Small Business Cybersecurity Enhancement Act
This bill authorizes the Small Business Administration to guarantee up to 90% of the amount of a loan made to a small business that has 100 or fewer employees, has been in business for at least one year, and has obtained training from a small business development center. The loan guarantee must be used for the acquisition of cybersecurity technology and services and the cost of the installation or use of such technology and services.
For purposes of this bill, cybersecurity technology and services excludes information technology whose sole use is financial management, maintenance of inventory of basic supplies, or appointment scheduling.
To amend the Small Business Act to provide loan guarantees for the 
acquisition of cybersecurity technology and services by eligible small 
                  businesses, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Small Business Cybersecurity 
Enhancement Act''.

SEC. 2. LOAN GUARANTEES FOR CYBERSECURITY TECHNOLOGY AND SERVICES.

    (a) In General.--The Small Business Act (15 U.S.C. 631 et seq.) is 
amended--
            (1) by redesignating section 49 as section 50; and
            (2) by inserting the following new section after section 
        48:

``SEC. 49. LOAN GUARANTEES FOR CYBERSECURITY TECHNOLOGY AND SERVICES.

    ``(a) Definitions.--As used in this section:
            ``(1) Cybersecurity technology and services.--The term 
        `cybersecurity technology and services'--
                    ``(A) means--
                            ``(i) computer hardware, software, and 
                        related technology that--
                                    ``(I) supports the prevention of 
                                damage to, protection of, and 
                                restoration of computers, electronic 
                                communications systems, electronic 
                                communications services, wire 
                                communication, and electronic 
                                communication, including information 
                                contained therein, to ensure its 
                                availability, integrity, 
                                authentication, confidentiality, and 
                                nonrepudiation;
                                    ``(II) is purchased by an eligible 
                                small business;
                                    ``(III) provides for encryption of 
                                data, detection of malware, or 
                                protection of information and 
                                information systems from unauthorized 
                                access, use, disclosure, disruption, 
                                modification, or destruction;
                                    ``(IV) meets any requirements 
                                established by the Small Business 
                                Development Center Cyber Strategy 
                                developed under section 1841(a) of the 
                                National Defense Authorization Act for 
                                Fiscal Year 2017 (Public Law 114-328; 
                                130 Stat. 2662); and
                                    ``(V) meets any industry best 
                                practices standards;
                            ``(ii) an insurance product available for 
                        purchase by an eligible small business that 
                        provides coverage for losses caused by a cyber 
                        attack on such business;
                            ``(iii) services related to--
                                    ``(I) the installation of computer 
                                hardware, software, and related 
                                technology described under clause (i); 
                                or
                                    ``(II) training on security 
                                principles for employees of an eligible 
                                small business; or
                            ``(iv) has the meaning given such term by 
                        the Administrator; and
                    ``(B) does not include information technology whose 
                sole use is financial management, maintenance of 
                inventory of basic supplies, or appointment scheduling.
            ``(2) Eligible small business.--The term `eligible small 
        business' means a small business concern that--
                    ``(A) has 100 or fewer employees;
                    ``(B) has been in business for at least 1 year; and
                    ``(C) has obtained training from a small business 
                development center.
            ``(3) Prime rate.--The term `prime rate' means the discount 
        window primary credit interest rate most recently published in 
        the Federal Reserve Statistical Release on selected interest 
        rates (daily or weekly), commonly referred to as the H.15 
        release, or any successor publication.
    ``(b) Loan Guarantees for Eligible Small Businesses.--
            ``(1) Guarantee percentage.--Subject to paragraph (2), the 
        Administrator may guarantee up to 90 percent of the amount of a 
        loan made to an eligible small business for--
                    ``(A) the acquisition of cybersecurity technology 
                and services for use in the business operations of the 
                eligible small business; and
                    ``(B) the costs associated with the installation or 
                use of such cybersecurity technology and services.
            ``(2) Limitations on guarantee amounts.--The maximum amount 
        of the principal of a loan guaranteed under this section may 
        not exceed $50,000. The aggregate total amount of the principal 
        of loans guaranteed under this section in a year may not exceed 
        $500,000,000.
    ``(c) Fees.--With respect to each loan guaranteed under this 
section, the Administration shall assess, collect, and retain such fees 
as are necessary to reduce to zero the cost to the Administration of 
making guarantees under this section. As used in this subsection, the 
term `cost' has the meaning given that term in section 502 of the 
Federal Credit Reform Act of 1990 (2 U.S.C. 661a).
