SBA Cyber Awareness Act

Bill: 117-hr-3462
Sponsor: full_name: Rep. Crow, Jason [D-CO-6]
Introduced: 2021-05-21
Policy area: Commerce
Subjects: Asia

China

Computer security and identity theft

Congressional oversight

Government studies and investigations

Public contracts and procurement

Small Business Administration

Small business

Technology assessment
Latest action: action_date: 2022-12-21
text: Became Public Law No: 117-259.

Summaries:
action_date: 2021-05-21
action_desc: Introduced in House
text: <p><b>SBA Cyber Awareness Act</b></p> <p>This bill requires the Small Business Administration (SBA) to annually report specified information related to cybersecurity awareness.</p> <p>Such reports must provide (1) an assessment of the SBA's information technology (IT) and cybersecurity infrastructure, (2) a strategy to increase such infrastructure, (3) a detailed account of the SBA's IT equipment that is manufactured by an entity that has its principal place of business in China, and (4) any SBA cybersecurity risk or incident that occurred during the two years prior to the report (including the SBA's action to respond to or remediate it).</p>

action_date: 2021-10-12
action_desc: Reported to House
text: <p><b>SBA Cyber Awareness Act</b></p> <p>This bill requires the Small Business Administration (SBA) to annually report specified information related to cybersecurity awareness.</p> <p>Such reports must provide (1) an assessment of the SBA's information technology (IT) and cybersecurity infrastructure, (2) a strategy to increase such infrastructure, (3) a detailed account of the SBA's IT equipment that is manufactured by an entity that has its principal place of business in China, and (4) any SBA cybersecurity risk or incident that occurred during the two years prior to the report (including the SBA's action to respond to or remediate it).</p>

action_date: 2021-11-02
action_desc: Passed House
text: <p><b>SBA Cyber Awareness Act</b></p> <p>This bill requires the Small Business Administration (SBA) to annually report specified information related to cybersecurity awareness.</p> <p>Such reports must provide (1) an assessment of the SBA's information technology (IT) and cybersecurity infrastructure, (2) a strategy to increase such infrastructure, (3) a detailed account of the SBA's IT equipment that is manufactured by an entity that has its principal place of business in China, and (4) any SBA cybersecurity risk or incident that occurred during the two years prior to the report (including the SBA's action to respond to or remediate it).</p>

action_date: 2022-02-17
action_desc: Reported to Senate
text: <p><b>SBA Cyber Awareness Act</b></p> <p>This bill requires the Small Business Administration (SBA) to annually report specified information related to cybersecurity awareness.</p> <p>Such reports must provide (1) an assessment of the SBA's information technology (IT) and cybersecurity infrastructure, (2) a strategy to increase such infrastructure, (3) a detailed account of the SBA's IT equipment that is manufactured by an entity that has its principal place of business in China, and (4) any SBA cybersecurity risk or incident that occurred during the two years prior to the report (including the SBA's action to respond to or remediate it).</p>

action_date: 2022-09-28
action_desc: Passed Senate
text: <p><b>SBA Cyber Awareness Act</b></p> <p>This bill requires the Small Business Administration (SBA) to annually report specified information related to cybersecurity awareness.</p> <p>Such reports must include (1) a strategy to increase the cybersecurity of the SBA's information technology (IT) infrastructure, (2) a supply chain risk management strategy that includes risk mitigation activities for IT components originating from an entity that has its principal place of business in China, and (3) any SBA cybersecurity incident that occurred during the two years prior to the initial report (including the SBA's action to respond to or remediate it).</p>

action_date: 2022-12-05
action_desc: House agreed to Senate amendment
text: <p><b>SBA Cyber Awareness Act</b></p> <p>This bill requires the Small Business Administration (SBA) to annually report specified information related to cybersecurity awareness.</p> <p>Such reports must include (1) a strategy to increase the cybersecurity of the SBA's information technology (IT) infrastructure, (2) a supply chain risk management strategy that includes risk mitigation activities for IT components originating from an entity that has its principal place of business in China, and (3) any SBA cybersecurity incident that occurred during the two years prior to the initial report (including the SBA's action to respond to or remediate it).</p>

action_date: 2022-12-21
action_desc: Public Law
text: <p><b>SBA Cyber Awareness Act</b></p> <p>This act requires the Small Business Administration (SBA) to annually report specified information related to cybersecurity awareness.</p> <p>Such reports must include (1) a strategy to increase the cybersecurity of the SBA's information technology (IT) infrastructure, (2) a supply chain risk management strategy that includes risk mitigation activities for IT components originating from an entity that has its principal place of business in China, and (3) any SBA cybersecurity incident that occurred during the two years prior to the initial report (including the SBA's action to respond to or remediate it).</p>

tv_txt: I 117th CONGRESS 1st Session H. R. 3462 IN THE HOUSE OF REPRESENTATIVES May 21, 2021 Mr. Crow (for himself and Mrs. Kim of California ) introduced the following bill; which was referred to the Committee on Small Business A BILL To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes.

1. Short title This Act may be cited as the SBA Cyber Awareness Act . 2. Cybersecurity awareness reporting Section 10 of the Small Business Act ( 15 U.S.C. 639 ) is amended by inserting after subsection (a) the following: (b) Cybersecurity reports (1) Annual report Not later than 180 days after the date of enactment of this subsection, and every year thereafter, the Administrator shall submit a report to the appropriate congressional committees that includes— (A) an assessment of the information technology (as defined in section 11101 of title 40, United States Code) and cybersecurity infrastructure of the Administration; (B) a strategy to increase the cybersecurity infrastructure of the Administration; (C) a detailed account of any information technology equipment or interconnected system or subsystem of equipment of the Administration that was manufactured by an entity that has its principal place of business located in the People’s Republic of China; and (D) an account of any cybersecurity risk or incident that occurred at the Administration during the 2-year period preceding the date on which the report is submitted, and any action taken by the Administrator to respond to or remediate any such cybersecurity risk or incident. (2) Additional reports If the Administrator determines that there is a reasonable basis to conclude that a cybersecurity risk or incident occurred at the Administration, the Administrator shall— (A) not later than 7 days after the date on which the Administrator makes that determination, notify the appropriate congressional committees of the cybersecurity risk or incident; and (B) not later than 30 days after the date on which the Administrator makes a determination under subparagraph (A)— (i) provide notice to individuals and small business concerns affected by the cybersecurity risk or incident; and (ii) submit to the appropriate congressional committees a report, based on information available to the Administrator as of the date which the Administrator submits the report, that includes— (I) a summary of information about the cybersecurity risk or incident, including how the cybersecurity risk or incident occurred; and (II) an estimate of the number of individuals and small business concerns affected by the cybersecurity risk or incident, including an assessment of the risk of harm to affected individuals and small business concerns. (3) Rule of construction Nothing in this subsection shall be construed to affect the reporting requirements of the Administrator under chapter 35 of title 44, United States Code, in particular the requirement to notify the Federal information security incident center under section 3554(b)(7)(C)(ii) of such title, or any other provision of law. (4) Definitions In this subsection: (A) Appropriate congressional committees The term appropriate congressional committees means— (i) the Committee on Small Business and Entrepreneurship of the Senate; and (ii) the Committee on Small Business of the House of Representatives. (B) Cybersecurity risk; incident The terms cybersecurity risk and incident have the meanings given such terms, respectively, under section 2209(a) of the Homeland Security Act of 2002. .

tv_txt: IB Union Calendar No. 98 117th CONGRESS 1st Session H. R. 3462 [Report No. 117–138] IN THE HOUSE OF REPRESENTATIVES May 21, 2021 Mr. Crow (for himself and Mrs. Kim of California ) introduced the following bill; which was referred to the Committee on Small Business October 12, 2021 Reported from the Committee on Small Business ; committed to the Committee of the Whole House on the State of the Union and ordered to be printed A BILL To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes.

