I 
119TH CONGRESS 
1ST SESSION H. R. 1258 
To amend title 41, United States Code, to require information technology 
contractors to maintain a vulnerability disclosure policy and program, 
and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 12, 2025 
Mr. LIEU introduced the following bill; which was referred to the Committee 
on Oversight and Government Reform 
A BILL 
To amend title 41, United States Code, to require informa-
tion technology contractors to maintain a vulnerability 
disclosure policy and program, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Improving Contractor 
Cybersecurity Act’’. 
VerDate Sep 11 2014 
22:25 Mar 10, 2025
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1258.IH
H1258
kjohnson on DSK7ZCZBW3PROD with $$_JOB
SEC. 2. VULNERABILITY DISCLOSURE POLICY AND PRO-
GRAM REQUIRED FOR INFORMATION TECH-
NOLOGY CONTRACTORS. 
(a) AMENDMENT.—Chapter 47 of division C of sub-
title I of title 41, United States Code, is amended by add-
ing at the end the following new section: 
‘‘§ 4715. Vulnerability disclosure policy and program 
required 
‘‘(a) REQUIREMENTS
FOR
INFORMATION
TECH-
NOLOGY CONTRACTORS.—The head of an executive agen-
cy may not enter into a contract for information tech-
nology unless the contractor maintains or does the fol-
lowing: 
‘‘(1) A vulnerability disclosure policy for infor-
mation technology that— 
‘‘(A) includes— 
‘‘(i) a description of which systems 
are in scope; 
‘‘(ii) the type of information tech-
nology testing for each system that is al-
lowed (or specifically not authorized); 
‘‘(iii) if a contractor includes systems 
that host sensitive information in the vul-
nerability disclosure policy, the contractor 
shall determine whether to impose restric-
tions on accessing, copying, transferring, 
VerDate Sep 11 2014 
22:25 Mar 10, 2025
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1258.IH
H1258
kjohnson on DSK7ZCZBW3PROD with $$_JOB
storing, using, and retaining such informa-
tion, including by— 
‘‘(I) prohibiting sensitive infor-
mation from being saved, stored, 
transferred, or otherwise accessed 
after initial discovery; 
‘‘(II) directing that sensitive in-
formation be viewed only to the extent 
required to identify a vulnerability 
and that the information not be re-
tained; or 
‘‘(III) limiting use of information 
obtained from interacting with the 
systems or services to be explored by 
the researcher to activities directly re-
lated 
to 
reporting 
security 
vulnerabilities; 
‘‘(iv) a description of how an indi-
vidual may submit a vulnerability report 
that includes— 
‘‘(I) the location of where to send 
the report, such as a web form or 
email address; 
‘‘(II) a description of the type of 
information necessary to find and 
VerDate Sep 11 2014 
22:25 Mar 10, 2025
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1258.IH
H1258
kjohnson on DSK7ZCZBW3PROD with $$_JOB
analyze the vulnerability (such as a 
description, the location, and potential 
impact of the vulnerability, the tech-
nical information needed to reproduce 
the vulnerability, and any proof of 
concept); and 
‘‘(III) a clear statement— 
‘‘(aa) that any individual 
that submits a vulnerability re-
port may do so anonymously; and 
‘‘(bb) on how and whether 
any incomplete submission is 
evaluated; 
‘‘(v) a commitment from the con-
tractor that the contractor will not pursue 
civil action for any accidental, good faith 
violation of the vulnerability disclosure pol-
icy; 
‘‘(vi) a commitment from the con-
tractor that if an individual acting in ac-
cordance with the vulnerability disclosure 
policy of the contractor is sued by a third 
party, the contractor will inform the public 
or the court that the individual was acting 
VerDate Sep 11 2014 
22:25 Mar 10, 2025
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1258.IH
H1258
kjohnson on DSK7ZCZBW3PROD with $$_JOB
in compliance with the vulnerability disclo-
sure policy; 
‘‘(vii) a statement that describes the 
time frame in which the individual that 
submits a report, if known, will receive a 
notification of receipt of the report and a 
description of what steps will be taken by 
the contractor during the remediation 
process; and 
‘‘(viii) a set of guidelines that estab-
lishes what type of activity by a researcher 
are acceptable and unacceptable; and 
‘‘(B) does not— 
‘‘(i) require the submission of person-
ally identifiable information of a re-
searcher; and 
‘‘(ii) limit testing solely to entities ap-
proved by the contractor but rather au-
thorizes the public to search for and report 
any vulnerability. 
‘‘(2) A description of additional procedures that 
describe how the contractor will communicate with 
the researcher, and how and when any communica-
tion occurs. 
VerDate Sep 11 2014 
22:25 Mar 10, 2025
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1258.IH
H1258
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(5) In the case of a discovered vulnerability 
that the contractor is not responsible for patching, 
the contractor shall submit the vulnerability to the 
responsible party or direct the researcher to the ap-
propriate party. 
‘‘(b) REPORTING REQUIREMENTS AND METRICS.— 
Not later than 7 days after the date on which the vulner-
ability disclosure policy described in subsection (a) is pub-
lished, and on an ongoing basis as vulnerability reports 
are received, an information technology contractor shall 
report to the Cybersecurity and Infrastructure Security 
Agency of the Department of Homeland Security the fol-
lowing information: 
‘‘(1) Any valid or credible report of a not pre-
viously known public vulnerability (including any 
misconfiguration) on a system that uses commercial 
software or services that affect or are likely to affect 
other parties in government or industry once a patch 
or viable mitigation is available. 
‘‘(2) Any other situation where the contractor 
determines it would be helpful or necessary to in-
volve the Cybersecurity and Infrastructure Security 
Agency. 
‘‘(c) CISA SUBMISSION OF VULNERABILITIES.—The 
Cybersecurity and Infrastructure Security Agency shall 
VerDate Sep 11 2014 
22:25 Mar 10, 2025
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H1258.IH
H1258
kjohnson on DSK7ZCZBW3PROD with $$_JOB
communicate 
with 
and 
submit, 
as 
necessary, 
vulnerabilities to the MITRE Common Vulnerabilities and 
Exposures database and the National Institute of Stand-
ards and Technology National Vulnerability Database. 
‘‘(d) DEFINITIONS.—In this section: 
‘‘(1) EXECUTIVE AGENCY.—The term ‘executive 
agency’ has the meaning given that term in section 
133. 
‘‘(2) RESEARCHER.—The term ‘researcher’ 
means the individual who submits a vulnerability re-
port. 
‘‘(3) INFORMATION
TECHNOLOGY.—The term 
‘information technology’ has the meaning given that 
term in section 11101 of title 40.’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.— 
The table of sections for chapter 47 of division C of sub-
title I of title 41, United States Code, is amended by add-
ing at the end the following new item: 
‘‘4715. Vulnerability disclosure policy and program required.’’. 
(c) APPLICABILITY.—The amendments made by this 
section shall take effect on the date of the enactment of 
this section and shall apply to any contract entered into 
on or after such effective date. 
Æ 
VerDate Sep 11 2014 
22:25 Mar 10, 2025
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H1258.IH
H1258
kjohnson on DSK7ZCZBW3PROD with $$_JOB