Last month, Rep Joyce (R,OH) introduced HR 6812, the Small Business Cybersecurity Assistance Pilot Program Act. The bill would provide continued funding for the Cybersecurity Assistance Pilot Program through 2025 at the rate of $3 million per year. The bill also contains congressional reporting requirements.
Grant Program
As noted in §2(a) the program was established last year in the FY 2021 spending bill. While the bill’s reference to “established pursuant to title V of the Financial Services and General Government Appropriations Act, 2021 (Public Law 116–260; 134 Stat. 1406)”, is technically correct, there is no actual mention of the grant program in the text of the bill. That is not unexpected as spending amounts this ‘small’ seldom make it into the actual text of the bill. To find the language establishing the Program you have to look in the Explanatory Statement that accompanies bills coming out of a conference committee.
In this case you have to go to Book IV of the December 21, 2020 Congressional Record to find the portion of the Explanatory Notes dealing with to title V of the Financial Services and General Government Appropriations Act, 2021. There on page H8444, you find:
“Cybersecurity for Small Businesses Pilot Program.—The agreement includes $3,000,000 for a Cybersecurity Assistance Pilot Program that will competitively award up to three grants to States to provide new small businesses with access to cybersecurity tools during their formative and most vulnerable years.”
Interestingly, there is no mention of this program in the House Report for the Financial Services and General Government Appropriations Act, 2021 (H. Rept 116-456) and there was no Senate spending bill introduced that year for these agencies.
Similarly, the Joint Explanatory Statement (pg 54) for Division E of HR 2471 contains nearly identical language for the FY 2022 spending bill:
“Cybersecurity for Small Businesses Pilot Program. The agreement includes $3,000,000 for a Cybersecurity Assistance Pilot Program that will competitively award up to three grants to States to provide new small businesses with access to cybersecurity tools during their formative and most vulnerable years.”
The House Appropriations Committee report on HR 4345, the Financial Services And General Government Appropriations Bill, 2022, did include a mention of the program on page 109:
“Cybersecurity Assistance Pilot Program.—The Financial Services and General Government Appropriations Act, 2021, included $3,000,000 for a Cybersecurity Assistance Pilot Program to award up to three grants to States to provide new small businesses with access to cybersecurity tools during their formative and most vulnerable years. Within 60 days of enactment of this Act, SBA is directed to brief the Committee on the status of the pilot program.”
So, the Program has been funded through this fiscal year, but there are no details on what the grant program would cover. The only guidance in this bill is found in §2(b) and that is a requirement for SBA to coordinate with CISA in providing “recipients of grants under the Cybersecurity Assistance Pilot Program guidance on using such grants to provide businesses with, or to enable businesses to attain, the greatest degree of cybersecurity practicable, including information on cybersecurity best practices.”
Moving Forward
While Joyce is not a member of the House Small Business Committee to which this bill was assigned for consideration, one of his cosponsors {Rep Garbarino (R,NY)} is a member. This means that there may be sufficient influence to see this bill considered in Committee. I see nothing in this bill that would engender any organized opposition. Even the authorization provision, which frequently impedes consideration of bills like this, should not be a problem since the Appropriations Committee is obviously already on board.
I suspect that the bill would receive significant bipartisan support in Committee and that that support should be large enough to allow this bill to be considered under the suspension of the rules process.
Commentary
This is a rather small ‘pilot’ grant program, but it still deserves better documentation of the purpose and scope of the program than the mention in passing in two separate spending bill explanatory statements that has been the sole documentation of the authorization of this program.