be incorporated by reference and shall not be set forth 
in summary or other form in regulations.
          (C) Whereas On an annual basis, the Small Business 
        Development Center shall review and coordinate public 
        and private partnerships and cosponsorships with the 
        Administration for the purpose of more efficiently 
        leveraging available resources on a National and a 
        State basis.
  (4) Small business development center program level.--
          (A) In general.--The Administration shall require as 
        a condition of any grant (or amendment or modification 
        thereof) made to an applicant under this section, that 
        a matching amount (excluding any fees collected from 
        recipients of such assistance) equal to the amount of 
        such grant be provided from sources other than the 
        Federal Government, to be comprised of not less than 50 
        percent cash and not more than 50 percent of indirect 
        costs and in-kind contributions.
          (B) Restriction.--The matching amount described in 
        subparagraph (A) shall not include any indirect costs 
        or in-kind contributions derived from any Federal 
        program.
          (C) Funding formula.--
                  (i) In general.--Subject to clause (iii), the 
                amount of a formula grant received by a State 
                under this subparagraph shall be equal to an 
                amount determined in accordance with the 
                following formula:
                          (I) The annual amount made available 
                        under section 20(a) for the Small 
                        Business Development Center Program, 
                        less any reductions made for expenses 
                        authorized by clause (v) of this 
                        subparagraph, shall be divided on a pro 
                        rata basis, based on the percentage of 
                        the population of each State, as 
                        compared to the population of the 
                        United States.
                          (II) If the pro rata amount 
                        calculated under subclause (I) for any 
                        State is less than the minimum funding 
                        level under clause (iii), the 
                        Administration shall determine the 
                        aggregate amount necessary to achieve 
                        that minimum funding level for each 
                        such State.
                          (III) The aggregate amount calculated 
                        under subclause (II) shall be deducted 
                        from the amount calculated under 
                        subclause (I) for States eligible to 
                        receive more than the minimum funding 
                        level. The deductions shall be made on 
                        a pro rata basis, based on the 
                        population of each such State, as 
                        compared to the total population of all 
                        such States.
                          (IV) The aggregate amount deducted 
                        under subclause (III) shall be added to 
                        the grants of those States that are not 
                        eligible to receive more than the 
                        minimum funding level in order to 
                        achieve the minimum funding level for 
                        each such State, except that the 
                        eligible amount of a grant to any State 
                        shall not be reduced to an amount below 
                        the minimum funding level.
                  (ii) Grant determination.--The amount of a 
                grant that a State is eligible to apply for 
                under this subparagraph shall be the amount 
                determined under clause (i), subject to any 
                modifications required under clause (iii), and 
                shall be based on the amount available for the 
                fiscal year in which performance of the grant 
                commences, but not including amounts 
                distributed in accordance with clause (iv). The 
                amount of a grant received by a State under any 
                provision of this subparagraph shall not exceed 
                the amount of matching funds from sources other 
                than the Federal Government, as required under 
                subparagraph (A).
                  (iii) Minimum funding level.--The amount of 
                the minimum funding level for each State shall 
                be determined for each fiscal year based on the 
                amount made available for that fiscal year to 
                carry out this section, as follows:
                          (I) If the amount made available is 
                        not less than $81,500,000 and not more 
                        than $90,000,000, the minimum funding 
                        level shall be $500,000.
                          (II) If the amount made available is 
                        less than $81,500,000, the minimum 
                        funding level shall be the remainder of 
                        $500,000 minus a percentage of $500,000 
                        equal to the percentage amount by which 
                        the amount made available is less than 
                        $81,500,000.
                          (III) If the amount made available is 
                        more than $90,000,000, the minimum 
                        funding level shall be the sum of 
                        $500,000 plus a percentage of $500,000 
                        equal to the percentage amount by which 
                        the amount made available exceeds 
                        $90,000,000.
                  (iv) Distributions.--Subject to clause (iii), 
                if any State does not apply for, or use, its 
                full funding eligibility for a fiscal year, the 
                Administration shall distribute the remaining 
                funds as follows:
                          (I) If the grant to any State is less 
                        than the amount received by that State 
                        in fiscal year 2000, the Administration 
                        shall distribute such remaining funds, 
                        on a pro rata basis, based on the 
                        percentage of shortage of each such 
                        State, as compared to the total amount 
                        of such remaining funds available, to 
                        the extent necessary in order to 
                        increase the amount of the grant to the 
                        amount received by that State in fiscal 
                        year 2000, or until such funds are 
                        exhausted, whichever first occurs.
                          (II) If any funds remain after the 
                        application of subclause (I), the 
                        remaining amount may be distributed as 
                        supplemental grants to any State, as 
                        the Administration determines, in its 
                        discretion, to be appropriate, after 
                        consultation with the association 
                        referred to in subsection (a)(3)(A).
                  (v) Use of amounts.--
                          (I) In general.--Of the amounts made 
                        available in any fiscal year to carry 
                        out this section--
                                  (aa) not more than $500,000 
                                may be used by the 
                                Administration to pay expenses 
                                enumerated in subparagraphs (B) 
                                through (D) of section 
                                20(a)(1); and
                                  (bb) not more than $500,000 
                                may be used by the 
                                Administration to pay the 
                                examination expenses enumerated 
                                in section 20(a)(1)(E).
                          (II) Limitation.--No funds described 
                        in subclause (I) may be used for 
                        examination expenses under section 
                        20(a)(1)(E) if the usage would reduce 
                        the amount of grants made available 
                        under clause (i)(I) of this 
                        subparagraph to less than $85,000,000 
                        (after excluding any amounts provided 
                        in appropriations Acts, or accompanying 
                        report language, for specific 
                        institutions or for purposes other than 
                        the general small business development 
                        center program) or would further reduce 
                        the amount of such grants below such 
                        amount.
