H.R. 872 · Where this bill is now
In the Senate
Passed the House Mar 3, 2025. Received Mar 4, 2025; no Senate vote yet
What this bill does
In plain words · AI-written from the official summaryStrengthens cybersecurity rules for federal contractors
Ever wondered how the government makes sure contractors don't get hacked? This bill requires the government to update its rules for companies that work on federal contracts or manage government computer systems. The updates would require these contractors to have plans for finding and fixing security problems in their systems, following guidelines from a government tech standards agency. Both the general government and the Department of Defense would make these changes to their contract rules.
How it affects you
If you work for a federal contractor or a company that manages government computer systems, your employer would need to follow stricter cybersecurity rules. For most Americans, this mainly matters indirectly: it aims to reduce the chance that hackers could breach government systems through contractor networks.
Read the official summary (Introduced in House, Jan 31, 2025)
Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025
This bill requires revisions to acquisition regulations related to information systems vulnerabilities for certain federal contractors. The revisions apply to contractors whose contract is at or above the simplified acquisition threshold ($250,000 in most cases) or that use, operate, manage, or maintain a federal information system on behalf of an agency.
Under the bill, the Office of Management and Budget must review the Federal Acquisition Regulation (FAR) and recommend updated contract requirements and language for contractor vulnerability disclosure programs. (Such programs establish processes for identifying, reporting, and mitigating information system vulnerabilities discovered by security researchers, software developers, and others.) The recommendations must include requirements to ensure that such contractors implement vulnerability disclosure policies consistent with guidelines from the National Institute of Standards and Technology. The Federal Acquisition Regulation Council must review these recommendations and update the FAR as necessary to incorporate requirements for such contractors to receive information about potential security vulnerabilities in contractor information systems used in performance of contract.
The Department of Defense (DOD) must conduct a similar review and update of regulations with respect to the DOD Supplement to the FAR.
Written by AI (Claude) using only the official summary by the Congressional Research Service, the Library of Congress’s nonpartisan research staff. It can miss nuance, so check the official summary and the bill text for details.
1st SessionH. R. 872
AN ACT
Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025
Sponsor: Rep. Nancy Mace (R-SC-1) · Introduced Jan 31, 2025 · Government Operations and Politics · 3 versions of the text
Sources: Congress.gov actions and votes · bill text from GovInfo · latest official action Mar 4, 2025: “Received in the Senate and Read twice and referred to the Committee on Homeland Security and Governmental Affairs.”