HR 8880: Small Business Cybersecurity Assistance Evaluation Act of 2026

HR 8880 in plain English: This bill requires the Government Accountability Office to study federal cybersecurity programs and resources that help small businesses identify and prepare for cyber threats. The study must cover the most common cyberattacks affecting small businesses and include recommendations for improving the effectiveness, awareness, and coordination of those federal programs.

Stated purpose

This bill directs the Government Accountability Office to study the federal cybersecurity programs, tools, and resources that help small businesses recognize and prepare for cyber threats, and to recommend ways to make those programs more effective, better known, and better coordinated.

Key points

• Directs the GAO to study existing federal cybersecurity initiatives, programs, and tools that assist small businesses.
• Requires the study to identify the most common cyberattacks affecting small businesses.
• Mandates recommendations for improving effectiveness, awareness, and coordination of federal cybersecurity programs.

Arguments supporters make

• Small businesses are frequent cyberattack targets but often lack the resources of large companies, so a clear picture of what federal help exists — and whether it works — is a sensible first step toward fixing gaps.
• The study costs nothing extra because the bill explicitly bars new spending, making it a low-risk way to gather useful information.
• Better coordination among scattered federal cybersecurity programs could make existing resources easier for small business owners to find and use without creating new bureaucracy.

Arguments opponents make

• A study alone changes nothing; without a follow-up commitment to act on the findings, this bill may produce a report that sits unused while small businesses remain vulnerable.
• Federal cybersecurity programs already exist and have been studied before, so another review may duplicate prior work without delivering meaningful new help to business owners.
• Because no funding is authorized, the GAO must absorb the workload within its existing budget, which could delay or limit the depth of the study.

Tradeoffs

Conducting a study before acting gives policymakers better information but delays any concrete help to small businesses that may be facing cyber risks right now; skipping the study and acting immediately risks spending resources on programs that may not work or overlap with ones that already exist.

Current status in Congress: Passed House.

NewsClear — neutral news & congressional tracking · Bill of the Week