                  (vi) Exclusions.--Grants provided to a State 
                by the Administration or another Federal agency 
                to carry out subsection (a)(6) or (c)(3)(G), or 
                for supplemental grants set forth in clause 
                (iv)(II) of this subparagraph, shall not be 
                included in the calculation of maximum funding 
                for a State under clause (ii) of this 
                subparagraph.
                  (vii) Authorization of appropriations.--There 
                are authorized to be appropriated to carry out 
                this subparagraph--
                          (I) $130,000,000 for fiscal year 
                        2005; and
                          (II) $135,000,000 for fiscal year 
                        2006.
                  (viii) Limitation.--From the funds 
                appropriated pursuant to clause (vii), the 
                Administration shall reserve not less than 
                $1,000,000 in each fiscal year to develop 
                portable assistance for startup and 
                sustainability non-matching grant programs to 
                be conducted by eligible small business 
                development centers in communities that are 
                economically challenged as a result of a 
                business or government facility down sizing or 
                closing, which has resulted in the loss of jobs 
                or small business instability. A non-matching 
                grant under this clause shall not exceed 
                $100,000, and shall be used for small business 
                development center personnel expenses and 
                related small business programs and services.
                  (ix) State defined.--In this subparagraph, 
                the term ``State'' means each of the several 
                States, the District of Columbia, the 
                Commonwealth of Puerto Rico, the Virgin 
                Islands, Guam, and American Samoa.
  (5) Federal contracts with small business development 
centers.--
          (A) In general.--Subject to the conditions set forth 
        in subparagraph (B), a small business development 
        center may enter into a contract with a Federal 
        department or agency to provide specific assistance to 
        small business concerns.
          (B) Contract prerequisites.--Before bidding on a 
        contract described in subparagraph (A), a small 
        business development center shall receive approval from 
        the Associate Administrator of the small business 
        development center program of the subject and general 
        scope of the contract. Each approval under subparagraph 
        (A) shall be based upon a determination that the 
        contract will provide assistance to small business 
        concerns and that performance of the contract will not 
        hinder the small business development center in 
        carrying out the terms of the grant received by the 
        small business development center from the 
        Administration.
          (C) Exemption from matching requirement.--A contract 
        under this paragraph shall not be subject to the 
        matching funds or eligibility requirements of paragraph 
        (4).
          (D) Additional provision.--Notwithstanding any other 
        provision of law, a contract for assistance under this 
        paragraph shall not be applied to any Federal 
        department or agency's small business, woman-owned 
        business, or socially and economically disadvantaged 
        business contracting goal under section 15(g).
          (6) Any applicant which is funded by the 
        Administration as a Small Business Development Center 
        may apply for an additional grant to be used solely to 
        assist--
                  (A) with the development and enhancement of 
                exports by small business concerns;
                  (B) in technology transfer; and
                  (C) with outreach, development, and 
                enhancement of minority-owned small business 
                startups or expansions, HUBZone small business 
                concerns, veteran-owned small business startups 
                or expansions, and women-owned small business 
                startups or expansions, in communities impacted 
                by base closings or military or corporate 
                downsizing, or in rural or underserved 
                communities;
        as provided under subparagraphs (B) through (G) of 
        subsection (c)(3). Applicants for such additional 
        grants shall comply with all of the provisions of this 
        section, including providing matching funds, except 
        that funding under this paragraph shall be effective 
        for any fiscal year to the extent provided in advance 
        in appropriations Acts and shall be in addition to the 
        dollar program limitations specified in paragraphs (4) 
        and (5). No recipient of funds under this paragraph 
        shall receive a grant which would exceed its pro rata 
        share of a $15,000,000 program based upon the 
        populations to be served by the Small Business 
        Development Center as compared to the total population 
        of the United States. The minimum amount of eligibility 
        for any State shall be $100,000.
          (7) Privacy requirements.--
                  (A) In general.--A small business development 
                center, consortium of small business 
                development centers, or contractor or agent of 
                a small business development center may not 
                disclose the name, address, or telephone number 
                of any individual or small business concern 
                receiving assistance under this section without 
                the consent of such individual or small 
                business concern, unless--
                          (i) the Administrator is ordered to 
                        make such a disclosure by a court in 
                        any civil or criminal enforcement 
                        action initiated by a Federal or State 
                        agency; or
                          (ii) the Administrator considers such 
                        a disclosure to be necessary for the 
                        purpose of conducting a financial audit 
                        of a small business development center, 
                        but a disclosure under this clause 
                        shall be limited to the information 
                        necessary for such audit.
                  (B) Administrator use of information.--This 
                section shall not--
                          (i) restrict Administrator access to 
                        program activity data; or
                          (ii) prevent the Administrator from 
                        using client information to conduct 
                        client surveys.
                  (C) Regulations.--
                          (i) In general.--The Administrator 
                        shall issue regulations to establish 
                        standards--
                                  (I) for disclosures with 
                                respect to financial audits 
                                under subparagraph (A)(ii); and
                                  (II) for client surveys under 
                                subparagraph (B)(ii), including 
                                standards for oversight of such 
                                surveys and for dissemination 
                                and use of client information.
                          (ii) Maximum privacy protection.--
                        Regulations under this subparagraph, 
                        shall, to the extent practicable, 
                        provide for the maximum amount of 
                        privacy protection.
                          (iii) Inspector general.--Until the 
                        effective date of regulations under 
                        this subparagraph, any client survey 
                        and the use of such information shall 
                        be approved by the Inspector General 
                        who shall include such approval in his 
                        semi-annual report.
          (8) Cyber security assistance.--The Department of 
        Homeland Security, and any other Federal department or 
        agency in coordination with the Department of Homeland 
        Security, may leverage small business development 
        centers to provide assistance to small businesses by 
        disseminating cyber security risk information and other 
        homeland security information to help small business 
        concerns in developing or enhancing cyber security 
        infrastructure, cyber threat awareness, and cyber 
        training programs for employees.
