,,ii ,calendar ,no4 #eb #aafth ,,congress #ast ,session ,s4 #ggb ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,march #ac1 #bjai,mr4 ,rubio 7for himself1 ,mr4 ,cardin1 ,mr4 ,risch1 and ,mr4 ,hawley7 introduced the following bill2 which was read twice and referred to the ,committee on ,small ,business and ,entrepreneurship ,april #a1 #bjai,reported by ,mr4 ,rubio1 with an amendment,strike out all after the enacting clause and insert the part printed in italic ,a ,,bill ,to require an annual report on the cybersecurity of the ,small ,business ,administration1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,,sba ,cyber ,awareness ,act4 #b4 ,cybersecurity awareness reporting ,section #aj of the ,small ,business ,act 7#ae ,u4,s4,c4 #fci7 is amended by striking subsection 7b7 and inserting the following3 7b7 ,cybersecurity reports 7#a7 ,definition ,in this subsection1 the term appropriate congressional committees means-- 7,a7 the ,committee on ,small ,business and ,entrepreneurship of the ,senate2 and 7,b7 the ,committee on ,small ,business of the ,house of ,representatives4 7#b7 ,annual report ,not later than #ahj days after the date of enactment of the ,,sba ,cyber ,awareness ,act1 and every year thereafter1 the ,administration shall submit a report to the appropriate congressional committees that includes-- 7,a7 an assessment of the information technology and cybersecurity of the ,administration2 7,b7 a strategy to increase the cybersecurity of the ,administration2 7,c7 a detailed account of any information technology component or system of the ,administration that was manufactured by a company located in the ,people's ,republic of ,china2 and 7,d7 an account of any cyber threat1 breach1 or cyber attack that occurred at the ,administration during the #b-year period preceding the date on which the report is submitted1 and any action taken by the ,administration to respond to or remediate the cyber threat1 breach1 or cyber attack4 7#c7 ,additional reports ,if the ,administration determines that there is a reasonable basis to conclude that a cyber threat1 breach1 or cyber attack occurred at the ,administration1 the ,administration shall-- 7,a7 not later than #g days after the date on which the ,administration makes that determination1 notify the appropriate congressional committees of the cyber threat1 breach1 or cyber attack2 and 7,b7 not later than #cj days after the date on which the ,administration makes that determination1 submit to the appropriate congressional committees a report that includes-- 7i7 a summary of information about the cyber threat1 breach1 or cyber attack1 including how the cyber threat1 breach1 or cyber attack occurred1 based on information available to the ,administration as of the date which the ,administration submits the report2 7ii7 an estimate of the number of individuals and small entities affected by the cyber threat1 breach1 or cyber attack1 including an assessment of the risk of harm to affected individuals and small entities based on information available to the ,administration as of the date on which the ,administration submits the report2 and 7iii7 an estimate of when the ,administration will provide notice to affected individuals and small entities4 7#d7 ,rule of construction ,nothing in this subsection shall be construed to affect the reporting requirements of the ,administration under chapter #ce of title #dd ,united ,states ,code1 in particular the requirement to notify the ,federal information security incident center under section #ceed7;b77#g77;,c77ii7 of such title1 or any other provision of law4 4 #a4 ,short title ,this ,act may be cited as the ,,sba ,cyber ,awareness ,act4 #b4 ,cybersecurity awareness reporting ,section #aj of the ,small ,business ,act 7#ae ,u4,s4,c4 #fci7 is amended by inserting after subsection 7a7 the following3 7b7 ,cybersecurity reports 7#a7 ,definitions ,in this subsection-- 7,a7 the term appropriate congressional committees means-- 7i7 the ,committee on ,small ,business and ,entrepreneurship of the ,senate2 and 7ii7 the ,committee on ,small ,business of the ,house of ,representatives2 and 7,b7 the term major incident has the meaning given the term in the ,office of ,management and ,budget ,memorandum on ,federal ,information ,security and ,privacy ,management ,requirements1 dated ,october #af1 #bjag 7,m-#ah-jb71 or any successor memorandum4 7#b7 ,annual report ,not later than #ahj days after the date of enactment of the ,,sba ,cyber ,awareness ,act1 and every year thereafter1 the ,administration shall submit to the appropriate congressional committees a report that includes-- 7,a7 an assessment of the information technology and cybersecurity of the ,administration2 7,b7 a strategy to increase the cybersecurity of the ,administration2 7,c7 a detailed account of any information technology component or system of the ,administration that was manufactured by a company located in the ,people's ,republic of ,china2 and 7,d7 an account of any major incident that occurred at the ,administration during the #b-year period preceding the date on which the report is submitted1 and any action taken by the ,administration to respond to or remediate the major incident4 7#c7 ,additional reports ,if the ,administration determines that there is a reasonable basis to conclude that a major incident occurred at the ,administration1 the ,administration shall-- 7,a7 not later than #g days after the date on which the ,administration makes that determination1 notify the appropriate congressional committees of the major incident2 and 7,b7 not later than #cj days after the date on which the ,administration makes that determination1 submit to the appropriate congressional committees a report that includes-- 7i7 a summary of information about the major incident1 including how the major incident occurred1 based on information available to the ,administration as of the date which the ,administration submits the report2 7ii7 an estimate of the number of individuals and small entities affected by the major incident1 including an assessment of the risk of harm to affected individuals and small entities based on information available to the ,administration as of the date on which the ,administration submits the report2 and 7iii7 an estimate of when the ,administration will provide notice to affected individuals and small entities4 7#d7 ,rule of construction ,nothing in this subsection shall be construed to affect the reporting requirements of the ,administration under chapter #ce of title #dd ,united ,states ,code1 in particular the requirement to notify the ,federal information security incident center under section #ceed7;b77#g77;,c77ii7 of such title1 or any other provision of law4 4 ,april #a1 #bjai,reported with an amendment