IIB 

117TH CONGRESS 

1ST SESSION H. R. 3462 

IN THE SENATE OF THE UNITED STATES 

NOVEMBER 3, 2021 

Received; read twice and referred to the Committee on Small Business and 

Entrepreneurship 

AN ACT 

To require an annual report on the cybersecurity of the 

Small Business Administration, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 


pbinns on DSKJLVW7X2PROD with BILLS
2 

HR 3462 RFS

1 SECTION 1. SHORT TITLE. 

2 This Act may be cited as the ‘‘SBA Cyber Awareness 

3 Act’’. 

4 SEC. 2. CYBERSECURITY AWARENESS REPORTING. 

5 Section 10 of the Small Business Act (15 U.S.C. 639) 

6 is amended by inserting after subsection (a) the following: 

7 ‘‘(b) CYBERSECURITY REPORTS.— 

8 ‘‘(1) ANNUAL REPORT.—Not later than 180 

9 days after the date of enactment of this subsection, 

10 and every year thereafter, the Administrator shall 

11 submit a report to the appropriate congressional 

12 committees that includes— 

13 ‘‘(A) an assessment of the information 

14 technology (as defined in section 11101 of title 

15 40, United States Code) and cybersecurity in16 frastructure of the Administration; 

17 ‘‘(B) a strategy to increase the cybersecu18 rity infrastructure of the Administration; 

19 ‘‘(C) a detailed account of any information 

20 technology equipment or interconnected system 

21 or subsystem of equipment of the Administra22 tion that was manufactured by an entity that 

23 has its principal place of business located in the 

24 People’s Republic of China; and 

25 ‘‘(D) an account of any cybersecurity risk 

26 or incident that occurred at the Administration 


pbinns on DSKJLVW7X2PROD with BILLS
3 

HR 3462 RFS

1 during the 2-year period preceding the date on 

2 which the report is submitted, and any action 

3 taken by the Administrator to respond to or re4 mediate any such cybersecurity risk or incident. 

5 ‘‘(2) ADDITIONAL REPORTS.—If the Adminis6 trator determines that there is a reasonable basis to 

7 conclude that a cybersecurity risk or incident oc8 curred at the Administration, the Administrator 

9 shall— 

10 ‘‘(A) not later than 7 days after the date 

11 on which the Administrator makes that deter12 mination, notify the appropriate congressional 

13 committees of the cybersecurity risk or incident; 

14 and 

15 ‘‘(B) not later than 30 days after the date 

16 on which the Administrator makes a determina17 tion under subparagraph (A)— 

18 ‘‘(i) provide notice to individuals and 

19 small business concerns affected by the cy20 bersecurity risk or incident; and 

21 ‘‘(ii) submit to the appropriate con22 gressional committees a report, based on 

23 information available to the Administrator 

24 as of the date which the Administrator 

25 submits the report, that includes— 


pbinns on DSKJLVW7X2PROD with BILLS
4 

HR 3462 RFS

1 ‘‘(I) a summary of information 

2 about the cybersecurity risk or inci3 dent, including how the cybersecurity 

4 risk or incident occurred; and 

5 ‘‘(II) an estimate of the number 

6 of individuals and small business con7 cerns affected by the cybersecurity 

8 risk or incident, including an assess9 ment of the risk of harm to affected 

10 individuals and small business con11 cerns. 

12 ‘‘(3) RULE OF CONSTRUCTION.—Nothing in 

13 this subsection shall be construed to affect the re14 porting requirements of the Administrator under 

15 chapter 35 of title 44, United States Code, in par16 ticular the requirement to notify the Federal infor17 mation security incident center under section 

18 3554(b)(7)(C)(ii) of such title, or any other provi19 sion of law. 

20 ‘‘(4) DEFINITIONS.—In this subsection: 

21 ‘‘(A) APPROPRIATE CONGRESSIONAL COM22 MITTEES.—The term ‘appropriate congressional 

23 committees’ means— 

24 ‘‘(i) the Committee on Small Business 

25 and Entrepreneurship of the Senate; and 


pbinns on DSKJLVW7X2PROD with BILLS
5 

HR 3462 RFS

1 ‘‘(ii) the Committee on Small Busi2 ness of the House of Representatives. 

3 ‘‘(B) CYBERSECURITY RISK; INCIDENT.— 

4 The terms ‘cybersecurity risk’ and ‘incident’ 

5 have the meanings given such terms, respec6 tively, under section 2209(a) of the Homeland 

7 Security Act of 2002.’’. 

Passed the House of Representatives November 2, 

2021. 

Attest: CHERYL L. JOHNSON, 

Clerk. 


pbinns on DSKJLVW7X2PROD with BILLS