II 

116TH CONGRESS 

1ST SESSION S. 772 

To require an annual report on the cybersecurity of the Small Business 

Administration, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

MARCH 13, 2019 

Mr. RUBIO (for himself and Mr. CARDIN) introduced the following bill; which 

was read twice and referred to the Committee on Small Business and Entrepreneurship 

A BILL 

To require an annual report on the cybersecurity of the 

Small Business Administration, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘SBA Cyber Awareness 

5 Act’’. 

6 SEC. 2. CYBERSECURITY AWARENESS REPORTING. 

7 Section 10 of the Small Business Act (15 U.S.C. 639) 

8 is amended by striking subsection (b) and inserting the 

9 following: 

10 ‘‘(b) CYBERSECURITY REPORTS.— 


kjohnson on DSK79L0C42 with BILLS
2 

•S 772 IS

1 ‘‘(1) DEFINITION.—In this subsection, the term 

2 ‘appropriate congressional committees’ means— 

3 ‘‘(A) the Committee on Small Business 

4 and Entrepreneurship of the Senate; and 

5 ‘‘(B) the Committee on Small Business of 

6 the House of Representatives. 

7 ‘‘(2) ANNUAL REPORT.—Not later than 180 

8 days after the date of enactment of the SBA Cyber 

9 Awareness Act, and every year thereafter, the Ad10 ministration shall submit a report to the appropriate 

11 congressional committees that includes— 

12 ‘‘(A) an assessment of the information 

13 technology and cybersecurity of the Administra14 tion; 

15 ‘‘(B) a strategy to increase the cybersecu16 rity of the Administration; 

17 ‘‘(C) a detailed account of any information 

18 technology component or system of the Admin19 istration that was manufactured by a company 

20 located in the People’s Republic of China; and 

21 ‘‘(D) an account of any cyber threat, 

22 breach, or cyber attack that occurred at the Ad23 ministration during the 2-year period preceding 

24 the date on which the report is submitted, and 

25 any action taken by the Administration to reVerDate Sep 11 2014 02:43 Mar 23, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S772.IS S772

kjohnson on DSK79L0C42 with BILLS
3 

•S 772 IS

1 spond to or remediate the cyber threat, breach, 

2 or cyber attack. 

3 ‘‘(3) ADDITIONAL REPORTS.—If the Adminis4 tration determines that there is a reasonable basis to 

5 conclude that a cyber threat, breach, or cyber attack 

6 occurred at the Administration, the Administration 

7 shall— 

8 ‘‘(A) not later than 7 days after the date 

9 on which the Administration makes that deter10 mination, notify the appropriate congressional 

11 committees of the cyber threat, breach, or cyber 

12 attack; and 

13 ‘‘(B) not later than 30 days after the date 

14 on which the Administration makes that deter15 mination, submit to the appropriate congres16 sional committees a report that includes— 

17 ‘‘(i) a summary of information about 

18 the cyber threat, breach, or cyber attack, 

19 including how the cyber threat, breach, or 

20 cyber attack occurred, based on informa21 tion available to the Administration as of 

22 the date which the Administration submits 

23 the report; 

24 ‘‘(ii) an estimate of the number of in25 dividuals and small entities affected by the 


kjohnson on DSK79L0C42 with BILLS
4 

•S 772 IS

1 cyber threat, breach, or cyber attack, in2 cluding an assessment of the risk of harm 

3 to affected individuals and small entities 

4 based on information available to the Ad5 ministration as of the date on which the 

6 Administration submits the report; and 

7 ‘‘(iii) an estimate of when the Admin8 istration will provide notice to affected in9 dividuals and small entities. 

10 ‘‘(4) RULE OF CONSTRUCTION.—Nothing in 

11 this subsection shall be construed to affect the re12 porting requirements of the Administration under 

13 chapter 35 of title 44 United States Code, in par14 ticular the requirement to notify the Federal infor15 mation security incident center under section 

16 3554(b)(7)(C)(ii) of such title, or any other provi17 sion of law.’’. 

Æ 


kjohnson on DSK79L0C42 with BILLS