PRIA Logo™
119-hr-1258119th CongressWALLET

Improving Contractor Cybersecurity Act

Sponsored By: Representative Lieu, Ted [D-CA-36]

Introduced

Summary

Requires IT contractors to publish vulnerability disclosure programs and report key findings to the Cybersecurity and Infrastructure Security Agency (CISA). This bill would make a published vulnerability disclosure policy a condition for federal IT contracts and set specific content and reporting rules.

Show full summary
  • Contractors would have to publish a vulnerability disclosure policy that lists in-scope systems, allowed testing, how sensitive data is handled, reporting channels, response timelines, and guidelines on acceptable researcher activity. They must also promise not to pursue civil action against good faith reporters.
  • Security researchers would get clear, public ways to submit reports, the option to remain anonymous, and commitments on how the contractor will acknowledge and respond to reports.
  • Federal agencies would be barred from awarding IT contracts to companies that do not meet the policy and reporting requirements, making VDPs a procurement condition.
  • Contractors must notify CISA within 7 days of publishing a policy and report valid new public vulnerabilities as they are received; CISA would forward those vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the NIST National Vulnerability Database.
  • If a discovered vulnerability is not the contractor's responsibility to patch, the contractor must submit it to the responsible party or direct the researcher to that party.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

2 provisions identified: 1 benefits, 0 costs, 1 mixed.

Report serious software bugs to the cyber agency

If enacted, information technology contractors would need to tell the federal cybersecurity agency about new, credible software flaws. They would report not later than 7 days after they publish their policy and keep reporting as valid reports arrive, once a patch or workaround is available. If another party is responsible for the fix, the contractor would forward the report or tell the researcher who to contact. The agency would share details with public databases like the MITRE Common Vulnerabilities and Exposures list and the National Vulnerability Database at NIST, and could get involved in other helpful cases.

Public bug-report rules for information technology contractors

If enacted, executive agencies would not sign new information technology contracts unless the contractor keeps a public vulnerability disclosure policy and web page. The policy would list which systems are in scope and what testing is allowed, and the page would let anyone report bugs, even anonymously, with contact info and expected response times. Contractors would commit not to sue good‑faith researchers and would publish rules for acceptable research activity. For systems with sensitive data, the policy could limit viewing or storing that data, but it could not require a researcher's personal ID or limit testing only to preapproved people.

Sponsors & CoSponsors

Sponsor

Lieu, Ted [D-CA-36]

CA • D

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation