Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
Requires OMB, in consultation with CISA, NIST, the National Cyber Director, and others, to review and recommend updates to FAR contract language so covered federal contractors adopt vulnerability disclosure policies consistent with NIST and IoT Cybersecurity Improvement Act guidance. Directs the FAR Council and the Department of Defense to update the FAR and DFARS respectively to incorporate those requirements, aligning with ISO 29147 and 30111 where practicable.
Progressives emphasize transparency and researcher protections; conservatives worry about regulatory burden.
Relative to its intended legislative type, this bill establishes a clear substantive policy change by directing executive entities to create and incorporate contractor vulnerability disclosure requirements into procurement regulations, and it provides a concrete administrative pathway (responsible agencies and deadlines) and statutory cross-references.
Requires OMB, in consultation with CISA, NIST, the National Cyber Director, and others, to review and recommend updates to FAR contract language so covered federal contractors adopt vulnerability disclosure policies consistent with NIST and IoT Cybersecurity Improvement Act guidance.
Directs the FAR Council and the Department of Defense to update the FAR and DFARS respectively to incorporate those requirements, aligning with ISO 29147 and 30111 where practicable.
Allows agency and DoD CIO waivers for national security or research reasons with notifications to relevant congressional committees.
Text is narrow, technical, and non-controversial with limited fiscal impact, improving chances; final outcome depends on Senate action and executive signing.
Relative to its intended legislative type, this bill establishes a clear substantive policy change by directing executive entities to create and incorporate contractor vulnerability disclosure requirements into procurement regulations, and it provides a concrete administrative pathway (responsible agencies and deadlines) and statutory cross-references. It leaves implementation specifics to subsequent rulemaking and does not include funding, enforcement, or comprehensive compliance metrics.
Progressives emphasize transparency and researcher protections; conservatives worry about regulatory burden.
These are examples from the analysis, not a ranked list of the most-affected groups.
Progressives emphasize transparency and researcher protections; conservatives worry about regulatory burden.
Likely supportive overall because the bill strengthens contractor cybersecurity and aligns with NIST and industry standards.
Would welcome improved coordinated disclosure but want stronger researcher protections and limits on waiver use.
May press for enforcement, resourcing, and transparency on waiver justifications.
Sees the bill as a practical, technical update to procurement rules to reduce cyber risk.
Generally favorable but cautious about implementation timing, compliance costs, and clarity for small contractors.
Would seek phased implementation and clear guidance to minimize unintended burdens.
Skeptical of new federal mandates that expand procurement compliance obligations.
Concerns focus on regulatory burden, costs to contractors, and possible exposure of vulnerabilities.
The national-security waiver is a needed safeguard but may not fully mitigate risks of mandated disclosure processes.
Reached or meaningfully advanced
Reached or meaningfully advanced
Still ahead
Still ahead
Still ahead
Text is narrow, technical, and non-controversial with limited fiscal impact, improving chances; final outcome depends on Senate action and executive signing.
The bill has not accumulated any surfaced votes yet.
Progressives emphasize transparency and researcher protections; conservatives worry about regulatory burden.
Text is narrow, technical, and non-controversial with limited fiscal impact, improving chances; final outcome depends on Senate action and…
Relative to its intended legislative type, this bill establishes a clear substantive policy change by directing executive entities to create and incorporate contractor vulnerability disclosure requirements into procurem…
Go beyond the headline summary with full stakeholder mapping, legislative design analysis, passage barriers, and lens-by-lens tradeoff breakdowns.