Cyber Certification Program 2026-01

The U.S. Small Business Administration, through its Office of Small Business Development Centers, is offering the Cyber Certification Program under Funding Opportunity No. SB-OEDSB-26-003. The SBA has supported small businesses since 1953 through financial assistance as well as counseling, training, and other technical assistance. The Office of Small Business Development Centers administers this Cyber Certification Program and works with SBA District Offices and Small Business Development Centers to connect federal, state, local, educational, and private sector resources with the small business community. The program is structured as a cooperative agreement and is intended to strengthen cybersecurity assistance available through SBA Resource Partners. The purpose of the Cyber Certification Program is to prepare SBA Resource Partner employees in cyber strategy and cyber planning assistance and to expand the number of qualified Cyber Certified SBA Resource Partners. The ultimate objective is to increase the number of small businesses that are cybersecurity aware and take action to protect their businesses. The program is intended to support development, launch, management, or continuation of a sustainable Cyber Certification Program for SBA Resource Partners, including Small Business Development Centers, Womens Business Centers, SCORE, Veterans Business Outreach Centers, and other SBA Resource Partners. The selected recipient will address four principal areas: curriculum development, course delivery, assessment and certification, and program management. Curriculum must address, at minimum, cybersecurity awareness and fundamentals, threat identification and mitigation, data security and data privacy, and cybersecurity best practices. Approximately $500,000 is available, and SBA expects to make one award of not more than $500,000 for a twenty-four-month period beginning October 1, 2026. There is no matching requirement. Program income may be generated under the award. Award funds must be used solely for the purposes stipulated in the funding opportunity and Notice of Award and may not be commingled with other monies. Proposed costs must satisfy federal standards for allowability, allocability, and reasonableness. Applicants may waive indirect costs, use an applicable negotiated indirect cost rate agreement, or elect the 15 percent de minimis rate on modified total direct costs when eligible. The recipient is expected to leverage SBA funding through collaboration with SBA offices and resource partners, government programs, educational institutions, cyber and business assistance organizations, and other appropriate public and private partners. Eligibility is narrowly restricted. An applicant must be a state entity or university in Delaware, Michigan, or Ohio and must have experience providing cybersecurity training. The applicant must document a specific eligible history of service relevant to the proposed Cyber Certification Program. A state entity or university may submit one proposal. The program seeks demonstrated experience in cyber awareness, planning, strategy, cybersecurity threats and protections, services to small businesses facing cybersecurity vulnerabilities, and delivery of specialized cyber programs. SBA also expects evidence of capacity to operate at national scale and potentially provide services to more than 3,000 clients. Applications must be submitted electronically through Grants.gov. The application consists of a cover page, table of contents, technical proposal in MS Word format, budget information, certifications, forms and assurances, and applicable attachments and exhibits. The technical proposal may not exceed 10 pages and must describe organizational experience and capacity, proposed technical assistance delivery methods, implementation and evaluation, Project Director and key personnel, contractors and consultants, an organizational chart, a two-year scope of work, quarterly performance milestones, and cumulative project goals and core metrics. Budget submissions include SF-424, SF-424A, the Cost Price Analysis and Budget Justifications workbook, applicable budget justification information, and applicable indirect cost documentation. Attachments may include resumes, position descriptions, letters of support, a conflict of interest policy, and other supporting documentation. SBA will evaluate timely and materially complete applications from eligible organizations for organizational experience and capacity, project design, project management, collaboration and leveraging of resources, and operational controls. Evaluation considerations include cybersecurity expertise and accomplishments, national-scale delivery capability, curriculum and delivery design, outcome measurement, availability of a certification platform, staffing and financial controls, ongoing support, partnerships, audit matters, and efficient use of grant funds. SBA states that, all else being equal, preference will be given to organizations with lower indirect costs. SBA will conduct a sufficiency review followed by a risk evaluation under applicable federal requirements. Applications from ineligible organizations, illegible applications, and materially incomplete applications may be rejected without evaluation. The opportunity opened August 10, 2026, and applications must be received through Grants.gov by September 1, 2026, at 11:59 PM Eastern Daylight Time. Late proposals will generally be rejected without evaluation, subject to the stated exception for demonstrated Grants.gov system issues. The project start date is October 1, 2026, with a two-year period of performance. Selected applicants will receive written award notification, while applicants not selected will not be notified and no debriefing process is provided. The programmatic contact is Traci Giddens at Traci.Giddens@sba.gov, and budgetary questions may be directed to Teresa Clouser at Teresa.Clouser@sba.gov. GrantSolutions technical support is available at help@GrantSolutions.gov or 1-866-577-0771. Recipients must provide quarterly financial and performance reporting, with quarterly reports due 30 days after each quarter and the final report due no later than 120 days after the end of the award period.

Address every sufficiency criterion directly and provide concrete evidence of cybersecurity experience, successful past outcomes, national-scale delivery capacity, and qualified personnel. Present measurable objectives, quarterly milestones, outcome measurement methods, continuous improvement processes, and a clear two-year implementation plan. Explain availability of a 24/7 certification platform and demonstrate access to SBA Resource Partners. Document meaningful partnerships with agreements or letters or emails of support. Show efficient use of the available funding because SBA evaluates efficiency and effectiveness and, all else being equal, prefers lower indirect costs.