  (b)(1) Financial assistance shall not be made available to 
any applicant if approving such assistance would be 
inconsistent with a plan for the area involved which has been 
adopted by an agency recognized by the State government as 
authorized to do so and approved by the Administration in 
accordance with the standards and requirements established 
pursuant to this section.
  (2) An applicant may apply to participate in the program by 
submitting to the Administration for approval a plan naming 
those authorized in subsection (a) to participate in the 
program, the geographic area to be served, the services that it 
would provide, the method for delivering services, a budget, 
and any other information and assurances the Administration may 
require to insure that the applicant will carry out the 
activities eligible for assistance. The Administration is 
authorized to approve, conditionally approve or reject a plan 
or combination of plans submitted. In all cases, the 
Administration shall review plans for conformity with the plan 
submitted pursuant to paragraph (1) of this subsection, and 
with a view toward providing small business with the most 
comprehensive and coordinated assistance in the State or part 
thereof to be served.
          (3) Assistance to out-of-state small business 
        concerns.--
                  (A) In general.--At the discretion of the 
                Administration, the Administration is 
                authorized to permit a small business 
                development center to provide advice, 
                information and assistance, as described in 
                subsection (c), to small businesses located 
                outside the State, but only to the extent such 
                businesses are located within close 
                geographical proximity to the small business 
                development center, as determined by the 
                Administration.
                  (B) Disaster recovery assistance.--
                          (i) In general.--At the discretion of 
                        the Administrator, the Administrator 
                        may authorize a small business 
                        development center to provide advice, 
                        information, and assistance, as 
                        described in subsection (c), to a small 
                        business concern located outside of the 
                        State, without regard to geographic 
                        proximity to the small business 
                        development center, if the small 
                        business concern is located in an area 
                        for which the President has declared a 
                        major disaster.
                          (ii) Term.--
                                  (I) In general.--A small 
                                business development center may 
                                provide advice, information, 
                                and assistance to a small 
                                business concern under clause 
                                (i) for a period of not more 
                                than 2 years after the date on 
                                which the President declared a 
                                major disaster for the area in 
                                which the small business 
                                concern is located.
                                  (II) Extension.--The 
                                Administrator may, at the 
                                discretion of the 
                                Administrator, extend the 
                                period described in subclause 
                                (I).
                          (iii) Continuity of services.--A 
                        small business development center that 
                        provides counselors to an area 
                        described in clause (i) shall, to the 
                        maximum extent practicable, ensure 
                        continuity of services in any State in 
                        which the small business development 
                        center otherwise provides services.
                          (iv) Access to disaster recovery 
                        facilities.--For purposes of this 
                        subparagraph, the Administrator shall, 
                        to the maximum extent practicable, 
                        permit the personnel of a small 
                        business development center to use any 
                        site or facility designated by the 
                        Administrator for use to provide 
                        disaster recovery assistance.
  (c)(1) Applicants receiving grants under this section shall 
assist small businesses in solving problems concerning 
operations, manufacturing, engineering, technology exchange and 
development, personnel administration, marketing, sales, 
merchandising, finance, accounting, business strategy 
development, and other disciplines required for small business 
growth and expansion, innovation, increased productivity, and 
management improvement, and for decreasing industry economic 
concentrations. Applicants receiving grants under this section 
may also assist small businesses by providing, where 
appropriate, education on the requirements applicable to small 
businesses under the regulations issued under section 38 of the 
Arms Export Control Act (22 U.S.C. 2778) and on compliance with 
those requirements.
  (2) A small business development center shall provide 
services as close as possible to small businesses by providing 
extension services and utilizing satellite locations when 
necessary. The facilities and staff of each Small Business 
Development Center shall be located in such places as to 
provide maximum accessibility and benefits to the small 
businesses which the center is intended to serve. To the extent 
possible, it also shall make full use of other Federal and 
State government programs that are concerned with aiding small 
business. A small business development center shall have--
          (A) a full-time staff, including a full-time director 
        who shall have the authority to make expenditures under 
        the center's budget and who shall manage the program 
        activities;
          (B) access to business analysts to counsel, assist, 
        and inform small business clients;
          (C) access to technology transfer agent to provide 
        state or art technology to small businesses through 
        coupling with national and regional technology data 
        sources;
          (D) access to information specialists to assist in 
        providing information searches and referrals to small 
        business;
          (E) access to part-time professional specialists to 
        conduct research or to provide counseling assistance 
        whenever the need arises; [and]
          (F) access to laboratory and adaptive engineering 
        facilities[.]; and
          (G) access to cyber security specialists to counsel, 
        assist, and inform small business concern clients, in 
        furtherance of the Small Business Development Center 
        Cyber Strategy developed under section 5(b) of the 
        Improving Small Business Cyber Security Act of 2016.
