,,ib  ,union ,calendar ,no4 #hc  #aafth 
,,congress  #ast ,session  ,h4 ,r4 #bcca
  ,report ,no4 #aaf-aad  ,,in ,,the     
,,house ,,of ,,representatives  ,april  
#ah1 #bjai ,mr4 ,crow 7for himself1 ,mr4
 ,balderson1 ,ms4 ,velzquez1 and ,mr4   
,chabot7 introduced the following bill2 
which was referred to the ,committee on 
,small ,business  ,june #ac1 #bjai      
,additional sponsors3 ,mr4 ,fitzpatrick1
 ,ms4 ,houlahan1 ,mr4 ,burchett1 and    
,mrs4 ,craig  ,june #ac1 #bjai          
,committed to the ,committee of the     
,whole ,house on the ,state of the      
,union and ordered to be printed  ,a    
,,bill  ,to require an annual report on 
the cybersecurity of the ,small         
,business ,administration1 and for other
 purposes4  #a4 ,short title ,this ,act 
may be cited as the ,,sba ,cyber        
,awareness ,act4  #b4 ,cybersecurity    
awareness reporting ,section #aj of the 
,small ,business ,act 7#ae ,u4,s4,c4    
#fci7 is amended by inserting after     
subsection 7a7 the following3  7b7      

,cybersecurity reports  7#a7 ,annual    
report ,not later than #ahj days after  
the date of enactment of this           
subsection1 and every year thereafter1  
the ,administrator shall submit a report
 to the appropriate congressional       
committees that includes--  7,a7 an     
assessment of the information technology
 7as defined in section #aaaja of title 
#dj1 ,united ,states ,code7 and         
cybersecurity infrastructure of the     
,administration2  7,b7 a strategy to    
increase the cybersecurity              
infrastructure of the ,administration2  
7,c7 a detailed account of any          
information technology equipment or     
interconnected system or subsystem of   
equipment of the ,administration that   
was manufactured by an entity that has  
its principal place of business located 
in the ,people's ,republic of ,china2   
and  7,d7 an account of any             
cybersecurity risk or incident that     
occurred at the ,administration during  
the #b-year period preceding the date on

 which the report is submitted1 and any 
action taken by the ,administrator to   
respond to or remediate any such        
cybersecurity risk or incident4  7#b7   
,additional reports ,if the             
,administrator determines that there is 
a reasonable basis to conclude that a   
cybersecurity risk or incident occurred 
at the ,administration1 the             
,administrator shall--  7,a7 not later  
than #g days after the date on which the
 ,administrator makes that              
determination1 notify the appropriate   
congressional committees of the         
cybersecurity risk or incident2 and     
7,b7 not later than #cj days after the  
date on which the ,administrator makes a
 determination under subparagraph 7,a7--
  7i7 provide notice to individuals and 
small business concerns affected by the 
cybersecurity risk or incident2 and     
7ii7 submit to the appropriate          
congressional committees a report1 based
 on information available to the        
,administrator as of the date which the 

,administrator submits the report1 that 
includes--  7,i7 a summary of           
information about the cybersecurity risk
 or incident1 including how the         
cybersecurity risk or incident occurred2
 and  7,,ii7 an estimate of the number  
of individuals and small business       
concerns affected by the cybersecurity  
risk or incident1 including an          
assessment of the risk of harm to       
affected individuals and small business 
concerns4  7#c7 ,rule of construction   
,nothing in this subsection shall be    
construed to affect the reporting       
requirements of the ,administrator under
 chapter #ce of title #dd1 ,united      
,states ,code1 in particular the        
requirement to notify the ,federal      
information security incident center    
under section #ceed7;b77#g77;,c77ii7 of 
such title1 or any other provision of   
law4  7#d7 ,definitions ,in this        
subsection3 7,a7 ,appropriate           
congressional committees ,the term      
appropriate congressional committees    

means--  7i7 the ,committee on ,small   
,business and ,entrepreneurship of the  
,senate2 and  7ii7 the ,committee on    
,small ,business of the ,house of       
,representatives4  7,b7 ,cybersecurity  
risk2 incident ,the terms cybersecurity 
risk and incident have the meanings     
given such terms1 respectively1 under   
section #bbji7;a7 of the ,homeland      
,security ,act of #bjjb4  4  ,june #ac1 
#bjai ,committed to the ,committee of   
the ,whole ,house on the ,state of the  
,union and ordered to be printed