,,ii  #aafth ,,congress  #ast ,session  
,s4 #ggb  ,,in ,,the ,,senate ,,of ,,the
 ,,united ,,states  ,march #ac1 #bjai   
,mr4 ,rubio 7for himself and ,mr4       
,cardin7 introduced the following bill2 
which was read twice and referred to the
 ,committee on ,small ,business and     
,entrepreneurship  ,a ,,bill  ,to       
require an annual report on the         
cybersecurity of the ,small ,business   
,administration1 and for other purposes4
  #a4 ,short title  ,this ,act may be   
cited as the ,,sba ,cyber ,awareness    
,act4  #b4 ,cybersecurity awareness     
reporting ,section #aj of the ,small    
,business ,act 7#ae ,u4,s4,c4 #fci7 is  
amended by striking subsection 7b7 and  
inserting the following3  7b7           
,cybersecurity reports  7#a7 ,definition
 ,in this subsection1 the term          
appropriate congressional committees    
means-- 7,a7 the ,committee on ,small   
,business and ,entrepreneurship of the  
,senate2 and  7,b7 the ,committee on    
,small ,business of the ,house of       

,representatives4  7#b7 ,annual report  
,not later than #ahj days after the date
 of enactment of the ,,sba ,cyber       
,awareness ,act1 and every year         
thereafter1 the ,administration shall   
submit a report to the appropriate      
congressional committees that includes--
  7,a7 an assessment of the information 
technology and cybersecurity of the     
,administration2  7,b7 a strategy to    
increase the cybersecurity of the       
,administration2  7,c7 a detailed       
account of any information technology   
component or system of the              
,administration that was manufactured by
 a company located in the ,people's     
,republic of ,china2 and  7,d7 an       
account of any cyber threat1 breach1 or 
cyber attack that occurred at the       
,administration during the #b-year      
period preceding the date on which the  
report is submitted1 and any action     
taken by the ,administration to respond 
to or remediate the cyber threat1       
breach1 or cyber attack4  7#c7          

,additional reports ,if the             
,administration determines that there is
 a reasonable basis to conclude that a  
cyber threat1 breach1 or cyber attack   
occurred at the ,administration1 the    
,administration shall--  7,a7 not later 
than #g days after the date on which the
 ,administration makes that             
determination1 notify the appropriate   
congressional committees of the cyber   
threat1 breach1 or cyber attack2 and    
7,b7 not later than #cj days after the  
date on which the ,administration makes 
that determination1 submit to the       
appropriate congressional committees a  
report that includes--  7i7 a summary of
 information about the cyber threat1    
breach1 or cyber attack1 including how  
the cyber threat1 breach1 or cyber      
attack occurred1 based on information   
available to the ,administration as of  
the date which the ,administration      
submits the report2  7ii7 an estimate of
 the number of individuals and small    
entities affected by the cyber threat1  

breach1 or cyber attack1 including an   
assessment of the risk of harm to       
affected individuals and small entities 
based on information available to the   
,administration as of the date on which 
the ,administration submits the report2 
and  7iii7 an estimate of when the      
,administration will provide notice to  
affected individuals and small entities4
  7#d7 ,rule of construction ,nothing in
 this subsection shall be construed to  
affect the reporting requirements of the
 ,administration under chapter #ce of   
title #dd ,united ,states ,code1 in     
particular the requirement to notify the
 ,federal information security incident 
center under section                    
#ceed7;b77#g77;,c77ii7 of such title1 or
 any other provision of law4  4