  (3) Services provided by a small business development center 
shall include, but shall not be limited to--
          (A) furnishing one-to-one individual counseling to 
        small businesses, including--
                  (i) working with individuals to increase 
                awareness of basic credit practices and credit 
                requirements;
                  (ii) working with individuals to develop 
                business plans, financial packages, credit 
                applications, and contract proposals;
                  (iii) working with the Administration to 
                develop and provide informational tools for use 
                in working with individuals on pre-business 
                startup planning, existing business expansion, 
                and export planning; and
                  (iv) working with individuals referred by the 
                local offices of the Administration and 
                Administration participating lenders;
          (B) assisting in technology transfer, research and 
        development, including applied research, and coupling 
        from existing sources to small businesses, including--
                  (i) working to increase the access of small 
                businesses to the capabilities of automated 
                flexible manufacturing systems;
                  (ii) working through existing networks and 
                developing new networks for technology transfer 
                that encourage partnership between the small 
                business and academic communities to help 
                commercialize university-based research and 
                development and introduce university-based 
                engineers and scientists to their counterparts 
                in small technology-based firms; and
                  (iii) exploring the viability of developing 
                shared production facilities, under appropriate 
                circumstances;
          (C) in cooperation with the Department of Commerce 
        and other relevant Federal agencies, actively assisting 
        small businesses in exporting by identifying and 
        developing potential export markets, facilitating 
        export transactions, developing linkages between United 
        States small business firms and prescreened foreign 
        buyers, assisting small businesses to participate in 
        international trade shows, assisting small businesses 
        in obtaining export financing, and facilitating the 
        development or reorientation of marketing and 
        production strategies; where appropriate, the Small 
        Business Development Center and the Administration may 
        work in cooperation with the State to establish a State 
        international trade center for these purposes;
          (D) developing a program in conjunction with the 
        Export-Import Bank and local and regional 
        Administration offices that will enable Small Business 
        Development Centers to serve as an information network 
        and to assist small business applicants for Export-
        Import Bank financing programs, and otherwise identify 
        and help to make available export financing programs to 
        small businesses;
          (E) working closely with the small business 
        community, small business consultants, State agencies, 
        universities and other appropriate groups to make 
        translation services more readily available to small 
        business firms doing business, or attempting to develop 
        business, in foreign markets;
          (F) in providing assistance under this subsection, 
        applicants shall cooperate with the Department of 
        Commerce and other relevant Federal agencies to 
        increase access to available export market information 
        systems, including the CIMS system;
          (G) assisting small businesses to develop and 
        implement strategic business plans to timely and 
        effectively respond to the planned closure (or 
        reduction) of a Department of Defense facility within 
        the community, or actual or projected reductions in 
        such firms' business base due to the actual or 
        projected termination (or reduction) of a Department of 
        Defense program or a contract in support of such 
        program--
                  (i) by developing broad economic assessments 
                of the adverse impacts of--
                          (I) the closure (or reduction) of the 
                        Department of Defense facility on the 
                        small business concerns providing goods 
                        or services to such facility or to the 
                        military and civilian personnel 
                        currently stationed or working at such 
                        facility; and
                          (II) the termination (or reduction) 
                        of a Department of Defense program (or 
                        contracts under such program) on the 
                        small business concerns participating 
                        in such program as a prime contractor, 
                        subcontractor or supplier at any tier;
                  (ii) by developing, in conjunction with 
                appropriate Federal, State, and local 
                governmental entities and other private sector 
                organizations, the parameters of a transition 
                adjustment program adaptable to the needs of 
                individual small business concerns;
                  (iii) by conducting appropriate programs to 
                inform the affected small business community 
                regarding the anticipated adverse impacts 
                identified under clause (i) and the economic 
                adjustment assistance available to such firms; 
                and
                  (iv) by assisting small business concerns to 
                develop and implement an individualized 
                transition business plan.
          (H) maintaining current information concerning 
        Federal, State, and local regulations that affect small 
        businesses and counsel small businesses on methods of 
        compliance. Counseling and technology development shall 
        be provided when necessary to help small businesses 
        find solutions for complying with environmental, 
        energy, health, safety, and other Federal, State, and 
        local regulations;
          (I) coordinating and conducting research into 
        technical and general small business problems for which 
        there are no ready solutions;
          (J) providing and maintaining a comprehensive library 
        that contains current information and statistical data 
        needed by small businesses;
          (K) maintaining a working relationship and open 
        communications with the financial and investment 
        communities, legal associations, local and regional 
        private consultants, and local and regional small 
        business groups and associations in order to help 
        address the various needs of the small business 
        community;
          (L) conducting in-depth surveys for local small 
        business groups in order to develop general information 
        regarding the local economy and general small 
        businesses strengths and weaknesses in the locality;
          (M) in cooperation with the Department of Commerce, 
        the Administration and other relevant Federal agencies, 
        actively assisting rural small businesses in exporting 
        by identifying and developing potential export markets 
        for rural small businesses, facilitating export 
        transactions for rural small businesses, developing 
        linkages between United States' rural small businesses 
        and prescreened foreign buyers, assisting rural small 
        businesses to participate in international trade shows, 
        assisting rural small businesses in obtaining export 
        financing and developing marketing and production 
        strategies;
          (N) assisting rural small businesses--
                  (i) in developing marketing and production 
                strategies that will enable them to better 
                compete in the domestic market--
                  (ii) by providing technical assistance needed 
                by rural small businesses;
                  (iii) by making available managerial 
                assistance to rural small business concerns; 
                and
                  (iv) by providing information and assistance 
                in obtaining financing for business startups 
                and expansion;
          (O) in conjunction with the United States Travel and 
        Tourism Administration, assist rural small business in 
        developing the tourism potential of rural communities 
        by--
                  (i) identifying the cultural, historic, 
                recreational, and scenic resources of such 
                communities;
                  (ii) providing assistance to small businesses 
                in developing tourism marketing and promotion 
                plans relating to tourism in rural areas; and
                  (iii) assisting small business concerns to 
                obtain capital for starting or expanding 
                businesses primarily serving tourists;
          (P) maintaining lists of local and regional private 
        consultants to whom small business can be referred;
          (Q) providing information to small business concerns 
        regarding compliance with regulatory requirements;
          (R) developing informational publications, 
        establishing resource centers of reference materials, 
        and distributing compliance guides published under 
        section 312(a) of the Small Business Regulatory 
        Enforcement Fairness Act of 1996;
          (S) providing small business owners with access to a 
        wide variety of export-related information by 
        establishing on-line computer linkages between small 
        business development centers and an international trade 
        data information network with ties to the Export 
        Assistance Center program; and
          (T) providing information and assistance to small 
        business concerns with respect to establishing drug-
        free workplace programs on or before October 1, 2006.
  (4) A small business development center shall continue to 
upgrade and modify its services, as needed, in order to meet 
the changing and evolving needs of the small business 
community.
