II 

118TH CONGRESS 

2D SESSION S. 5028 

To require Federal contractors to implement a vulnerability disclosure policy 

consistent with NIST guidelines, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

SEPTEMBER 11, 2024 

Mr. WARNER (for himself and Mr. LANKFORD) introduced the following bill; 

which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

A BILL 

To require Federal contractors to implement a vulnerability 

disclosure policy consistent with NIST guidelines, and 

for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Federal Contractor 

5 Cybersecurity Vulnerability Reduction Act of 2024’’. 

6 SEC. 2. FEDERAL CONTRACTOR VULNERABILITY DISCLO7 SURE POLICY. 

8 (a) RECOMMENDATIONS.— 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•S 5028 IS

1 (1) IN GENERAL.—Not later than 180 days 

2 after the date of the enactment of this Act, the Di3 rector of the Office of Management and Budget, in 

4 consultation with the Director of the Cybersecurity 

5 and Infrastructure Security Agency, the National 

6 Cyber Director, the Director of the National Insti7 tute of Standards and Technology, and any other 

8 appropriate head of an Executive department, 

9 shall— 

10 (A) review the Federal Acquisition Regula11 tion (FAR) contract requirements and language 

12 for contractor vulnerability disclosure programs; 

13 and 

14 (B) recommend updates to such require15 ments and language to the Federal Acquisition 

16 Regulation Council. 

17 (2) CONTENTS.—The recommendations re18 quired by paragraph (1) shall include updates to 

19 such requirements designed to ensure that covered 

20 contractors implement a vulnerability disclosure pol21 icy consistent with National Institute of Standards 

22 and Technology (NIST) guidelines for contractors as 

23 required under section 5 of the IoT Cybersecurity 

24 Improvement Act of 2020 (15 U.S.C. 278g–3c). 


ssavage on LAPJG3WLY3PROD with BILLS
3 

•S 5028 IS

1 (b) PROCUREMENT REQUIREMENTS.—Not later than 

2 180 days after the date on which the recommended con3 tract language developed pursuant to subsection (a) is re4 ceived, the Federal Acquisition Regulation Council shall 

5 review the recommended contract language and amend the 

6 FAR as necessary to incorporate requirements for covered 

7 contractors to solicit and address information about poten8 tial security vulnerabilities relating to an information sys9 tem owned or controlled by the contractor that is used 

10 in performance of a Federal contract. 

11 (c) ELEMENTS.—The update to the FAR pursuant 

12 to subsection (b) shall— 

13 (1) to the maximum extent practicable, align 

14 with the security vulnerability disclosure process and 

15 coordinated disclosure requirements relating to Fed16 eral information systems under sections 5 and 6 of 

17 the IoT Cybersecurity Improvement Act of 2020 (15 

18 U.S.C. 278g–3c, 278g–3d); and 

19 (2) to the maximum extent practicable, be 

20 aligned with industry best practices and Standards 

21 29147 and 30111 of the International Standards 

22 Organization (or any successor standard) or any 

23 other appropriate, relevant, and widely used stand24 ard. 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•S 5028 IS

1 (d) WAIVER.—The head of an agency may waive the 

2 security vulnerability disclosure policy requirement under 

3 subsection (b) if the agency Chief Information Officer— 

4 (1) determines that the waiver is necessary in 

5 the interest of national security or research pur6 poses; and 

7 (2) not later than 30 days after granting the 

8 waiver, submits a notification and justification, in9 cluding information about the duration of the waiv10 er, to the Committee on Homeland Security and 

11 Governmental Affairs of the Senate and the Com12 mittee on Oversight and Accountability of the House 

13 of Representatives. 

14 (e) DEPARTMENT OF DEFENSE SUPPLEMENT TO

15 THE FEDERAL ACQUISITION REGULATION.— 

16 (1) REVIEW.—Not later than 180 days after 

17 the date of the enactment of this Act, the Secretary 

18 of Defense shall review the Department of Defense 

19 Supplement to the Federal Acquisition Regulation 

20 (DFARS) contract requirements and language for 

21 contractor vulnerability disclosure programs and de22 velop updates to such requirements designed to en23 sure that covered contractors, to the maximum ex24 tent practicable, align with the security vulnerability 

25 disclosure process and coordinated disclosure reVerDate Sep 11 2014 19:43 Sep 16, 2024 Jkt 049200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S5028.IS S5028

ssavage on LAPJG3WLY3PROD with BILLS
5 

•S 5028 IS

1 quirements relating to Federal information systems 

2 under sections 5 and 6 of the IoT Cybersecurity Im3 provement Act of 2020 (15 U.S.C. 278g–3c, 278g– 

4 3d). 

5 (2) REVISIONS.—Not later than 180 days after 

6 the date on which the review required under sub7 section (a) is completed, the Secretary shall revise 

8 the DFARS as necessary to incorporate require9 ments for covered contractors to receive information 

10 about a potential security vulnerability relating to an 

11 information system owned or controlled by a con12 tractor, in performance of the contract. 

13 (3) ELEMENTS.—The Secretary shall ensure 

14 that the revision to the DFARS described in this 

15 subsection is carried out in accordance with the re16 quirements of paragraphs (1) and (2) of subsection 

17 (c). 

18 (4) WAIVER.—The Chief Information Officer of 

19 the Department of Defense may waive the security 

20 vulnerability disclosure policy requirements under 

21 paragraph (2) if the Chief Information Officer— 

22 (A) determines that the waiver is necessary 

23 in the interest of national security or research 

24 purposes; and 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•S 5028 IS

1 (B) not later than 30 days after granting 

2 the waiver, submits a notification and justifica3 tion, including information about the duration 

4 of the waiver, to the Committee on Armed Serv5 ices of the Senate and the Committee on Armed 

6 Services of the House of Representatives. 

7 (f) DEFINITIONS.—In this section: 

8 (1) AGENCY.—The term ‘‘agency’’ has the 

9 meaning given the term in section 3502 of title 44, 

10 United States Code. 

11 (2) COVERED CONTRACTOR.—The term ‘‘cov12 ered contractor’’ means a contractor (as defined in 

13 section 7101 of title 41, United States Code)— 

14 (A) whose contract is in an amount the 

15 same as or greater than the simplified acquisi16 tion threshold; or 

17 (B) that uses, operates, manages, or main18 tains a Federal information system (as defined 

19 by section 11331 of title 40, United Stated 

20 Code) on behalf of an agency. 

21 (3) EXECUTIVE DEPARTMENT.—The term ‘‘Ex22 ecutive department’’ has the meaning given that 

23 term in section 101 of title 5, United States Code. 

24 (4) SECURITY VULNERABILITY.—The term ‘‘se25 curity vulnerability’’ has the meaning given that 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•S 5028 IS

1 term in section 2200 of the Homeland Security Act 

2 of 2002 (6 U.S.C. 650). 

3 (5) SIMPLIFIED ACQUISITION THRESHOLD.— 

4 The term ‘‘simplified acquisition threshold’’ has the 

5 meaning given that term in section 134 of title 41, 

6 United States Code. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS