PlainBillCongress, translated.Legislation. Context. Public interest.Referred to the House Committee on Oversight and Government Reform.
Congressional Research Service
Version 00 · Introduced in House · Feb 12, 2025
Improving Contractor Cybersecurity Act
This bill prohibits an executive agency from entering into a contract for information technology unless the contractor maintains a vulnerability disclosure policy (VDP) and program.
The contractor must report to the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security, within seven days after the VDP is published and on an ongoing basis as vulnerability reports are received, information regarding
any valid or credible report of a not previously known public vulnerability on a system that uses commercial software or services that affect, or are likely to affect, other parties in government or industry once a patch or viable mitigation is available; and
any other situation where the contractor determines it would be helpful or necessary to involve CISA.
CISA must submit vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database.
People & committees
Rep. Lieu, Ted [D-CA-36] · D–CA
Legislative record
A procedural vote is different from passage. Passage in one chamber does not establish enactment. Explore the glossary.
Referred to the House Committee on Oversight and Government Reform.
Introduced in House
Introduced in House
Primary sources
Text links open the official source. We also preserved the text version used in the PlainBill explanation below.
No related bills are listed in this snapshot. This does not establish whether the proposal has appeared in earlier Congresses.
Source last updated: May 6, 2025. Consult Congress.gov for the current record.
AI Conversation Starters
Choose a perspective, copy a prompt, and paste it into your preferred AI. Each prompt includes the bill version and available official source links, and asks for counterarguments as well as supporting evidence.
Analyze H.R.1258 as objectively as possible. Explain its main provisions, who would be affected, possible benefits and harms, implementation, exceptions, and uncertainties. Present the strongest arguments for and against it, and identify evidence needed to assess its public impact.
Examine H.R.1258 through a progressive lens, focusing on fairness, access, economic inequality, and effects on vulnerable communities. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and distinguish stated goals from demonstrated outcomes.
Examine H.R.1258 through a conservative lens, focusing on fiscal responsibility, institutional stability, federalism, and the scope of government. Explain potential benefits, costs, and unintended consequences. Consider the strongest counterarguments and any provisions that challenge this perspective.
Examine H.R.1258 through a civil-liberties and limited-government lens. Consider individual rights, privacy, voluntary choice, accountability, and government power. Explain tradeoffs, possible safeguards, and the strongest counterarguments without assuming the proposal is beneficial or harmful.
PlainBill explanation
Based on the full Introduced in House · 2025-02-12 text. This explanation has not received human editorial review. This overview describes the proposal’s major provisions; it does not establish what its real-world effects would be.
The proposed Improving Contractor Cybersecurity Act would require companies entering federal executive-agency information technology contracts to maintain policies and procedures for receiving reports of security weaknesses. The public could test systems within those policies’ limits and report weaknesses anonymously. Contractors would describe how they handle reports, make commitments protecting researchers in specified circumstances, and report certain vulnerabilities to the federal cybersecurity agency. These requirements would apply to contracts entered into on or after enactment.
This Act may be cited as the Improving Contractor Cybersecurity Act.
The head of an executive agency may not enter into a contract for information technology unless the contractor maintains or does the following:
a clear statement— (aa) that any individual that submits a vulnerability report may do so anonymously; and (bb) on how and whether any incomplete submission is evaluated;
a commitment from the contractor that the contractor will not pursue civil action for any accidental, good faith violation of the vulnerability disclosure policy;
does not— (i) require the submission of personally identifiable information of a researcher; and (ii) limit testing solely to entities approved by the contractor but rather authorizes the public to search for and report any vulnerability.
an information technology contractor shall report to the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security the following information:
The amendments made by this section shall take effect on the date of the enactment of this section and shall apply to any contract entered into on or after such effective date.
The bill would add a contracting restriction to federal law: an executive agency could not enter an information technology contract unless the contractor met the listed disclosure-policy and program requirements.
