,i #aag? ,,congress #a/ ,session ,h4 ,r4 #cfjh ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,may #bh1 #bjba,mr4 ,lieu introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,ov]sight & ,re=m ,a ,,bill ,to am5d title #da1 ,unit$ ,/ates ,code1 to require in=mation te*nology contractors to ma9ta9 a vuln]ability disclosure policy & program1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,improv+ ,contractor ,cyb]security ,act4 #b4 ,vuln]ability disclosure policy & program requir$ = in=mation te*nology contractors 7a7 ,am5dm5t ,*apt] #dg ( division ,c ( subtitle ,i ( title #da1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+ new section3 #dgae4 ,vuln]ability disclosure policy & program requir$ 7a7 ,requirem5ts = in=mation te*nology contractors ,! head ( an executive ag5cy may n ent] into a contract = in=mation te*nology unless ! contractor ma9ta9s or does ! foll[+3 7#a7 ,a vuln]ability disclosure policy = in=mation te*nology t-- 7,a7 includes-- 7i7 a description ( :i* sy/ems are 9 scope2 7ii7 ! type ( in=mation te*nology te/+ = ea* sy/em t is all[$ 7or specifically n au?oriz$72 7iii7 if a contractor includes sy/ems t ho/ s5sitive in=mation 9 ! vuln]ability disclosure policy1 ! contractor %all det]m9e :e!r to impose re/rictions on access+1 copy+1 transf]r+1 /or+1 us+1 & reta9+ su* in=mation1 includ+ by-- 7,i7 prohibit+ s5sitive in=mation f be+ sav$1 /or$1 transf]r$1 or o!rwise access$ aft] initial discov]y2 7,,ii7 direct+ t s5sitive in=mation be view$ only to ! ext5t requir$ to id5tify a vuln]ability & t ! in=mation n be reta9$2 or 7,,iii7 limit+ use ( in=mation obta9$ f int]act+ ) ! sy/ems or s]vices to be explor$ by ! rese>*] to activities directly relat$ to report+ security vuln]abilities2 7iv7 a description ( h[ an individual may submit a vuln]ability report t includes-- 7,i7 ! location ( :]e to s5d ! report1 su* z a web =m or email address2 7,,ii7 a description ( ! type ( in=mation necess>y to f9d & analyze ! vuln]ability 7su* z a description1 ! location1 & pot5tial impact ( ! vuln]ability1 ! te*nical in=mation ne$$ to reproduce ! vuln]ability1 & any pro( ( concept72 & 7,,iii7 a cle> /atem5t-- 7aa7 t any individual t submits a vuln]ability report may d s anonym\sly2 & 7bb7 on h[ & :e!r any incomplete submission is evaluat$2 7v7 a commitm5t f ! contractor t ! contractor w n pursue civil action = any accid5tal1 good fai? violation ( ! vuln]ability disclosure policy2 7vi7 a commitm5t f ! contractor t if an individual act+ 9 accordance ) ! vuln]ability disclosure policy ( ! contractor is su$ by a ?ird p>ty1 ! contractor w in=m ! public or ! c\rt t ! individual 0 act+ 9 compliance ) ! vuln]ability disclosure policy2 7vii7 a /atem5t t describes ! "t frame 9 :i* ! individual t submits a report1 if kn[n1 w receive a notification ( receipt ( ! report & a description ( :at /eps w be tak5 by ! contractor dur+ ! rem$iation process2 & 7viii7 a set ( guidel9es t e/abli%es :at type ( activity by a rese>*] are acceptable & unacceptable2 & 7,b7 does n-- 7i7 require ! submission ( p]sonally id5tifiable in=mation ( a rese>*]2 & 7ii7 limit te/+ solely to entities approv$ by ! contractor b r au?orizes ! public to se>* = & report any vuln]ability4 7#b7 ,a description ( additional proc$ures t describe h[ ! contractor w communicate ) ! rese>*]1 & h[ & :5 any communication occurs4 7#c7 ,a description ( ! t>get timel9es = & track+ ( ! foll[+3 7,a7 ,notification ( receipt to ! individual t submits ! report1 if kn[n4 7,b7 ,an initial assessm5t1 su* z det]m9+ :e!r any disclos$ vuln]ability is valid4 7,c7 ,resolution ( a vuln]ability1 includ+ notification ( ! outcome to ! rese>*]4 7#d7 ,a page on ! website ( ! contractor t-- 7,a7 all[s = ! submission ( vuln]abilities by anyone relat+ to ! in=mation te*nology2 7,b7 li/s ! contact in=mation1 su* z a phone numb] or email address = an individual or team responsible = review+ any su* submission "u subp>agraph 7,a72 & 7,c7 describes ! process by :i* a review is conduct$1 includ+ h[ long x w take = ! contractor to respond to rese>*] & :e!r or n monet>y rew>ds w be paid to ! report] = id5tify+ a vuln]ability4 7#e7 ,9 ! case ( a discov]$ vuln]ability t ! contractor is n responsible = pat*+1 ! contractor %all submit ! vuln]ability to ! responsible p>ty or direct ! rese>*] to ! appropriate p>ty4 7b7 ,report+ requirem5ts & metrics ,n lat] ?an #g days aft] ! date on :i* ! vuln]ability disclosure policy describ$ 9 subsection 7a7 is publi%$1 & on an ongo+ basis z vuln]ability reports are receiv$1 an in=mation te*nology contractor %all report to ! ,cyb]security & ,infra/ructure ,security ,ag5cy ( ! ,dep>tm5t ( ,homel& ,security ! foll[+ in=mation3 7#a7 ,any valid or cr$ible report ( a n previ\sly kn[n public vuln]ability 7includ+ any misconfiguration7 on a sy/em t uses comm]cial s(tw>e or s]vices t affect or are likely to affect o!r p>ties 9 gov]nm5t or indu/ry once a pat* or viable mitigation is available4 7#b7 ,any o!r situation :]e ! contractor det]m9es x w\ld be helpful or necess>y to involve ! ,cyb]security & ,infra/ructure ,security ,ag5cy4 7c7 ,,cisa submission ( vuln]abilities ,! ,cyb]security & ,infra/ructure ,security ,ag5cy %all communicate ) & submit1 z necess>y1 vuln]abilities to ! ,,mitre ,common ,vuln]abilities & ,exposures database & ! ,national ,in/itute ( ,/&>ds & ,te*nology ,national ,vuln]ability ,database4 7d7 ,def9itions ,9 ?is section3 7#a7 ,executive ag5cy ,! t]m executive ag5cy has ! mean+ giv5 t t]m 9 section #acc4 7#b7 ,rese>*] ,! t]m rese>*] means ! individual :o submits a vuln]ability report4 7#c7 ,in=mation te*nology ,! t]m in=mation te*nology has ! mean+ giv5 t t]m 9 section #aaaja ( title #dj4 4 7b7 ,te*nical & con=m+ am5dm5t ,! table ( sections = *apt] #dg ( division ,c ( subtitle ,i ( title #da1 ,unit$ ,/ates ,code1 is am5d$ by add+ at ! end ! foll[+ new item3 #dgae4 ,vuln]ability disclosure policy & program requir$4 4 7c7 ,applicability ,! am5dm5ts made by ?is section %all take effect on ! date ( ! enactm5t ( ?is section & %all apply to any contract ent]$ into on or aft] su* effective date4