PRIA Logo™
119-s-1899119th CongressWALLET

Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025

Sponsored By: Senator Warner, Mark R. [D-VA]

Introduced

Summary

Requires covered federal contractors to adopt vulnerability disclosure policies aligned with NIST guidance and the IoT Cybersecurity Improvement Act of 2020. It would direct OMB, working with CISA, the National Cyber Director, and NIST, to review and recommend updates to FAR contract language so contractors must solicit and address reports of security vulnerabilities.

Show full summary
  • Contractors would need a vulnerability disclosure policy consistent with NIST guidelines and IoT Act section 5 if they meet the bill's definition of a covered contractor or operate a federal information system used under a contract.
  • Agencies would have deadlines for changes. OMB must review FAR language and recommend updates within 180 days and the FAR Council would have 180 days after receiving recommendations to amend the FAR as needed.
  • Disclosure rules would be aligned with IoT Act sections 5 and 6 and with industry best practices and ISO Standards 29147 and 30111.
  • Agency Chief Information Officers could grant waivers for national security or research reasons but must notify the Senate Homeland Security and Governmental Affairs Committee and the House Committee on Oversight and Reform within 30 days with justification and a waiver duration.

*Does not authorize additional appropriations for implementation.*

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

1 provisions identified: 0 benefits, 1 costs, 0 mixed.

New cybersecurity rules for federal contractors

If enacted, this bill would require many federal contractors to adopt vulnerability disclosure policies. You would be a "covered contractor" if your contract is at or above the simplified acquisition threshold or if you run or maintain a federal agency computer system. OMB would have 180 days to review contract rules and recommend FAR updates. The FAR Council would have 180 days after receiving recommendations to update the FAR so contractors must solicit and address reports of possible security vulnerabilities. The updates would be aligned with NIST guidance, the IoT Cybersecurity Improvement Act, and common industry standards (ISO 29147 and 30111 or successors). An agency CIO could waive the rule for national security or research reasons, but the agency must notify two congressional committees with the reason and waiver duration within 30 days. The bill would not authorize new money to carry out these rules; agencies must use existing funds.

Sponsors & CoSponsors

Sponsor

Warner, Mark R. [D-VA]

VA • D

Cosponsors

  • Sen. Lankford, James [R-OK]

    OK • R

    Sponsored 6/2/2025

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation