I 

116TH CONGRESS 

1ST SESSION H. R. 2331 

To require an annual report on the cybersecurity of the Small Business 

Administration, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 18, 2019 

Mr. CROW (for himself, Mr. BALDERSON, Ms. VELA ́ZQUEZ, and Mr. CHABOT) 

introduced the following bill; which was referred to the Committee on 

Small Business 

A BILL 

To require an annual report on the cybersecurity of the 

Small Business Administration, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘SBA Cyber Awareness 

5 Act’’. 

6 SEC. 2. CYBERSECURITY AWARENESS REPORTING. 

7 Section 10 of the Small Business Act (15 U.S.C. 639) 

8 is amended by inserting after subsection (a) the following: 

9 ‘‘(b) CYBERSECURITY REPORTS.— 


kjohnson on DSK79L0C42 with BILLS
2 

•HR 2331 IH

1 ‘‘(1) ANNUAL REPORT.—Not later than 180 

2 days after the date of enactment of this subsection, 

3 and every year thereafter, the Administrator shall 

4 submit a report to the appropriate congressional 

5 committees that includes— 

6 ‘‘(A) an assessment of the information 

7 technology (as defined in section 11101 of title 

8 40, United States Code) and cybersecurity in9 frastructure of the Administration; 

10 ‘‘(B) a strategy to increase the cybersecuri11 ty infrastructure of the Administration; 

12 ‘‘(C) a detailed account of any information 

13 technology equipment or interconnected system 

14 or subsystem of equipment of the Administra15 tion that was manufactured by an entity that 

16 has its principal place of business located in the 

17 People’s Republic of China; and 

18 ‘‘(D) an account of any cybersecurity risk 

19 or incident that occurred at the Administration 

20 during the 2-year period preceding the date on 

21 which the report is submitted, and any action 

22 taken by the Administrator to respond to or re23 mediate any such cybersecurity risk or incident. 

24 ‘‘(2) ADDITIONAL REPORTS.—If the Adminis25 trator determines that there is a reasonable basis to 


kjohnson on DSK79L0C42 with BILLS
3 

•HR 2331 IH

1 conclude that a cybersecurity risk or incident oc2 curred at the Administration, the Administrator 

3 shall— 

4 ‘‘(A) not later than 7 days after the date 

5 on which the Administrator makes that deter6 mination, notify the appropriate congressional 

7 committees of the cybersecurity risk or incident; 

8 and 

9 ‘‘(B) not later than 30 days after the date 

10 on which the Administrator makes a determina11 tion under subparagraph (A)— 

12 ‘‘(i) provide notice to individuals and 

13 small business concerns affected by the cy14 bersecurity risk or incident; and 

15 ‘‘(ii) submit to the appropriate con16 gressional committees a report, based on 

17 information available to the Administrator 

18 as of the date which the Administrator 

19 submits the report, that includes— 

20 ‘‘(I) a summary of information 

21 about the cybersecurity risk or inci22 dent, including how the cybersecurity 

23 risk or incident occurred; and 

24 ‘‘(II) an estimate of the number 

25 of individuals and small business conVerDate Sep 11 2014 21:57 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\H2331.IH H2331

kjohnson on DSK79L0C42 with BILLS
4 

•HR 2331 IH

1 cerns affected by the cybersecurity 

2 risk or incident, including an assess3 ment of the risk of harm to affected 

4 individuals and small business con5 cerns. 

6 ‘‘(3) RULE OF CONSTRUCTION.—Nothing in 

7 this subsection shall be construed to affect the re8 porting requirements of the Administrator under 

9 chapter 35 of title 44, United States Code, in par10 ticular the requirement to notify the Federal infor11 mation security incident center under section 

12 3554(b)(7)(C)(ii) of such title, or any other provi13 sion of law. 

14 ‘‘(4) DEFINITIONS.—In this subsection: 

15 ‘‘(A) APPROPRIATE CONGRESSIONAL COM16 MITTEES.—The term ‘appropriate congressional 

17 committees’ means— 

18 ‘‘(i) the Committee on Small Business 

19 and Entrepreneurship of the Senate; and 

20 ‘‘(ii) the Committee on Small Busi21 ness of the House of Representatives. 

22 ‘‘(B) CYBERSECURITY RISK; INCIDENT.— 

23 The terms ‘cybersecurity risk’ and ‘incident’ 

24 have the meanings given such terms, respecVerDate Sep 11 2014 21:57 Apr 23, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\H2331.IH H2331

kjohnson on DSK79L0C42 with BILLS
5 

•HR 2331 IH

1 tively, under section 2209(a) of the Homeland 

2 Security Act of 2002.’’. 

Æ 


kjohnson on DSK79L0C42 with BILLS