Summary#
This bill requires the Administrator of the Small Business Administration, acting through the SBA Chief Information Officer, to implement the recommendations in the Comptroller General's report titled "IT MODERNIZATION: SBA Urgently Needs to Address Risks on Newly Deployed System" (GAO-25-106963; published November 6, 2024). The Administrator must submit an implementation plan to the House Committee on Small Business and the Senate Committee on Small Business and Entrepreneurship within 180 days of enactment.
The implementation plan must describe actions the SBA will take to create and use policies and procedures for IT modernization projects. For each project, the policies and procedures must do the following:
- State the source of each identified risk in the risk documentation.
- Clearly define risk parameters.
- Establish and maintain risk management strategies.
- Identify and document risks for all phases of the project life cycle.
- Evaluate, categorize, and prioritize risks and develop project risk management plans.
- Connect risk mitigation measures to risk mitigation plans.
- Require that IT acquisition plans and strategic plans include information needed to manage cyber risks.
- Require that a traceability analysis is performed and documented.
- Involve security-related subject matter experts in the contractor selection process for a project.
- Develop master schedules using GAO's "GAO Schedule Assessment Guide: Best Practices for Project Schedules" (GAO-16-89G).
- Develop cost estimates using GAO's "Cost Estimating and Assessment Guide: Best Practices for Developing and Managing Program Costs" (GAO-20-195G).
The implementation plan must also identify the SBA office responsible for each action and provide timelines for completing each action. The Administrator must provide a briefing to the same congressional committees no later than 30 days after submitting the implementation plan.
What it means for you#
- The bill directs the SBA to follow specific GAO recommendations and to create formal policies and plans for IT modernization projects.
- The SBA must send a written implementation plan to two congressional committees within 180 days and brief those committees within 30 days after submission.
- The bill does not itself change SBA programs, benefits, or services in its text; it focuses on how the agency will manage IT projects and risks.
Expenses#
No publicly available information on expected costs or funding is included in the bill text.
Proponents' View#
No publicly available information.
Opponents' View#
No publicly available information.