HR 872
Passed a chamber
Directs federal agencies to update contracting rules so that contractors handling federal systems or contracts at or above the simplified acquisition threshold adopt vulnerability disclosure policies consistent with NIST guidelines.
Official title: Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025
Timeline each lane is a chamber; dates pull from congress.gov actions
House
Introduced
31-JAN-2025
Referred
31-JAN-2025
Passed
03-MAR-2025
Senate
Received
04-MAR-2025
- Requires OMB, with CISA, the National Cyber Director, and NIST, to review Federal Acquisition Regulation language on contractor vulnerability disclosure programs and recommend updates within 180 days of enactment.
- Requires the FAR Council to update the FAR within 180 days after receiving those recommendations so covered contractors receive reports of potential security vulnerabilities in their systems.
- Requires the Secretary of Defense to develop similar updates and revise the DFARS on the same timeline.
- Allows agency heads to waive the requirement for national security or research purposes, with notice and justification to Congress within 30 days.
Covers an older version. The newest CRS summary describes the bill as of "Introduced in House" (31-JAN-2025); the text has changed since (Engrossed in House, 03-MAR-2025).
CRS is the Library of Congress's nonpartisan research office. Read it on congress.gov- Armed Services Committee (House)
- Oversight and Government Reform Committee (House)
- Homeland Security and Governmental Affairs Committee (Senate)
Government Operations and Politics
■ 1 D
1 Democrat