S. 4948: SBA IT Modernization Reporting Act

This bill would require the Small Business Administration (SBA) to carry out recommendations from a recent Government Accountability Office (GAO) report about problems with the SBA’s information technology modernization efforts.

What the bill requires

The SBA Administrator, through the agency’s Chief Information Officer, would have to take the actions needed to address the GAO’s concerns about a newly deployed system and the broader management of SBA technology projects.

Within 180 days after the bill becomes law, the SBA would also have to submit an implementation plan to the Senate and House small business committees. That plan would have to explain how the agency will create and use policies and procedures for managing its IT modernization projects.

What the plan must cover

For each technology project, the SBA’s policies and procedures would need to address:

• Identifying the source of each risk in the risk documentation
• Clearly defining risk limits and thresholds
• Creating and maintaining risk management strategies
• Tracking risks throughout the entire project lifecycle
• Evaluating, classifying, and prioritizing risks
• Linking risk-reduction measures to specific mitigation plans
• Making sure acquisition and strategic plans include cyber-risk management information
• Performing and documenting traceability analysis
• Including security experts in contractor selection
• Creating master schedules using GAO scheduling guidance
• Creating cost estimates using GAO cost-estimating guidance

Additional reporting requirements

The implementation plan would also need to name which SBA office is responsible for each part of the work and give timelines for completing the actions.

After submitting the plan, the SBA Administrator would have to brief both congressional committees within 30 days.

Relevant Companies

None found