IB 
Union Calendar No. 98 
117TH CONGRESS 
1ST SESSION H. R. 3462 
[Report No. 117–138] 
To require an annual report on the cybersecurity of the Small Business 
Administration, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MAY 21, 2021 
Mr. CROW (for himself and Mrs. KIM of California) introduced the following 
bill; which was referred to the Committee on Small Business 
OCTOBER 12, 2021 
Reported from the Committee on Small Business; committed to the Committee 
of the Whole House on the State of the Union and ordered to be printed 
VerDate Sep 11 2014 
00:50 Oct 13, 2021
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6652
E:\BILLS\H3462.RH
H3462
pbinns on DSKJLVW7X2PROD with BILLS
A BILL 
To require an annual report on the cybersecurity of the 
Small Business Administration, and for other purposes. 
VerDate Sep 11 2014 
00:50 Oct 13, 2021
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6652
E:\BILLS\H3462.RH
H3462
pbinns on DSKJLVW7X2PROD with BILLS
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘SBA Cyber Awareness 
Act’’. 
SEC. 2. CYBERSECURITY AWARENESS REPORTING. 
Section 10 of the Small Business Act (15 U.S.C. 639) 
is amended by inserting after subsection (a) the following: 
‘‘(b) CYBERSECURITY REPORTS.— 
‘‘(1) ANNUAL
REPORT.—Not later than 180 
days after the date of enactment of this subsection, 
and every year thereafter, the Administrator shall 
submit a report to the appropriate congressional 
committees that includes— 
‘‘(A) an assessment of the information 
technology (as defined in section 11101 of title 
40, United States Code) and cybersecurity in-
frastructure of the Administration; 
‘‘(B) a strategy to increase the cybersecu-
rity infrastructure of the Administration; 
‘‘(C) a detailed account of any information 
technology equipment or interconnected system 
or subsystem of equipment of the Administra-
tion that was manufactured by an entity that 
VerDate Sep 11 2014 
00:50 Oct 13, 2021
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H3462.RH
H3462
pbinns on DSKJLVW7X2PROD with BILLS
has its principal place of business located in the 
People’s Republic of China; and 
‘‘(D) an account of any cybersecurity risk 
or incident that occurred at the Administration 
during the 2-year period preceding the date on 
which the report is submitted, and any action 
taken by the Administrator to respond to or re-
mediate any such cybersecurity risk or incident. 
‘‘(2) ADDITIONAL REPORTS.—If the Adminis-
trator determines that there is a reasonable basis to 
conclude that a cybersecurity risk or incident oc-
curred at the Administration, the Administrator 
shall— 
‘‘(A) not later than 7 days after the date 
on which the Administrator makes that deter-
mination, notify the appropriate congressional 
committees of the cybersecurity risk or incident; 
and 
‘‘(B) not later than 30 days after the date 
on which the Administrator makes a determina-
tion under subparagraph (A)— 
‘‘(i) provide notice to individuals and 
small business concerns affected by the cy-
bersecurity risk or incident; and 
VerDate Sep 11 2014 
00:50 Oct 13, 2021
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H3462.RH
H3462
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(ii) submit to the appropriate con-
gressional committees a report, based on 
information available to the Administrator 
as of the date which the Administrator 
submits the report, that includes— 
‘‘(I) a summary of information 
about the cybersecurity risk or inci-
dent, including how the cybersecurity 
risk or incident occurred; and 
‘‘(II) an estimate of the number 
of individuals and small business con-
cerns affected by the cybersecurity 
risk or incident, including an assess-
ment of the risk of harm to affected 
individuals and small business con-
cerns. 
‘‘(3) RULE
OF
CONSTRUCTION.—Nothing in 
this subsection shall be construed to affect the re-
porting requirements of the Administrator under 
chapter 35 of title 44, United States Code, in par-
ticular the requirement to notify the Federal infor-
mation security incident center under section 
3554(b)(7)(C)(ii) of such title, or any other provi-
sion of law. 
‘‘(4) DEFINITIONS.—In this subsection: 
VerDate Sep 11 2014 
00:50 Oct 13, 2021
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H3462.RH
H3462
pbinns on DSKJLVW7X2PROD with BILLS
‘‘(A) APPROPRIATE CONGRESSIONAL COM-
MITTEES.—The term ‘appropriate congressional 
committees’ means— 
‘‘(i) the Committee on Small Business 
and Entrepreneurship of the Senate; and 
‘‘(ii) the Committee on Small Busi-
ness of the House of Representatives. 
‘‘(B) CYBERSECURITY RISK; INCIDENT.— 
The terms ‘cybersecurity risk’ and ‘incident’ 
have the meanings given such terms, respec-
tively, under section 2209(a) of the Homeland 
Security Act of 2002.’’. 
VerDate Sep 11 2014 
00:50 Oct 13, 2021
Jkt 029200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H3462.RH
H3462
pbinns on DSKJLVW7X2PROD with BILLS
Union Calendar No. 98 
117TH CONGRESS 
1ST SESSION 
H. R. 3462 
[Report No. 117–138] 
A BILL 
To require an annual report on the cybersecurity of 
the Small Business Administration, and for other 
purposes. 
OCTOBER 12, 2021 
Committed to the Committee of the Whole House on the 
State of the Union and ordered to be printed 
VerDate Sep 11 2014 
00:50 Oct 13, 2021
Jkt 029200
PO 00000
Frm 00008
Fmt 6651
Sfmt 6651
E:\BILLS\H3462.RH
H3462
pbinns on DSKJLVW7X2PROD with BILLS