A new small business cybersecurity bill, the Cybersecurity for Small Businesses Act of 2026 (H.R. 10238), would require the Small Business Administration and the Cybersecurity and Infrastructure Security Agency to publish plain-language cybersecurity guidance for small companies. It was introduced on September 2, 2026, and is still sitting in committee. Nothing in it changes what you need to do this week to protect your business.
- H.R. 10238 would have the SBA and CISA jointly produce cybersecurity best-practice guidance aimed at small businesses, not large enterprises.
- A related bill, H.R. 8880, passed the House unanimously in June 2026 and would direct the GAO to study how well federal cyber assistance programs actually serve small businesses.
- Neither bill has passed the Senate. Both could stall, change substantially, or die at the end of the session.
- Lawmakers are citing a figure that small businesses are far more likely to be hit by a cyber incident than larger companies.
- None of this replaces having a managed firewall, current backups, and multi-factor authentication in place today.
What would the Cybersecurity for Small Businesses Act actually require?
H.R. 10238, sponsored by Rep. Tony Wied with Rep. Beth Van Duyne and Rep. Kimberlyn King-Hinds as original cosponsors, directs the SBA Administrator to work with CISA to develop and distribute cybersecurity best-practice information for small businesses. It also requires the SBA to coordinate on explaining Cybersecurity Maturity Model Certification (CMMC) requirement levels for businesses that touch Department of Defense contracts, and adds an annual reporting requirement to the Small Business Act, according to the sponsor’s own announcement. The bill was referred to the House Committee on Small Business and has not had a committee vote as of this writing.
Why is Congress suddenly focused on small business cybersecurity?
Part of the push is cost. Lawmakers’ staff point to small businesses paying what Rep. Van Duyne’s office describes as six-figure sums to meet CMMC compliance rules that, in some cases, did not even apply to them. Part of it is exposure. Rep. Rob Bresnahan, who co-led the separate GAO study bill, has cited a figure that small businesses are 210% more likely to experience a cyber incident than larger companies, a number reported by Government Technology and again when that bill, H.R. 8880, passed the House by unanimous vote in June 2026. Neither office has published the underlying methodology for that number, so treat it as a talking point rather than a verified statistic.
Will either bill actually become law this year?
Don’t plan around it. H.R. 10238 has been in committee since early September with no scheduled markup. H.R. 8880 moved faster, clearing its House committee by a 23-0 vote in May and the full House in June, but it has been sitting in the Senate Homeland Security and Governmental Affairs Committee since then with no reported action. Bills in this position routinely expire at the end of a Congress without a vote. Even if one passes, SBA and CISA guidance documents take time to write and longer to reach a business owner in Naples or Fort Myers who is trying to run a company, not read federal bulletins.
What should a Southwest Florida business actually do right now?
Treat this news as a reminder, not a plan. The gap these bills are trying to describe, that small businesses face real cyber risk with fewer resources than large companies, is already true today and has been for years. A few things close more of that gap than waiting on Washington:
- Multi-factor authentication on email, VPN, and any system that touches money or customer data.
- Backups that are tested, not just scheduled, so you know they actually restore.
- A written, one-page incident response plan: who you call first, and in what order.
- A real look at whether your current antivirus is doing enough, covered in our EDR vs. antivirus comparison.
If your business ever bids on federal or defense-adjacent contracts, CMMC is worth understanding now rather than scrambling later, and it’s also worth checking whether cyber insurance would actually pay out if something went wrong today.
Frequently asked questions
What is the Cybersecurity for Small Businesses Act of 2026?
It’s a bill, H.R. 10238, introduced in the U.S. House in September 2026. It would require the SBA and CISA to jointly publish cybersecurity guidance aimed at small businesses and explain CMMC requirements to businesses that work with defense contracts.
Has H.R. 10238 become law?
No. As of this post, it is still in the House Committee on Small Business with no scheduled vote. A related bill, H.R. 8880, has passed the House but remains stalled in a Senate committee.
What is CMMC and does it apply to my business?
CMMC, the Cybersecurity Maturity Model Certification, is a Department of Defense framework for contractors handling certain defense-related data. If you don’t hold or bid on DoD contracts, it likely doesn’t apply to you directly, though some supply-chain vendors get pulled in indirectly.
Should I wait for federal guidance before improving my cybersecurity?
No. These bills, even if passed, would take months to produce usable guidance. Basic protections like MFA, tested backups, and current endpoint security close more risk today than any future government bulletin.
If you want a clear picture of where your business actually stands, SWFIT offers a free 15-minute IT and security review. Contact us to schedule one.
