In the Senate of the United States, 
September 28, 2022. 
Resolved, That the bill from the House of Representa-
tives (H.R. 3462) entitled ‘‘An Act to require an annual re-
port on the cybersecurity of the Small Business Administra-
tion, and for other purposes.’’, do pass with the following 
AMENDMENT: 
Strike out all after the enacting clause and insert: 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘SBA Cyber Awareness 
Act’’. 
SEC. 2. CYBERSECURITY AWARENESS REPORTING. 
(a) IN GENERAL.—Section 10 of the Small Business 
Act (15 U.S.C. 639) is amended by inserting after sub-
section (a) the following: 
‘‘(b) CYBERSECURITY REPORTS.— 
‘‘(1) ANNUAL REPORT.—Not later than 180 days 
after the date of enactment of this subsection, and 
every year thereafter, the Administrator shall submit
† HR 3462 EAS 
a report to the appropriate congressional committees 
that includes— 
‘‘(A) a strategy to increase the cybersecurity 
of information technology infrastructure of the 
Administration; 
‘‘(B) a supply chain risk management 
strategy and an implementation plan to address 
the risks of foreign manufactured information 
technology equipment utilized by the Adminis-
tration, including specific risk mitigation activi-
ties for components originating from entities 
with principal places of business located in the 
People’s Republic of China; and 
‘‘(C) an account of— 
‘‘(i) any incident that occurred at the 
Administration during the 2-year period 
preceding the date on which the first report 
is submitted, and, for subsequent reports, 
the 1-year period preceding the date of sub-
mission; and 
‘‘(ii) any action taken by the Adminis-
trator to respond to or remediate any such 
incident. 
‘‘(2) FISMA REPORTS.—Each report required 
under paragraph (1) may be submitted as part of the
† HR 3462 EAS 
report required under section 3554 of title 44, United 
States Code. 
‘‘(3) RULE OF CONSTRUCTION.—Nothing in this 
subsection shall be construed to affect the reporting re-
quirements of the Administrator under chapter 35 of 
title 44, United States Code, in particular the re-
quirement to notify the Federal information security 
incident center under section 3554(b)(7)(C)(ii) of such 
title, any guidance issued by the Office of Manage-
ment and Budget, or any other provision of law or 
Federal policy. 
‘‘(4) DEFINITIONS.—In this subsection: 
‘‘(A) APPROPRIATE
CONGRESSIONAL
COM-
MITTEES.—The term ‘appropriate congressional 
committees’ means— 
‘‘(i) the Committee on Small Business 
and Entrepreneurship of the Senate; 
‘‘(ii) the Committee on Homeland Se-
curity and Governmental Affairs of the Sen-
ate; 
‘‘(iii) the Committee on Small Busi-
ness of the House of Representatives; and 
‘‘(iv) the Committee on Oversight and 
Reform of the House of Representatives.
† HR 3462 EAS 
‘‘(B) INCIDENT.—The term ‘incident’ has 
the meaning given the term in section 3552 of 
title 44, United States Code. 
‘‘(C) 
INFORMATION
TECHNOLOGY.—The 
term ‘information technology’ has the meaning 
given the term in section 3502 of title 44, United 
States Code.’’. 
(b) REPORT.—Not later than 1 year after the date of 
enactment of this Act, the Administrator of the Small Busi-
ness Administration shall, to the greatest extent practicable, 
provide to the Committee on Small Business and Entrepre-
neurship of the Senate, the Committee on Homeland Secu-
rity and Governmental Affairs of the Senate, the Committee 
on Small Business of the House of Representatives, and the 
Committee on Oversight and Reform of the House of Rep-
resentatives a detailed account of information technology 
(as defined in section 3502 of title 44, United States Code) 
of the Small Business Administration that was manufac-
tured by an entity that has its principal place of business 
located in the People’s Republic of China. 
Attest: 
Secretary.