HR872-119

What This Bill Does

The Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025 makes vulnerability disclosure policies part of federal contracting. Within 180 days, OMB must review Federal Acquisition Regulation contract requirements and language for contractor vulnerability disclosure programs in consultation with CISA, the National Cyber Director, NIST, and other agency heads, then recommend updates to the FAR Council. Those updates must ensure covered contractors implement policies consistent with NIST contractor guidelines under the IoT Cybersecurity Improvement Act of 2020. Within 180 days after receiving the recommended language, the FAR Council must review it and update the FAR as necessary so covered contractors can receive reports about vulnerabilities in contractor-owned or contractor-controlled information systems used to perform federal contracts. The FAR update must align where practicable with coordinated disclosure requirements for federal information systems and ISO Standards 29147 and 30111. Agency heads may waive the requirement for national security or research reasons with notice to House Oversight and Senate Homeland Security. The Defense Department must conduct a parallel DFARS review and revision, with waiver authority for the DOD Chief Information Officer in consultation with the National Manager for National Security Systems.

Who Benefits and How

Federal agencies benefit because contractors operating or supporting federal information systems would have clearer channels to receive vulnerability reports. Security researchers benefit from more standardized disclosure pathways tied to NIST and coordinated-disclosure standards. CISA, the National Cyber Director, and NIST benefit because their guidance becomes part of procurement language rather than voluntary advice. Federal contracting officers benefit from updated FAR and DFARS clauses they can apply across covered contracts. Congressional oversight committees benefit from waiver notices explaining national-security or research exceptions.

Who Bears the Burden and How

Covered federal contractors must implement vulnerability disclosure policies for qualifying contracts, including contracts at or above the simplified acquisition threshold and contracts involving federal information systems. OMB, the FAR Council, and DOD procurement officials must review, draft, and revise acquisition language on statutory timelines. Agency chief information officers and the DOD Chief Information Officer must justify waivers within 30 days when they invoke national-security or research exceptions. Defense contractors must adapt to DFARS requirements in addition to ordinary FAR changes.

Key Provisions

• Requires OMB to review FAR vulnerability disclosure requirements within 180 days.
• Requires OMB recommendations to ensure covered contractors implement NIST-consistent vulnerability disclosure policies.
• Requires the FAR Council to review recommended language and update the FAR within 180 days after receiving it.
• Requires FAR updates to align where practicable with IoT Cybersecurity Improvement Act disclosure processes and ISO 29147 and 30111.
• Authorizes agency waivers for national-security or research reasons with congressional notification within 30 days.
• Requires DOD to conduct a parallel DFARS review, revision, and waiver process.