Small business cyber bill would cost $6M

It would cost the federal government $6 million to implement legislation aimed at helping small businesses improve their cybersecurity, the Congressional Budget Office (CBO) estimates.

The legislation, introduced by Rep. Daniel Webster (R-Fla.) earlier this year, would direct the National Institute of Standards and Technology (NIST) to develop and disseminate guidelines, tools and other resources that small businesses could choose to use as they work to secure their systems from cyber threats.

NIST is a nonregulatory body at the Commerce Department that developed a widely lauded cybersecurity framework.

{mosads}According to the CBO, it would cost $2 million for NIST to consult with federal agencies in 2018 to develop the resources required by the bill and an additional $4 million to update the resources in subsequent years through 2022.

The legislation does not appropriate any additional funds for NIST to develop the resources for small businesses.

Lawmakers have introduced versions of the legislation in both chambers, and the measures have received bipartisan support as well as backing from industry groups. 

The cost estimate comes weeks after the House bill advanced through the Science Committee.

Despite offering support for the bill, Rep. Eddie Bernice Johnson (D-Texas), the committee’s ranking member, has voiced concerns about the legislation not coming with funds attached.

“I’m concerned that the House bill contains an explicit underfunded mandate clause and that the Senate bill is silent in funding,” Johnson said at the markup of the legislation earlier in May. 

The CBO estimates that the Senate version of the bill would cost the same to implement