SBA Cyber Awareness Act

II 117TH CONGRESS 1ST SESSION S. 1691 To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes. IN THE SENATE OF THE UNITED STATES MAY 18, 2021 Mr. RUBIO (for himself, Mr. RISCH, and Mr. CASSIDY) introduced the fol- lowing bill; which was read twice and referred to the Committee on Small Business and Entrepreneurship A BILL To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘SBA Cyber Awareness 4 Act’’. 5 SEC. 2. CYBERSECURITY AWARENESS REPORTING. 6 Section 10 of the Small Business Act (15 U.S.C. 639) 7 is amended by striking subsection (b) and inserting the 8 following: 9 ‘‘(b) CYBERSECURITY REPORTS.— 10 VerDate Sep 11 2014 02:23 May 28, 2021 Jkt 019200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1691.IS S1691 kjohnson on DSK79L0C42PROD with BILLS 2 •S 1691 IS ‘‘(1) DEFINITION.—In this subsection, the term 1 ‘appropriate congressional committees’ means— 2 ‘‘(A) the Committee on Small Business 3 and Entrepreneurship of the Senate; and 4 ‘‘(B) the Committee on Small Business of 5 the House of Representatives. 6 ‘‘(2) ANNUAL REPORT.—Not later than 180 7 days after the date of enactment of the SBA Cyber 8 Awareness Act, and every year thereafter, the Ad- 9 ministration shall submit a report to the appropriate 10 congressional committees that includes— 11 ‘‘(A) an assessment of the information 12 technology and cybersecurity of the Administra- 13 tion; 14 ‘‘(B) a strategy to increase the cybersecu- 15 rity of the Administration; 16 ‘‘(C) a detailed account of any information 17 technology component or system of the Admin- 18 istration that was manufactured by a company 19 located in the People’s Republic of China; and 20 ‘‘(D) an account of any cyber threat, 21 breach, or cyber attack that occurred at the Ad- 22 ministration during the 2-year period preceding 23 the date on which the report is submitted, and 24 any action taken by the Administration to re- 25 VerDate Sep 11 2014 02:23 May 28, 2021 Jkt 019200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1691.IS S1691 kjohnson on DSK79L0C42PROD with BILLS 3 •S 1691 IS spond to or remediate the cyber threat, breach, 1 or cyber attack. 2 ‘‘(3) ADDITIONAL REPORTS.—If the Adminis- 3 tration determines that there is a reasonable basis to 4 conclude that a cyber threat, breach, or cyber attack 5 occurred at the Administration, the Administration 6 shall— 7 ‘‘(A) not later than 7 days after the date 8 on which the Administration makes that deter- 9 mination, notify the appropriate congressional 10 committees of the cyber threat, breach, or cyber 11 attack; and 12 ‘‘(B) not later than 30 days after the date 13 on which the Administration makes that deter- 14 mination, submit to the appropriate congres- 15 sional committees a report that includes— 16 ‘‘(i) a summary of information about 17 the cyber threat, breach, or cyber attack, 18 including how the cyber threat, breach, or 19 cyber attack occurred, based on informa- 20 tion available to the Administration as of 21 the date which the Administration submits 22 the report; 23 ‘‘(ii) an estimate of the number of in- 24 dividuals and small entities affected by the 25 VerDate Sep 11 2014 02:23 May 28, 2021 Jkt 019200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1691.IS S1691 kjohnson on DSK79L0C42PROD with BILLS 4 •S 1691 IS cyber threat, breach, or cyber attack, in- 1 cluding an assessment of the risk of harm 2 to affected individuals and small entities 3 based on information available to the Ad- 4 ministration as of the date on which the 5 Administration submits the report; and 6 ‘‘(iii) an estimate of when the Admin- 7 istration will provide notice to affected in- 8 dividuals and small entities. 9 ‘‘(4) RULE OF CONSTRUCTION.—Nothing in 10 this subsection shall be construed to affect the re- 11 porting requirements of the Administration under 12 chapter 35 of title 44 United States Code, in par- 13 ticular the requirement to notify the Federal infor- 14 mation security incident center under section 15 3554(b)(7)(C)(ii) of such title, or any other provi- 16 sion of law.’’. 17 Æ VerDate Sep 11 2014 02:23 May 28, 2021 Jkt 019200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\S1691.IS S1691 kjohnson on DSK79L0C42PROD with BILLS