SBA to centralize small-business cybersecurity guidance for federal contractors
H.R. 10238 — Cybersecurity for Small Businesses Act of 2026 · Filed by Tony Wied (R-WI) · 3 cosponsors · Introduced Sep 2, 2026 · Reported out
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires the Small Business Administration to develop and share cybersecurity information and resources with small businesses, working with federal cybersecurity agencies. It specifically mandates that the SBA help small firms understand federal cybersecurity certification requirements (particularly the Cybersecurity Maturity Model Certification program) if they want to bid on federal contracts, and report annually to Congress on how many small businesses seek this assistance.
Why we flagged it
The bill's sole operative mechanism is a mandate for the SBA to develop and disseminate cybersecurity information and resources to small businesses. It creates no new restrictions, no subsidies, and no carve-outs—only an information-sharing and advisory function.
What the text implies
- Annual reporting requirement may create administrative burden on SBA but provides Congress with data on small-business cybersecurity needs, potentially informing future policy.
- Coordination with DoD and NIST may indirectly strengthen federal supply-chain security by raising cybersecurity standards among small federal contractors.
- Guidance on Cybersecurity Maturity Model Certification (CMMC) compliance may reduce compliance costs for small firms by centralizing information that is currently scattered across multiple agencies.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Small businesses gain free access to cybersecurity guidance and federal compliance information, reducing barriers to federal contracting and improving their ability to protect against cyber threats. There are no direct costs to citizens or restrictions on rights; the bill is purely informational and advisory.
Named in the bill
Small Business Administration (SBA), Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), Department of Defense (DoD), Director of Small and Disadvantaged Business Utilization, Cybersecurity Maturity Model Certification (CMMC) program, APEX Accelerator Program
Where it stands
3 cosponsors: 2 Republicans, 1 Democrats.
- Sep 2, 2026 — Introduced · Congress.gov: “Introduced in House”
- Sep 2, 2026 — Referred to House Committee on Small Business · Congress.gov: “Referred to the House Committee on Small Business”
- Sep 16, 2026 — Markup held in committee · Congress.gov: “Committee Consideration and Mark-up Session Held”
- Sep 16, 2026 — Reported out of committee · Congress.gov: “Ordered to be Reported in the Nature of a Substitute by the Yeas and Nays: 23 - 0”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (2,551 characters) on Sep 5, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-21.
“SBA to centralize small-business cybersecurity guidance for federal contractors” QuorumCivic. https://share.quorumcivic.app/bill/119/hr10238 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.