    ``(d) Interest Rates.--
            ``(1) Fixed rate loans.--With respect to a fixed rate loan 
        guaranteed under this section, the interest rate for such a 
        loan may not exceed--
                    ``(A) for a loan in an amount greater than $25,000, 
                the prime rate; and
                    ``(B) for a loan in an amount less than or equal to 
                $25,000, the prime rate plus 3.25 percent.
            ``(2) Variable rate loans.--
                    ``(A) In general.--With respect to a variable rate 
                loan guaranteed under this section, the interest rate 
                for such a loan shall equal--
                            ``(i) the prime rate plus the spread 
                        described under subparagraph (B); or
                            ``(ii) the optional peg rate, as calculated 
                        quarterly by the Administrator and published in 
                        the Federal Register, plus the spread described 
                        under subparagraph (B).
                    ``(B) Negotiation of spread and rate of change.--
                The lender and the borrower shall negotiate the amount 
                of the spread which will be added to the interest rate 
                described under subparagraph (A) and select the 
                frequency at which the spread will change, which shall 
                be no more often than monthly and shall be consistent 
                over the term of the loan.
    ``(e) Deferral Period.--The Administrator may defer payment of the 
principal and interest on a loan guaranteed under this section for a 
period not to exceed 3 years.
    ``(f) Terms and Conditions for Loan Guarantees.--
            ``(1) In general.--A loan guaranteed under this section 
        shall be subject to such terms and conditions as the 
        Administrator may prescribe, including--
                    ``(A) explicit standards for use in periodically 
                assessing the credit risk of guaranteed loans;
                    ``(B) a requirement that the final maturity of such 
                a loan may not exceed 7 years; and
                    ``(C) a requirement that such a loan may not be 
                subordinated to another debt contracted by the borrower 
                or to any other claims against the borrower in the case 
                of default.
            ``(2) Restrictions.--The Administrator may not guarantee a 
        loan under this section--
                    ``(A) unless the Administrator determines that the 
                lender is responsible, that there is a reasonable 
                assurance of repayment, and that adequate provision is 
                made for servicing the loan on reasonable terms and 
                protecting the financial interest of the United States;
                    ``(B) except to the extent that appropriations of 
                budget authority to cover their costs are made in 
                advance, as required under section 504 of the Federal 
                Credit Reform Act of 1990; and
                    ``(C) if--
                            ``(i) the income from such loan is excluded 
                        from gross income for purposes of chapter 1 of 
                        the Internal Revenue Code of 1986; or
                            ``(ii) the guarantee provides significant 
                        collateral or security, as determined by the 
                        Administrator, for other obligations the income 
                        from which is so excluded.
            ``(3) Guarantees.--A loan guarantee provided under this 
        section shall be conclusive evidence that--
                    ``(A) the guarantee has been properly obtained;
                    ``(B) the underlying loan qualified for such 
                guarantee; and
                    ``(C) absent fraud or material misrepresentation by 
                the holder and the lender, the guarantee is presumed to 
                be valid, legal, and enforceable.
    ``(g) Payment of Losses.--
            ``(1) In general.--If, as a result of a default by a 
        borrower under a loan guaranteed under this section, and after 
        the holder of the loan has made collection efforts and 
        instituted enforcement proceedings as the Administrator may 
        require, the Administrator determines that the holder of the 
        loan has suffered a loss, the Administrator shall pay to such 
        holder the percentage of such loss specified in the guarantee 
        contract. Upon making any such payment, the Administrator shall 
        be subrogated to all the rights of the recipient of the 
        payment. The Administrator shall be entitled to recover from 
        the borrower the amount of any payments made to the holder of 
        the loan under this paragraph.
            ``(2) Forbearance.--Nothing in this section may be 
        construed to preclude any forbearance for the benefit of the 
        borrower which may be agreed upon by the parties to the 
        guaranteed loan and approved by the Administrator, if budget 
        authority for any resulting subsidy costs (as defined in 
        section 502(5) of the Federal Credit Reform Act of 1990) is 
        available.
            ``(3) Management of property.--Notwithstanding any other 
        provision of law relating to the acquisition, handling, or 
        disposal of property by the United States, the Administrator 
        may complete, recondition, reconstruct, renovate, repair, 
        maintain, operate, or sell any property acquired by the 
        Administrator pursuant to this section.
    ``(h) Sunset of Authority.--The authority of the Administrator to 
make new loan guarantees under this section shall terminate after the 
end of the 5-year period beginning on the date of the enactment of this 
section.''.
    (b) Effective Date.--The amendments made by subsection (a) shall 
take effect on the date that is 180 days after the date of the 
enactment of this Act.
                                 <all>
Small Business Cybersecurity Enhancement Act
To amend the Small Business Act to provide loan guarantees for the acquisition of cybersecurity technology and services by eligible small businesses, and for other purposes.
Small Business Cybersecurity Enhancement Act
Rep. Schneider, Bradley Scott