PRIA Logo™
119-hr-872119th CongressWALLET

Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025

Sponsored By: Representative Mace, Nancy [R-SC-1]

Passed House

Summary

Requires federal contractors to adopt standardized vulnerability disclosure programs to ensure they receive and handle reports of security flaws. It directs the Office of Management and Budget and the Department of Defense to update the Federal Acquisition Regulation and its DoD supplement so contractor rules align with NIST guidance and international disclosure standards.

Show full summary
  • Covered contractors. Contractors with contracts at or above the simplified acquisition threshold ($250,000) or those that use, operate, manage, or maintain a federal information system must implement vulnerability disclosure policies consistent with NIST guidelines and relevant ISO standards. They must be set up to receive information about potential security vulnerabilities in contractor-owned or controlled systems.
  • Agency and DoD rule updates. The Director of OMB must review and recommend FAR contract language in consultation with CISA, the National Cyber Director, and NIST within 180 days. The FAR Council and the Secretary of Defense must then review and update the FAR and the DoD FAR supplement (DFARS) to incorporate those contractor requirements within 180 days of receiving recommendations.
  • Waivers and notifications. An agency head or the DoD Chief Information Officer may waive the disclosure requirement for national security or research reasons but must notify the relevant congressional committees within 30 days with justification and the waiver duration.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

2 provisions identified: 1 benefits, 1 costs, 0 mixed.

New cyber disclosure rules for federal contractors

If enacted, the government would update federal and DoD contract rules for cybersecurity disclosures. OMB would propose FAR changes within 180 days of enactment, and the FAR Council would finish updates within 180 days after it receives them. DoD would review DFARS within 180 days and issue needed revisions within 180 days after that review. Updates would require covered contractors to have a NIST- and ISO-aligned vulnerability disclosure policy and to receive reports about security problems in systems they use for the contract. You would be a “covered contractor” if your contract is at or above the simplified acquisition threshold or you run a federal information system for an agency, so many firms would face new compliance work.

Limited waivers for contractor cyber reporting

If enacted, agency heads would be able to waive FAR vulnerability disclosure rules when the agency CIO finds it needed for national security or research. The agency would have to notify House Oversight and Senate Homeland Security within 30 days and state how long the waiver lasts. For DoD work, the DoD CIO (after consulting the National Manager for National Security Systems) would be able to waive DFARS disclosure rules on the same grounds. DoD would have to notify the House and Senate Armed Services Committees within 30 days and include the waiver’s duration. These waivers would be narrow and case by case.

Sponsors & CoSponsors

Sponsor

Mace, Nancy [R-SC-1]

SC • R

Cosponsors

  • Rep. Brown, Shontel M. [D-OH-11]

    OH • D

    Sponsored 1/31/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation