# Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025 - Summary

## What This Bill Does

This bill requires federal government contractors to establish formal processes for reporting and handling cybersecurity vulnerabilities in their systems. Specifically, it directs federal agencies to update their contracting rules so that companies working on government contracts must follow standardized vulnerability disclosure policies—essentially creating a formal "report security problems here" process. The bill references existing cybersecurity standards from the National Institute of Standards and Technology (NIST) and international standards organizations to ensure consistency and best practices.

## Who Is Affected

**Federal contractors** are the primary targets, particularly:
- Companies with contracts worth $250,000 or more (the "simplified acquisition threshold")
- Any contractor that operates, manages, or maintains federal computer systems on behalf of government agencies

**Government agencies** must implement these new requirements through updated contracting rules within 180 days. The Department of Defense has its own separate timeline and requirements. **Taxpayers and the public** benefit indirectly through improved cybersecurity of government systems and contractor networks.

## Key Provisions

- **Mandatory vulnerability disclosure policies**: Contractors must have formal processes for receiving and handling reports of security weaknesses
- **Standards alignment**: Policies must follow NIST guidelines and international standards (ISO 29147 and 30111)
- **National security exceptions**: Agencies can waive requirements if necessary for national security or research, but must notify Congress within 30 days
- **Coordinated timelines**: OMB has 180 days to recommend updates, then the Federal Acquisition Regulation Council has another 180 days to implement them; DoD follows a similar schedule

Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025

Mace, Nancy

Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025This bill requires revisions to acquisition regulations&nbsp;related to information systems vulnerabilities&nbsp;for certain federal contractors. The revisions apply to contractors whose contract is at or above the simplified acquisition threshold ($250,000 in most cases) or that use, operate, manage, or maintain a federal information system on behalf of an agency.&nbsp;Under the bill, the Office of Management and Budget must review the Federal Acquisition Regulation (FAR) and recommend updated contract requirements and language for contractor vulnerability disclosure programs. (Such programs establish processes for identifying, reporting, and mitigating information system vulnerabilities discovered by security researchers, software developers, and others.) The recommendations must include requirements to ensure that such contractors implement vulnerability disclosure policies consistent with guidelines from the National Institute of Standards and Technology. The Federal Acquisition Regulation Council must review these recommendations and update the FAR as necessary to incorporate requirements for such contractors to receive information about potential security vulnerabilities in contractor information systems used in performance of contract.The Department of Defense (DOD) must conduct a similar review and update of regulations with respect to the DOD Supplement to the FAR.