Analyst Brief November 06, 2026

H.R. 10238 — Cybersecurity for Small Businesses Act of 2026, as amended

Current Status

Introduced

Executive Summary

This bill directs the Small Business Administration (SBA), in coordination with the Cybersecurity and Infrastructure Security Agency (CISA) and the Department of Defense, to develop and distribute cybersecurity resources to small businesses. It specifically targets small businesses seeking federal contracts by providing guidance on compliance with the complex Cybersecurity Maturity Model Certification (CMMC) program. The legislation aims to bridge the knowledge gap for small enterprises facing increasing cyber threats and stringent federal procurement requirements, ensuring they remain competitive and secure without being locked out of the federal supply chain.

Bill Data

Primary Sponsor

Rep. Wied

Bill Number

H.R. 10238

Session

119th

Co-Sponsors

Rep. King-HindsRep. Van Duyne
View on Congress.gov ↗

Arguments For

  • Economic Competitiveness: Helps small businesses navigate complex DoD cybersecurity requirements (CMMC), preventing them from being locked out of lucrative federal contracts due to compliance confusion.
  • National Security: Hardens the defense industrial base by ensuring subcontractors and smaller vendors are not the weak link in federal supply chains.
  • Low Cost/High Reward: Leverages existing infrastructure (SBDCs and the SBA website) to distribute critical information without creating massive new bureaucratic programs.

Likely Supporters

National Defense Industrial Association (NDIA)National Federation of Independent Business (NFIB)Small Business Majority

Arguments Against

  • Redundancy: Critics might argue that CISA and the DoD already provide extensive resources, making the SBA's role duplicative and potentially confusing if messaging is not perfectly aligned.
  • Insufficient Support: Merely disseminating information does not provide the financial capital or technical labor small businesses actually need to implement expensive CMMC compliance upgrades.

Likely Opponents

None specified

📋 Key Provisions

  • Requires the SBA Administrator, consulting with CISA, to develop and disseminate cybersecurity best practices and infrastructure resources for small businesses.
  • Mandates the SBA, in coordination with the DoD, to distribute compliance information regarding the Cybersecurity Maturity Model Certification (CMMC) program to small businesses seeking federal contracts.
  • Directs the use of Small Business Development Centers (SBDCs) and SBA district offices to facilitate the distribution of CMMC compliance information.
  • Requires the SBA to publish CMMC compliance information on its website and in its general outreach communications.
  • Mandates an annual report to Congress from the SBA's Chief Counsel for Advocacy detailing the number and nature of small business inquiries related to cybersecurity.
search Verification Guide BETA expand_more

Don't trust AI? Don't worry, neither do I. Verify the claims yourself.

Claim Analysis Page 2, Line 5

Requires the SBA to consult with CISA to develop and disseminate cybersecurity resources.

Verify Text

"consultation with the Director of the Cybersecurity"

Claim Analysis Page 2, Line 19

Mandates dissemination of information regarding the Cybersecurity Maturity Model Certification program.

Verify Text

"bersecurity Maturity Model Certification program"

Claim Analysis Page 3, Line 9

Requires an annual report to Congress within 90 days of enactment detailing small business cyber inquiries.

Verify Text

"Not later than 90 days after"