S. 1691 – SBA Cyber Awareness Act

AI-Generated Summary

Updated February 8, 2026 at 3:10 AM UTC

The SBA Cyber Awareness Act amends the Small Business Act to require the Small Business Administration to report on its cybersecurity each year. The reports go to the Senate and House Small Business committees and cover the agency’s IT security, any Chinese‑made components, and past cyber incidents. The bill also sets rapid‑notification rules for new cyber threats or breaches, affecting the SBA and the small businesses it serves.

Key Provisions

Defines the “appropriate congressional committees” as the Senate Committee on Small Business and Entrepreneurship and the House Committee on Small Business.
Requires the SBA to submit an annual report within 180 days of the law’s enactment and each year thereafter, including an IT/cybersecurity assessment, a strategy to improve security, a list of any systems made by companies in the People’s Republic of China, and a summary of cyber threats, breaches, or attacks from the prior two years and the agency’s response.
Mandates that if the SBA determines a cyber incident has occurred, it must notify the designated committees within 7 days and provide a detailed report within 30 days covering how the incident happened, estimates of affected individuals and small entities, risk assessment, and the timeline for notifying those parties.
Clarifies that these new reporting requirements do not alter the SBA’s existing obligations under other federal cybersecurity reporting laws.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

1 earlier action

SenateIntro Referral Latest Action

Read twice and referred to the Committee on Small Business and Entrepreneurship.

Small Business and Entrepreneurship Committee

May 18, 2021

View full timeline

SenateIntro Referral

Introduced in Senate

May 18, 2021

SenateIntro Referral

Read twice and referred to the Committee on Small Business and Entrepreneurship.

Small Business and Entrepreneurship Committee

May 18, 2021

Bill Text

Latest available legislative text

Reading Mode

Raw Text PDF XML

Introduced in SenateIssued May 18, 2021

II

117th CONGRESS

1st Session

S. 1691

IN THE SENATE OF THE UNITED STATES

May 18, 2021

Mr. Rubio (for himself, Mr. Risch, and Mr. Cassidy) introduced the following bill; which was read twice and referred to the Committee on Small Business and Entrepreneurship

A BILL

To require an annual report on the cybersecurity of the Small Business Administration, and for other purposes.

1.

Short title

This Act may be cited as the SBA Cyber Awareness Act.

2.

Cybersecurity awareness reporting

Section 10 of the Small Business Act (15 U.S.C. 639) is amended by striking subsection (b) and inserting the following:

(b)

Cybersecurity reports

(1)

Definition

In this subsection, the term appropriate congressional committees means—

(A)

the Committee on Small Business and Entrepreneurship of the Senate; and

(B)

the Committee on Small Business of the House of Representatives.

(2)

Annual report

Not later than 180 days after the date of enactment of the SBA Cyber Awareness Act, and every year thereafter, the Administration shall submit a report to the appropriate congressional committees that includes—

(A)

an assessment of the information technology and cybersecurity of the Administration;

(B)

a strategy to increase the cybersecurity of the Administration;

(C)

a detailed account of any information technology component or system of the Administration that was manufactured by a company located in the People's Republic of China; and

(D)

an account of any cyber threat, breach, or cyber attack that occurred at the Administration during the 2-year period preceding the date on which the report is submitted, and any action taken by the Administration to respond to or remediate the cyber threat, breach, or cyber attack.

(3)

Additional reports

If the Administration determines that there is a reasonable basis to conclude that a cyber threat, breach, or cyber attack occurred at the Administration, the Administration shall—

(A)

not later than 7 days after the date on which the Administration makes that determination, notify the appropriate congressional committees of the cyber threat, breach, or cyber attack; and

(B)

not later than 30 days after the date on which the Administration makes that determination, submit to the appropriate congressional committees a report that includes—

(i)

a summary of information about the cyber threat, breach, or cyber attack, including how the cyber threat, breach, or cyber attack occurred, based on information available to the Administration as of the date which the Administration submits the report;

(ii)

an estimate of the number of individuals and small entities affected by the cyber threat, breach, or cyber attack, including an assessment of the risk of harm to affected individuals and small entities based on information available to the Administration as of the date on which the Administration submits the report; and

(iii)

an estimate of when the Administration will provide notice to affected individuals and small entities.

(4)

Rule of construction

Nothing in this subsection shall be construed to affect the reporting requirements of the Administration under chapter 35 of title 44 United States Code, in particular the requirement to notify the Federal information security incident center under section 3554(b)(7)(C)(ii) of such title, or any other provision of law.

.