H.R. 10238
Cybersecurity for Small Businesses Act of 2026
Sponsor: Tony Wied · 3 cosponsors
Follow this billOfficial summary
No official summary yet.
Text of the bill
Where this section came from
-
Sep 2, 2026 · Introduced in House
-
Oct 13, 2026 · Reported in House
(a) Cybersecurity
compliance
maturity model certification
resources. The Administrator of the Small Business Administration, in coordination with the Secretary of Defense and other appropriate Federal agencies, shall
disseminate
provide
information
and resources
to a small business concern seeking to enter into a contract with the Federal Government, or seeking to be a subcontractor on a Federal contract, regarding the Cybersecurity Maturity Model Certification program (or successor program), including information
necessary
and
to
resources
facilitate
produced
compliance
and
with
provided
such
by—
requirements,
(1)
through
the
small
Director
business
of
development
Small
centers
and
(as
Disadvantaged
defined
Business
in
Utilization (established under
section
3
15(k)
of the Small Business Act (15 U.S.C.
632))
644(k)))
and
for
district
the
offices
Department
of
Defense; (2)
the
Administration
program established under section 1807 of the National Defense Authorization Act for Fiscal Year 2026 (10 U
.
S.C. 144 note); or (3) the APEX Accelerator Program of the Department of Defense (or a successor program).
… 2 unchanged passages …
(d) Annual report. Not later than 90 days after the date of the enactment of this Act, and annually thereafter, the
Chief
Administrator
Counsel for Advocacy
shall submit to Congress a report that includes the number and a description of small business concerns that contacted the
Chief
Administrator
Counsel for Advocacy
during the year covered by the report with matters relating to
the
cybersecurity of such concerns.
(a) Cybersecurity maturity model certification resources. The Administrator of the Small Business Administration, in coordination with the Secretary of Defense and other appropriate Federal agencies, shall provide information and resources to a small business concern seeking to enter into a contract with the Federal Government, or seeking to be a subcontractor on a Federal contract, regarding the Cybersecurity Maturity Model Certification program (or successor program), including information and resources produced and provided by—
(1) the Director of Small and Disadvantaged Business Utilization (established under section 15(k) of the Small Business Act (15 U.S.C. 644(k))) for the Department of Defense;
(2) the program established under section 1807 of the National Defense Authorization Act for Fiscal Year 2026 (10 U.S.C. 144 note); or
(3) the APEX Accelerator Program of the Department of Defense (or a successor program).
(b) Publication. The Administrator shall include the information described in subsection (a) in outreach and communications of the Small Business Administration, including through publication on a website of the Administration.
(c) Best practices. The Administrator shall annually consult with the Chief Counsel for Advocacy of the Office of Advocacy of the Administration to determine best practices for the dissemination of other information relating to cybersecurity matters to small business concerns.
(d) Annual report. Not later than 90 days after the date of the enactment of this Act, and annually thereafter, the Administrator shall submit to Congress a report that includes the number and a description of small business concerns that contacted the Administrator during the year covered by the report with matters relating to the cybersecurity of such concerns.