House-passed cyber bill for small businesses gets Senate companion

Small businesses could get better cybersecurity support from the federal government under a new bill from a bipartisan Senate duo.

Introduced last week, the Small Business Cybersecurity Assistance Evaluation Act (S.5291) is a companion to H.R. 8880 from Reps. Lateefah Simon, D-Calif., and Rob Bresnahan, R-Pa., which cleared the House in June. 

The upper chamber’s version, sponsored by Sens. Adam Schiff, D-Calif., and Todd Young, R-Ind., would also require the Government Accountability Office to evaluate current federal cybersecurity initiatives, programs, resources, tools and support systems to U.S. small businesses.

“As small businesses face a growing threat of cyberattacks and phishing schemes, we must give them the tools they need to stop hacks and lower their risk,” Schiff said in a press release. “Our bipartisan legislation will improve federal cybersecurity resources to help small businesses mitigate their cybersecurity vulnerabilities.”

The report from GAO would also identify top cyber risks, threats and vulnerabilities to small businesses, per the bill text, in addition to assessing their preparedness. The watchdog would determine how small businesses are currently planning for, mitigating and recovering from cyber incidents, plus how they’re implementing defensive cyber measures and how they’re paying for it. 

The bill also calls on the GAO to examine the effectiveness of current federal cybersecurity programs that assist small businesses, and identify any “foundational cybersecurity concepts” that are missing from those programs. 

“Small businesses are increasingly targeted by cybercriminals, but too many owners don’t know where to turn for help,” said Young, who serves with Schiff on the Senate Small Business and Entrepreneurship Committee. 

“This commonsense legislation will identify gaps, improve coordination, and ensure small businesses have access to the tools they need to defend themselves from evolving cyber threats,” the Indiana Republican added. “When small businesses are better protected, they can spend less time responding to cyberattacks and more time creating jobs and growing our economy.” 

The report from the GAO would then be delivered to the Senate and House Small Business Committees. The lawmakers want the recommendations to focus on the effectiveness of federal cybersecurity programs that aid small businesses, and the coordination behind the initiatives. 

Ahead of the House’s passage of the bill earlier this summer, Simon said the legislation would provide Congress with “the best data available” to help small businesses defend themselves from cyberattacks. 

“Many small business owners do not have dedicated cybersecurity staff or the resources to protect themselves,” the California Democrat said at the time. “A single cybersecurity attack could mean the difference between survival and failure for our mom-and-pop businesses residing on our main streets.”

The introduction of the legislation comes as the cybersecurity of small businesses that work with the U.S. military has been a hot topic under the Pentagon’s Cybersecurity Maturity Model Certification. The department recently paused that program to review it and address concerns from small businesses that claim its requirements are too costly and burdensome.