Skip to Content

Do you allow analytics?

We use analytics tools to understand how people use the site. They're optional: if you decline, the site works the same, no analytics cookies are set and Google gets only a cookieless, anonymous count signal. Your votes are saved either way; the details are in the privacy policy.

Referandom is here: Tinder for Congress 🔥

Support Referandom
GovernmentH.R. 872Comments

Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025

Official title: To require covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines, and for other purposes.

What Do You Think?

How would you vote?

Referandom Vote

Vote to see the result.

Where the Bill Stands

  1. Introduced, done
  2. Committee, done
  3. Floor Vote, done
  4. Outcome, current stage

What This Bill Does

This bill requires revisions to acquisition regulations related to information systems vulnerabilities for certain federal contractors. The revisions apply to contractors whose contract is at or above the simplified acquisition threshold ($250,000 in most cases) or that use, operate, manage, or maintain a federal information system on behalf of an agency.

Under the bill, the Office of Management and Budget must review the Federal Acquisition Regulation (FAR) and recommend updated contract requirements and language for contractor vulnerability disclosure programs. (Such programs establish processes for identifying, reporting, and mitigating information system vulnerabilities discovered by security researchers, software developers, and others.) The recommendations must include requirements to ensure that such contractors implement vulnerability disclosure policies consistent with guidelines from the National Institute of Standards and Technology. The Federal Acquisition Regulation Council must review these recommendations and update the FAR as necessary to incorporate requirements for such contractors to receive information about potential security vulnerabilities in contractor information systems used in performance of contract.

The Department of Defense (DOD) must conduct a similar review and update of regulations with respect to the DOD Supplement to the FAR.

Sponsors

Related Documents

Bill on Congress.govWeb Page ↗ (opens in a new tab)

Timeline

  1. SenateReceived in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
  2. House floor actionsMr. Comer moved to suspend the rules and pass the bill, as amended.
  3. Passed the House
  4. Library of CongressIntroduced in House
  5. House floor actionsReferred to the Committee on Oversight and Government Reform, and in addition to the Committee on Armed Services, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
  6. Introduced
  7. Committee

Comments

Comments with insults, hate speech or personal information are removed.