Bill Summary
The "Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025" aims to enhance cybersecurity measures among federal contractors by mandating the implementation of vulnerability disclosure policies that align with guidelines set by the National Institute of Standards and Technology (NIST).
Key provisions of the Act include:
1. **Policy Development**: Within 180 days of enactment, the Office of Management and Budget (OMB), in collaboration with other federal cybersecurity agencies, will review and recommend updates to the Federal Acquisition Regulation (FAR) to ensure that contractors have effective vulnerability disclosure programs.
2. **Contract Language Updates**: Following the recommendations from OMB, the FAR Council will update procurement requirements to mandate that covered contractors be able to receive and respond to information about potential security vulnerabilities in their information systems.
3. **Alignment with Standards**: The updates to the FAR must align with both federal cybersecurity standards and relevant industry best practices.
4. **Waiver Authority**: Agency heads have the authority to waive these requirements for national security or research purposes, but they must provide justification to congressional committees within 30 days of granting a waiver.
5. **Department of Defense (DoD) Provisions**: The Act also requires the Secretary of Defense to develop similar updates for the Department of Defense Supplement to the FAR (DFARS) to ensure compliance among DoD contractors.
Overall, this legislation is designed to bolster the cybersecurity posture of federal contractors and enhance the government's ability to manage and mitigate cybersecurity risks.
Possible Impacts
The "Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025" could affect people in several ways:
1. **Increased Security for Personal Data**: As federal contractors implement vulnerability disclosure policies that align with NIST guidelines, the security of systems that handle personal data may improve. This could reduce the risk of data breaches, ultimately protecting individuals’ personal information from unauthorized access and potential misuse.
2. **Economic Impact on Contractors**: Covered contractors may face increased costs and operational changes to comply with the new vulnerability disclosure policies. This could lead to higher prices for government contracts, which might affect taxpayers and the overall budget for governmental projects. Companies may need to invest in new technologies or personnel to meet compliance, potentially impacting their financial stability and workforce.
3. **Greater Transparency and Accountability**: The requirement for contractors to report security vulnerabilities can foster a culture of transparency and accountability in cybersecurity practices. This may build public trust in government contractors as they become more proactive in addressing security flaws, leading to better outcomes for citizens who rely on government services that depend on these contractors.
[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[H.R. 872 Referred in Senate (RFS)]
<DOC>
119th CONGRESS
1st Session
H. R. 872
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
March 4, 2025
Received; read twice and referred to the Committee on Homeland Security
and Governmental Affairs
_______________________________________________________________________
AN ACT
To require covered contractors implement a vulnerability disclosure
policy consistent with NIST guidelines, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Federal Contractor Cybersecurity
Vulnerability Reduction Act of 2025''.
SEC. 2. FEDERAL CONTRACTOR VULNERABILITY DISCLOSURE POLICY.
(a) Recommendations.--
(1) In general.--Not later than 180 days after the date of
the enactment of this Act, the Director of the Office of
Management and Budget, in consultation with the Director of the
Cybersecurity and Infrastructure Security Agency, the National
Cyber Director, the Director of the National Institute of
Standards and Technology, and any other appropriate head of an
Executive department, shall--
(A) review the Federal Acquisition Regulation
contract requirements and language for contractor
vulnerability disclosure programs; and
(B) recommend updates to such requirements and
language to the Federal Acquisition Regulation Council.
(2) Contents.--The recommendations required by paragraph
(1) shall include updates to such requirements designed to
ensure that covered contractors implement a vulnerability
disclosure policy consistent with NIST guidelines for
contractors as required under section 5 of the IoT
Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g-3c;
Public Law 116-207).
(b) Procurement Requirements.--Not later than 180 days after the
date on which the recommended contract language developed pursuant to
subsection (a) is received, the Federal Acquisition Regulation Council
shall review the recommended contract language and update the FAR as
necessary to incorporate requirements for covered contractors to
receive information about a potential security vulnerability relating
to an information system owned or controlled by a contractor, in
performance of the contract.
