2 versions

SubstantiveWhat changed in REPORTED IN HOUSEcompared with INTRODUCED IN HOUSE (Sep 2, 2026)

A substantive modification. v2 expands the consultation requirements for cybersecurity information dissemination by adding the Director of NIST. It also refines the sources and methods for providing cybersecurity compliance resources to small businesses seeking federal contracts, while shifting the responsibility for the annual cybersecurity contact report from the Chief Counsel for Advocacy to the SBA Administrator.

H.R. 10238119th CongressIntroduced Sep 2, 2026

Cybersecurity for Small Businesses Act of 2026

Reported To HouseCommerceSubstantive

View bill text

Sponsor: Rep. Wied, Tony [R-WI-8]
Committees: Small Business Committee (primary)
Last action: Oct 13, 2026

Bottom line

This bill aims to enhance the cybersecurity posture of small businesses by requiring the SBA to provide targeted information and resources, particularly for those engaging with federal contracts.

What it actually does

This bill mandates the Small Business Administration (SBA) to develop and disseminate information and resources to help small businesses strengthen their cybersecurity infrastructure and implement best practices. It specifically requires the SBA to provide guidance on the Cybersecurity Maturity Model Certification (CMMC) program for small businesses seeking federal contracts or subcontracts, and to publish this information online. The bill also requires the SBA Administrator to consult annually on dissemination best practices and submit annual reports to Congress on small business cybersecurity inquiries.

Proponents argue

Supporters argue that small businesses are often vulnerable targets for cyberattacks due to limited resources and expertise, and this bill provides crucial, accessible support to help them protect themselves and their data. They contend that strengthening small business cybersecurity is vital for national economic security and for ensuring small businesses can effectively participate in the federal supply chain, especially concerning programs like CMMC which can be complex to navigate.

Opponents contend

Critics might argue that while the intent is good, mandating the SBA to disseminate information might create an unfunded mandate or divert resources from other core SBA functions without a clear measure of effectiveness. Some might also contend that small businesses already have access to various cybersecurity resources from other federal agencies or private sector entities, and this bill risks duplicating efforts or adding bureaucratic layers without significantly improving outcomes.

The bill text is very short and can be read quickly, making it highly accessible for any interested party to understand its core provisions.

Section 2

SBA Cybersecurity Resource Dissemination

prominently featuredstraightforward

This section requires the Small Business Administration (SBA) Administrator, in collaboration with the Cybersecurity and Infrastructure Security Agency (CISA) and the National Institute of Standards and Technology (NIST), to create and distribute information and resources. The goal is to help small businesses improve their cybersecurity infrastructure and adopt best practices to protect against cyber threats.

GroupImpactMechanismScale

GroupSmall business concernsImpactBenefit (access to cybersecurity guidance)MechanismDirect provision of resources by SBA.ScaleBroad, affecting all small businesses that engage with SBA resources.

GroupSmall Business Administration (SBA)ImpactIncreased workload/mandateMechanismNew statutory requirement to develop and disseminate resources.ScaleModerate, requiring interagency coordination and resource allocation.

Supporters argue

Supporters argue this provision directly addresses a critical vulnerability for small businesses, many of whom lack the internal expertise or budget for robust cybersecurity. By leveraging the expertise of CISA and NIST through the SBA, it provides a centralized, trusted source of information tailored to their needs.

Critics contend

Some might argue that this duplicates existing efforts by CISA and NIST, or that the SBA may not be the most effective agency to lead on technical cybersecurity dissemination, potentially leading to less impactful or redundant resources.

Tradeoffs

The tension lies between providing necessary support to vulnerable small businesses and ensuring efficient use of federal resources without duplicating existing agency functions.

Section 3(a)

CMMC Program Information for Federal Contractors

prominently featuredmoderately complex

This section directs the SBA Administrator, in coordination with the Secretary of Defense and other relevant federal agencies, to provide specific information and resources about the Cybersecurity Maturity Model Certification (CMMC) program. This is aimed at small businesses that want to contract directly with the Federal Government or serve as subcontractors, helping them understand and comply with CMMC requirements. The information should include resources from the Department of Defense's Small and Disadvantaged Business Utilization office, a program established under the FY26 NDAA, and the APEX Accelerator Program.

Section 3(c) and 3(d)

SBA Cybersecurity Outreach Best Practices and Annual Report

mentioned in summarystraightforward

This section requires the SBA Administrator to annually consult with the Chief Counsel for Advocacy of the Office of Advocacy to determine the most effective ways to disseminate cybersecurity information to small businesses. Additionally, the Administrator must submit an annual report to Congress, starting 90 days after enactment, detailing the number and description of small businesses that contacted the SBA regarding cybersecurity matters during the preceding year.

About this analysis. AI-Generated from the official bill text and available committee reports. Gaps in available data are noted explicitly. Verify important details with the official Congress.gov record.