Chief Information Officer Open Recommendations: Small Business Administration

What GAO Found

In September 2025, GAO identified 20 open recommendations under the purview of the Small Business Administration's (SBA) Chief Information Officer (CIO), from previously issued work. Each of these recommendations relates to a GAO High-Risk area: (1) Ensuring the Cybersecurity of the Nation or (2) Improving IT Acquisitions and Management. In addition, GAO has designated four of the 20 as priority recommendations.

For example, GAO previously recommended that SBA fully define and document a process for ensuring that designated privacy officials are involved in assessing and addressing the hiring, training, and professional development needs of the agency with respect to privacy. Further, GAO recommended that SBA develop a project risk management strategy and risk mitigation plan for its newly deployed Unified Certification Platform.

GAO also previously recommended that the agency complete annual reviews of its IT portfolio consistent with federal requirements. The CIO's continued attention to these recommendations will help ensure the secure and effective use of IT at the agency.

Why GAO Did This Study

CIO open recommendations are outstanding GAO recommendations that warrant the attention of agency CIOs because their implementation could significantly improve government IT operations by securing IT systems, identifying cost savings, improving major government programs, eliminating mismanagement of IT programs and processes, or ensuring that IT programs comply with laws, among others.

For more information, contact Nick Marinos at marinosn@gao.gov.