II 

Calendar No. 52 

116TH CONGRESS 

1ST SESSION S. 772 

To require an annual report on the cybersecurity of the Small Business 

Administration, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 13, 2019 

Mr. RUBIO (for himself, Mr. CARDIN, Mr. RISCH, and Mr. HAWLEY) introduced the following bill; which was read twice and referred to the Committee on Small Business and Entrepreneurship 

APRIL 1, 2019 

Reported by Mr. RUBIO, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To require an annual report on the cybersecurity of the 

Small Business Administration, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘SBA Cyber Awareness 

5 Act’’. 


pamtmann on DSKBFK8HB2PROD with BILLS
2 

•S 772 RS

1 SEC. 2. CYBERSECURITY AWARENESS REPORTING. 

2 Section 10 of the Small Business Act (15 U.S.C. 639) 

3 is amended by striking subsection (b) and inserting the 

4 following: 

5 ‘‘(b) CYBERSECURITY REPORTS.— 

6 ‘‘(1) DEFINITION.—In this subsection, the term 

7 ‘appropriate congressional committees’ means— 

8 ‘‘(A) the Committee on Small Business 

9 and Entrepreneurship of the Senate; and 

10 ‘‘(B) the Committee on Small Business of 

11 the House of Representatives. 

12 ‘‘(2) ANNUAL REPORT.—Not later than 180 

13 days after the date of enactment of the SBA Cyber 

14 Awareness Act, and every year thereafter, the Ad15 ministration shall submit a report to the appropriate 

16 congressional committees that includes— 

17 ‘‘(A) an assessment of the information 

18 technology and cybersecurity of the Administra19 tion; 

20 ‘‘(B) a strategy to increase the cybersecu21 rity of the Administration; 

22 ‘‘(C) a detailed account of any information 

23 technology component or system of the Admin24 istration that was manufactured by a company 

25 located in the People’s Republic of China; and 


pamtmann on DSKBFK8HB2PROD with BILLS
3 

•S 772 RS

1 ‘‘(D) an account of any cyber threat, 

2 breach, or cyber attack that occurred at the Ad3 ministration during the 2-year period preceding 

4 the date on which the report is submitted, and 

5 any action taken by the Administration to re6 spond to or remediate the cyber threat, breach, 

7 or cyber attack. 

8 ‘‘(3) ADDITIONAL REPORTS.—If the Adminis9 tration determines that there is a reasonable basis to 

10 conclude that a cyber threat, breach, or cyber attack 

11 occurred at the Administration, the Administration 

12 shall— 

13 ‘‘(A) not later than 7 days after the date 

14 on which the Administration makes that deter15 mination, notify the appropriate congressional 

16 committees of the cyber threat, breach, or cyber 

17 attack; and 

18 ‘‘(B) not later than 30 days after the date 

19 on which the Administration makes that deter20 mination, submit to the appropriate congres21 sional committees a report that includes— 

22 ‘‘(i) a summary of information about 

23 the cyber threat, breach, or cyber attack, 

24 including how the cyber threat, breach, or 

25 cyber attack occurred, based on informaVerDate Sep 11 2014 23:17 Apr 01, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S772.RS S772

pamtmann on DSKBFK8HB2PROD with BILLS
4 

•S 772 RS

1 tion available to the Administration as of 

2 the date which the Administration submits 

3 the report; 

4 ‘‘(ii) an estimate of the number of in5 dividuals and small entities affected by the 

6 cyber threat, breach, or cyber attack, in7 cluding an assessment of the risk of harm 

8 to affected individuals and small entities 

9 based on information available to the Ad10 ministration as of the date on which the 

11 Administration submits the report; and 

12 ‘‘(iii) an estimate of when the Admin13 istration will provide notice to affected in14 dividuals and small entities. 

15 ‘‘(4) RULE OF CONSTRUCTION.—Nothing in 

16 this subsection shall be construed to affect the re17 porting requirements of the Administration under 

18 chapter 35 of title 44 United States Code, in par19 ticular the requirement to notify the Federal infor20 mation security incident center under section 

21 3554(b)(7)(C)(ii) of such title, or any other provi22 sion of law.’’. 

23 SECTION 1. SHORT TITLE. 

24 This Act may be cited as the ‘‘SBA Cyber Awareness 

25 Act’’. 


pamtmann on DSKBFK8HB2PROD with BILLS
5 

•S 772 RS

1 SEC. 2. CYBERSECURITY AWARENESS REPORTING. 

2 Section 10 of the Small Business Act (15 U.S.C. 639) 

3 is amended by inserting after subsection (a) the following: 

4 ‘‘(b) CYBERSECURITY REPORTS.— 

5 ‘‘(1) DEFINITIONS.—In this subsection— 

6 ‘‘(A) the term ‘appropriate congressional 

7 committees’ means— 

8 ‘‘(i) the Committee on Small Business 

9 and Entrepreneurship of the Senate; and 

10 ‘‘(ii) the Committee on Small Business 

11 of the House of Representatives; and 

12 ‘‘(B) the term ‘major incident’ has the 

13 meaning given the term in the Office of Manage14 ment and Budget Memorandum on Federal In15 formation Security and Privacy Management 

16 Requirements, dated October 16, 2017 (M–18– 

17 02), or any successor memorandum. 

18 ‘‘(2) ANNUAL REPORT.—Not later than 180 days 

19 after the date of enactment of the SBA Cyber Aware20 ness Act, and every year thereafter, the Administra21 tion shall submit to the appropriate congressional 

22 committees a report that includes— 

23 ‘‘(A) an assessment of the information tech24 nology and cybersecurity of the Administration; 

25 ‘‘(B) a strategy to increase the cybersecurity 

26 of the Administration; 


pamtmann on DSKBFK8HB2PROD with BILLS
6 

•S 772 RS

1 ‘‘(C) a detailed account of any information 

2 technology component or system of the Adminis3 tration that was manufactured by a company lo4 cated in the People’s Republic of China; and 

5 ‘‘(D) an account of any major incident that 

6 occurred at the Administration during the 2- 

7 year period preceding the date on which the re8 port is submitted, and any action taken by the 

9 Administration to respond to or remediate the 

10 major incident. 

11 ‘‘(3) ADDITIONAL REPORTS.—If the Administra12 tion determines that there is a reasonable basis to 

13 conclude that a major incident occurred at the Ad14 ministration, the Administration shall— 

15 ‘‘(A) not later than 7 days after the date on 

16 which the Administration makes that determina17 tion, notify the appropriate congressional com18 mittees of the major incident; and 

19 ‘‘(B) not later than 30 days after the date 

20 on which the Administration makes that deter21 mination, submit to the appropriate congres22 sional committees a report that includes— 

23 ‘‘(i) a summary of information about 

24 the major incident, including how the major 

25 incident occurred, based on information 


pamtmann on DSKBFK8HB2PROD with BILLS
7 

•S 772 RS

1 available to the Administration as of the 

2 date which the Administration submits the 

3 report; 

4 ‘‘(ii) an estimate of the number of in5 dividuals and small entities affected by the 

6 major incident, including an assessment of 

7 the risk of harm to affected individuals and 

8 small entities based on information avail9 able to the Administration as of the date on 

10 which the Administration submits the re11 port; and 

12 ‘‘(iii) an estimate of when the Admin13 istration will provide notice to affected in14 dividuals and small entities. 

15 ‘‘(4) RULE OF CONSTRUCTION.—Nothing in this 

16 subsection shall be construed to affect the reporting re17 quirements of the Administration under chapter 35 of 

18 title 44 United States Code, in particular the require19 ment to notify the Federal information security inci20 dent center under section 3554(b)(7)(C)(ii) of such 

21 title, or any other provision of law.’’. 


pamtmann on DSKBFK8HB2PROD with BILLS
Calendar No. 52 

116TH CONGRESS 

1ST SESSION S. 772 

A BILL 

To require an annual report on the cybersecurity of 

purposes. the Small Business Administration, and for other 

APRIL 1, 2019 

Reported with an amendment 


pamtmann on DSKBFK8HB2PROD with BILLS