# Plain Language Summary: Improving Contractor Cybersecurity Act

This bill requires companies that do information technology work for the federal government to create and maintain a public system where anyone can report security vulnerabilities they find in the company's systems. Think of it like creating an official channel for security researchers and everyday people to alert a company when they discover a digital security weakness, rather than having to figure out who to contact or worrying about legal consequences for trying to help.

The bill spells out exactly what these companies need to do. They must publish a clear vulnerability disclosure policy on their website that explains which computer systems people are allowed to test, what types of testing are permitted, and how to submit a report about any security problems they discover. The policy has to include a specific contact method (like an email address or web form), explain what information researchers should include in their reports, and promise that people can submit reports anonymously if they want to. Importantly, the company must commit not to sue someone for accidentally breaking the rules while trying to report a vulnerability in good faith, and if a third party sues the researcher, the company must tell the court that the person was following the company's official vulnerability reporting process.

Companies also need to set clear timelines for responding to vulnerability reports—acknowledging when they receive one, assessing whether it's a real problem, and letting the researcher know when it's been fixed. If they discover a vulnerability in software or services that could affect other government agencies or private companies, they must report it to the federal Cybersecurity and Infrastructure Security Agency within seven days so the government can help coordinate a fix and protect others. This bill essentially creates a standardized, transparent process that encourages security researchers to help find and fix problems in government contractor systems rather than keeping vulnerabilities secret or selling them to bad actors.

Improving Contractor Cybersecurity Act

Lieu, Ted

Improving Contractor Cybersecurity ActThis bill prohibits an executive agency from entering into a contract for information technology unless the contractor maintains a vulnerability disclosure policy (VDP) and program.The contractor must report to the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security, within seven days after the VDP is published&nbsp;and on an ongoing basis as vulnerability reports are received, information regarding<ul><li>any valid or credible report of a not previously known public vulnerability on a system that uses commercial software or services that affect, or are likely to affect, other parties in government or industry once a patch or viable mitigation is available; and</li><li>any other situation where the contractor determines it would be helpful or necessary to involve CISA.</li></ul>CISA must submit vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database.