# 119-s-1899: Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025

119-s-1899, Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025, is a 119th Congress bill sponsored by Sen. Warner, Mark R. [D-VA] (D-VA); status introduced; PRIA reads it as touching household money (as of 2025-12-21).

- Canonical: https://policyrisk.com/legislation/119-s-1899
- As of: 2025-12-21
- Plain-text twin of the page above; the HTML and this file carry the same facts.

## Facts
- Bill: 119-s-1899
- Congress: 119
- Title: Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025
- Status: introduced
- Introduced: 2025-05-22
- Sponsor: Sen. Warner, Mark R. [D-VA] (D-VA)
- Cosponsors: 1
- Policy area: Science, Technology, Communications
- Touches household money: yes
- Last recorded action: 2025-12-21

## Summary

**Requires covered federal contractors to adopt vulnerability disclosure policies aligned with NIST guidance and the IoT Cybersecurity Improvement Act of 2020.** It would direct OMB, working with CISA, the National Cyber Director, and NIST, to review and recommend updates to FAR contract language so contractors must solicit and address reports of security vulnerabilities. - Contractors would need a vulnerability disclosure policy consistent with NIST guidelines and IoT Act section 5 if they meet the bill's definition of a covered contractor or operate a federal information system used under a contract. - Agencies would have deadlines for changes. OMB must review FAR language and recommend updates within 180 days and the FAR Council would have 180 days after receiving recommendations to amend the FAR as needed. - Disclosure rules would be aligned with IoT Act sections 5 and 6 and with industry best practices and ISO Standards 29147 and 30111. - Agency Chief Information Officers could grant waivers for national security or research reasons but must notify the Senate Homeland Security and Governmental Affairs Committee and the House Committee on Oversight and Reform within 30 days with justification and a waiver duration. *Does not authorize additional appropriations for implementation.*

## Cosponsors (1)

- Sen. Lankford, James [R-OK] (R-OK), 2025-06-02T00:00:00.000Z

## Provisions PRIA read

- New cybersecurity rules for federal contractors: cost, medium. If enacted, this bill would require many federal contractors to adopt vulnerability disclosure policies. You would be a "covered contractor" if your contract is at or above the simplified acquisition threshold or if you run or maintain a federal agency computer system. OMB would have 180 days to re…

## Related bills

- 119-s-1748: Kids Online Safety Act
- 119-s-882: Patients Before Middlemen Act
- 119-s-789: Critical Minerals Security Act of 2025
- 119-s-554: United States-Israel Defense Partnership Act of 2025
- 119-s-3990: PrEP Access and Coverage Act of 2026
- 119-s-1639: American Innovation and Jobs Act

## Sources
- [119-s-1899 on Congress.gov](https://www.congress.gov/bill/119th-congress/senate-bill/1899)

## Related
- [119-s-1748: Kids Online Safety Act](https://policyrisk.com/legislation/119-s-1748)
- [119-s-882: Patients Before Middlemen Act](https://policyrisk.com/legislation/119-s-882)
- [119-s-789: Critical Minerals Security Act of 2025](https://policyrisk.com/legislation/119-s-789)
- [119-s-554: United States-Israel Defense Partnership Act of 2025](https://policyrisk.com/legislation/119-s-554)
- [119-s-3990: PrEP Access and Coverage Act of 2026](https://policyrisk.com/legislation/119-s-3990)
- [119-s-1639: American Innovation and Jobs Act](https://policyrisk.com/legislation/119-s-1639)
- [All bills in Congress](https://policyrisk.com/legislation)

Source: PRIA, https://policyrisk.com/legislation/119-s-1899 (as of 2025-12-21).