Small Business Cybersecurity Assistance Evaluation Act of 2026

Small business cybersecurity study, no new funds

This bill would require the Comptroller General (GAO) to study Federal cybersecurity programs, tools, and services meant to help small businesses. For the study, "small business concern" would be defined by section 3 of the Small Business Act (15 U.S.C. 632). The study would examine four core activities: identifying cyber risks and common attacks; assessing small business preparedness; planning, mitigating, and recovering from attacks (including training, protocols, tools, and infrastructure); and identifying sources of capital to carry out those activities. The GAO would be required to report seven specific topics, including common attacks, which Federal offerings exist, awareness and use by small businesses and reasons for differences, coordination among offerings, effectiveness, missing basic cybersecurity concepts, and recommendations to improve these efforts. The GAO would send a report of findings to the Senate Committee on Small Business and Entrepreneurship and the House Committee on Small Business. The bill would not authorize any new money to carry out these requirements, and these rules would take effect upon enactment.