1. Short title This Act may be cited as the SBA Cyber Awareness Act . 2. Cybersecurity awareness reporting Section 10 of the Small Business Act ( 15 U.S.C. 639 ) is amended by inserting after subsection (a) the following: (b) Cybersecurity reports (1) Annual report Not later than 180 days after the date of enactment of this subsection, and every year thereafter, the Administrator shall submit a report to the appropriate congressional committees that includes— (A) an assessment of the information technology (as defined in section 11101 of title 40, United States Code) and cybersecurity infrastructure of the Administration; (B) a strategy to increase the cy­ber­se­cu­ri­ty infrastructure of the Administration; (C) a detailed account of any information technology equipment or interconnected system or subsystem of equipment of the Administration that was manufactured by an entity that has its principal place of business located in the People’s Republic of China; and (D) an account of any cybersecurity risk or incident that occurred at the Administration during the 2-year period preceding the date on which the report is submitted, and any action taken by the Administrator to respond to or remediate any such cybersecurity risk or incident. (2) Additional reports If the Administrator determines that there is a reasonable basis to conclude that a cybersecurity risk or incident occurred at the Administration, the Administrator shall— (A) not later than 7 days after the date on which the Administrator makes that determination, notify the appropriate congressional committees of the cybersecurity risk or incident; and (B) not later than 30 days after the date on which the Administrator makes a determination under subparagraph (A)— (i) provide notice to individuals and small business concerns affected by the cybersecurity risk or incident