,i  #aagth ,,congress  #ast ,session    
,h4 ,r4 #cfjh  ,,in ,,the ,,house ,,of  
,,representatives  ,may #bh1 #bjba,mr4  
,lieu introduced the following bill2    
which was referred to the ,committee on 
,oversight and ,reform  ,a ,,bill  ,to  
amend title #da1 ,united ,states ,code1 
to require information technology       
contractors to maintain a vulnerability 
disclosure policy and program1 and for  
other purposes4  #a4 ,short title ,this 
,act may be cited as the ,improving     
,contractor ,cybersecurity ,act4  #b4   
,vulnerability disclosure policy and    
program required for information        
technology contractors  7a7 ,amendment  
,chapter #dg of division ,c of subtitle 
,i of title #da1 ,united ,states ,code1 
is amended by adding at the end the     
following new section3  #dgae4          
,vulnerability disclosure policy and    
program required  7a7 ,requirements for 
information technology contractors ,the 
head of an executive agency may not     
enter into a contract for information   

technology unless the contractor        
maintains or does the following3 7#a7 ,a
 vulnerability disclosure policy for    
information technology that-- 7,a7      
includes-- 7i7 a description of which   
systems are in scope2  7ii7 the type of 
information technology testing for each 
system that is allowed 7or specifically 
not authorized72  7iii7 if a contractor 
includes systems that host sensitive    
information in the vulnerability        
disclosure policy1 the contractor shall 
determine whether to impose restrictions
 on accessing1 copying1 transferring1   
storing1 using1 and retaining such      
information1 including by-- 7,i7        
prohibiting sensitive information from  
being saved1 stored1 transferred1 or    
otherwise accessed after initial        
discovery2  7,,ii7 directing that       
sensitive information be viewed only to 
the extent required to identify a       
vulnerability and that the information  
not be retained2 or  7,,iii7 limiting   
use of information obtained from        

interacting with the systems or services
 to be explored by the researcher to    
activities directly related to reporting
 security vulnerabilities2  7iv7 a      
description of how an individual may    
submit a vulnerability report that      
includes-- 7,i7 the location of where to
 send the report1 such as a web form or 
email address2  7,,ii7 a description of 
the type of information necessary to    
find and analyze the vulnerability 7such
 as a description1 the location1 and    
potential impact of the vulnerability1  
the technical information needed to     
reproduce the vulnerability1 and any    
proof of concept72 and  7,,iii7 a clear 
statement-- 7aa7 that any individual    
that submits a vulnerability report may 
do so anonymously2 and  7bb7 on how and 
whether any incomplete submission is    
evaluated2  7v7 a commitment from the   
contractor that the contractor will not 
pursue civil action for any accidental1 
good faith violation of the             
vulnerability disclosure policy2  7vi7 a

 commitment from the contractor that if 
an individual acting in accordance with 
the vulnerability disclosure policy of  
the contractor is sued by a third party1
 the contractor will inform the public  
or the court that the individual was    
acting in compliance with the           
vulnerability disclosure policy2  7vii7 
a statement that describes the time     
frame in which the individual that      
submits a report1 if known1 will receive
 a notification of receipt of the report
 and a description of what steps will be
 taken by the contractor during the     
remediation process2 and  7viii7 a set  
of guidelines that establishes what type
 of activity by a researcher are        
acceptable and unacceptable2 and  7,b7  
does not-- 7i7 require the submission of
 personally identifiable information of 
a researcher2 and  7ii7 limit testing   
solely to entities approved by the      
contractor but rather authorizes the    
public to search for and report any     
vulnerability4  7#b7 ,a description of  

additional procedures that describe how 
the contractor will communicate with the
 researcher1 and how and when any       
communication occurs4  7#c7 ,a          
description of the target timelines for 
and tracking of the following3 7,a7     
,notification of receipt to the         
individual that submits the report1 if  
known4  7,b7 ,an initial assessment1    
such as determining whether any         
disclosed vulnerability is valid4  7,c7 
,resolution of a vulnerability1         
including notification of the outcome to
 the researcher4  7#d7 ,a page on the   
website of the contractor that-- 7,a7   
allows for the submission of            
vulnerabilities by anyone relating to   
the information technology2  7,b7 lists 
the contact information1 such as a phone
 number or email address for an         
individual or team responsible for      
reviewing any such submission under     
subparagraph 7,a72 and  7,c7 describes  
the process by which a review is        
conducted1 including how long it will   

take for the contractor to respond to   
researcher and whether or not monetary  
rewards will be paid to the reporter for
 identifying a vulnerability4  7#e7 ,in 
the case of a discovered vulnerability  
that the contractor is not responsible  
for patching1 the contractor shall      
submit the vulnerability to the         
responsible party or direct the         
researcher to the appropriate party4    
7b7 ,reporting requirements and metrics 
,not later than #g days after the date  
on which the vulnerability disclosure   
policy described in subsection 7a7 is   
published1 and on an ongoing basis as   
vulnerability reports are received1 an  
information technology contractor shall 
report to the ,cybersecurity and        
,infrastructure ,security ,agency of the
 ,department of ,homeland ,security the 
following information3 7#a7 ,any valid  
or credible report of a not previously  
known public vulnerability 7including   
any misconfiguration7 on a system that  
uses commercial software or services    

that affect or are likely to affect     
other parties in government or industry 
once a patch or viable mitigation is    
available4  7#b7 ,any other situation   
where the contractor determines it would
 be helpful or necessary to involve the 
,cybersecurity and ,infrastructure      
,security ,agency4  7c7 ,,cisa          
submission of vulnerabilities ,the      
,cybersecurity and ,infrastructure      
,security ,agency shall communicate with
 and submit1 as necessary1              
vulnerabilities to the ,,mitre ,common  
,vulnerabilities and ,exposures database
 and the ,national ,institute of        
,standards and ,technology ,national    
,vulnerability ,database4  7d7          
,definitions ,in this section3 7#a7     
,executive agency ,the term executive   
agency has the meaning given that term  
in section #acc4  7#b7 ,researcher ,the 
term researcher means the individual who
 submits a vulnerability report4  7#c7  
,information technology ,the term       
information technology has the meaning  

given that term in section #aaaja of    
title #dj4  4  7b7 ,technical and       
conforming amendment ,the table of      
sections for chapter #dg of division ,c 
of subtitle ,i of title #da1 ,united    
,states ,code1 is amended by adding at  
the end the following new item3  #dgae4 
,vulnerability disclosure policy and    
program required4  4  7c7 ,applicability
 ,the amendments made by this section   
shall take effect on the date of the    
enactment of this section and shall     
apply to any contract entered into on or
 after such effective date4