IB 
Union Calendar No. 181 
119TH CONGRESS 
1ST SESSION H. R. 4491 
[Report No. 119–223] 
To require the Administrator of the Small Business Administration to imple-
ment certain recommendations relating to information technology mod-
ernization, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
JULY 17, 2025 
Mr. CISNEROS (for himself and Mr. JACK) introduced the following bill; which 
was referred to the Committee on Small Business 
AUGUST 15, 2025 
Committed to the Committee of the Whole House on the State of the Union 
and ordered to be printed 
VerDate Sep 11 2014 
21:25 Aug 15, 2025
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H4491.RH
H4491
kjohnson on DSK7ZCZBW3PROD with $$_JOB
A BILL 
To require the Administrator of the Small Business Adminis-
tration to implement certain recommendations relating 
to information technology modernization, and for other 
purposes. 
VerDate Sep 11 2014 
21:25 Aug 15, 2025
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H4491.RH
H4491
kjohnson on DSK7ZCZBW3PROD with $$_JOB
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘SBA IT Modernization 
Reporting Act’’. 
SEC. 2. IMPLEMENTATION OF RECOMMENDATIONS RELAT-
ING TO INFORMATION TECHNOLOGY MOD-
ERNIZATION FOR THE SMALL BUSINESS AD-
MINISTRATION. 
(a) IN GENERAL.—The Administrator of the Small 
Business Administration, acting through the Chief Infor-
mation Officer of the Administration, shall take such ac-
tions as may be necessary to implement the recommenda-
tions contained in the report of the Comptroller General 
of the United States titled ‘‘IT MODERNIZATION: SBA 
Urgently Needs to Address Risks on Newly Deployed Sys-
tem’’ (GAO–25–106963; published November 6, 2024). 
(b) IMPLEMENTATION PLAN.—Not later than 180 
days after the date of the enactment of this Act, the Ad-
ministrator shall submit to the Committee on Small Busi-
ness of the House of Representatives and the Committee 
on Small Business and Entrepreneurship of the Senate an 
implementation plan detailing the actions the Small Busi-
ness Administration will undertake to establish and imple-
ment policies and procedures to govern information tech-
VerDate Sep 11 2014 
21:25 Aug 15, 2025
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4491.RH
H4491
kjohnson on DSK7ZCZBW3PROD with $$_JOB
nology modernization projects of the Administration. Such 
policies and procedures shall, with respect to each 
project— 
(1) for each risk identified, explicitly state the 
source of such risk in the relevant risk documenta-
tion; 
(2) clearly define risk parameters; 
(3) establish and maintain risk management 
strategies; 
(4) identify and document risks for all phases 
of the life cycle; 
(5) evaluate, categorize, and prioritize risks 
based on defined risk parameters and develop 
project risk management plans; 
(6) connect measures to mitigate risk to risk 
mitigation plans; 
(7) require that any information technology ac-
quisition plan and any strategic plan contains infor-
mation needed to manage cyber risks; 
(8) require that a traceability analysis is per-
formed and documented; 
(9) require that security-related subject matter 
experts are involved in selection process for contrac-
tors for a project; 
VerDate Sep 11 2014 
21:25 Aug 15, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4491.RH
H4491
kjohnson on DSK7ZCZBW3PROD with $$_JOB
(10) develop master schedules using the guide-
lines contained in the publication of the Comptroller 
General titled ‘‘GAO Schedule Assessment Guide: 
Best Practices for Project Schedules’’ (GAO–16– 
89G; published December 22, 2015); and 
(11) develop cost estimates using the guidelines 
contained in the publication of the Comptroller Gen-
eral titled ‘‘Cost Estimating and Assessment Guide: 
Best Practices for Developing and Managing Pro-
gram Costs’’ (GAO–20–195G; published March 12, 
2020). 
(c) ADDITIONAL REQUIREMENTS.—The implementa-
tion plan required by this section shall include the actions 
required to carry out the requirements listed in para-
graphs (1) through (11) of subsection (b), an identifica-
tion of the office of the Administration responsible for im-
plementation, and the timelines for completion of each ac-
tion. 
(d) BRIEFING REQUIRED.—Not later than 30 days 
after the submission of the implementation plan required 
under this section, the Administrator shall provide to the 
Committee on Small Business of the House of Representa-
tives and the Committee on Small Business and Entrepre-
neurship of the Senate a briefing on the plan. 
VerDate Sep 11 2014 
21:25 Aug 15, 2025
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4491.RH
H4491
kjohnson on DSK7ZCZBW3PROD with $$_JOB
Union Calendar No. 181 
119TH CONGRESS 
1ST SESSION 
H. R. 4491 
[Report No. 119–223] 
A BILL 
To require the Administrator of the Small Business 
Administration 
to 
implement 
certain 
rec-
ommendations relating to information technology 
modernization, and for other purposes. 
AUGUST 15, 2025 
Committed to the Committee of the Whole House on the 
State of the Union and ordered to be printed 
VerDate Sep 11 2014 
21:25 Aug 15, 2025
Jkt 059200
PO 00000
Frm 00006
Fmt 6651
Sfmt 6651
E:\BILLS\H4491.RH
H4491
kjohnson on DSK7ZCZBW3PROD with $$_JOB