Nancy Mace (R-SC)
Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025
A Republican bill with 1 Democratic cosponsor · See the cosponsor
Last activity — Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
In the other chamber's committee
Passed one chamber and has been handed to a committee in the other.
The committee decides whether it goes any further, and most bills that reach a committee never leave it. A committee that simply does nothing kills a bill without anyone ever voting against it, so no news from here is usually the news.
Its path through Congress
- Introduced
- Passed House voice vote
- In Senate committee
The House by voice vote (members called out yes or no together): no member's position on it was recorded.
What this bill would do
The Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025 requires covered contractors to implement vulnerability disclosure policies. The Director of the Office of Management and Budget will review and recommend updates to the Federal Acquisition Regulation to include these requirements. Following these recommendations, the Federal Acquisition Regulation Council will update the FAR to ensure contractors can receive information about potential security vulnerabilities in their information systems. Additionally, the Secretary of Defense is tasked with reviewing and revising the Department of Defense Supplement to the Federal Acquisition Regulation. These updates aim to align contractor policies with NIST guidelines and industry best practices.
Yes· 3 of 4
- Scored +8
Does this better protect the country from computer attacks?
The bill mandates that federal contractors implement vulnerability disclosure policies to improve the security of information systems.
- Scored +3
Does this give people more control over their personal data?
By requiring vulnerability disclosure policies, the bill helps protect the integrity and privacy of information systems managed by contractors.
- Scored +2
Does this make what the government does easier for the public to see?
The bill requires agencies to submit notifications and justifications to Congress if they waive cybersecurity requirements.
The opposite
- Scored -2
Would business owners be better off under this?
The bill imposes new compliance requirements and vulnerability disclosure policies on covered contractors.
Who it would affect, and how
Potential Positive Impacts for People
-
Improved Security Processes: Covered contractors will be required to implement a vulnerability disclosure policy consistent with NIST guidelines, which helps ensure they receive information about potential security vulnerabilities relating to information systems they own or control in the performance of a contract (Section 2(a), Section 2(b)).
-
Standardization of Safety: The update to the Federal Acquisition Regulation will align with industry best practices and specific International Standards Organization standards, ensuring a more consistent approach to security (Section 2(c)).
-
Department of Defense Oversight: The Secretary of Defense will review and revise the Department of Defense Supplement to the Federal Acquisition Regulation to ensure contractors implement policies consistent with NIST guidelines (Section 2(e)).
Potential Negative Impacts for People
- Agency Discretionary Waivers: Agency heads or the Department of Defense Chief Information Officer can waive the security vulnerability disclosure policy requirements if they determine it is necessary for national security or research purposes (Section 2(d), Section 2(e)).
Groups and Interests Ranking
Every group the model scored this bill for, from -10 to +10. Tap or hover a score for the reason it gave.
- National Security And Foreign Policy
- Does this better protect the country from computer attacks? — The bill mandates that federal contractors implement vulnerability disclosure policies to improve the security of information systems.
- Education And Technology
- Does this give people more control over their personal data? — By requiring vulnerability disclosure policies, the bill helps protect the integrity and privacy of information systems managed by contractors.
- Demographic And Interest Groups
- Would business owners be better off under this? — The bill imposes new compliance requirements and vulnerability disclosure policies on covered contractors.
- Governance And Ideology
- Does this make what the government does easier for the public to see? — The bill requires agencies to submit notifications and justifications to Congress if they waive cybersecurity requirements.
- Economy And Finance
- Does this make the government pay for what it commits to? — The act implements security requirements for federal contractors to protect government information systems.
- 3/4/2025
- Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.
- 3/3/2025
- Motion to reconsider laid on the table Agreed to without objection.
- Passed/agreed to in House: On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote. (text: CR H930-931)
- On motion to suspend the rules and pass the bill, as amended Agreed to by voice vote. (text: CR H930-931)
- DEBATE - The House proceeded with forty minutes of debate on H.R. 872.
- Considered under suspension of the rules. (consideration: CR H930-932)
- Mr. Comer moved to suspend the rules and pass the bill, as amended.
- 1/31/2025
- Referred to the Committee on Oversight and Government Reform, and in addition to the Committee on Armed Services, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned.
- 1 Cosponsor added.
- Introduced in House
One bill Congress.gov lists as related to this one — companions in the other chamber, earlier versions, and bills this one absorbed or was folded into.
Shontel BrownDemocrat · Ohio