  (5) In addition to the methods prescribed in section 
21(c)(2), a small business development center shall utilize and 
compensate as one of its resources qualified small business 
vendors, including but not limited to, private management 
consultants, private consulting engineers and private testing 
laboratories, to provide services as described in this 
subsection to small businesses on behalf of such small business 
development center.
  (6) In any State (A) in which the Administration has not made 
a grant pursuant to paragraph (1) of subsection (a), or (B) in 
which no application for a grant has been made by a Small 
Business Development Center pursuant to paragraph (6) of such 
subsection within 60 days after the effective date of any grant 
under subsection (a)(1) to such center or the date the 
Administration notifies the grantee funded under subsection 
(a)(1) that funds are available for grant applications pursuant 
to subsection (a)(6), whichever date occurs last, the 
Administration may make grants to a non-profit entity in that 
State to carry out the activities specified in paragraph (6) of 
subsection (a). Any such applicants shall comply with the 
matching funds requirement of paragraph (4) of subsection (a). 
Such grants shall be effective for any fiscal year only to the 
extent provided in advance in appropriations Acts, and each 
State shall be limited to the pro rata share provisions of 
paragraph (6) of subsection (a).
          (7) In performing the services identified in 
        paragraph (3), the Small Business Development Centers 
        shall work in close cooperation with the 
        Administration's regional and local offices, the local 
        small business community, and appropriate State and 
        local agencies.
          (8) The Associate Administrator for Small Business 
        Development Centers, in consultation with the Small 
        Business Development Centers, shall develop and 
        implement an information sharing system. Subject to 
        amounts approved in advance in appropriations Acts, the 
        Administration may make grants or enter cooperative 
        agreements with one or more centers to carry out the 
        provisions of this paragraph. Said grants or 
        cooperative agreements shall be awarded for periods of 
        no more than five years duration. The matching funds 
        provisions of subsection (a) shall not be applicable to 
        grants or cooperative agreements under this paragraph. 
        The system shall--
                  (A) allow Small Business Development Centers 
                participating in the program to exchange 
                information about their programs; and
                  (B) provide information central to technology 
                transfer.
  (d) Where appropriate, the Small Business Development Centers 
shall work in conjunction with the relevant State agency and 
the Department of Commerce to develop a comprehensive plan for 
enhancing the export potential of small businesses located 
within the State. This plan may involve the cofunding and 
staffing of a State Office of International Trade within the 
State Small Business Development Center, using joint State and 
Federal funding, and any other appropriate measures directed at 
improving the export performance of small businesses within the 
State.
  (e) Laboratories operated and funded by the Federal 
Government are authorized and directed to cooperate with the 
Administration in developing and establishing programs to 
support small business development centers by making facilities 
and equipment available; providing experiment station 
capabilities in adaptive engineering; providing library and 
technical information processing capabilities; and providing 
professional staff for consulting. The Administration is 
authorized to reimburse the laboratories for such services.
  (f) The National Science Foundation is authorized and 
directed to cooperate with the Administration and with the 
Small Business Development Centers in developing and 
establishing programs to support the centers.
  (g) National Aeronautics and Space Administration and 
Regional Technology Transfer Centers.--The National Aeronautics 
and Space Administration and regional technology transfer 
centers supported by the National Aeronautics and Space 
Administration are authorized and directed to cooperate with 
small business development centers participating in the 
program.
  (h) Associate Administrator for Small Business Development 
Centers.--
          (1) Appointment and compensation.--The Administrator 
        shall appoint an Associate Administrator for Small 
        Business Development Centers who shall report to an 
        official who is not more than one level below the 
        Office of the Administrator and who shall serve without 
        regard to the provisions of title 5, governing 
        appointments in the competitive service, and without 
        regard to chapter 51, and subchapter III of chapter 53 
        of such title relating to classification and General 
        Schedule pay rates, but at a rate not less than the 
        rate of GS-17 of the General Schedule.
          (2) Duties.--
                  (A) In general.--The sole responsibility of 
                the Associate Administrator for Small Business 
                Development Centers shall be to administer the 
                small business development center program. 
                Duties of the position shall include 
                recommending the annual program budget, 
                reviewing the annual budgets submitted by each 
                applicant, establishing appropriate funding 
                levels therefore, selecting applicants to 
                participate in this program, implementing the 
                provisions of this section, maintaining a 
                clearinghouse to provide for the dissemination 
                and exchange of information between small 
                business development centers and conducting 
                audits of recipients of grants under this 
                section.
                  (B) Consultation requirements.--In carrying 
                out the duties described in this subsection, 
                the Associate Administrator shall confer with 
                and seek the advice of the Board established by 
                subsection (i) and Administration officials in 
                areas served by the small business development 
                centers; however, the Associate Administrator 
                shall be responsible for the management and 
                administration of the program and shall not be 
                subject to the approval or concurrence of such 
                Administration officials.
  (i)(1) There is established a National Small Business 
Development Center Advisory Board (herein referred to as 
``Board'') which shall consist of nine members appointed from 
civilian life by the Administrator and who shall be persons of 
outstanding qualifications known to be familiar and sympathetic 
with small business needs and problems. No more than three 
members shall be from universities or their affiliates and six 
shall be from small businesses or associations representing 
small businesses. At the time of the appointment of the Board, 
the Administrator shall designate one-third of the members and 
at least one from each category whose term shall end in two 
years from the date of appointment, a second third whose term 
shall end in three years from the date of appointment, and the 
final third whose term shall end in four years from the date of 
appointment. Succeeding Boards shall have three-year terms, 
with one-third of the Board changing each year.
  (2) The Board shall elect a Chairman and advise, counsel, and 
confer with the Associate Administrator for Small Business 
Development Centers in carrying out the duties described in 
this section. The Board shall meet at least semiannually and at 
the call of the Chairman of the Board. Each member of the Board 
shall be entitled to be compensated at the rate not in excess 
of the per diem equivalent of the highest rate of pay for 
individuals occupying the position under GS-18 of the General 
Schedule for each day engaged in activities of the Board and 
shall be entitled to be reimbursed for expenses as a member of 
the Board.
