# 119-hr-872: Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025

119-hr-872, Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025, is a 119th Congress bill sponsored by Rep. Mace, Nancy [R-SC-1] (R-SC); status passed_house; PRIA reads it as touching household money (as of 2026-07-20).

- Canonical: https://policyrisk.com/legislation/119-hr-872
- As of: 2026-07-20
- Plain-text twin of the page above; the HTML and this file carry the same facts.

## Facts
- Bill: 119-hr-872
- Congress: 119
- Title: Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025
- Status: passed_house
- Introduced: 2025-01-31
- Sponsor: Rep. Mace, Nancy [R-SC-1] (R-SC)
- Cosponsors: 1
- Policy area: Government Operations and Politics
- Touches household money: yes
- Last recorded action: 2026-07-20

## Summary

**Requires federal contractors to adopt standardized vulnerability disclosure programs to ensure they receive and handle reports of security flaws.** It directs the Office of Management and Budget and the Department of Defense to update the Federal Acquisition Regulation and its DoD supplement so contractor rules align with NIST guidance and international disclosure standards. - Covered contractors. Contractors with contracts at or above the simplified acquisition threshold ($250,000) or those that use, operate, manage, or maintain a federal information system must implement vulnerability disclosure policies consistent with NIST guidelines and relevant ISO standards. They must be set up to receive information about potential security vulnerabilities in contractor-owned or controlled systems. - Agency and DoD rule updates. The Director of OMB must review and recommend FAR contract language in consultation with CISA, the National Cyber Director, and NIST within 180 days. The FAR Council and the Secretary of Defense must then review and update the FAR and the DoD FAR supplement (DFARS) to incorporate those contractor requirements within 180 days of receiving recommendations. - Waivers and notifications. An agency head or the DoD Chief Information Officer may waive the disclosure requirement for national security or research reasons but must notify the relevant congressional committees within 30 days with justification and the waiver duration.

## Cosponsors (1)

- Rep. Brown, Shontel M. [D-OH-11] (D-OH), 2025-01-31T00:00:00.000Z

## Provisions PRIA read

- Limited waivers for contractor cyber reporting: benefit, low. If enacted, agency heads would be able to waive FAR vulnerability disclosure rules when the agency CIO finds it needed for national security or research. The agency would have to notify House Oversight and Senate Homeland Security within 30 days and state how long the waiver lasts. For DoD work, th…
- New cyber disclosure rules for federal contractors: cost, medium. If enacted, the government would update federal and DoD contract rules for cybersecurity disclosures. OMB would propose FAR changes within 180 days of enactment, and the FAR Council would finish updates within 180 days after it receives them. DoD would review DFARS within 180 days and issue needed…

## Related bills

- 119-hr-3151: SHIPS for America Act of 2025
- 119-hr-5457: Strengthening Agency Management and Oversight of Software Assets Act
- 119-hr-1684: PAST Act of 2025
- 119-hr-1422: Enhanced Iran Sanctions Act of 2025
- 119-hr-5000: Cybersecurity Hiring Modernization Act
- 119-hr-4398: Veteran Burial Timeliness and Death Certificate Accountability Act

## Sources
- [119-hr-872 on Congress.gov](https://www.congress.gov/bill/119th-congress/house-bill/872)

## Related
- [119-hr-3151: SHIPS for America Act of 2025](https://policyrisk.com/legislation/119-hr-3151)
- [119-hr-5457: Strengthening Agency Management and Oversight of Software Assets Act](https://policyrisk.com/legislation/119-hr-5457)
- [119-hr-1684: PAST Act of 2025](https://policyrisk.com/legislation/119-hr-1684)
- [119-hr-1422: Enhanced Iran Sanctions Act of 2025](https://policyrisk.com/legislation/119-hr-1422)
- [119-hr-5000: Cybersecurity Hiring Modernization Act](https://policyrisk.com/legislation/119-hr-5000)
- [119-hr-4398: Veteran Burial Timeliness and Death Certificate Accountability Act](https://policyrisk.com/legislation/119-hr-4398)
- [All bills in Congress](https://policyrisk.com/legislation)

Source: PRIA, https://policyrisk.com/legislation/119-hr-872 (as of 2026-07-20).