Bipartisan Cybersecurity Bill Puts Federal Support for Small Businesses Under GAO Review

A bipartisan push in Congress is seeking to determine whether the federal government is giving small businesses the cybersecurity tools, resources and support they need to withstand increasingly sophisticated cyber threats.

The initiative, the Small Business Cybersecurity Assistance Evaluation Act of 2026 (H.R. 8880), directs the Government Accountability Office (GAO) to conduct a comprehensive review of federal cybersecurity assistance available to small businesses. The legislation was introduced by Reps. Lateefah Simon (D-Calif.) and Rob Bresnahan (R-Pa.).

The House Committee on Small Business approved the measure unanimously, 23-0, on May 20. The full House subsequently passed it unanimously on June 23, before it was sent to the Senate Committee on Homeland Security and Governmental Affairs.

GAO to Examine Federal Cybersecurity Support

Rather than immediately creating another federal cybersecurity programme, the bill takes an oversight approach.

It would require the GAO to examine existing federal cybersecurity initiatives, programmes, resources, tools and services intended to assist small businesses.

The review would assess whether those resources help small businesses identify cyber risks and vulnerabilities, evaluate their preparedness, and plan for, mitigate and recover from cyberattacks. The legislation also specifically covers social-engineering attacks, scams and fraud.

GAO would also be expected to identify shortcomings in existing federal assistance and recommend ways to improve the effectiveness and accessibility of those resources.

That focus is significant because cybersecurity assistance can be difficult for smaller organisations to navigate. Unlike large corporations, many small businesses operate without dedicated security teams, mature risk-management functions or substantial budgets for cybersecurity controls.

The bill is therefore aimed not only at identifying threats but at determining whether government assistance is actually reaching the organisations most in need.

Cyber Risk Meets Compliance Risk

The legislation arrives as federal oversight increasingly focuses on cybersecurity governance, risk management and accountability.

Recent GAO work has identified cybersecurity and IT-management challenges within the Small Business Administration itself, highlighting the importance of strengthening federal systems and oversight. GAO has also found that federal cybersecurity requirements can overlap: its July 2026 review identified 117 cybersecurity regulations across 37 federal agencies, with about 70% containing reporting requirements that duplicated requirements in another regulation.

For small businesses, regulatory complexity can become a compliance risk of its own.

A company may have access to cybersecurity guidance from several federal agencies but lack the personnel to determine which programme applies, which controls should be prioritised or how different requirements interact.

The proposed GAO review could therefore provide lawmakers with a clearer picture of whether federal cybersecurity assistance is sufficiently coordinated, accessible and effective.

Why It Matters to Compliance Officers

For compliance professionals, the bill has implications beyond technical cybersecurity.

Cybersecurity increasingly sits at the intersection of risk management, privacy, fraud prevention, business continuity and regulatory compliance. A weak cybersecurity environment can expose organisations to financial losses, regulatory scrutiny, operational disruption and reputational damage.

The legislation’s emphasis on preparedness, mitigation and recovery also reflects a shift away from treating cybersecurity solely as an IT issue.

Boards and senior management are increasingly expected to understand cyber risk, establish appropriate controls and demonstrate that reasonable measures are being taken to protect business systems and information.

The GAO study could ultimately help identify where federal programmes are failing to meet those needs and where small businesses require better tools, training, funding or technical assistance.

For now, however, the legislation remains a study and oversight measure rather than a new cybersecurity mandate. The Senate received the House-passed bill on June 24 and referred it to the Homeland Security and Governmental Affairs Committee.

Compliance Takeaway

Cybersecurity compliance is becoming an organisational responsibility, not simply an IT function.

Small businesses should not wait for new federal programmes or legislation before assessing their cyber exposure. Management and compliance teams should identify critical systems and data, document key cyber risks, review access controls and incident-response procedures, train employees against phishing and social-engineering threats, and establish a practical recovery plan.

For policymakers, the lesson is equally important: cybersecurity assistance must be usable, coordinated and accessible—not merely available on paper.

If enacted, the GAO review could provide Congress with the evidence needed to determine whether existing federal cybersecurity programmes are closing those gaps or simply adding another layer to an already complicated compliance landscape.