1. Short title This Act may be cited as the SBA Cyber Awareness Act . 2. Cybersecurity awareness reporting Section 10 of the Small Business Act ( 15 U.S.C. 639 ) is amended by inserting after subsection (a) the following: (b) Cybersecurity reports (1) Annual report Not later than 180 days after the date of enactment of this subsection, and every year thereafter, the Administrator shall submit a report to the appropriate congressional committees that includes— (A) an assessment of the information technology (as defined in section 11101 of title 40, United States Code) and cybersecurity infrastructure of the Administration; (B) a strategy to increase the cybersecurity infrastructure of the Administration; (C) a detailed account of any information technology equipment or interconnected system or subsystem of equipment of the Administration that was manufactured by an entity that has its principal place of business located in the People’s Republic of China; and (D) an account of any cybersecurity risk or incident that occurred at the Administration during the 2-year period preceding the date on which the report is submitted, and any action taken by the Administrator to respond to or remediate any such cybersecurity risk or incident. (2) Additional reports If the Administrator determines that there is a reasonable basis to conclude that a cybersecurity risk or incident occurred at the Administration, the Administrator shall— (A) not later than 7 days after the date on which the Administrator makes that determination, notify the appropriate congressional committees of the cybersecurity risk or incident; and (B) not later than 30 days after the date on which the Administrator makes a determination under subparagraph (A)— (i) provide notice to individuals and small business concerns affected by the cybersecurity risk or incident; and (ii) submit to the appropriate congressional committees a report, based on information available to the Administrator as of the date which the Administrator submits the report, that includes— (I) a summary of information about the cybersecurity risk or incident, including how the cybersecurity risk or incident occurred; and (II) an estimate of the number of individuals and small business concerns affected by the cybersecurity risk or incident, including an assessment of the risk of harm to affected individuals and small business concerns. (3) Rule of construction Nothing in this subsection shall be construed to affect the reporting requirements of the Administrator under chapter 35 of title 44, United States Code, in particular the requirement to notify the Federal information security incident center under section 3554(b)(7)(C)(ii) of such title, or any other provision of law. (4) Definitions In this subsection: (A) Appropriate congressional committees The term appropriate congressional committees means— (i) the Committee on Small Business and Entrepreneurship of the Senate; and (ii) the Committee on Small Business of the House of Representatives. (B) Cybersecurity risk; incident The terms cybersecurity risk and incident have the meanings given such terms, respectively, under section 2209(a) of the Homeland Security Act of 2002. .

October 12, 2021 Committed to the Committee of the Whole House on the State of the Union and ordered to be printed

tv_txt: IIB 117th CONGRESS 1st Session H. R. 3462 IN THE SENATE OF THE UNITED STATES November 3, 2021 Received; read twice and referred to the Committee on Small Business and Entrepreneurship AN ACT To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes.

1. Short title This Act may be cited as the SBA Cyber Awareness Act . 2. Cybersecurity awareness reporting Section 10 of the Small Business Act ( 15 U.S.C. 639 ) is amended by inserting after subsection (a) the following: (b) Cybersecurity reports (1) Annual report Not later than 180 days after the date of enactment of this subsection, and every year thereafter, the Administrator shall submit a report to the appropriate congressional committees that includes— (A) an assessment of the information technology (as defined in section 11101 of title 40, United States Code) and cybersecurity infrastructure of the Administration; (B) a strategy to increase the cybersecurity infrastructure of the Administration; (C) a detailed account of any information technology equipment or interconnected system or subsystem of equipment of the Administration that was manufactured by an entity that has its principal place of business located in the People’s Republic of China; and (D) an account of any cybersecurity risk or incident that occurred at the Administration during the 2-year period preceding the date on which the report is submitted, and any action taken by the Administrator to respond to or remediate any such cybersecurity risk or incident. (2) Additional reports If the Administrator determines that there is a reasonable basis to conclude that a cybersecurity risk or incident occurred at the Administration, the Administrator shall— (A) not later than 7 days after the date on which the Administrator makes that determination, notify the appropriate congressional committees of the cybersecurity risk or incident; and (B) not later than 30 days after the date on which the Administrator makes a determination under subparagraph (A)— (i) provide notice to individuals and small business concerns affected by the cybersecurity risk or incident; and (ii) submit to the appropriate congressional committees a report, based on information available to the Administrator as of the date which the Administrator submits the report, that includes— (I) a summary of information about the cybersecurity risk or incident, including how the cybersecurity risk or incident occurred; and (II) an estimate of the number of individuals and small business concerns affected by the cybersecurity risk or incident, including an assessment of the risk of harm to affected individuals and small business concerns. (3) Rule of construction Nothing in this subsection shall be construed to affect the reporting requirements of the Administrator under chapter 35 of title 44, United States Code, in particular the requirement to notify the Federal information security incident center under section 3554(b)(7)(C)(ii) of such title, or any other provision of law. (4) Definitions In this subsection: (A) Appropriate congressional committees The term appropriate congressional committees means— (i) the Committee on Small Business and Entrepreneurship of the Senate; and (ii) the Committee on Small Business of the House of Representatives. (B) Cybersecurity risk; incident The terms cybersecurity risk and incident have the meanings given such terms, respectively, under section 2209(a) of the Homeland Security Act of 2002. .

Passed the House of Representatives November 2, 2021. Cheryl L. Johnson, Clerk

tv_txt: IB 117th CONGRESS 1st Session H. R. 3462 IN THE HOUSE OF REPRESENTATIVES AN ACT To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes.

1. Short title This Act may be cited as the SBA Cyber Awareness Act . 2. Cybersecurity awareness reporting Section 10 of the Small Business Act ( 15 U.S.C. 639 ) is amended by inserting after subsection (a) the following: (b) Cybersecurity reports (1) Annual report Not later than 180 days after the date of enactment of this subsection, and every year thereafter, the Administrator shall submit a report to the appropriate congressional committees that includes— (A) an assessment of the information technology (as defined in section 11101 of title 40, United States Code) and cybersecurity infrastructure of the Administration; (B) a strategy to increase the cybersecurity infrastructure of the Administration; (C) a detailed account of any information technology equipment or interconnected system or subsystem of equipment of the Administration that was manufactured by an entity that has its principal place of business located in the People’s Republic of China; and (D) an account of any cybersecurity risk or incident that occurred at the Administration during the 2-year period preceding the date on which the report is submitted, and any action taken by the Administrator to respond to or remediate any such cybersecurity risk or incident. (2) Additional reports If the Administrator determines that there is a reasonable basis to conclude that a cybersecurity risk or incident occurred at the Administration, the Administrator shall— (A) not later than 7 days after the date on which the Administrator makes that determination, notify the appropriate congressional committees of the cybersecurity risk or incident; and (B) not later than 30 days after the date on which the Administrator makes a determination under subparagraph (A)— (i) provide notice to individuals and small business concerns affected by the cybersecurity risk or incident; and (ii) submit to the appropriate congressional committees a report, based on information available to the Administrator as of the date which the Administrator submits the report, that includes— (I) a summary of information about the cybersecurity risk or incident, including how the cybersecurity risk or incident occurred; and (II) an estimate of the number of individuals and small business concerns affected by the cybersecurity risk or incident, including an assessment of the risk of harm to affected individuals and small business concerns. (3) Rule of construction Nothing in this subsection shall be construed to affect the reporting requirements of the Administrator under chapter 35 of title 44, United States Code, in particular the requirement to notify the Federal information security incident center under section 3554(b)(7)(C)(ii) of such title, or any other provision of law. (4) Definitions In this subsection: (A) Appropriate congressional committees The term appropriate congressional committees means— (i) the Committee on Small Business and Entrepreneurship of the Senate; and (ii) the Committee on Small Business of the House of Representatives. (B) Cybersecurity risk; incident The terms cybersecurity risk and incident have the meanings given such terms, respectively, under section 2209(a) of the Homeland Security Act of 2002. .

Passed the House of Representatives November 2, 2021. Cheryl L. Johnson, Clerk.

tv_txt: II Calendar No. 281 117th CONGRESS 2d Session H. R. 3462 IN THE SENATE OF THE UNITED STATES November 3, 2021 Received; read twice and referred to the Committee on Small Business and Entrepreneurship February 17, 2022 Reported by Mr. Cardin , without amendment AN ACT To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes.

1. Short title This Act may be cited as the SBA Cyber Awareness Act . 2. Cybersecurity awareness reporting Section 10 of the Small Business Act ( 15 U.S.C. 639 ) is amended by inserting after subsection (a) the following: (b) Cybersecurity reports (1) Annual report Not later than 180 days after the date of enactment of this subsection, and every year thereafter, the Administrator shall submit a report to the appropriate congressional committees that includes— (A) an assessment of the information technology (as defined in section 11101 of title 40, United States Code) and cybersecurity infrastructure of the Administration; (B) a strategy to increase the cybersecurity infrastructure of the Administration; (C) a detailed account of any information technology equipment or interconnected system or subsystem of equipment of the Administration that was manufactured by an entity that has its principal place of business located in the People’s Republic of China; and (D) an account of any cybersecurity risk or incident that occurred at the Administration during the 2-year period preceding the date on which the report is submitted, and any action taken by the Administrator to respond to or remediate any such cybersecurity risk or incident. (2) Additional reports If the Administrator determines that there is a reasonable basis to conclude that a cybersecurity risk or incident occurred at the Administration, the Administrator shall— (A) not later than 7 days after the date on which the Administrator makes that determination, notify the appropriate congressional committees of the cybersecurity risk or incident; and (B) not later than 30 days after the date on which the Administrator makes a determination under subparagraph (A)— (i) provide notice to individuals and small business concerns affected by the cybersecurity risk or incident; and (ii) submit to the appropriate congressional committees a report, based on information available to the Administrator as of the date which the Administrator submits the report, that includes— (I) a summary of information about the cybersecurity risk or incident, including how the cybersecurity risk or incident occurred; and (II) an estimate of the number of individuals and small business concerns affected by the cybersecurity risk or incident, including an assessment of the risk of harm to affected individuals and small business concerns. (3) Rule of construction Nothing in this subsection shall be construed to affect the reporting requirements of the Administrator under chapter 35 of title 44, United States Code, in particular the requirement to notify the Federal information security incident center under section 3554(b)(7)(C)(ii) of such title, or any other provision of law. (4) Definitions In this subsection: (A) Appropriate congressional committees The term appropriate congressional committees means— (i) the Committee on Small Business and Entrepreneurship of the Senate; and (ii) the Committee on Small Business of the House of Representatives. (B) Cybersecurity risk; incident The terms cybersecurity risk and incident have the meanings given such terms, respectively, under section 2209(a) of the Homeland Security Act of 2002. .

February 17, 2022 Reported without amendment

tv_txt: 117th CONGRESS 2d Session H.R. 3462 In the Senate of the United States, September 28, 2022. Amendment:

That the bill from the House of Representatives (H.R. 3462) entitled An Act to require an annual report on the cybersecurity of the Small Business Administration, and for other purposes. , do pass with the following Strike out all after the enacting clause and insert: 1. Short title This Act may be cited as the SBA Cyber Awareness Act . 2. Cybersecurity awareness reporting (a) In general Section 10 of the Small Business Act ( 15 U.S.C. 639 ) is amended by inserting after subsection (a) the following: (b) Cybersecurity reports (1) Annual report Not later than 180 days after the date of enactment of this subsection, and every year thereafter, the Administrator shall submit a report to the appropriate congressional committees that includes— (A) a strategy to increase the cybersecurity of information technology infrastructure of the Administration; (B) a supply chain risk management strategy and an implementation plan to address the risks of foreign manufactured information technology equipment utilized by the Administration, including specific risk mitigation activities for components originating from entities with principal places of business located in the People’s Republic of China; and (C) an account of— (i) any incident that occurred at the Administration during the 2-year period preceding the date on which the first report is submitted, and, for subsequent reports, the 1-year period preceding the date of submission; and (ii) any action taken by the Administrator to respond to or remediate any such incident. (2) FISMA reports Each report required under paragraph (1) may be submitted as part of the report required under section 3554 of title 44, United States Code. (3) Rule of construction Nothing in this subsection shall be construed to affect the reporting requirements of the Administrator under chapter 35 of title 44, United States Code, in particular the requirement to notify the Federal information security incident center under section 3554(b)(7)(C)(ii) of such title, any guidance issued by the Office of Management and Budget, or any other provision of law or Federal policy. (4) Definitions In this subsection: (A) Appropriate congressional committees The term appropriate congressional committees means— (i) the Committee on Small Business and Entrepreneurship of the Senate; (ii) the Committee on Homeland Security and Governmental Affairs of the Senate; (iii) the Committee on Small Business of the House of Representatives; and (iv) the Committee on Oversight and Reform of the House of Representatives. (B) Incident The term incident has the meaning given the term in section 3552 of title 44, United States Code. (C) Information technology The term information technology has the meaning given the term in section 3502 of title 44, United States Code. . (b) Report Not later than 1 year after the date of enactment of this Act, the Administrator of the Small Business Administration shall, to the greatest extent practicable, provide to the Committee on Small Business and Entrepreneurship of the Senate, the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Small Business of the House of Representatives, and the Committee on Oversight and Reform of the House of Representatives a detailed account of information technology (as defined in section 3502 of title 44, United States Code) of the Small Business Administration that was manufactured by an entity that has its principal place of business located in the People’s Republic of China.