Chapter 47 of division C of subtitle I of title 41, United States Code, is amended by adding at the end the following new section: 4715. Vulnerability disclosure policy and program required (a) Requirements for information technology contractors The head of an executive agency may not enter into a contract for information technology unless the contractor maintains or does the following:
Each contractor’s policy would identify which systems could be tested, which types of testing were allowed or unauthorized, and acceptable and unacceptable researcher activity. Within that framework, testing could not be restricted solely to contractor-approved entities; the policy would authorize public participation.
a description of which systems are in scope; (ii) the type of information technology testing for each system that is allowed (or specifically not authorized);
a set of guidelines that establishes what type of activity by a researcher are acceptable and unacceptable;
limit testing solely to entities approved by the contractor but rather authorizes the public to search for and report any vulnerability.
If a contractor included systems holding sensitive information, it would have to decide whether to restrict researchers’ handling of that information. Possible restrictions include stopping access after discovery, allowing only the viewing needed to identify a weakness without retaining the information, or limiting its use to reporting security weaknesses. The text requires that decision, rather than mandating every listed restriction.
if a contractor includes systems that host sensitive information in the vulnerability disclosure policy, the contractor shall determine whether to impose restrictions on accessing, copying, transferring, storing, using, and retaining such information, including by— (I) prohibiting sensitive information from being saved, stored, transferred, or otherwise accessed after initial discovery; (II) directing that sensitive information be viewed only to the extent required to identify a vulnerability and that the information not be retained; or (III) limiting use of information obtained from interacting with the systems or services to be explored by the researcher to activities directly related to reporting security vulnerabilities;
The policy would explain where to send reports, what information was needed to investigate a weakness, and whether and how incomplete reports would be evaluated. Individuals could report anonymously, and the policy could not require information identifying the researcher.
a description of how an individual may submit a vulnerability report that includes— (I) the location of where to send the report, such as a web form or email address; (II) a description of the type of information necessary to find and analyze the vulnerability (such as a description, the location, and potential impact of the vulnerability, the technical information needed to reproduce the vulnerability, and any proof of concept); and (III) a clear statement— (aa) that any individual that submits a vulnerability report may do so anonymously; and (bb) on how and whether any incomplete submission is evaluated;
does not— (i) require the submission of personally identifiable information of a researcher;
Contractors would promise not to bring civil lawsuits over accidental, good-faith violations of their disclosure policies. If a third party sued someone who followed the policy, the contractor would promise to tell the public or the court that the person complied. These are specified contractor commitments, not a stated guarantee against all lawsuits.
a commitment from the contractor that the contractor will not pursue civil action for any accidental, good faith violation of the vulnerability disclosure policy; (vi) a commitment from the contractor that if an individual acting in accordance with the vulnerability disclosure policy of the contractor is sued by a third party, the contractor will inform the public or the court that the individual was acting in compliance with the vulnerability disclosure policy;
Contractors would describe how and when they communicate with researchers, acknowledge reports from known submitters, and address reported weaknesses. They would describe target timelines and tracking for acknowledgment, initial assessment, and resolution, including notice of the outcome. The bill calls for contractor-described timelines rather than setting a single response or repair deadline.
a statement that describes the time frame in which the individual that submits a report, if known, will receive a notification of receipt of the report and a description of what steps will be taken by the contractor during the remediation process;
(2) A description of additional procedures that describe how the contractor will communicate with the researcher, and how and when any communication occurs. (3) A description of the target timelines for and tracking of the following: (A) Notification of receipt to the individual that submits the report, if known. (B) An initial assessment, such as determining whether any disclosed vulnerability is valid. (C) Resolution of a vulnerability, including notification of the outcome to the researcher.
Contractors would maintain a webpage accepting vulnerability reports from anyone, identifying the responsible individual or team’s contact information, and explaining review and response timing. It would say whether monetary rewards were offered; the provision would not require rewards.
