Technical corrections only. The diff includes a minor update to the Clerk's attestation and a slight formatting adjustment in subsection 2(d). No substantive policy changes were made between v3 and v4.
SBA IT Modernization Reporting Act
- Sponsor
- Rep. Cisneros, Gilbert Ray [D-CA-31]
- Committees
- Small Business and Entrepreneurship Committee (primary)
- Last action
- Dec 2, 2025
Bottom line
The bill requires the SBA to adopt specific best practices for IT modernization and risk management, as recommended by the GAO, and to report its progress to Congress.
What it actually does
This bill mandates that the Administrator of the Small Business Administration (SBA), through its Chief Information Officer, implement recommendations from a specific Government Accountability Office (GAO) report concerning IT modernization risks. It requires the SBA to submit an implementation plan within 180 days, detailing new policies and procedures for IT projects, including enhanced risk management, cybersecurity integration, and adherence to GAO guidelines for scheduling and cost estimation. A briefing on this plan must be provided to relevant congressional committees.
Proponents argue
Supporters argue that this bill is a crucial step to improve the efficiency, security, and accountability of the Small Business Administration's information technology systems. By mandating the implementation of GAO recommendations, it ensures that identified risks in newly deployed systems are urgently addressed, protecting taxpayer investments and enhancing the SBA's ability to serve small businesses effectively. It promotes good governance and responsible use of federal funds.
Opponents contend
Critics might contend that while the intent is sound, mandating specific administrative actions through legislation can create an unfunded burden on agencies, potentially diverting resources from core mission activities. Some may argue that the SBA already has mechanisms to address these issues and that a legislative mandate could reduce the agency's flexibility to adapt its IT strategies to evolving threats and technologies. Concerns could also be raised about the administrative overhead of detailed reporting requirements.
The bill is short and clearly written, making it accessible for a quick read and understanding of its core requirements.
Section 2(a)
Mandate to Implement GAO Recommendations
This provision requires the Administrator of the Small Business Administration (SBA), specifically through its Chief Information Officer, to take all necessary actions to implement the recommendations outlined in a particular Government Accountability Office (GAO) report. The report, titled 'IT MODERNIZATION: SBA Urgently Needs to Address Risks on Newly Deployed System' (GAO-25-106963), was published on November 6, 2024, indicating a direct response to identified issues within the SBA's IT infrastructure.
Supporters argue
Supporters argue that this direct mandate ensures the SBA addresses critical vulnerabilities identified by an independent oversight body, thereby safeguarding sensitive data and improving the effectiveness of systems vital for supporting small businesses. It ensures accountability and responsiveness to expert advice.
Critics contend
Some might argue that such a specific legislative mandate could be overly prescriptive, potentially limiting the SBA's agility in responding to rapidly evolving IT challenges or imposing solutions that may not perfectly align with the agency's unique operational context. However, given the GAO's role as an independent auditor, direct opposition to implementing its recommendations is uncommon.
Tradeoffs
The tension lies between ensuring strict adherence to external recommendations for accountability and allowing the agency sufficient flexibility to implement solutions tailored to its specific needs and resources. This provision prioritizes external oversight and best practices.
Section 2(b)
Implementation Plan and Policy Requirements
This section requires the SBA Administrator to submit an implementation plan within 180 days of the bill's enactment. This plan must detail how the SBA will establish and implement new policies and procedures for all IT modernization projects. These policies must include 11 specific requirements, such as explicitly stating risk sources, defining risk parameters, establishing risk management strategies, identifying risks across all project phases, evaluating and prioritizing risks, connecting mitigation measures to plans, integrating cyber risk management into acquisition and strategic plans, requiring traceability analysis, involving security experts in contractor selection, and developing schedules and cost estimates using specific GAO guidelines.