HR 10238: Cybersecurity for Small Businesses Act of 2026

HR 10238 in plain English: This bill requires the Small Business Administration (SBA) to develop and distribute cybersecurity information and resources to small businesses, including guidance on the Department of Defense's Cybersecurity Maturity Model Certification (CMMC) program for businesses seeking federal contracts. The SBA must also submit annual reports to Congress on small businesses that have contacted it about cybersecurity.

Stated purpose

The bill requires the Small Business Administration to develop and share cybersecurity information and resources with small businesses, including guidance on a mandatory certification program for businesses seeking federal government contracts.

Key points

• Requires the SBA to develop and distribute cybersecurity best-practice resources to small businesses.
• Requires the SBA to provide information on the DOD's CMMC program to small businesses seeking federal contracts.
• Mandates that resources include existing DOD cybersecurity materials.
• Requires the SBA to report annually to Congress on small businesses contacting it about cybersecurity.

Arguments supporters make

• Small businesses are frequent targets of cyberattacks but often lack the expertise or resources to protect themselves, so centralized government guidance could fill a real gap.
• Helping small businesses understand and meet the CMMC certification requirement lowers a barrier that might otherwise prevent them from competing for federal contracts.
• Annual reporting to Congress creates accountability and helps lawmakers track whether small businesses are actually being reached and helped.

Arguments opponents make

• The bill only requires the SBA to share information and resources — it provides no funding or hands-on assistance, which may not be enough for small businesses that lack the staff or budget to act on guidance alone.
• Adding a new reporting requirement and coordination mandate to the SBA could stretch the agency's capacity without clear evidence that information-sharing alone improves small business cybersecurity outcomes.
• Small businesses that cannot afford CMMC compliance may still be shut out of federal contracting even after receiving information, meaning the bill addresses awareness but not the underlying cost barrier.

Tradeoffs

The bill focuses resources on education and outreach rather than direct financial support, which is lower cost to the government but may have limited impact for businesses that need money or technical help, not just information. It also prioritizes businesses seeking federal contracts for dedicated CMMC guidance, which may leave behind small businesses with no interest in government work.

Current status in Congress: Passed House.

NewsClear — neutral news & congressional tracking · Bill of the Week