# Understanding the SBA Cyber Awareness Act

The Small Business Administration (SBA) is a government agency that helps entrepreneurs start and grow businesses by offering loans, counseling, and other support. This bill requires the SBA to be much more transparent about its cybersecurity—basically, how well it protects its computer systems and the sensitive information it holds about small business owners and loan applicants.

Right now, the SBA handles a lot of personal and financial data from small business owners who apply for loans or use the agency's services. If hackers or foreign actors breach the SBA's computer systems, they could potentially access information like Social Security numbers, business financial records, and loan details. This bill says the SBA must now tell Congress every year exactly what shape its cybersecurity is in, what equipment it uses (including whether any comes from China), and what problems have happened in the past two years. The agency also has to explain its plan to improve its defenses going forward.

If something goes wrong—if the SBA discovers a cybersecurity breach or serious threat—the bill requires the agency to notify Congress within just seven days, and then notify affected small business owners and individuals within 30 days. This means if your information is compromised, you'll find out relatively quickly instead of potentially months later. The bill essentially creates accountability and transparency so Congress and the public can see whether the SBA is taking cybersecurity seriously and protecting the data of the millions of small business owners who interact with it.

SBA Cyber Awareness Act

Crow, Jason

SBA Cyber Awareness Act This bill requires the Small Business Administration (SBA) to annually report specified information related to cybersecurity awareness. Such reports must provide (1) an assessment of the SBA's information technology (IT) and cybersecurity infrastructure, (2) a strategy to increase such infrastructure, (3) a detailed account of the SBA's IT equipment that is manufactured by an entity that has its principal place of business in China, and (4) any SBA cybersecurity risk or incident that occurred during the two years prior to the report (including the SBA's action to respond to or remediate it).