[Report No. 119–851]
September 2, 2026
Mr. Wied (for himself, Ms. King-Hinds, and Ms. Van Duyne) introduced the following bill; which was referred to the Committee on Small Business
October 13, 2026
Additional sponsor: Mr. Latimer
October 13, 2026
Reported with an amendment, committed to the Committee of the Whole House on the State of the Union, and ordered to be printed
Strike out all after the enacting clause and insert the part printed in italic
For text of introduced bill, see copy of bill as introduced on September 2, 2026
To require the Administrator of the Small Business Administration to disseminate to small business concerns certain information and resources relating to cybersecurity matters, and for other purposes.
Be it enacted by the Senate and House of Representatives of the United States of America in Congress assembled,
Section 1. Short title
This Act may be cited as the Cybersecurity for Small Businesses Act of 2026
.
Sec. 2. Information and resources relating to cybersecurity matters for small business concerns
The Administrator of the Small Business Administration, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency and the Director of the National Institute of Standards and Technology, shall develop and disseminate information and resources to assist small business concerns in strengthening the cybersecurity infrastructure of such concerns and implementing cybersecurity best practices.
Sec. 3. Cybersecurity compliance information
(a) Cybersecurity maturity model certification resources
The Administrator of the Small Business Administration, in coordination with the Secretary of Defense and other appropriate Federal agencies, shall provide information and resources to a small business concern seeking to enter into a contract with the Federal Government, or seeking to be a subcontractor on a Federal contract, regarding the Cybersecurity Maturity Model Certification program (or successor program), including information and resources produced and provided by—
(1)
the Director of Small and Disadvantaged Business Utilization (established under section 15(k) of the Small Business Act (15 U.S.C. 644(k))) for the Department of Defense;
(2)
the program established under section 1807 of the National Defense Authorization Act for Fiscal Year 2026 (10 U.S.C. 144 note); or
(3)
the APEX Accelerator Program of the Department of Defense (or a successor program).
(b) Publication
The Administrator shall include the information described in subsection (a) in outreach and communications of the Small Business Administration, including through publication on a website of the Administration.
(c) Best practices
The Administrator shall annually consult with the Chief Counsel for Advocacy of the Office of Advocacy of the Administration to determine best practices for the dissemination of other information relating to cybersecurity matters to small business concerns.
(d) Annual report
Not later than 90 days after the date of the enactment of this Act, and annually thereafter, the Administrator shall submit to Congress a report that includes the number and a description of small business concerns that contacted the Administrator during the year covered by the report with matters relating to the cybersecurity of such concerns.