The bill would require federal contract rules to include vulnerability disclosure policies for covered contractors. Within 180 days after enactment, the Office of Management and Budget would recommend updates to the Federal Acquisition Regulation, consulting cybersecurity and standards officials. The regulation council would then have 180 days after receiving those recommendations to review them and make needed changes. The policies would follow NIST guidance and, where practicable, align with federal disclosure processes and industry standards. Agencies could waive the requirement for national security or research purposes, with a written notice and justification sent to Congress within 30 days.
Contractors with contracts at or above the simplified acquisition threshold, and contractors that operate or manage federal information systems, would be covered. They would need to seek and address information about possible security weaknesses in systems used to perform federal contracts. Agency officials could grant a limited waiver under the conditions in the bill.
The bill authorizes no additional funds for its implementation.
No publicly available information.
No publicly available information.