  (j)(1) Each small business development center shall establish 
an advisory board.
  (2) Each small business development center advisory board 
shall elect a chairman and advise, counsel, and confer with the 
director of the small business development center on all policy 
matters pertaining to the operation of the small business 
development center, including who may be eligible to receive 
assistance from, and how local and regional private consultants 
may participate with the small business development center.
  (k) Program Examination and Accreditation.--
          (1) Examination.--Not later than 180 days after the 
        date of enactment of this subsection, the 
        Administration shall develop and implement a biennial 
        programmatic and financial examination of each small 
        business development center established pursuant to 
        this section.
          (2) Accreditation.--The Administration may provide 
        financial support, by contract or otherwise, to the 
        association authorized by subsection (a)(3)(A) for the 
        purpose of developing a small business development 
        center accreditation program.
          (3) Extension or renewal of cooperative agreements.--
                  (A) In general.--In extending or renewing a 
                cooperative agreement of a small business 
                development center, the Administration shall 
                consider the results of the examination and 
                accreditation program conducted pursuant to 
                paragraphs (1) and (2).
                  (B) Accreditation requirement.--After 
                September 30, 2000, the Administration may not 
                renew or extend any cooperative agreement with 
                a small business development center unless the 
                center has been approved under the 
                accreditation program conducted pursuant to 
                this subsection, except that the Associate 
                Administrator for Small Business Development 
                Centers may waive such accreditation 
                requirement, in the discretion of the Associate 
                Administrator, upon a showing that the center 
                is making a good faith effort to obtain 
                accreditation.
  (l) Contract Authority.--The authority to enter into 
contracts shall be in effect for each fiscal year only to the 
extent and in the amounts as are provided in advance in 
appropriations Acts. After the administration has entered a 
contract, either as a grant or a cooperative agreement, with 
any applicant under this section, it shall not suspend, 
terminate, or fail to renew or extend any such contract unless 
the Administration provides the applicant with written 
notification setting forth the reasons therefore and affording 
the applicant an opportunity for a hearing, appeal, or other 
administrative proceeding under the provisions of chapter 5 of 
title 5, United States Code. If any contract or cooperative 
agreement under this section with an entity that is covered by 
this section is not renewed or extended, any award of a 
successor contract or cooperative agreement under this section 
to another entity shall be made on a competitive basis.
  (m) Prohibition on Certain Fees.--A small business 
development center shall not impose or otherwise collect a fee 
or other compensation in connection with the provision of 
counseling services under this section.
  (n) Veterans Assistance and Services Program.--
          (1) In general.--A small business development center 
        may apply for a grant under this subsection to carry 
        out a veterans assistance and services program.
          (2) Elements of program.--Under a program carried out 
        with a grant under this subsection, a small business 
        development center shall--
                  (A) create a marketing campaign to promote 
                awareness and education of the services of the 
                center that are available to veterans, and to 
                target the campaign toward veterans, service-
                disabled veterans, military units, Federal 
                agencies, and veterans organizations;
                  (B) use technology-assisted online counseling 
                and distance learning technology to overcome 
                the impediments to entrepreneurship faced by 
                veterans and members of the Armed Forces; and
                  (C) increase coordination among organizations 
                that assist veterans, including by establishing 
                virtual integration of service providers and 
                offerings for a one-stop point of contact for 
                veterans who are entrepreneurs or owners of 
                small business concerns.
          (3) Amount of grants.--A grant under this subsection 
        shall be for not less than $75,000 and not more than 
        $250,000.
          (4) Funding.--Subject to amounts approved in advance 
        in appropriations Acts, the Administration may make 
        grants or enter into cooperative agreements to carry 
        out the provisions of this subsection.

           *       *       *       *       *       *       *

                              ----------                              


HOMELAND SECURITY ACT OF 2002

           *       *       *       *       *       *       *


TITLE II--INFORMATION ANALYSIS AND INFRASTRUCTURE PROTECTION

           *       *       *       *       *       *       *


Subtitle C--Information Security

           *       *       *       *       *       *       *


SEC. 227. NATIONAL CYBERSECURITY AND COMMUNICATIONS INTEGRATION CENTER.

  (a) Definitions.--In this section--
          (1) the term ``cybersecurity risk''--
                  (A) means threats to and vulnerabilities of 
                information or information systems and any 
                related consequences caused by or resulting 
                from unauthorized access, use, disclosure, 
                degradation, disruption, modification, or 
                destruction of such information or information 
                systems, including such related consequences 
                caused by an act of terrorism; and
                  (B) does not include any action that solely 
                involves a violation of a consumer term of 
                service or a consumer licensing agreement;
          (2) the terms ``cyber threat indicator'' and 
        ``defensive measure'' have the meanings given those 
        terms in section 102 of the Cybersecurity Act of 2015;
          (3) the term ``incident'' means an occurrence that 
        actually or imminently jeopardizes, without lawful 
        authority, the integrity, confidentiality, or 
        availability of information on an information system, 
        or actually or imminently jeopardizes, without lawful 
        authority, an information system;
          (4) the term ``information sharing and analysis 
        organization'' has the meaning given that term in 
        section 212(5);
          (5) the term ``information system'' has the meaning 
        given that term in section 3502(8) of title 44, United 
        States Code; and
          (6) the term ``sharing'' (including all conjugations 
        thereof) means providing, receiving, and disseminating 
        (including all conjugations of each of such terms).
  (b) Center.--There is in the Department a national 
cybersecurity and communications integration center (referred 
to in this section as the ``Center'') to carry out certain 
responsibilities of the Under Secretary appointed under section 
103(a)(1)(H).
