,i #aahth ,,congress #ast ,session ,h4 ,r4 #ebee ,,in ,,the ,,house ,,of ,,representatives ,august #bb1 #bjbc,ms4 ,mace introduced the following bill2 which was referred to the ,committee on ,oversight and ,accountability1 and in addition to the ,committee on ,armed ,services1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,a ,,bill ,to require covered contractors implement a vulnerability disclosure policy consistent with ,,nist guidelines1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,federal ,cybersecurity ,vulnerability ,reduction ,act of #bjbc4 #b4 ,federal contractor vulnerability disclosure policy 7a7 ,in general ,not later than #ahj days after the date of the enactment of this ,act1 the ,director of the ,office of ,management and ,budget1 in consultation with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 the ,national ,cyber ,director1 the ,director of the ,national ,institute of ,standards and ,technology1 and any other appropriate head of an ,executive department1 shall review the ,federal ,acquisition ,regulation contract requirements and language for contractor vulnerability disclosure programs and recommend updates to such requirements and language to the ,federal ,acquisition ,regulation ,council4 ,the recommendations shall include updates to such requirements designed to ensure that covered contractors implement a vulnerability disclosure policy consistent with ,,nist guidelines for contractors as required under section #e of the ,io,t ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c2 ,public ,law #aaf-bjg74 7b7 ,procurement requirements ,not later than #fj days after the date on which the recommended contract language developed pursuant to subsection 7a7 is received1 the ,,far ,council shall review the recommended contract language and update the ,,far as necessary to incorporate requirements for covered contractors to receive information about a potential security vulnerability relating to an information system owned or controlled by a contractor4 7c7 ,elements ,the update to the ,,far pursuant to subsection 7b7 shall-- 7#a7 to the maximum extent practicable1 be aligned with the ,,nist guidelines and ,,omb implementation for contractors as required under sections #e and #f of the ,io,t ,cybersecurity ,improvement ,act of #bjbj 7,public ,law #aaf-bjg2 #ae ,u4,s4,c4 #bgh;g-#c;c and #bgh;g-#c;d72 7#b7 to the maximum extent practicable1 be aligned with industry best practices and ,standards #biadg and #cjaaa of the ,international ,standards ,organization 7or any successor standard7 or any other appropriate1 relevant1 and widely used standard2 and 7#c7 not apply to contractors whose contracts are in amounts not greater than the simplified acquisition threshold4 7d7 ,waiver ,consistent with section #g7;b7 of the ,io,t ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;e7b771 the ,chief ,information ,officer of an ,executive department may waive the vulnerability disclosure policy requirement under subsection 7b7 if the ,chief ,information ,officer determines that the waiver is necessary in the interest of national security or research purposes4 7e7 ,department of ,defense ,supplement to the ,federal ,acquisition ,regulation 7#a7 ,review ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary of ,defense shall review the ,department of ,defense ,supplement to the ,federal ,acquisition ,regulation contract requirements and language for contractor vulnerability disclosure programs and develop updates to such requirements designed to ensure that covered contractors implement a vulnerability disclosure policy consistent with ,,nist guidelines for contractors as required under section #e of the ,io,t ,cybersecurity ,improvement ,act of #bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c2 ,public ,law #aaf-bjg74 7#b7 ,revisions ,not later than #fj days after the date on which the review required under subsection 7a7 is completed1 the ,secretary shall revise the ,,dfars as necessary to incorporate requirements for covered contractors to receive information about a potential security vulnerability relating to an information system owned or controlled by a contractor4 7#c7 ,elements ,the ,secretary shall ensure that the revision to the ,,dfars described in this subsection is carried out in accordance with the requirements of paragraphs 7#a71 7#b71 and 7#c7 of subsection 7c74 7#d7 ,waiver ,the ,chief ,information ,officer of the ,department of ,defense may waive the security vulnerability disclosure requirements under paragraph 7#b7 if the ,chief ,information ,officer determines that the waiver is necessary in the interest of national security or research purposes4 7f7 ,definitions ,in this section3 7#a7 ,covered contractor ,the term covered contractor means a contractor 7as defined in section #gaja of title #da1 ,united ,states ,code7 whose contract is in an amount the same as or greater than the simplified acquisition threshold4 7#b7 ,,dfars ,the term ,,dfars means the ,department of ,defense ,supplement to the ,federal ,acquisition ,regulation4 7#c7 ,executive department ,the term ,executive department has the meaning given that term in section #aja of title #e1 ,united ,states ,code4 7#d7 ,,far ,the term ,,far means the ,federal ,acquisition ,regulation4 7#e7 ,,nist ,the term ,,nist means the ,national ,institute of ,standards and ,technology4 7#f7 ,,omb ,the term ,,omb means the ,office of ,management and ,budget4 7#g7 ,security vulnerability ,the term security vulnerability has the meaning given that term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 7#h7 ,simplified acquisition threshold ,the term simplified acquisition threshold has the meaning given that term in section #acd of title #da1 ,united ,states ,code4