Technical corrections only. The v3 version of H.R. 872 reflects its referral to the Senate and includes the name of the House Clerk, which are procedural updates after passing the House. No substantive policy changes were made to the bill text.
Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025
- Sponsor
- Rep. Mace, Nancy [R-SC-1]
- Committees
- Homeland Security and Governmental Affairs Committee (primary)
- Last action
- Mar 4, 2025
Bottom line
The bill aims to enhance federal supply chain cybersecurity by standardizing vulnerability disclosure requirements for contractors, aligning them with established cybersecurity frameworks.
What it actually does
This bill mandates that federal agencies, through updates to the Federal Acquisition Regulation (FAR) and the Department of Defense Supplement to the FAR (DFARS), require covered contractors to implement vulnerability disclosure policies. These policies must be consistent with National Institute of Standards and Technology (NIST) guidelines and industry best practices, ensuring contractors have a formal process to receive information about potential security vulnerabilities in their information systems used for federal contracts. It also includes waiver provisions for national security or research purposes.
Proponents argue
Proponents argue that this legislation is a crucial step to bolster the cybersecurity posture of the federal government and its supply chain. By requiring contractors to adopt formal vulnerability disclosure policies, the bill will facilitate the identification and remediation of security flaws before they can be exploited, thereby reducing the risk of costly data breaches and cyberattacks. They emphasize that aligning with NIST guidelines and international standards ensures a consistent, effective, and widely recognized approach to cybersecurity.
Opponents contend
Opponents, if any, might contend that this bill could impose additional compliance burdens and costs on federal contractors, particularly smaller businesses, potentially deterring them from seeking government contracts. They might argue that existing contractual obligations or market forces already incentivize cybersecurity best practices, and that a new mandate could be overly prescriptive or redundant, leading to increased bureaucracy without a proportional increase in security.
The bill is concise and clearly written, making it accessible for a quick read and easy to understand its core purpose within a short timeframe.
Section 2(a) and 2(b)
Federal Acquisition Regulation (FAR) Updates for Vulnerability Disclosure
This provision requires the Office of Management and Budget (OMB), in consultation with key cybersecurity agencies, to review existing Federal Acquisition Regulation (FAR) requirements and recommend updates to the FAR Council within 180 days. These recommendations must ensure that federal contractors implement a vulnerability disclosure policy consistent with NIST guidelines. Subsequently, the FAR Council must update the FAR within 180 days of receiving these recommendations to incorporate these new requirements, obligating covered contractors to have a system for receiving security vulnerability information.
Supporters argue
Supporters argue that standardizing vulnerability disclosure through the FAR will create a consistent and robust framework across all federal contracts, significantly improving the security posture of the federal supply chain. This proactive approach is essential for identifying and mitigating risks effectively.
Critics contend
Critics might argue that mandating specific policy implementations through FAR updates could lead to a 'one-size-fits-all' approach that may not be optimal for all contractors or contract types, potentially increasing compliance costs without necessarily enhancing security proportionally.
Tradeoffs
The provision balances the need for enhanced cybersecurity with the potential for increased administrative and compliance burdens on both government entities and contractors. It seeks to leverage existing regulatory frameworks (FAR) to achieve a new security objective.
Section 2(e)
Department of Defense Supplement (DFARS) Updates and Waiver Authority
This section specifically directs the Secretary of Defense to review and update the Department of Defense Supplement to the Federal Acquisition Regulation (DFARS) within 180 days of the Act's enactment. The updates must ensure that covered contractors working with the DoD implement vulnerability disclosure policies consistent with NIST guidelines. Similar to the general FAR requirements, these revisions must align with industry best practices. It also grants the DoD Chief Information Officer, in consultation with the National Manager for National Security Systems, the authority to waive these requirements for national security or research purposes, provided Congress is notified.
The definition of 'covered contractor' includes any contractor whose contract is equal to or greater than the simplified acquisition threshold, OR any contractor that uses, operates, manages, or maintains a Federal information system on behalf of an agency. This means even small contracts can be covered if they involve federal information systems.
Section 2(f)(2)
Why it matters:This is standard legislative practice to consolidate definitions at the end of a bill. However, its specific wording significantly broadens the scope of the bill's applicability.
Case for: Supporters would argue that this broad definition is essential to close potential cybersecurity gaps. Many critical federal information systems are managed by contractors whose individual contracts might fall below a higher monetary threshold, but whose work is vital to federal operations. Including them ensures comprehensive security.
Case against: Critics might argue that this broad definition could disproportionately impact small businesses or specialized contractors who might not meet the simplified acquisition threshold but could still be caught by the 'uses, operates, manages, or maintains a Federal information system' clause, leading to unexpected compliance costs.
Estimated impact: Significantly expands the number and type of federal contractors subject to the new vulnerability disclosure requirements, beyond just those with large contracts.
The bill explicitly requires that the updates to the FAR and DFARS align with the security vulnerability disclosure process and coordinated disclosure requirements under sections 5 and 6 of the IoT Cybersecurity Improvement Act of 2020 (Public Law 116-207).
Section 2(c)(1) and 2(e)(3)
Why it matters:This is a common legislative technique to avoid reprinting lengthy statutory language and to ensure consistency with existing law. It is not necessarily evasive.
Case for: Proponents would highlight that this cross-reference ensures consistency and leverages established, effective cybersecurity frameworks. The IoT Cybersecurity Improvement Act already provides a robust model for vulnerability disclosure, making its adoption here a logical and efficient approach.
Case against: No specific opposition is typically raised against leveraging existing, well-regarded cybersecurity frameworks, though some might argue that it limits flexibility for future adaptations if the referenced act becomes outdated.
Estimated impact: Ensures that the new contractor vulnerability disclosure policies are built upon a foundation of existing, proven federal cybersecurity standards, promoting interoperability and clarity.