  (c) Functions.--The cybersecurity functions of the Center 
shall include--
          (1) being a Federal civilian interface for the multi-
        directional and cross-sector sharing of information 
        related to cyber threat indicators, defensivemeasures, 
        cybersecurity risks, incidents, analysis, and warnings 
        for Federal and non-Federal entities, including the 
        implementationof title I of the Cybersecurity Act of 
        2015;
          (2) providing shared situational awareness to enable 
        real-time, integrated, and operational actions across 
        the Federal Government and non-Federal entities to 
        address cybersecurity risks and incidents to Federal 
        and non-Federal entities;
          (3) coordinating the sharing of information related 
        to cyber threat indicators, defensive 
        measures,cybersecurity risks, and incidents across the 
        Federal Government;
          (4) facilitating cross-sector coordination to address 
        cybersecurity risks and incidents, including 
        cybersecurity risks and incidents that may be related 
        or could have consequential impacts across multiple 
        sectors;
          (5)(A) conducting integration and analysis, including 
        cross-sector integration and analysis, of cyber threat 
        indicators, defensivemeasures, cybersecurity risks, and 
        incidents; and
          (B) sharing the analysis conducted under subparagraph 
        (A) with Federal and non-Federal entities;
          (6) upon request, providing timely technical 
        assistance, risk management support, and incident 
        response capabilities to Federal and non-Federal 
        entities with respect to cyber threat indicators, 
        defensive measures, cybersecurityrisks, and incidents, 
        which may include attribution, mitigation, and 
        remediation;
          (7) providing information and recommendations on 
        security and resilience measures to Federal and non-
        Federal entities, including information and 
        recommendations to--
                  (A) facilitate information security;
                  (B) strengthen information systems against 
                cybersecurity risks and incidents; and
                  (C) sharing cyber threat indicators and 
                defensive measures;
          (8) engaging with international partners, in 
        consultation with other appropriate agencies, to--
                  (A) collaborate on cyber threat indicators, 
                defensive measures, and information related to 
                cybersecurity risks and incidents; and
                  (B) enhance the security and resilience of 
                global cybersecurity;
          (9) sharing cyber threat indicators, defensive 
        measures, and other information related to 
        cybersecurity risks and incidents with Federal and non-
        Federal entities, including across sectors of critical 
        infrastructure and with State and major urban area 
        fusion centers, as appropriate;
          (10) participating, as appropriate, in national 
        exercises run by the Department; and
          (11) in coordination with the Office of Emergency 
        Communications of the Department, assessing and 
        evaluating consequence, vulnerability, and threat 
        information regarding cyber incidents to public safety 
        communications to help facilitate continuous 
        improvements to the security and resiliency of such 
        communications.
  (d) Composition.--
          (1) In general.--The Center shall be composed of--
                  (A) appropriate representatives of Federal 
                entities, such as--
                          (i) sector-specific agencies;
                          (ii) civilian and law enforcement 
                        agencies; and
                          (iii) elements of the intelligence 
                        community, as that term is defined 
                        under section 3(4) of the National 
                        Security Act of 1947 (50 U.S.C. 
                        3003(4));
                  (B) appropriate representatives of non-
                Federal entities, such as--
                          (i) State, local, and tribal 
                        governments;
                          (ii) information sharing and analysis 
                        organizations, including information 
                        sharing and analysis centers;
                          (iii) owners and operators of 
                        critical information systems; and
                          (iv) private entities;
                  (C) components within the Center that carry 
                out cybersecurity and communications 
                activities;
                  (D) a designated Federal official for 
                operational coordination with and across each 
                sector;
                  (E) an entity that collaborates with State 
                and local governments on cybersecurity risks 
                and incidents, and has entered into a voluntary 
                information sharing relationship with the 
                Center; and
                  (F) other appropriate representatives or 
                entities, as determined by the Secretary.
          (2) Incidents.--In the event of an incident, during 
        exigent circumstances the Secretary may grant a Federal 
        or non-Federal entity immediate temporary access to the 
        Center.
  (e) Principles.--In carrying out the functions under 
subsection (c), the Center shall ensure--
          (1) to the extent practicable, that--
                  (A) timely, actionable, and relevant cyber 
                threatindicators, defensive measures, and 
                information related to cybersecurity risks, 
                incidents, and analysis is shared;
                  (B) when appropriate, cyber threatindicators, 
                defensive measures, and information related to 
                cybersecurity risks, incidents, and analysis is 
                integrated with other relevant information and 
                tailored to the specific characteristics of a 
                sector;
                  (C) activities are prioritized and conducted 
                based on the level of risk;
                  (D) industry sector-specific, academic, and 
                national laboratory expertise is sought and 
                receives appropriate consideration;
                  (E) continuous, collaborative, and inclusive 
                coordination occurs--
                          (i) across sectors; and
                          (ii) with--
                                  (I) sector coordinating 
                                councils;
                                  (II) information sharing and 
                                analysis organizations; and
                                  (III) other appropriate non-
                                Federal partners;
                  (F) as appropriate, the Center works to 
                develop and use mechanisms for sharing 
                information related to cyber threat indicators, 
                defensive measures,cybersecurity risks, and 
                incidents that are technology-neutral, 
                interoperable, real-time, cost-effective, and 
                resilient;
                  (G) the Center works with other agencies to 
                reduce unnecessarily duplicative sharing of 
                information related to cyber threat 
                indicators,defensive measures, cybersecurity 
                risks, andincidents; and;
                  (H) the Center designates an agency contact 
                for non-Federal entities;
          (2) that information related to cyber threat 
        indicators, defensive measures, cybersecurityrisks, and 
        incidents is appropriately safeguarded against 
        unauthorized access or disclosure; and
          (3) that activities conducted by the Center comply 
        with all policies, regulations, and laws that protect 
        the privacy and civil liberties of United States 
        persons, including by working withthe Privacy Officer 
        appointed under section 222 to ensurethat the Center 
        follows the policies and procedures specifiedin 
        subsections (b) and (d)(5)(C) of section 105 of the 
        CybersecurityAct of 2015.
