H.R. 4491 — SBA IT Modernization Reporting Act

This section requires the Administrator of the Small Business Administration (SBA), acting through the Chief Information Officer, to implement recommendations from the November 6, 2024, GAO report titled “IT MODERNIZATION: SBA Urgently Needs to Address Risks on Newly Deployed System” (GAO–25–106963). Within 180 days of enactment, the Administrator must submit to the House Committee on Small Business and the Senate Committee on Small Business and Entrepreneurship an implementation plan detailing actions to establish and implement policies and procedures for SBA IT modernization projects that, for each project— (1) explicitly state the source of each identified risk; (2) clearly define risk parameters; (3) establish and maintain risk management strategies; (4) identify and document risks across all project life-cycle phases; (5) evaluate, categorize, prioritize risks based on defined parameters, and develop project risk management plans; (6) connect risk mitigation measures to mitigation plans; (7) require IT acquisition and strategic plans to address cyber risks; (8) perform and document a traceability analysis; (9) involve security-related subject matter experts in contractor selection; (10) develop master schedules per the GAO Schedule Assessment Guide (GAO–16–89G, December 22, 2015); and (11) develop cost estimates per the GAO Cost Estimating and Assessment Guide (GAO–20–195G, March 12, 2020). The plan must identify responsible SBA offices and timelines for each action, and within 30 days after submission, the Administrator must brief the committees on the plan.