Placed on the Union Calendar, Calendar No. 181.
This bill directs the Administrator of the Small Business Administration (SBA), through the agency Chief Information Officer, to implement the recommendations in GAO report GAO-25-106963 ("IT Modernization: SBA Urgently Needs to Address Risks on Newly Deployed System"). It requires the SBA to submit, within 180 days of enactment, an implementation plan that details policies and procedures to govern IT modernization projects, including specific requirements for risk documentation and management, cyber risk inclusion in acquisition and strategic plans, traceability analyses, involvement of security subject-matter experts in contractor selection, and use of GAO guidance for schedule and cost estimating.
Degree of concern about added bureaucracy versus the need for rigorous risk management—conservatives emphasize flexibility and cost, liberals emphasize security and equity.
Relative to its intended legislative type, this bill provides a clear mandate and detailed procedural requirements for SBA IT modernization planning and requires a near-term implementation plan and briefing.
This bill directs the Administrator of the Small Business Administration (SBA), through the agency Chief Information Officer, to implement the recommendations in GAO report GAO-25-106963 ("IT Modernization: SBA Urgently Needs to Address Risks on Newly Deployed System").
It requires the SBA to submit, within 180 days of enactment, an implementation plan that details policies and procedures to govern IT modernization projects, including specific requirements for risk documentation and management, cyber risk inclusion in acquisition and strategic plans, traceability analyses, involvement of security subject-matter experts in contractor selection, and use of GAO guidance for schedule and cost estimating.
The plan must identify the responsible SBA office and provide timelines for each action, and the Administrator must brief the House and Senate small business committees within 30 days after plan submission.
On content alone, the bill is a narrow, technical measure that advances implementation of GAO recommendations without creating new programs or spending mandates—attributes that historically increase enactment chances. The main barriers are procedural (Senate scheduling or holds) rather than substantive opposition. Therefore, conditional on ordinary legislative processing, the bill has a good chance of enactment, though not guaranteed.
Relative to its intended legislative type, this bill provides a clear mandate and detailed procedural requirements for SBA IT modernization planning and requires a near-term implementation plan and briefing. It is strong on specifying what the implementation plan should contain and which GAO guidance to follow, but it provides limited guidance on resource implications, enforcement, follow-up oversight, and handling exceptions.
Degree of concern about added bureaucracy versus the need for rigorous risk management—conservatives emphasize flexibility and cost, liberals emphasize security and equity.
These are examples from the analysis, not a ranked list of the most-affected groups.
Degree of concern about added bureaucracy versus the need for rigorous risk management—conservatives emphasize flexibility and cost, liberals emphasize security and equity.
A mainstream liberal/left-leaning observer would generally view this bill positively as a concrete step to strengthen oversight, cybersecurity, and risk management at a federal agency that serves small businesses.
They would welcome requirements for documented risk management, cyber risk inclusion, and involvement of security experts because these reduce the likelihood of failures that could disproportionately harm underserved entrepreneurs.
However, they would be concerned about whether the SBA will receive sufficient resources to implement these best practices and whether the plan will include provisions to ensure equitable access for historically marginalized small businesses during modernization.
A centrist/moderate observer would likely regard the bill as a sensible, targeted requirement that implements GAO recommendations to strengthen governance of SBA IT modernization.
They would appreciate the use of established GAO guidance and clear deadlines, seeing this as improving project discipline without dramatic new policy changes.
Their primary concerns would be the feasibility of the 180-day planning deadline, clarity about resource needs and whether additional appropriations are required, and ensuring the plan balances rigor with operational flexibility.
A mainstream conservative observer would cautiously support efforts to reduce IT risk and improve accountability at a federal agency, especially where GAO has identified urgent weaknesses.
However, they would be wary of prescriptive federal mandates that expand paperwork and slow procurement, and would be sensitive to any implicit increase in ongoing costs or bureaucratic overhead.
They would favor preserving flexibility for agency leadership and contractors to implement improvements in a cost-effective manner, and would seek assurances that the bill does not create unfunded mandates or reduce the pace of delivering services to small businesses.
Reached or meaningfully advanced
Reached or meaningfully advanced
Still ahead
Still ahead
Still ahead
On content alone, the bill is a narrow, technical measure that advances implementation of GAO recommendations without creating new programs or spending mandates—attributes that historically increase enactment chances. The main barriers are procedural (Senate scheduling or holds) rather than substantive opposition. Therefore, conditional on ordinary legislative processing, the bill has a good chance of enactment, though not guaranteed.
The bill has not accumulated any surfaced votes yet.
Degree of concern about added bureaucracy versus the need for rigorous risk management—conservatives emphasize flexibility and cost, libera…
On content alone, the bill is a narrow, technical measure that advances implementation of GAO recommendations without creating new programs…
Relative to its intended legislative type, this bill provides a clear mandate and detailed procedural requirements for SBA IT modernization planning and requires a near-term implementation plan and briefing. It is stron…
Go beyond the headline summary with full stakeholder mapping, legislative design analysis, passage barriers, and lens-by-lens tradeoff breakdowns.