[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 10238 Reported in House (RH)]

<DOC>





                                                 Union Calendar No. 748
119th CONGRESS
  2d Session
                               H. R. 10238

                          [Report No. 119-851]

 To require the Administrator of the Small Business Administration to 
    disseminate to small business concerns certain information and 
  resources relating to cybersecurity matters, and for other purposes.


_______________________________________________________________________


                    IN THE HOUSE OF REPRESENTATIVES

                           September 2, 2026

 Mr. Wied (for himself, Ms. King-Hinds, and Ms. Van Duyne) introduced 
   the following bill; which was referred to the Committee on Small 
                                Business

                            October 13, 2026

                    Additional sponsor: Mr. Latimer

                            October 13, 2026

  Reported with an amendment, committed to the Committee of the Whole 
       House on the State of the Union, and ordered to be printed
 [Strike out all after the enacting clause and insert the part printed 
                               in italic]
    [For text of introduced bill, see copy of bill as introduced on 
                           September 2, 2026]


_______________________________________________________________________

                                 A BILL


 
 To require the Administrator of the Small Business Administration to 
    disseminate to small business concerns certain information and 
  resources relating to cybersecurity matters, and for other purposes.


 


    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Cybersecurity for Small Businesses 
Act of 2026''.

SEC. 2. INFORMATION AND RESOURCES RELATING TO CYBERSECURITY MATTERS FOR 
              SMALL BUSINESS CONCERNS.

    The Administrator of the Small Business Administration, in 
consultation with the Director of the Cybersecurity and Infrastructure 
Security Agency and the Director of the National Institute of Standards 
and Technology, shall develop and disseminate information and resources 
to assist small business concerns in strengthening the cybersecurity 
infrastructure of such concerns and implementing cybersecurity best 
practices.

SEC. 3. CYBERSECURITY COMPLIANCE INFORMATION.

    (a) Cybersecurity Maturity Model Certification Resources.--The 
Administrator of the Small Business Administration, in coordination 
with the Secretary of Defense and other appropriate Federal agencies, 
shall provide information and resources to a small business concern 
seeking to enter into a contract with the Federal Government, or 
seeking to be a subcontractor on a Federal contract, regarding the 
Cybersecurity Maturity Model Certification program (or successor 
program), including information and resources produced and provided 
by--
            (1) the Director of Small and Disadvantaged Business 
        Utilization (established under section 15(k) of the Small 
        Business Act (15 U.S.C. 644(k))) for the Department of Defense;
            (2) the program established under section 1807 of the 
        National Defense Authorization Act for Fiscal Year 2026 (10 
        U.S.C. 144 note); or
            (3) the APEX Accelerator Program of the Department of 
        Defense (or a successor program).
    (b) Publication.--The Administrator shall include the information 
described in subsection (a) in outreach and communications of the Small 
Business Administration, including through publication on a website of 
the Administration.
    (c) Best Practices.--The Administrator shall annually consult with 
the Chief Counsel for Advocacy of the Office of Advocacy of the 
Administration to determine best practices for the dissemination of 
other information relating to cybersecurity matters to small business 
concerns.
    (d) Annual Report.--Not later than 90 days after the date of the 
enactment of this Act, and annually thereafter, the Administrator shall 
submit to Congress a report that includes the number and a description 
of small business concerns that contacted the Administrator during the 
year covered by the report with matters relating to the cybersecurity 
of such concerns.
                                                 Union Calendar No. 748

119th CONGRESS

  2d Session

                              H. R. 10238

                          [Report No. 119-851]

_______________________________________________________________________

                                 A BILL

 To require the Administrator of the Small Business Administration to 
    disseminate to small business concerns certain information and 
  resources relating to cybersecurity matters, and for other purposes.

_______________________________________________________________________

                            October 13, 2026

  Reported with an amendment, committed to the Committee of the Whole 
       House on the State of the Union, and ordered to be printed