Bills · HR 1258
IN COMMITTEE· 119TH CONGRESS
House BillHR 1258Computers and information technologyPublic contracts and procurement
Improving Contractor Cybersecurity Act
INTRO FEB 12· LAST ACTION FEB 12
READING
6MIN
COSPONSORS
0
READER REACTIONS0 TOTAL
NO VOTES YET · BE THE FIRST
- Introduced only
LEGISLATIVE PROGRESS
STEP 2 / 8Introduced
In Committee
Reported
Passed House
Passed Senate
Conference
To President
Became Law
WHAT THE BILL DOES
AI-writtenThis bill matters because government computer systems are vital for critical services and often hold sensitive personal data and national security information. Security vulnerabilities in these systems can lead to devastating data breaches, identity theft, or disruptions to essential government functions. Currently, there isn't a consistent or safe way for security researchers, who often find these weaknesses first, to report them to the companies managing government IT.
If this bill becomes law, it will establish a clear, protected, and standardized method for reporting security flaws. This means vulnerabilities in government systems could be identified and fixed much faster, significantly enhancing the nation's cybersecurity defenses and protecting public data. If it doesn't pass, the fragmented approach to vulnerability reporting would likely continue, leaving government IT systems more exposed to cyber threats and making it harder for well-intentioned researchers to help secure them.
KEY PROVISIONS
5AI-extractedPROVISION 01
Requires information technology (IT) contractors to have a vulnerability disclosure policy and program to be eligible for contracts with executive agencies.
This ensures that government IT contractors establish a formal and public system for external parties to report security weaknesses.
PROVISION 02
Mandates specific elements for the policy, including a commitment not to pursue civil action against individuals reporting vulnerabilities in good faith.
This encourages security researchers to report flaws without fear of legal reprisal, leading to more identified and fixed vulnerabilities.
PROVISION 03
Requires contractors to maintain a public website page for submitting vulnerabilities, including contact information and a description of the review process.
This makes it easy and transparent for anyone to find the correct channel for reporting security issues related to government IT.
PROVISION 04
Requires contractors to report valid or credible, previously unknown public vulnerabilities that affect other parties in government or industry to CISA.
This centralizes crucial vulnerability information, allowing for broader awareness and faster coordination of fixes across relevant sectors.
PROVISION 05
Directs the Cybersecurity and Infrastructure Security Agency (CISA) to submit necessary vulnerabilities to the MITRE Common Vulnerabilities and Exposures (CVE) and NIST National Vulnerability Database.
This ensures that identified vulnerabilities are publicly cataloged, helping other organizations protect themselves by staying informed.
SPONSORSHIP
1 + 0
D· California
YRS IN OFFICE
11
BILLS LED
46
ACTION TIMELINE
2 EVENTSFEB 12
Introduced in House
FEB 12
Referred to the House Committee on Oversight and Government Reform.
BILL INFO
TypeHouse Bill
NumberHR 1258
Congress119th
StatusIn Committee
IntroducedFeb 12, 2025
Last actionFeb 12, 2025
READER REACTIONS
OVERALL SENTIMENT
No reactions yet. Be the first to weigh in.
Discussion
Loading comments...
IN COMMITTEE· 119TH CONGRESS · OVERSIGHT AND GOVERNMENT REFORM COMMITTEE · INTRODUCED FEB 12, 2025
House BillHR 1258Computers and information technologyPublic contracts and procurement
Improving Contractor Cybersecurity Act
INTRODUCED FEB 12, 2025· LAST ACTION FEB 12, 2025
PASSAGE CHANCES
—%
READING
6 min
COSPONSORS
0
COMPLEXITY
Moderate