  (f) No Right or Benefit.--
          (1) In general.--The provision of assistance or 
        information to, and inclusion in the Center of, 
        governmental or private entities under this section 
        shall be at the sole and unreviewable discretion of the 
        Under Secretary appointed under section 103(a)(1)(H).
          (2) Certain assistance or information.--The provision 
        of certain assistance or information to, or inclusion 
        in the Center of, one governmental or private entity 
        pursuant to this section shall not create a right or 
        benefit, substantive or procedural, to similar 
        assistance or information for any other governmental or 
        private entity.
  (g) Automated Information Sharing.--
          (1) In general.--The Under Secretary appointed under 
        section 103(a)(1)(H), in coordination with industry and 
        other stakeholders, shall develop capabilities making 
        use of existing information technology industry 
        standards and best practices, as appropriate, that 
        support and rapidly advance the development, adoption, 
        and implementation of automated mechanisms for the 
        sharing of cyber threat indicators and defensive 
        measures in accordance with title I of the 
        Cybersecurity Act of 2015.
          (2) Annual report.--The Under Secretary appointed 
        under section 103(a)(1)(H) shall submit to the 
        Committee on Homeland Security and Governmental Affairs 
        of the Senate and the Committee on Homeland Security of 
        the House of Representatives an annual report on the 
        status and progress of the development of the 
        capabilities described in paragraph (1). Such reports 
        shall be required until such capabilities are fully 
        implemented.
  (h) Voluntary Information Sharing Procedures.--
          (1) Procedures.--
                  (A) In general.--The Center may enter into a 
                voluntary information sharing relationship with 
                any consenting non-Federal entity for the 
                sharing of cyber threat indicators and 
                defensive measures for cybersecurity purposes 
                in accordance with this section. Nothing in 
                this subsection may be construed to require any 
                non-Federal entity to enter into any such 
                information sharing relationship with the 
                Center or any other entity. The Center may 
                terminate a voluntary information sharing 
                relationship under this subsection, at the sole 
                and unreviewable discretion of the Secretary, 
                acting through the Under Secretary appointed 
                under section 103(a)(1)(H), for any reason, 
                including if the Center determines that the 
                non-Federal entity with which the Center has 
                entered into such a relationship has violated 
                the terms of this subsection.
                  (B) National security.--The Secretary may 
                decline to enter into a voluntary information 
                sharing relationship under this subsection, at 
                the sole and unreviewable discretion of the 
                Secretary, acting through the Under Secretary 
                appointed under section 103(a)(1)(H), for any 
                reason, including if the Secretary determines 
                that such is appropriate for national security.
          (2) Voluntary information sharing relationships.--A 
        voluntary information sharing relationship under this 
        subsection may be characterized as an agreement 
        described in this paragraph.
                  (A) Standard agreement.--For the use of a 
                non-Federal entity, the Center shall make 
                available a standard agreement, consistent with 
                this section, on the Department's website.
                  (B) Negotiated agreement.--At the request of 
                a non-Federal entity, and if determined 
                appropriate by the Center, at the sole and 
                unreviewable discretion of the Secretary, 
                acting through the Under Secretary appointed 
                under section 103(a)(1)(H), the Department 
                shall negotiate a non-standard agreement, 
                consistent with this section.
                  (C) Existing agreements.--An agreement 
                between the Center and a non-Federal entity 
                that is entered into before the date of 
                enactment of this subsection, or such an 
                agreement that is in effect before such date, 
                shall be deemed in compliance with the 
                requirements of this subsection, 
                notwithstanding any other provision or 
                requirement of this subsection. An agreement 
                under this subsection shall include the 
                relevant privacy protections as in effect under 
                the Cooperative Research and Development 
                Agreement for Cybersecurity Information Sharing 
                and Collaboration, as of December 31, 2014. 
                Nothing in this subsection may be construed to 
                require a non-Federal entity to enter into 
                either a standard or negotiated agreement to be 
                in compliance with this subsection.
  (i) Direct Reporting.--The Secretary shall develop policies 
and procedures for direct reporting to the Secretary by the 
Director of the Center regarding significant cybersecurity 
risks and incidents.
  (j) Reports on International Cooperation.--Not later than 180 
days after the date of enactment of this subsection, and 
periodically thereafter, the Secretary of Homeland Security 
shall submit to the Committee on Homeland Security and 
Governmental Affairs of the Senate and the Committee on 
Homeland Security of the House of Representatives a report on 
the range of efforts underway to bolster cybersecurity 
collaboration with relevant international partners in 
accordance with subsection (c)(8).
  (k) Outreach.--Not later than 60 days after the date of 
enactment of this subsection, the Secretary, acting through the 
Under Secretary appointed under section 103(a)(1)(H), shall--
          (1) disseminate to the public information about how 
        to voluntarily share cyber threat indicators and 
        defensive measures with the Center; and
          (2) enhance outreach to critical infrastructure 
        owners and operators for purposes of such sharing.
  (l) Cybersecurity Outreach.--
          (1) In general.--The Secretary may leverage small 
        business development centers to provide assistance to 
        small businesses by disseminating information on cyber 
        threat indicators, defensive measures, cybersecurity 
        risks, incidents, analysis, and warnings to help small 
        business concerns in developing or enhancing 
        cybersecurity infrastructure, cyber threat awareness, 
        and cyber training programs for employees.
          (2) Definitions.--For purposes of this subsection, 
        the terms ``small business concern'' and ``small 
        business development center'' have the meaning given 
        such terms, respectively, under section 3 of the Small 
        Business Act.
  [(l)] (m) Coordinated Vulnerability Disclosure.--The 
Secretary, in coordination with industry and other 
stakeholders, may develop and adhere to Department policies and 
procedures for coordinating vulnerability disclosures.

           *       *       *       *       *       *       *


                                  [all]