H.R. 1258 · 119th Congress
Improving Contractor Cybersecurity Act
Key: what the circles and colors mean
Each circle is a bill. The ring fills as it moves through Congress:
Under the number: the Yea · Nay count of its final (or latest) recorded vote. On a member's page, the small badge is how that member voted: Y Yea / Aye, N Nay / No, P Present, – Not voting.
Gold and violet are only for Yea and Nay; they never mean a party. A member's party is the letter on their photo.
Not yet voted on. This bill is still a proposal: it hasn't reached a floor vote, and its text can change in committee or on the floor before any vote.
D
LieuSponsorNo cosponsors.
This bill prohibits an executive agency from entering into a contract for information technology unless the contractor maintains a vulnerability disclosure policy (VDP) and program.
What it does: CRS summary · Introduced in House · Feb 12, 2025
Improving Contractor Cybersecurity Act
This bill prohibits an executive agency from entering into a contract for information technology unless the contractor maintains a vulnerability disclosure policy (VDP) and program.
The contractor must report to the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security, within seven days after the VDP is published and on an ongoing basis as vulnerability reports are received, information regarding
- any valid or credible report of a not previously known public vulnerability on a system that uses commercial software or services that affect, or are likely to affect, other parties in government or industry once a patch or viable mitigation is available; and
- any other situation where the contractor determines it would be helpful or necessary to involve CISA.
CISA must submit vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database.
Written by the nonpartisan Congressional Research Service. All summary versions on Congress.gov
About this bill and sources
Official title: Improving Contractor Cybersecurity Act
Latest action (Feb 12, 2025): Referred to the House Committee on Oversight and Government Reform.
Policy area: Government Operations and Politics · Origin: House · Introduced: Feb 12, 2025
Official page on Congress.gov · Bill text (GovInfo) · Status record (XML)
No recorded floor vote found.