,i  #aah? ,,congress  #a/ ,session  ,h4 
,r4 #ebee  ,,9 ,,! ,,h\se ,,(           
,,repres5tatives  ,augu/ #bb1 #bjbc,ms4 
,mace introduc$ ! foll[+ bill2 :i* 0    
ref]r$ to ! ,committee on ,ov]sight &   
,acc\ntability1 & 9 addition to !       
,committee on ,arm$ ,s]vices1 = a p]iod 
to be subsequ5tly det]m9$ by ! ,speak]1 
9 ea* case = consid]ation ( su*         
provisions z fall )9 ! jurisdiction ( ! 
committee conc]n$  ,a ,,bill  ,to       
require cov]$ contractors implem5t a    
vuln]ability disclosure policy consi/5t 
) ,,ni/ guidel9es1 & = o!r purposes4    
#a4 ,%ort title ,?is ,act may be cit$ z 
! ,f$]al ,cyb]security ,vuln]ability    
,r$uction ,act ( #bjbc4  #b4 ,f$]al     
contractor vuln]ability disclosure      
policy  7a7 ,9 g5]al ,n lat] ?an #ahj   
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,director ( ! ,(fice (          
,managem5t & ,budget1 9 consultation ) !
 ,director ( ! ,cyb]security &          
,infra/ructure ,security ,ag5cy1 !      
,national ,cyb] ,director1 ! ,director (

 ! ,national ,in/itute ( ,/&>ds &       
,te*nology1 & any o!r appropriate head (
 an ,executive dep>tm5t1 %all review !  
,f$]al ,acquisition ,regulation contract
 requirem5ts & language = contractor    
vuln]ability disclosure programs &      
recomm5d updates to su* requirem5ts &   
language to ! ,f$]al ,acquisition       
,regulation ,c\ncil4 ,! recomm5dations  
%all include updates to su* requirem5ts 
design$ to ensure t cov]$ contractors   
implem5t a vuln]ability disclosure      
policy consi/5t ) ,,ni/ guidel9es =     
contractors z requir$ "u section #e ( ! 
,io,t ,cyb]security ,improvem5t ,act (  
#bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c2       
,public ,law #aaf-bjg74  7b7 ,procurem5t
 requirem5ts ,n lat] ?an #fj days aft] !
 date on :i* ! recomm5d$ contract       
language develop$ pursuant to subsection
 7a7 is receiv$1 ! ,,f> ,c\ncil %all    
review ! recomm5d$ contract language &  
update ! ,,f> z necess>y to incorporate 
requirem5ts = cov]$ contractors to      
receive in=mation ab\t a pot5tial       

security vuln]ability relat+ to an      
in=mation sy/em own$ or controll$ by a  
contractor4  7c7 ,elem5ts ,! update to !
 ,,f> pursuant to subsection 7b7 %all-- 
7#a7 to ! maximum ext5t practicable1 be 
align$ ) ! ,,ni/ guidel9es & ,,omb      
implem5tation = contractors z requir$ "u
 sections #e & #f ( ! ,io,t             
,cyb]security ,improvem5t ,act ( #bjbj  
7,public ,law #aaf-bjg2 #ae ,u4,s4,c4   
#bgh;g-#c;c & #bgh;g-#c;d72  7#b7 to !  
maximum ext5t practicable1 be align$ )  
indu/ry be/ practices & ,/&>ds #biadg & 
#cjaaa ( ! ,int]national ,/&>ds         
,organization 7or any successor /&>d7 or
 any o!r appropriate1 relevant1 & widely
 us$ /&>d2 &  7#c7 n apply to           
contractors ^: contracts are 9 am\nts n 
great] ?an ! simplifi$ acquisition      
?re%old4  7d7 ,waiv] ,consi/5t ) section
 #g7;b7 ( ! ,io,t ,cyb]security         
,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 
#bgh;g-#c;e7b771 ! ,*ief ,in=mation     
,(fic] ( an ,executive dep>tm5t may     
waive ! vuln]ability disclosure policy  

requirem5t "u subsection 7b7 if ! ,*ief 
,in=mation ,(fic] det]m9es t ! waiv] is 
necess>y 9 ! int]e/ ( national security 
or rese>* purposes4  7e7 ,dep>tm5t (    
,def5se ,supplem5t to ! ,f$]al          
,acquisition ,regulation  7#a7 ,review  
,n lat] ?an #ahj days aft] ! date ( !   
enactm5t ( ?is ,act1 ! ,secret>y (      
,def5se %all review ! ,dep>tm5t (       
,def5se ,supplem5t to ! ,f$]al          
,acquisition ,regulation contract       
requirem5ts & language = contractor     
vuln]ability disclosure programs &      
develop updates to su* requirem5ts      
design$ to ensure t cov]$ contractors   
implem5t a vuln]ability disclosure      
policy consi/5t ) ,,ni/ guidel9es =     
contractors z requir$ "u section #e ( ! 
,io,t ,cyb]security ,improvem5t ,act (  
#bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c2       
,public ,law #aaf-bjg74  7#b7 ,revisions
 ,n lat] ?an #fj days aft] ! date on :i*
 ! review requir$ "u subsection 7a7 is  
complet$1 ! ,secret>y %all revise !     
,,df>s z necess>y to incorporate        

requirem5ts = cov]$ contractors to      
receive in=mation ab\t a pot5tial       
security vuln]ability relat+ to an      
in=mation sy/em own$ or controll$ by a  
contractor4  7#c7 ,elem5ts ,! ,secret>y 
%all ensure t ! revision to ! ,,df>s    
describ$ 9 ?is subsection is c>ri$ out 9
 accordance ) ! requirem5ts ( p>agraphs 
7#a71 7#b71 & 7#c7 ( subsection 7c74    
7#d7 ,waiv] ,! ,*ief ,in=mation ,(fic] (
 ! ,dep>tm5t ( ,def5se may waive !      
security vuln]ability disclosure        
requirem5ts "u p>agraph 7#b7 if ! ,*ief 
,in=mation ,(fic] det]m9es t ! waiv] is 
necess>y 9 ! int]e/ ( national security 
or rese>* purposes4  7f7 ,def9itions ,9 
?is section3 7#a7 ,cov]$ contractor ,!  
t]m cov]$ contractor means a contractor 
7z def9$ 9 section #gaja ( title #da1   
,unit$ ,/ates ,code7 ^: contract is 9 an
 am\nt ! same z or great] ?an !         
simplifi$ acquisition ?re%old4  7#b7    
,,df>s ,! t]m ,,df>s means ! ,dep>tm5t (
 ,def5se ,supplem5t to ! ,f$]al         
,acquisition ,regulation4  7#c7         

,executive dep>tm5t ,! t]m ,executive   
dep>tm5t has ! mean+ giv5 t t]m 9       
section #aja ( title #e1 ,unit$ ,/ates  
,code4  7#d7 ,,f> ,! t]m ,,f> means !   
,f$]al ,acquisition ,regulation4  7#e7  
,,ni/ ,! t]m ,,ni/ means ! ,national    
,in/itute ( ,/&>ds & ,te*nology4  7#f7  
,,omb ,! t]m ,,omb means ! ,(fice (     
,managem5t & ,budget4  7#g7 ,security   
vuln]ability ,! t]m security            
vuln]ability has ! mean+ giv5 t t]m 9   
section #bbjj ( ! ,homel& ,security ,act
 ( #bjjb 7#f ,u4,s4,c4 #fej74  7#h7     
,simplifi$ acquisition ?re%old ,! t]m   
simplifi$ acquisition ?re%old has !     
mean+ giv5 t t]m 9 section #acd ( title 
#da1 ,unit$ ,/ates ,code4