Bill · H.R. 1258· House(119-HR-1258)
Improving Contractor Cybersecurity Act
- Introduced
- 2/12/2025
- Last activity
- 2/12/2025 — Referred to the House Committee on Oversight and Government Reform.
- Sponsored by
- Ted Lieu
- Cosponsors
- None
- Introduced
- In Committee
What this bill would do
The Improving Contractor Cybersecurity Act aims to amend title 41 of the United States Code. It requires information technology contractors to establish and maintain a vulnerability disclosure policy and program. Under this bill, executive agencies may only enter into information technology contracts if the contractor meets these specific requirements. The policy must include details on system scope, testing types, and how to submit reports. Additionally, contractors must provide a way for the public to report vulnerabilities via their website. Finally, the bill mandates that certain vulnerability information be reported to the Cybersecurity and Infrastructure Security Agency.
Yes· 3 of 4
Does this better protect the country from computer attacks?+7
The bill strengthens national cybersecurity by requiring contractors to implement vulnerability disclosure programs and report findings to CISA.
Does this make what the government does easier for the public to see?+5
The bill mandates clear communication processes and standardized tracking for security vulnerability remediation.
Does this protect people from being watched or searched?+4
The bill protects researchers by allowing for anonymous submissions and prohibiting the requirement of personally identifiable information.
The opposite
Would business owners be better off under this?-2
The bill creates additional regulatory burdens and required disclosures for IT contractors.
Does this make it easier to run a small business?-2
The bill imposes new compliance and administrative requirements on information technology contractors.
Who it would affect, and how
Potential Positive Impacts for People
-
Protection for Researchers: The bill requires contractors to commit to not pursuing civil action for accidental, good-faith violations of the policy, and to inform the public or a court if a researcher is sued by a third party while following the policy (Section 2(a)(1)(a)(vi)).
-
Increased Transparency for Reporting: Contractors must provide a description of how an individual can submit a report, including the location to send it and the technical information required (Section 2(a)(1)(a)(iv)).
-
Anonymity and Privacy: The policy must include a statement that individuals may submit vulnerability reports anonymously and must not require the submission of a researcher's personally identifiable information (Section 2(a)(1)(a)(iv) and Section 2(a)(1)(a)(B)(i)).
-
Clear Communication Timelines: The act requires contractors to state the timeframe for receiving a notification of receipt and describe the steps taken during the remediation process (Section 2(a)(1)(a)(vii)).
-
Standardized Response Tracking: Contractors are required to provide descriptions of target timelines for tracking the receipt of reports, initial assessments, and the final resolution of a vulnerability (Section 2(a)(3)).
Potential Negative Impacts for People
- Restrictions on Sensitive Information Access: If a contractor includes systems that host sensitive information, they may impose restrictions on accessing, copying, transferring, storing, using, and retaining that information (Section 2(a)(1)(a)(iii)).
Groups and Interests Ranking
Every group the model scored this bill for, from -10 to +10. Hover a score for the reason it gave.
- Governance And Ideology
- Improves Government Transparency+5Improves Privacy Rights+4
- National Security And Foreign Policy
- Improves Cybersecurity Defense+7
- Education And Technology
- Improves Data Privacy+3
- Demographic And Interest Groups
- Good For Business Owners-2
- Economy And Finance
- Improves Small Business Support-2
- 2/12/2025
- Referred to the House Committee on Oversight and Government Reform.
- Introduced in House