S.Amdt. 2579

1. Adds SEC. ___. SMALL BUSINESS CYBER SECURITY OPERATIONS CENTER wherever appropriate

   Adds a section

   Inserted: SEC. ___. SMALL BUSINESS CYBER SECURITY OPERATIONS CENTER.

   Inserted: (a) Findings.--Congress finds the following:

   Inserted: (1) The Federal Government has been hit by a barrage of high-profile cyber assaults over the past year, including the attacks on the Office of Personnel Management and the Department of State.

   Inserted: (2) These attacks exposed the most sensitive personal information of millions of Federal employees and their families.

   Inserted: (3) The President has instituted emergency procedures to immediately deploy so-called indicators, or tell-tale signs of cybercrime operations, into agency anti-malware tools.

   Inserted: (4) According to the Federal Bureau of Investigation, small business concerns have lost more than $1,000,000,000 during the period beginning October 2013 and ending June 2015 as a result of cyber corporate account takeover and business email fraud.

   Inserted: (5) The Federal Government leverages the creative genius of small business concerns across the country to accomplish its missions.

   Inserted: (6) The Federal Acquisition Regulations dictates that a percentage of all Federal Government acquisition be set aside for small business concerns.

   Inserted: (7) Over 90 percent of small business concerns use the Internet through the course of their activities to conduct business.

   Inserted: (8) Small business concerns tend to have weaker online security and do not have necessary funding for high-end encryption technology or staff expertise.

   Inserted: (9) Industry reports indicate that 30 percent of cyber attacks target small business concerns and of those businesses that are attacked, 59 percent have no contingency plan, while according to a First Data report, the average cost for a data breach at a small business concern is $36,000 and rising annually.

   Inserted: (10) A 2012 Verizon study shows that in 855 data breaches examined, 71 percent occurred in businesses with fewer than 100 employees.

   Show 32 more inserted paragraphsShow less

   Inserted: (11) Small business concerns are increasingly attacked with data breaches and ransomware, where an attacker encrypts the businesses data until a ransom is paid to the attacker.

   Inserted: (12) It is imperative that small business concerns are provided improved secured guidance to limit negative impacts on the economy of the United States.

   Inserted: (13) There is a vast cyber threat facing the business sector of the United States, which poses a direct threat against the national security of the United States, the Department of Defense, private industry, and critical infrastructure components.

   Inserted: (14) The current layer of protection from cyber threats does not exist for small business concerns.

   Inserted: (b) Definitions.--In this section--

   Inserted: (1) the term "Center" means the Small Business Cyber Security Operations Center established under subsection (c);

   Inserted: (2) the term "cyber lab" means--

   Inserted: (A) a Joint Cyber Training Lab; and

   Inserted: (B) a facility that works in conjunction with the National Guard Cyber Teams;

   Inserted: (3) the term "Secretary" means the Secretary of Homeland Security; and

   Inserted: (4) the term "small business concern" has the meaning given that term under section 3 of the Small Business Act (15 U.S.C. 632).

   Inserted: (c) Establishment.--Not later than 1 year after the date of enactment of this Act, the Secretary shall begin carrying out a 3-year pilot program to establish a cybersecurity operations center for small business concerns, to be known as the Small Business Cyber Security Operations Center.

   Inserted: (d) Part of Existing Center.--The Secretary shall establish the Center as part of and co-locate the Center with a center providing situational awareness information to businesses on the date of enactment of this Act.

   Inserted: (e) Duties.--The Center shall--

   Inserted: (1) work with cyber labs to provide realistic scenario based training to network managers and security personnel of small business concerns, including monitoring, detection, analysis (such as trend and pattern analysis), and response and restoration activities;

   Inserted: (2) provide periodic sharing, through publication and targeted outreach, of cybersecurity best practices that are developed based on ongoing analysis of cyber threat indicators and information in possession of--

   Inserted: (A) the Federal Government;

   Inserted: (B) the Business Emergency Operations Center operated by the Federal Emergency Management Agency; and

   Inserted: (C) other technology and cyber research centers, as determined appropriate by the Secretary;

   Inserted: (3) collaborate with private industry, academia, and the Department of Defense to develop a secure business supply chain which is capable of adapting, evolving, and responding to emergent cybersecurity threats;

   Inserted: (4) review and develop the necessary tools to--

   Inserted: (A) facilitate security information flow and mitigation actions;

   Inserted: (B) provide cyber attack sensing, warning, and response services;

   Inserted: (5) place an emphasis on accessibility and relevance to small business concerns; and

   Inserted: (6) review the policy limitations and restrictions on information sharing relating to cybersecurity.

   Inserted: (f) Authorization of Appropriations.--

   Inserted: (1) In general.--There is authorized to be appropriated to carry out this section $2,000,000 for each of fiscal years 2016 through 2019, to remain available until expended.

   Inserted: (2) Offset.--Section 21(a)(4)(C)(vii) of the Small Business Act (15 U.S.C. 648(a)(4)(C)(vii)) is amended--

   Inserted: (A) in subclause (I), by striking "and" at the end;

   Inserted: (B) in subclause (II), by striking the period at the end and inserting "; and"; and

   Inserted: (C) by adding at the end the following:

   Inserted: "(III) $133,000,000 for each of fiscal years 2016 through 2019.".

   The amendment doesn't say where this goes; the clerk decides.

   Original wording

   At the appropriate place, insert the following:

Read automatically from the Congressional Record. Check the original before relying on it.

As printed