US HB4491

SBA Administrator must implement recommendations from GAO report "IT MODERNIZATION: SBA Urgently Needs to Address Risks on Newly Deployed System" (GAO-25-106963, published November 6, 2024)

Implementation plan required within 180 days of enactment, to be submitted to House and Senate Small Business committees

Plan must establish policies for IT modernization projects covering risk documentation, risk management strategies, cyber risk management, traceability analysis, and security expert involvement in contractor selection

Cost estimates and master schedules must follow GAO best practices guidelines (GAO-16-89G for schedules, GAO-20-195G for cost estimating)

Congressional briefing required within 30 days after submission of the implementation plan