Secretary

tv_txt: IB One Hundred Seventeenth Congress of the United States of America At the Second Session Begun and held at the City of Washington on Monday, the third day of January, two thousand and twenty-two H. R. 3462 AN ACT To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes.

1. Short title This Act may be cited as the SBA Cyber Awareness Act . 2. Cybersecurity awareness reporting (a) In general Section 10 of the Small Business Act ( 15 U.S.C. 639 ) is amended by inserting after subsection (a) the following: (b) Cybersecurity reports (1) Annual report Not later than 180 days after the date of enactment of this subsection, and every year thereafter, the Administrator shall submit a report to the appropriate congressional committees that includes— (A) a strategy to increase the cybersecurity of information technology infrastructure of the Administration; (B) a supply chain risk management strategy and an implementation plan to address the risks of foreign manufactured information technology equipment utilized by the Administration, including specific risk mitigation activities for components originating from entities with principal places of business located in the People’s Republic of China; and (C) an account of— (i) any incident that occurred at the Administration during the 2-year period preceding the date on which the first report is submitted, and, for subsequent reports, the 1-year period preceding the date of submission; and (ii) any action taken by the Administrator to respond to or remediate any such incident. (2) FISMA reports Each report required under paragraph (1) may be submitted as part of the report required under section 3554 of title 44, United States Code. (3) Rule of construction Nothing in this subsection shall be construed to affect the reporting requirements of the Administrator under chapter 35 of title 44, United States Code, in particular the requirement to notify the Federal information security incident center under section 3554(b)(7)(C)(ii) of such title, any guidance issued by the Office of Management and Budget, or any other provision of law or Federal policy. (4) Definitions In this subsection: (A) Appropriate congressional committees The term appropriate congressional committees means— (i) the Committee on Small Business and Entrepreneurship of the Senate; (ii) the Committee on Homeland Security and Governmental Affairs of the Senate; (iii) the Committee on Small Business of the House of Representatives; and (iv) the Committee on Oversight and Reform of the House of Representatives. (B) Incident The term incident has the meaning given the term in section 3552 of title 44, United States Code. (C) Information technology The term information technology has the meaning given the term in section 3502 of title 44, United States Code. . (b) Report Not later than 1 year after the date of enactment of this Act, the Administrator of the Small Business Administration shall, to the greatest extent practicable, provide to the Committee on Small Business and Entrepreneurship of the Senate, the Committee on Homeland Security and Governmental Affairs of the Senate, the Committee on Small Business of the House of Representatives, and the Committee on Oversight and Reform of the House of Representatives a detailed account of information technology (as defined in section 3502 of title 44, United States Code) of the Small Business Administration that was manufactured by an entity that has its principal place of business located in the People’s Republic of China.

Speaker of the House of Representatives. Vice President of the United States and President of the Senate.