United States
H.R. 10238
Cybersecurity for Small Businesses Act of 2026
Official summary (Congressional Research Service, Reported to House): Cybersecurity for Small Businesses Act of 2026
This bill requires the Small Business Administration (SBA) to provide cybersecurity information and resources to small businesses, including resources for businesses seeking to contract with the federal government.
Specifically, the SBA must develop and distribute resources to assist small businesses in strengthening their cybersecurity infrastructure and implementing best practices.
Further, in coordination with the Department of Defense (DOD) and other appropriate federal agencies, the SBA must provide information and resources on the Cybersecurity Maturity Model Certification (CMMC) program to small businesses seeking to contract with the federal government. (CMMC is a cybersecurity framework for DOD contractors; certification is mandatory for contractors with access to certain controlled information.) The information and resources provided to small businesses must include certain existing DOD resources.
Finally, the SBA must report annually to Congress with information on small businesses that have contacted the SBA about cybersecurity.
Record as of 13 October 2026 — the most recent action in the official record. Status can lag; each step below carries its own date.
- 13 October 2026 Reported by committee
What's next: Floor scheduling (leadership decides if and when it gets a vote)
- 13 October 2026 Placed on calendar (House)
2 more actions
- 16 September 2026 Ordered to be Reported in the Nature of a Substitute by the Yeas and Nays: 23 - 0.
- 16 September 2026 Committee Consideration and Mark-up Session Held
- 2 September 2026 Referred to committee
- 2 September 2026 Introduced in House
Read the live feed — on the site or in the app Find it on Congress.gov (opens in a new tab) All US bills