A page on the website of the contractor that— (A) allows for the submission of vulnerabilities by anyone relating to the information technology; (B) lists the contact information, such as a phone number or email address for an individual or team responsible for reviewing any such submission under subparagraph (A); and (C) describes the process by which a review is conducted, including how long it will take for the contractor to respond to the researcher and whether or not monetary rewards will be paid to the reporter for identifying a vulnerability.
When a contractor was not responsible for fixing a discovered weakness, it would have to send the report to the responsible party or direct the researcher to the appropriate party.
In the case of a discovered vulnerability that the contractor is not responsible for patching, the contractor shall submit the vulnerability to the responsible party or direct the researcher to the appropriate party.
The reporting requirement to the Cybersecurity and Infrastructure Security Agency would begin no later than seven days after policy publication and continue as reports arrived. It would cover valid or credible reports of previously unknown public vulnerabilities, including configuration errors, on systems using commercial software or services that affect or likely affect others in government or industry, once a fix or workable risk-reduction measure was available. Contractors would also report other situations in which they considered agency involvement helpful or necessary.
Not later than 7 days after the date on which the vulnerability disclosure policy described in subsection (a) is published, and on an ongoing basis as vulnerability reports are received, an information technology contractor shall report to the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security the following information: (1) Any valid or credible report of a not previously known public vulnerability (including any misconfiguration) on a system that uses commercial software or services that affect or are likely to affect other parties in government or industry once a patch or viable mitigation is available. (2) Any other situation where the contractor determines it would be helpful or necessary to involve the Cybersecurity and Infrastructure Security Agency.
The federal cybersecurity agency would communicate with two named vulnerability databases and submit vulnerabilities to them as necessary: MITRE’s Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology’s National Vulnerability Database.
The Cybersecurity and Infrastructure Security Agency shall communicate with and submit, as necessary, vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database.
The bill defines a researcher as the individual submitting a vulnerability report. It uses existing statutory definitions of executive agency and information technology, which are referenced but not reproduced in the supplied text.
(1) Executive agency The term executive agency has the meaning given that term in section 133. (2) Researcher The term researcher means the individual who submits a vulnerability report. (3) Information technology The term information technology has the meaning given that term in section 11101 of title 40.
The amendments would take effect upon enactment and apply to contracts entered into on or after that date.
The amendments made by this section shall take effect on the date of the enactment of this section and shall apply to any contract entered into on or after such effective date.
The supplied official-actions snapshot, updated May 6, 2025, records introduction in the House and referral to the House Committee on Oversight and Government Reform on February 12, 2025.
Source snapshot updated 2025-05-06T13:51:06Z. 2025-02-12: Referred to the House Committee on Oversight and Government Reform. 2025-02-12: Introduced in House
A closer look
Reviewed version: Introduced in House · 2025-02-12. These findings describe provisions and who may benefit; they are not judgments of waste, corruption, or motive.
This review covers the supplied bill text. “None identified” does not rule out provisions in later versions or accompanying reports and disclosures.
Provisions outside the bill’s main subject, or policy changes attached to appropriations.
None identified in the reviewed text
No unrelated provision or policy change attached to appropriations was identified in the complete supplied introduced text. This conclusion is limited to that version and does not establish absence in other versions or accompanying materials.
Spending directed to particular recipients or places outside ordinary competitive or formula-based allocation.
None identified in the reviewed text
No congressionally directed spending for particular recipients or places was identified in the complete supplied introduced text. This conclusion is limited to that version; accompanying earmark materials and other versions are not supplied.
Narrow exceptions, exemptions, or preferential treatment that warrant a closer look.
None identified in the reviewed text
No materially narrow special exemption, carve-out, or preferential treatment was identified in the complete supplied introduced text. Generally available participation and researcher protections do not alone constitute targeted benefits. This conclusion is limited to the supplied version and does not establish absence in other versions or accompanying materials.
Full text preserved for this analysis. Legislative record snapshot: May 6, 2025. How PlainBill uses AI