S.1899

Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025 requires federal contractors to implement a vulnerability disclosure policy.

The Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025 mandates that federal contractors implement a vulnerability disclosure policy in line with National Institute of Standards and Technology (NIST) guidelines. The Office of Management and Budget, in consultation with relevant cybersecurity and technology directors, must review and recommend updates to Federal Acquisition Regulation (FAR) contract requirements for contractor vulnerability disclosure programs. The FAR Council must then review and amend the FAR as necessary.