II 

Calendar No. 151 

116TH CONGRESS 

1ST SESSION H. R. 2331 

IN THE SENATE OF THE UNITED STATES 

JULY 16, 2019 

Received; read twice and placed on the calendar 

AN ACT 

To require an annual report on the cybersecurity of the 

Small Business Administration, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘SBA Cyber Awareness 

5 Act’’. 

6 SEC. 2. CYBERSECURITY AWARENESS REPORTING. 

7 Section 10 of the Small Business Act (15 U.S.C. 639) 

8 is amended by inserting after subsection (a) the following: 

9 ‘‘(b) CYBERSECURITY REPORTS.— 

10 ‘‘(1) ANNUAL REPORT.—Not later than 180 

11 days after the date of enactment of this subsection, 


pamtmann on DSKBFK8HB2PROD with BILLS
2 

HR 2331 PCS

1 and every year thereafter, the Administrator shall 

2 submit a report to the appropriate congressional 

3 committees that includes— 

4 ‘‘(A) an assessment of the information 

5 technology (as defined in section 11101 of title 

6 40, United States Code) and cybersecurity in7 frastructure of the Administration; 

8 ‘‘(B) a strategy to increase the cybersecuri9 ty infrastructure of the Administration; 

10 ‘‘(C) a detailed account of any information 

11 technology equipment or interconnected system 

12 or subsystem of equipment of the Administra13 tion that was manufactured by an entity that 

14 has its principal place of business located in the 

15 People’s Republic of China; and 

16 ‘‘(D) an account of any cybersecurity risk 

17 or incident that occurred at the Administration 

18 during the 2-year period preceding the date on 

19 which the report is submitted, and any action 

20 taken by the Administrator to respond to or re21 mediate any such cybersecurity risk or incident. 

22 ‘‘(2) ADDITIONAL REPORTS.—If the Adminis23 trator determines that there is a reasonable basis to 

24 conclude that a cybersecurity risk or incident ocVerDate Sep 11 2014 22:40 Jul 16, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H2331.PCS H2331

pamtmann on DSKBFK8HB2PROD with BILLS
3 

HR 2331 PCS

1 curred at the Administration, the Administrator 

2 shall— 

3 ‘‘(A) not later than 7 days after the date 

4 on which the Administrator makes that deter5 mination, notify the appropriate congressional 

6 committees of the cybersecurity risk or incident; 

7 and 

8 ‘‘(B) not later than 30 days after the date 

9 on which the Administrator makes a determina10 tion under subparagraph (A)— 

11 ‘‘(i) provide notice to individuals and 

12 small business concerns affected by the cy13 bersecurity risk or incident; and 

14 ‘‘(ii) submit to the appropriate con15 gressional committees a report, based on 

16 information available to the Administrator 

17 as of the date which the Administrator 

18 submits the report, that includes— 

19 ‘‘(I) a summary of information 

20 about the cybersecurity risk or inci21 dent, including how the cybersecurity 

22 risk or incident occurred; and 

23 ‘‘(II) an estimate of the number 

24 of individuals and small business con25 cerns affected by the cybersecurity 


pamtmann on DSKBFK8HB2PROD with BILLS
4 

HR 2331 PCS

1 risk or incident, including an assess2 ment of the risk of harm to affected 

3 individuals and small business con4 cerns. 

5 ‘‘(3) RULE OF CONSTRUCTION.—Nothing in 

6 this subsection shall be construed to affect the re7 porting requirements of the Administrator under 

8 chapter 35 of title 44, United States Code, in par9 ticular the requirement to notify the Federal infor10 mation security incident center under section 

11 3554(b)(7)(C)(ii) of such title, or any other provi12 sion of law. 

13 ‘‘(4) DEFINITIONS.—In this subsection: 

14 ‘‘(A) APPROPRIATE CONGRESSIONAL COM15 MITTEES.—The term ‘appropriate congressional 

16 committees’ means— 

17 ‘‘(i) the Committee on Small Business 

18 and Entrepreneurship of the Senate; and 

19 ‘‘(ii) the Committee on Small Busi20 ness of the House of Representatives. 

21 ‘‘(B) CYBERSECURITY RISK; INCIDENT.— 

22 The terms ‘cybersecurity risk’ and ‘incident’ 

23 have the meanings given such terms, respecVerDate Sep 11 2014 22:40 Jul 16, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H2331.PCS H2331

pamtmann on DSKBFK8HB2PROD with BILLS
5 

HR 2331 PCS

1 tively, under section 2209(a) of the Homeland 

2 Security Act of 2002.’’. 

Passed the House of Representatives July 15, 2019. 

Attest: CHERYL L. JOHNSON, 

Clerk. 


pamtmann on DSKBFK8HB2PROD with BILLS
Calendar No. 151 

116TH CONGRESS 

1ST SESSION H. R. 2331 

AN ACT 

To require an annual report on the cybersecurity of 

purposes. the Small Business Administration, and for other 

JULY 16, 2019 

Received; read twice and placed on the calendar 


pamtmann on DSKBFK8HB2PROD with BILLS