; or (ii) any action or inaction in response to any cyber threat indicator, defensive measure, or other information shared or received pursuant to this paragraph or the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 et seq. ). (B) Rule of construction Nothing in this paragraph shall be construed to affect the applicability or merits of any defense, motion, or argument in any cause of action in a court brought against an entity that is not a small business concern. (e) Report (1) In general Not later than 1 year after the date of enactment of the Small Business Cyber Resiliency Act , and every year thereafter, the Administrator and the head of each Federal agency that collects or shares information under this section shall submit to the Committee on Small Business and Entrepreneurship of the Senate and the Committee on Small Business of the House of Representatives a joint report on actions taken by the Administration and relevant Federal agencies to protect personally identifiable information, business identifiable information, sensitive financial information, and cybersecurity information received by those Federal agencies as a result of the requirements under this section. (2) Form Each report required under paragraph (1) shall be unclassified, but may include a classified annex. . (b) Prohibition on new appropriations (1) In general No additional funds are authorized to be appropriated to carry out this section and the amendments made by this section. (2) Existing funding This section and the amendments made by this section shall be carried out using amounts made available to the Small Business Administration under the heading Entrepreneurial Development Programs . (c) Implementation Not later than 180 days after the date of enactment of this Act, the Administrator of the Small Business Administration shall implement this section and the amendments made by this section. 3. Study and report on cybersecurity risks of small businesses (a) Definitions In this section: (1) Administration The term