[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 4948 Introduced in Senate (IS)]

<DOC>






119th CONGRESS
  2d Session
                                S. 4948

 To require the Administrator of the Small Business Administration to 
 implement certain recommendations relating to information technology 
                 modernization, and for other purposes.


_______________________________________________________________________


                   IN THE SENATE OF THE UNITED STATES

                             July 13, 2026

Mr. Schiff (for himself and Mr. Curtis) introduced the following bill; 
 which was read twice and referred to the Committee on Small Business 
                          and Entrepreneurship

_______________________________________________________________________

                                 A BILL


 
 To require the Administrator of the Small Business Administration to 
 implement certain recommendations relating to information technology 
                 modernization, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``SBA IT Modernization Reporting 
Act''.

SEC. 2. DEFINITIONS.

    In this Act, the terms ``Administration'' and ``Administrator'' 
mean the Small Business Administration and the Administrator thereof, 
respectively.

SEC. 3. IMPLEMENTATION OF RECOMMENDATIONS RELATING TO INFORMATION 
              TECHNOLOGY MODERNIZATION FOR THE SMALL BUSINESS 
              ADMINISTRATION.

    (a) In General.--The Administrator, acting through the Chief 
Information Officer of the Administration, shall take such actions as 
may be necessary to implement the recommendations contained in the 
report of the Comptroller General of the United States titled ``IT 
MODERNIZATION: SBA Urgently Needs to Address Risks on Newly Deployed 
System'' (GAO-25-106963; published November 6, 2024).
    (b) Implementation Plan.--Not later than 180 days after the date of 
enactment of this Act, the Administrator shall submit to the Committee 
on Small Business and Entrepreneurship of the Senate and the Committee 
on Small Business of the House of Representatives an implementation 
plan detailing the actions the Administration will undertake to 
establish and implement policies and procedures to govern information 
technology modernization projects of the Administration, which policies 
and procedures shall, with respect to each project--
            (1) for each risk identified, explicitly state the source 
        of such risk in the relevant risk documentation;
            (2) clearly define risk parameters;
            (3) establish and maintain risk management strategies;
            (4) identify and document risks for all phases of the life 
        cycle;
            (5) evaluate, categorize, and prioritize risks based on 
        defined risk parameters and develop project risk management 
        plans;
            (6) connect measures to mitigate risk to risk mitigation 
        plans;
            (7) require that any information technology acquisition 
        plan and any strategic plan contains information needed to 
        manage cyber risks;
            (8) require that a traceability analysis is performed and 
        documented;
            (9) require that security-related subject matter experts 
        are involved in selection process for contractors for a 
        project;
            (10) develop master schedules using the guidelines 
        contained in the publication of the Comptroller General of the 
        United States titled ``GAO Schedule Assessment Guide: Best 
        Practices for Project Schedules'' (GAO-16-89G; published 
        December 22, 2015); and
            (11) develop cost estimates using the guidelines contained 
        in the publication of the Comptroller General of the United 
        States titled ``Cost Estimating and Assessment Guide: Best 
        Practices for Developing and Managing Program Costs'' (GAO-20-
        195G; published March 12, 2020).
    (c) Additional Requirements.--The implementation plan required 
under this section shall include the actions required to carry out the 
requirements listed in paragraphs (1) through (11) of subsection (b), 
an identification of the office of the Administration responsible for 
implementation, and the timelines for completion of each action.
    (d) Briefing Required.--Not later than 30 days after the submission 
of the implementation plan required under this section, the 
Administrator shall provide to the Committee on Small Business and 
Entrepreneurship of the Senate and the Committee on Small Business of 
the House of Representatives a briefing on the plan.
                                 <all>