(c) Elements.--The update to the FAR pursuant to subsection (b)
shall--
(1) to the maximum extent practicable, align with the
security vulnerability disclosure process and coordinated
disclosure requirements relating to Federal information systems
under sections 5 and 6 of the IoT Cybersecurity Improvement Act
of 2020 (Public Law 116-207; 15 U.S.C. 278g-3c and 278g-3d);
and
(2) to the maximum extent practicable, be aligned with
industry best practices and Standards 29147 and 30111 of the
International Standards Organization (or any successor
standard) or any other appropriate, relevant, and widely used
standard.
(d) Waiver.--The head of an agency may waive the security
vulnerability disclosure policy requirement under subsection (b) if--
(1) the agency Chief Information Officer determines that
the waiver is necessary in the interest of national security or
research purposes; and
(2) if, not later than 30 days after granting a waiver,
such head submits a notification and justification (including
information about the duration of the waiver) to the Committee
on Oversight and Government Reform of the House of
Representatives and the Committee on Homeland Security and
Governmental Affairs of the Senate.
(e) Department of Defense Supplement to the Federal Acquisition
Regulation.--
(1) Review.--Not later than 180 days after the date of the
enactment of this Act, the Secretary of Defense shall review
the Department of Defense Supplement to the Federal Acquisition
Regulation contract requirements and language for contractor
vulnerability disclosure programs and develop updates to such
requirements designed to ensure that covered contractors
implement a vulnerability disclosure policy consistent with
NIST guidelines for contractors as required under section 5 of
the IoT Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g-
3c; Public Law 116-207).
(2) Revisions.--Not later than 180 days after the date on
which the review required under subsection (a) is completed,
the Secretary shall revise the DFARS as necessary to
incorporate requirements for covered contractors to receive
information about a potential security vulnerability relating
to an information system owned or controlled by a contractor,
in performance of the contract.
(3) Elements.--The Secretary shall ensure that the revision
to the DFARS described in this subsection is carried out in
accordance with the requirements of paragraphs (1) and (2) of
subsection (c).
(4) Waiver.--The Chief Information Officer of the
Department of Defense, in consultation with the National
Manager for National Security Systems, may waive the security
vulnerability disclosure policy requirements under paragraph
(2) if the Chief Information Officer--
(A) determines that the waiver is necessary in the
interest of national security or research purposes; and
(B) not later than 30 days after granting a waiver,
submits a notification and justification (including
information about the duration of the waiver) to the
Committees on Armed Services of the House of
Representatives and the Senate.
(f) Definitions.--In this section:
(1) The term ``agency'' has the meaning given the term in
section 3502 of title 44, United States Code.
(2) The term ``covered contractor'' means a contractor (as
defined in section 7101 of title 41, United States Code)--
(A) whose contract is in an amount the same as or
greater than the simplified acquisition threshold; or
(B) that uses, operates, manages, or maintains a
Federal information system (as defined by section 11331
of title 40, United Stated Code) on behalf of an
agency.
(3) The term ``DFARS'' means the Department of Defense
Supplement to the Federal Acquisition Regulation.
(4) The term ``Executive department'' has the meaning given
that term in section 101 of title 5, United States Code.
(5) The term ``FAR'' means the Federal Acquisition
Regulation.
(6) The term ``NIST'' means the National Institute of
Standards and Technology.
(7) The term ``OMB'' means the Office of Management and
Budget.
(8) The term ``security vulnerability'' has the meaning
given that term in section 2200 of the Homeland Security Act of
2002 (6 U.S.C. 650).
(9) The term ``simplified acquisition threshold'' has the
meaning given that term in section 134 of title 41, United
States Code.
Passed the House of Representatives March 3, 2025.
Attest:
KEVIN F. MCCUMBER,
Clerk.