Congress demands SBA fix broken IT systems before they fail again

What it does

This bill requires the Small Business Administration to implement recommendations from a November 2024 Government Accountability Office (GAO) report identifying serious IT security and project-management risks in the SBA's newly deployed systems. The SBA must submit a detailed implementation plan within 180 days outlining how it will adopt better risk management, cybersecurity, cost estimation, and project-scheduling practices for all future IT modernization projects, and brief Congress 30 days later on progress.

Why we flagged it

The bill is a straightforward mandate for the SBA to adopt better IT project management and cybersecurity practices based on GAO audit findings. It is a governance and accountability measure, not a spending bill, tax provision, or industry carve-out.

What the text implies

• The bill ties SBA IT modernization to specific GAO best-practice publications (Schedule Assessment Guide, Cost Estimating Guide), effectively embedding federal project-management standards into SBA operations and potentially raising the bar for IT governance across other federal agencies.
• Requiring security-subject-matter experts in contractor selection may increase procurement costs and timelines for SBA IT projects, but reduces the risk of security-compromised systems that could expose small-business data.
• The 180-day implementation-plan deadline creates a hard accountability checkpoint; failure to submit or implement risks congressional oversight and potential follow-up legislation.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill mandates concrete improvements to federal IT security and project governance at an agency serving millions of small-business owners and loan applicants. Better risk management, cybersecurity oversight, and cost controls reduce the likelihood of costly system failures, data breaches, or mismanagement of public funds—all of which would harm citizens and small businesses relying on SBA services.

Who stands to gain

• IT consulting and systems-integration firms (potential contractors for SBA modernization projects)
• Cybersecurity service providers

Named in the bill

Small Business Administration (SBA), Government Accountability Office (GAO), House Committee on Small Business, Senate Committee on Small Business and Entrepreneurship, SBA Chief Information Officer

Where it stands

1 cosponsor: 1 Republicans.

• Jul 17, 2025 — Introduced · Congress.gov: “Introduced in House”
• Jul 17, 2025 — Referred to House Committee on Small Business and Senate Committee on Small Business and Entrepreneurship · Congress.gov: “Referred to the House Committee on Small Business”
• Jul 22, 2025 — Markup held in committee · Congress.gov: “Committee Consideration and Mark-up Session Held”
• Jul 22, 2025 — Reported out of committee · Congress.gov: “Ordered to be Reported by the Yeas and Nays: 23 - 0”
• Dec 1, 2025 — Passed the House · Congress.gov: “On motion to suspend the rules and pass the bill Agreed to by voice vote. (text: CR H4913-4914)”
• Dec 1, 2025 — Floor vote scheduled · Congress.gov: “Mr. Williams (TX) moved to suspend the rules and pass the bill”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.