# 119-hr-1258: Improving Contractor Cybersecurity Act

119-hr-1258, Improving Contractor Cybersecurity Act, is a 119th Congress bill sponsored by Rep. Lieu, Ted [D-CA-36] (D-CA); status introduced; PRIA reads it as touching household money (as of 2025-12-21).

- Canonical: https://policyrisk.com/legislation/119-hr-1258
- As of: 2025-12-21
- Plain-text twin of the page above; the HTML and this file carry the same facts.

## Facts
- Bill: 119-hr-1258
- Congress: 119
- Title: Improving Contractor Cybersecurity Act
- Status: introduced
- Introduced: 2025-02-12
- Sponsor: Rep. Lieu, Ted [D-CA-36] (D-CA)
- Cosponsors: 0
- Policy area: Government Operations and Politics
- Touches household money: yes
- Last recorded action: 2025-12-21

## Summary

**Requires IT contractors to publish vulnerability disclosure programs and report key findings to the Cybersecurity and Infrastructure Security Agency (CISA).** This bill would make a published vulnerability disclosure policy a condition for federal IT contracts and set specific content and reporting rules. - Contractors would have to publish a vulnerability disclosure policy that lists in-scope systems, allowed testing, how sensitive data is handled, reporting channels, response timelines, and guidelines on acceptable researcher activity. They must also promise not to pursue civil action against good faith reporters. - Security researchers would get clear, public ways to submit reports, the option to remain anonymous, and commitments on how the contractor will acknowledge and respond to reports. - Federal agencies would be barred from awarding IT contracts to companies that do not meet the policy and reporting requirements, making VDPs a procurement condition. - Contractors must notify CISA within 7 days of publishing a policy and report valid new public vulnerabilities as they are received; CISA would forward those vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the NIST National Vulnerability Database. - If a discovered vulnerability is not the contractor's responsibility to patch, the contractor must submit it to the responsible party or direct the researcher to that party.

## Provisions PRIA read

- Report serious software bugs to the cyber agency: benefit, medium. If enacted, information technology contractors would need to tell the federal cybersecurity agency about new, credible software flaws. They would report not later than 7 days after they publish their policy and keep reporting as valid reports arrive, once a patch or workaround is available. If anot…
- Public bug-report rules for information technology contractors: mixed, medium. If enacted, executive agencies would not sign new information technology contracts unless the contractor keeps a public vulnerability disclosure policy and web page. The policy would list which systems are in scope and what testing is allowed, and the page would let anyone report bugs, even anonymo…

## Related bills

- 119-hr-9877: Health Equity and Accountability Act of 2026
- 119-hr-3151: SHIPS for America Act of 2025
- 119-hr-7977: Energy Bills Relief Act
- 119-hr-7481: Department of Homeland Security Appropriations Act, 2026
- 119-hr-7973: Momnibus Act
- 119-hr-8516: American Leadership in AI Act

## Sources
- [119-hr-1258 on Congress.gov](https://www.congress.gov/bill/119th-congress/house-bill/1258)

## Related
- [119-hr-9877: Health Equity and Accountability Act of 2026](https://policyrisk.com/legislation/119-hr-9877)
- [119-hr-3151: SHIPS for America Act of 2025](https://policyrisk.com/legislation/119-hr-3151)
- [119-hr-7977: Energy Bills Relief Act](https://policyrisk.com/legislation/119-hr-7977)
- [119-hr-7481: Department of Homeland Security Appropriations Act, 2026](https://policyrisk.com/legislation/119-hr-7481)
- [119-hr-7973: Momnibus Act](https://policyrisk.com/legislation/119-hr-7973)
- [119-hr-8516: American Leadership in AI Act](https://policyrisk.com/legislation/119-hr-8516)
- [All bills in Congress](https://policyrisk.com/legislation)

Source: PRIA, https://policyrisk.com/legislation/119-hr-1258 (as of 2025-12-21).