“(a) Definitions.—As used in this section:

“(1) CYBERSECURITY TECHNOLOGY AND SERVICES.—The term ‘cybersecurity technology and services’—

“(A) means—

“(i) computer hardware, software, and related technology that—

“(I) supports the prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation;

“(II) is purchased by an eligible small business;

“(III) provides for encryption of data, detection of malware, or protection of information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction;

“(IV) meets any requirements established by the Small Business Development Center Cyber Strategy developed under section 1841(a) of the National Defense Authorization Act for Fiscal Year 2017 (Public Law 114–328; 130 Stat. 2662); and

“(V) meets any industry best practices standards;

“(ii) an insurance product available for purchase by an eligible small business that provides coverage for losses caused by a cyber attack on such business;

“(iii) services related to—

“(I) the installation of computer hardware, software, and related technology described under clause (i); or

“(II) training on security principles for employees of an eligible small business; or

“(iv) has the meaning given such term by the Administrator; and

“(B) does not include information technology whose sole use is financial management, maintenance of inventory of basic supplies, or appointment scheduling.

“(2) ELIGIBLE SMALL BUSINESS.—The term ‘eligible small business’ means a small business concern that—

“(A) has 100 or fewer employees;

“(B) has been in business for at least 1 year; and

“(C) has obtained training from a small business development center.

“(3) PRIME RATE.—The term ‘prime rate’ means the discount window primary credit interest rate most recently published in the Federal Reserve Statistical Release on selected interest rates (daily or weekly), commonly referred to as the H.15 release, or any successor publication.

“(b) Loan guarantees for eligible small businesses.—

“(1) GUARANTEE PERCENTAGE.—Subject to paragraph (2), the Administrator may guarantee up to 90 percent of the amount of a loan made to an eligible small business for—

“(A) the acquisition of cybersecurity technology and services for use in the business operations of the eligible small business; and

“(B) the costs associated with the installation or use of such cybersecurity technology and services.

“(2) LIMITATIONS ON GUARANTEE AMOUNTS.—The maximum amount of the principal of a loan guaranteed under this section may not exceed $50,000. The aggregate total amount of the principal of loans guaranteed under this section in a year may not exceed $500,000,000.

“(c) Fees.—With respect to each loan guaranteed under this section, the Administration shall assess, collect, and retain such fees as are necessary to reduce to zero the cost to the Administration of making guarantees under this section. As used in this subsection, the term ‘cost’ has the meaning given that term in section 502 of the Federal Credit Reform Act of 1990 (2 U.S.C. 661a).

“(d) Interest rates.—

“(1) FIXED RATE LOANS.—With respect to a fixed rate loan guaranteed under this section, the interest rate for such a loan may not exceed—

“(A) for a loan in an amount greater than $25,000, the prime rate; and

“(B) for a loan in an amount less than or equal to $25,000, the prime rate plus 3.25 percent.

“(2) VARIABLE RATE LOANS.—

“(A) IN GENERAL.—With respect to a variable rate loan guaranteed under this section, the interest rate for such a loan shall equal—

“(i) the prime rate plus the spread described under subparagraph (B); or

“(ii) the optional peg rate, as calculated quarterly by the Administrator and published in the Federal Register, plus the spread described under subparagraph (B).

“(B) NEGOTIATION OF SPREAD AND RATE OF CHANGE.—The lender and the borrower shall negotiate the amount of the spread which will be added to the interest rate described under subparagraph (A) and select the frequency at which the spread will change, which shall be no more often than monthly and shall be consistent over the term of the loan.

“(e) Deferral period.—The Administrator may defer payment of the principal and interest on a loan guaranteed under this section for a period not to exceed 3 years.

“(f) Terms and conditions for loan guarantees.—

“(1) IN GENERAL.—A loan guaranteed under this section shall be subject to such terms and conditions as the Administrator may prescribe, including—

“(A) explicit standards for use in periodically assessing the credit risk of guaranteed loans;

“(B) a requirement that the final maturity of such a loan may not exceed 7 years; and

“(C) a requirement that such a loan may not be subordinated to another debt contracted by the borrower or to any other claims against the borrower in the case of default.

“(2) RESTRICTIONS.—The Administrator may not guarantee a loan under this section—

“(A) unless the Administrator determines that the lender is responsible, that there is a reasonable assurance of repayment, and that adequate provision is made for servicing the loan on reasonable terms and protecting the financial interest of the United States;

“(B) except to the extent that appropriations of budget authority to cover their costs are made in advance, as required under section 504 of the Federal Credit Reform Act of 1990; and

“(C) if—

“(i) the income from such loan is excluded from gross income for purposes of chapter 1 of the Internal Revenue Code of 1986; or

“(ii) the guarantee provides significant collateral or security, as determined by the Administrator, for other obligations the income from which is so excluded.

“(3) GUARANTEES.—A loan guarantee provided under this section shall be conclusive evidence that—

“(A) the guarantee has been properly obtained;

“(B) the underlying loan qualified for such guarantee; and

“(C) absent fraud or material misrepresentation by the holder and the lender, the guarantee is presumed to be valid, legal, and enforceable.

“(g) Payment of losses.—

“(1) IN GENERAL.—If, as a result of a default by a borrower under a loan guaranteed under this section, and after the holder of the loan has made collection efforts and instituted enforcement proceedings as the Administrator may require, the Administrator determines that the holder of the loan has suffered a loss, the Administrator shall pay to such holder the percentage of such loss specified in the guarantee contract. Upon making any such payment, the Administrator shall be subrogated to all the rights of the recipient of the payment. The Administrator shall be entitled to recover from the borrower the amount of any payments made to the holder of the loan under this paragraph.

“(2) FORBEARANCE.—Nothing in this section may be construed to preclude any forbearance for the benefit of the borrower which may be agreed upon by the parties to the guaranteed loan and approved by the Administrator, if budget authority for any resulting subsidy costs (as defined in section 502(5) of the Federal Credit Reform Act of 1990) is available.

“(3) MANAGEMENT OF PROPERTY.—Notwithstanding any other provision of law relating to the acquisition, handling, or disposal of property by the United States, the Administrator may complete, recondition, reconstruct, renovate, repair, maintain, operate, or sell any property acquired by the Administrator pursuant to this section.

“(h) Sunset of authority.—The authority of the Administrator to make new loan guarantees under this section shall terminate after the end of the 5-year period beginning on the date of the enactment of this section.”.