H.R. 10238 – Cybersecurity for Small Businesses Act of 2026

AI-Generated Summary

Updated October 14, 2026 at 4:20 AM UTC

The Cybersecurity for Small Businesses Act of 2026 directs the Small Business Administration (SBA) to create and share cybersecurity guidance and tools with small businesses. It focuses especially on helping firms that want to work on federal contracts understand and meet the Cybersecurity Maturity Model Certification (CMMC) requirements. The SBA must work with agencies like CISA, NIST, and the Department of Defense to develop these resources, publish them online, and report annually to Congress on the assistance provided.

Key Provisions

The SBA Administrator, in consultation with CISA and NIST, must develop and distribute information and resources to help small businesses improve their cybersecurity and adopt best practices.
The SBA must provide guidance on the Cybersecurity Maturity Model Certification (or its successor) for small businesses seeking federal contracts or subcontracting opportunities, using resources from the DoD and related programs.
All cybersecurity guidance must be published through SBA outreach channels, including its website.
The SBA must annually consult with the Office of Advocacy’s Chief Counsel for Advocacy to identify best practices for sharing cybersecurity information.
Within 90 days of enactment and each year thereafter, the SBA must submit a report to Congress detailing how many small businesses sought cybersecurity assistance and what issues they raised.

Legislative Activity

Stay on top of the latest movement without scrolling through every action

5 earlier actions

HouseCalendars Latest Action

Placed on the Union Calendar, Calendar No. 748.

October 13, 2026

View full timeline

HouseIntro Referral

Introduced in House

September 2, 2026

HouseIntro Referral

Referred to the House Committee on Small Business.

Small Business Committee

September 2, 2026

HouseCommittee

Committee Consideration and Mark-up Session Held

Small Business Committee

September 16, 2026

HouseCommittee

Ordered to be Reported in the Nature of a Substitute by the Yeas and Nays: 23 - 0.

Small Business Committee

September 16, 2026

HouseCommittee

Reported (Amended) by the Committee on Small Business. H. Rept. 119-851.

Small Business Committee

October 13, 2026

HouseCalendars

Placed on the Union Calendar, Calendar No. 748.

October 13, 2026

Bill Text

2 versions available

Reading Mode

Raw Text PDF XML

Reported in HouseIssued October 13, 2026

IB

Union Calendar No. 748

119th CONGRESS

2d Session

H. R. 10238

[Report No. 119–851]

IN THE HOUSE OF REPRESENTATIVES

September 2, 2026

Mr. Wied (for himself, Ms. King-Hinds, and Ms. Van Duyne) introduced the following bill; which was referred to the Committee on Small Business

October 13, 2026

Additional sponsor: Mr. Latimer

October 13, 2026

Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed

Strike out all after the enacting clause and insert the part printed in italic

For text of introduced bill, see copy of bill as introduced on September 2, 2026

A BILL

To require the Administrator of the Small Business Administration to disseminate to small business concerns certain information and resources relating to cybersecurity matters, and for other purposes.

1.

Short title

This Act may be cited as the Cybersecurity for Small Businesses Act of 2026.

2.

Information and resources relating to cybersecurity matters for small business concerns

The Administrator of the Small Business Administration, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of the National Institute of Standards and Technology, shall develop and disseminate information and resources to assist small business concerns in strengthening the cybersecurity infrastructure of such concerns and implementing cybersecurity best practices.

3.

Cybersecurity compliance information

(a)

Cybersecurity maturity model certification resources

The Administrator of the Small Business Administration, in coordination with the Secretary of Defense and other appropriate Federal agencies, shall provide information and resources to a small business concern seeking to enter into a contract with the Federal Government, or seeking to be a subcontractor on a Federal contract, regarding the Cybersecurity Maturity Model Certification program (or successor program), including information and resources produced and provided by—

(1)

the Director of Small and Disadvantaged Business Utilization (established under section 15(k) of the Small Business Act (15 U.S.C. 644(k))) for the Department of Defense;

(2)

the program established under section 1807 of the National Defense Authorization Act for Fiscal Year 2026 (10 U.S.C. 144 note); or

(3)

the APEX Accelerator Program of the Department of Defense (or a successor program).

(b)

Publication

The Administrator shall include the information described in subsection (a) in outreach and communications of the Small Business Administration, including through publication on a website of the Administration.

(c)

Best practices

The Administrator shall annually consult with the Chief Counsel for Advocacy of the Office of Advocacy of the Administration to determine best practices for the dissemination of other information relating to cybersecurity matters to small business concerns.

(d)

Annual report

Not later than 90 days after the date of the enactment of this Act, and annually thereafter, the Administrator shall submit to Congress a report that includes the number and a description of small business concerns that contacted the Administrator during the year covered by the report with matters relating to the cybersecurity of such concerns.

October 13, 2026

Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed