H.R. 10238: Cybersecurity for Small Businesses Act of 2026

This bill would direct the Small Business Administration (SBA) to provide small businesses with cybersecurity information and resources. The goal is to help them improve their cyber defenses and follow security best practices.

What the SBA would be required to do

• Work with the Cybersecurity and Infrastructure Security Agency (CISA) to create and distribute cybersecurity guidance for small businesses.
• Share practical resources meant to help small business owners strengthen their cybersecurity systems and adopt best practices.

Help for small businesses working with the federal government

For small businesses that want to bid on federal contracts, or serve as subcontractors on those contracts, the SBA would have to provide information about the Cybersecurity Maturity Model Certification program, or any replacement program. This would include guidance meant to help businesses understand and meet the cybersecurity requirements tied to federal contracting.

The bill says this information should be made available through:

• small business development centers, and
• SBA district offices.

Public outreach and website posting

The SBA would also have to include this cybersecurity compliance information in its outreach efforts and communications, including by posting it on the agency’s website.

Ongoing review of best practices

Each year, the SBA’s Office of Advocacy would consult with the SBA Chief Counsel for Advocacy to identify the best ways to share cybersecurity-related information with small businesses.

Reporting to Congress

The bill would require the Chief Counsel for Advocacy to submit a report to Congress within 90 days of enactment, and then once every year after that. The report would describe how many small businesses contacted the office about cybersecurity issues during the year, and summarize the types of concerns they raised.

Relevant Companies

None found