HR 1258
119th Congress
House
Government Operations and Politics
Computers and information technology
Government information and archives
Public contracts and procurement
Improving Contractor Cybersecurity Act
Everywhere this bill has been
2 steps
Introduced
In committee
Reported out
Passed House
Passed Senate
To President
Became law
Feb 12, 2025
Referred to the House Committee on Oversight and Government Reform.
Feb 12, 2025
Introduced in House
Plain-English summary
Improving Contractor Cybersecurity Act
This bill prohibits an executive agency from entering into a contract for information technology unless the contractor maintains a vulnerability disclosure policy (VDP) and program.
The contractor must report to the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security, within seven days after the VDP is published and on an ongoing basis as vulnerability reports are received, information regarding
- any valid or credible report of a not previously known public vulnerability on a system that uses commercial software or services that affect, or are likely to affect, other parties in government or industry once a patch or viable mitigation is available; and
- any other situation where the contractor determines it would be helpful or necessary to involve CISA.
CISA must submit vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database.
What's happening now
Referred to the House Committee on Oversight and Government Reform.
Committees of jurisdiction
1