#aai? ,,congress  #a/ ,session  ,h4 ,r4 
#ddia  ,,an ,,act  ,to require !        
,adm9i/rator ( ! ,small ,bus9ess        
,adm9i/ration to implem5t c]ta9         
recomm5dations relat+ to in=mation      
te*nology mod]nization1 & = o!r         
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,,sba ,,x ,mod]nization    
,report+ ,act4  #b4 ,implem5tation (    
recomm5dations relat+ to in=mation      
te*nology mod]nization = ! ,small       
,bus9ess ,adm9i/ration  7a7 ,9 g5]al ,! 
,adm9i/rator ( ! ,small ,bus9ess        
,adm9i/ration1 act+ ?r\gh ! ,*ief       
,in=mation ,(fic] ( ! ,adm9i/ration1    
%all take su* actions z may be necess>y 
to implem5t ! recomm5dations conta9$ 9 !
 report ( ! ,comptroll] ,g5]al ( !      
,unit$ ,/ates titl$ ,,x ,,mod]nization3 
,,sba ,urg5tly ,ne$s to ,address ,risks 
on ,newly ,deploy$ ,sy/em               
7,,gao-#be-ajfifc2 publi%$ ,novemb] #f1 
#bjbd74  7b7 ,implem5tation plan ,n lat]
 ?an #ahj days aft] ! date ( ! enactm5t 
( ?is ,act1 ! ,adm9i/rator %all submit  

to ! ,committee on ,small ,bus9ess ( !  
,h\se ( ,repres5tatives & ! ,committee  
on ,small ,bus9ess & ,entrepr5eur%ip ( !
 ,s5ate an implem5tation plan detail+ ! 
actions ! ,small ,bus9ess ,adm9i/ration 
w und]take to e/abli% & implem5t        
policies & proc$ures to gov]n in=mation 
te*nology mod]nization projects ( !     
,adm9i/ration4 ,su* policies & proc$ures
 %all1 ) respect to ea* project-- 7#a7 =
 ea* risk id5tifi$1 explicitly /ate !   
s\rce ( su* risk 9 ! relevant risk      
docum5tation2  7#b7 cle>ly def9e risk   
p>amet]s2  7#c7 e/abli% & ma9ta9 risk   
managem5t /rategies2  7#d7 id5tify &    
docum5t risks = all phases ( ! life     
cycle2  7#e7 evaluate1 categorize1 &    
prioritize risks bas$ on def9$ risk     
p>amet]s & develop project risk         
managem5t plans2  7#f7 connect measures 
to mitigate risk to risk mitigation     
plans2  7#g7 require t any in=mation    
te*nology acquisition plan & any        
/rategic plan conta9s in=mation ne$$ to 
manage cyb] risks2  7#h7 require t a    

traceability analysis is p]=m$ &        
docum5t$2  7#i7 require t               
security-relat$ subject matt] exp]ts are
 involv$ 9 selection process =          
contractors = a project2  7#aj7 develop 
ma/] s*$ules us+ ! guidel9es conta9$ 9 !
 publication ( ! ,comptroll] ,g5]al     
titl$ ,,gao ,s*$ule ,assessm5t ,guide3  
,be/ ,practices = ,project ,s*$ules     
7,,gao-#af-hi;,g2 publi%$ ,decemb] #bb1 
#bjae72 &  7#aa7 develop co/ e/imates   
us+ ! guidel9es conta9$ 9 ! publication 
( ! ,comptroll] ,g5]al titl$ ,co/       
,e/imat+ & ,assessm5t ,guide3 ,be/      
,practices = ,develop+ & ,manag+        
,program ,co/s 7,,gao-#bj-aie;,g2       
publi%$ ,m>* #ab1 #bjbj74  7c7          
,additional requirem5ts ,! implem5tation
 plan requir$ by ?is section %all       
include ! actions requir$ to c>ry out ! 
requirem5ts li/$ 9 p>agraphs 7#a7 ?r\gh 
7#aa7 ( subsection 7b71 an id5tification
 ( ! (fice ( ! ,adm9i/ration responsible
 = implem5tation1 & ! timel9es =        
completion ( ea* action4  7d7 ,brief+   

requir$ ,n lat] ?an #cj days aft] !     
submission ( ! implem5tation plan       
requir$ "u ?is section1 ! ,adm9i/rator  
%all provide to ! ,committee on ,small  
,bus9ess ( ! ,h\se ( ,repres5tatives & !
 ,committee on ,small ,bus9ess &        
,entrepr5eur%ip ( ! ,s5ate a brief+ on !
 plan4  ,pass$ ! ,h\se ( ,repres5tatives
 ,decemb] #a1 #bjbe4;,cl]k4