Cybersecurity Policy Report, House Bill Aims to Help Small Businesses Achieve Cyber ‘Maturity’ for DoD Contracts, (Sep 8, 2026)
Legislation that would help small businesses comply with the Defense Department’s cybersecurity “maturity” rules for contractors has been introduced in the House.
The Cybersecurity for Small Businesses Act (H.R. 10238, 119th Cong. (2026)) was introduced by Rep. Tony Wied (R., Wis.) and is co-sponsored by Rep. Beth Van Duyne (R., Texas) and Del. Kimberlyn King-Hinds (R., Northern Mariana Islands).
The bill would require the Small Business Administration (SBA) and Cybersecurity and Infrastructure Security Agency to provide more resources for small-business cybersecurity. It would also direct SBA and the Department of Defense to help small businesses that seek defense contracts comply with DoD’s Cybersecurity Maturity Model Certification (CMMC) program, according to its text.
The CMMC program, in particular, has presented hurdles to small businesses that lack the resources to comply with DoD’s cyber rules, prompting the DoD to revamp the program several times. DoD recently suspended the implementation of phase two of the program while it reconsidered the requirements (CPR, July 14).
Some small businesses that hoped to obtain DoD contracts or subcontracts “were forced to spend upwards of hundreds of thousands of dollars to comply with requirements they may not have needed,” Rep. Wied said in a news release.
“In today’s rapidly evolving digital world, it is critical for small businesses to maintain the highest-quality and most up-to-date cybersecurity infrastructure,” Rep. Wied said.
“However, small businesses shouldn’t be forced to spend hundreds of thousands of dollars to obtain a level of cybersecurity they don’t need simply because Washington has failed to provide clear rules,” he added. “The Cybersecurity for Small Businesses Act will provide much-needed clarity to help small businesses protect themselves without forcing them to spend excessive amounts of money trying to comply with vague guidelines.”
News: FederalLegislation DataSecurity