United States S 5291: Small Business Cybersecurity Assistance Evaluation Act of 2026

Summary

This bill requires the Comptroller General to conduct a comprehensive study of all Federal cybersecurity programs and resources available to help small businesses identify risks, prevent attacks, and recover from cyber incidents. The study will assess how aware small businesses are of these resources, how well they work, how coordinated they are with each other, and will recommend improvements to make them more effective and accessible. Small business owners affected by cyberattacks are the primary beneficiaries, as the findings could lead to better and more coordinated government support for their cybersecurity needs.

Bill Text

II
119TH CONGRESS
2D SESSION S. 5291
To require the Comptroller General to evaluate Federal cybersecurity
assistance to small business concerns, and for other purposes.
IN THE SENATE OF THE UNITED STATES
AUGUST 6, 2026
Mr. SCHIFF (for himself and Mr. YOUNG) introduced the following bill; which
was read twice and referred to the Committee on Small Business and En-
trepreneurship
A BILL
To require the Comptroller General to evaluate Federal cy-
bersecurity assistance to small business concerns, and
for other purposes.
Be it enacted by the Senate and House of Representa-1
tives of the United States of America in Congress assembled, 2
SECTION 1. SHORT TITLE. 3
This Act may be cited as the ‘‘Small Business Cyber-4
security Assistance Evaluation Act of 2026’’. 5
SEC. 2. GAO STUDY ON SMALL BUSINESS CYBERSECURITY 6
ASSISTANCE. 7
(a) SMALL BUSINESS CONCERN DEFINED.—In this 8
section, the term ‘‘small business concern’’ has the mean-9
VerDate Sep 11 2014 21:27 Aug 07, 2026 Jkt 069200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S5291.IS S5291ssavage on LAPJG3WLY3PROD with BILLS

2
•S 5291 IS
ing given the term in section 3 of the Small Business Act 1
(15 U.S.C. 632). 2
(b) STUDY.—The Comptroller General of the United 3
States shall conduct a study of available Federal cyberse-4
curity initiatives, programs, resources, tools, and services 5
intended to assist owners of small business concerns 6
with— 7
(1) identifying cyber risks, cyber threats, and 8
cybersecurity vulnerabilities relating to small busi-9
ness concerns; 10
(2) assessing the preparedness of small business 11
concerns for the risks, threats, and vulnerabilities 12
described in paragraph (1); 13
(3) planning for, mitigating, and recovering 14
from cyber attacks and incidents of social engineer-15
ing, scams, and fraud, including developing, adopt-16
ing, and implementing cybersecurity measures, train-17
ing, protocols, tools, and infrastructure; and 18
(4) identifying sources of capital, or obtaining 19
capital, to carry out the activities described in para-20
graphs (1), (2), and (3). 21
(c) REQUIRED CONTENT.—The study required under 22
subsection (b) shall include— 23
(1) information on the most common 24
cyberattacks affecting small business concerns; 25
VerDate Sep 11 2014 21:27 Aug 07, 2026 Jkt 069200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S5291.IS S5291ssavage on LAPJG3WLY3PROD with BILLS

3
•S 5291 IS
(2) an identification and description of the Fed-1
eral cybersecurity initiatives, programs, resources, 2
tools, and services included in the study; 3
(3) an assessment of the awareness and use of 4
those Federal cybersecurity initiatives, programs, re-5
sources, tools, and services by small business con-6
cerns and reasons for differences in levels of such 7
awareness and use; 8
(4) an assessment of the coordination and inte-9
gration among those Federal cybersecurity initia-10
tives, programs, resources, tools, and services; 11
(5) an assessment of the effectiveness of those 12
Federal cybersecurity initiatives, programs, re-13
sources, tools, and services in assisting small busi-14
ness concerns with the activities described in para-15
graphs (1) through (4) of subsection (b); 16
(6) an identification of any foundational cyber-17
security concepts absent from those Federal cyberse-18
curity initiatives, programs, resources, tools, and 19
services; and 20
(7) recommendations on how to improve the ef-21
fectiveness, awareness, and coordination of those 22
Federal cybersecurity initiatives, programs, re-23
sources, tools, and services for small business con-24
cerns. 25
VerDate Sep 11 2014 21:27 Aug 07, 2026 Jkt 069200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S5291.IS S5291ssavage on LAPJG3WLY3PROD with BILLS

4
•S 5291 IS
(d) REPORT.—The Comptroller General of the 1
United States shall submit to the Committee on Small 2
Business and Entrepreneurship of the Senate and the 3
Committee on Small Business of the House of Representa-4
tives a report containing all findings and determinations 5
made in carrying out the study required under subsection 6
(b). 7
(e) NO ADDITIONAL FUNDS.—No additional amounts 8
are authorized to carry out this Act. 9
Æ
VerDate Sep 11 2014 21:27 Aug 07, 2026 Jkt 069200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6301 E:\BILLS\S5291.IS S5291ssavage on LAPJG3WLY3PROD with BILLS