,,ii  #aaith ,,congress  #ast ,session  
,s4 #ahii  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,may #bb1      
#bjbe,mr4 ,warner introduced the        
following bill2 which was read twice and
 referred to the ,committee on ,homeland
 ,security and ,governmental ,affairs   
,a ,,bill  ,to require ,federal         
contractors to implement a vulnerability
 disclosure policy consistent with      
,,nist guidelines1 and for other        
purposes4  #a4 ,short title ,this ,act  
may be cited as the ,federal ,contractor
 ,cybersecurity ,vulnerability          
,reduction ,act of #bjbe4  #b4 ,federal 
contractor vulnerability disclosure     
policy  7a7 ,recommendations  7#a7 ,in  
general ,not later than #ahj days after 
the date of the enactment of this ,act1 
the ,director of the ,office of         
,management and ,budget1 in consultation
 with the ,director of the              
,cybersecurity and ,infrastructure      
,security ,agency1 the ,national ,cyber 
,director1 the ,director of the         

,national ,institute of ,standards and  
,technology1 and any other appropriate  
head of an ,executive department1       
shall-- 7,a7 review the ,federal        
,acquisition ,regulation 7,,far7        
contract requirements and language for  
contractor vulnerability disclosure     
programs2 and  7,b7 recommend updates to
 such requirements and language to the  
,federal ,acquisition ,regulation       
,council4  7#b7 ,contents ,the          
recommendations required by paragraph   
7#a7 shall include updates to such      
requirements designed to ensure that    
covered contractors implement a         
vulnerability disclosure policy         
consistent with ,national ,institute of 
,standards and ,technology 7,,nist7     
guidelines for contractors as required  
under section #e of the ,io,t           
,cybersecurity ,improvement ,act of     
#bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c74  7b7 
,procurement requirements ,not later    
than #ahj days after the date on which  
the recommended contract language       

developed pursuant to subsection 7a7 is 
received1 the ,federal ,acquisition     
,regulation ,council shall review the   
recommended contract language and amend 
the ,,far as necessary to incorporate   
requirements for covered contractors to 
solicit and address information about   
potential security vulnerabilities      
relating to an information system owned 
or controlled by the contractor that is 
used in performance of a ,federal       
contract4  7c7 ,elements ,the update to 
the ,,far pursuant to subsection 7b7    
shall-- 7#a7 to the maximum extent      
practicable1 align with the security    
vulnerability disclosure process and    
coordinated disclosure requirements     
relating to ,federal information systems
 under sections #e and #f of the ,io,t  
,cybersecurity ,improvement ,act of     
#bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c1       
#bgh;g-#c;d72 and  7#b7 to the maximum  
extent practicable1 be aligned with     
industry best practices and ,standards  
#biadg and #cjaaa of the ,international 

,standards ,organization 7or any        
successor standard7 or any other        
appropriate1 relevant1 and widely used  
standard4  7d7 ,waiver ,the head of an  
agency may waive the security           
vulnerability disclosure policy         
requirement under subsection 7b7 if the 
agency ,chief ,information ,officer--   
7#a7 determines that the waiver is      
necessary in the interest of national   
security or research purposes2 and  7#b7
 not later than #cj days after granting 
the waiver1 submits a notification and  
justification1 including information    
about the duration of the waiver1 to the
 ,committee on ,homeland ,security and  
,governmental ,affairs of the ,senate   
and the ,committee on ,oversight and    
,reform of the ,house of                
,representatives4  7e7 ,definitions ,in 
this section3 7#a7 ,agency ,the term    
agency has the meaning given the term in
 section #cejb of title #dd1 ,united    
,states ,code4  7#b7 ,covered contractor
 ,the term covered contractor means a   

contractor 7as defined in section #gaja 
of title #da1 ,united ,states ,code7--  
7,a7 whose contract is in an amount the 
same as or greater than the simplified  
acquisition threshold2 or  7,b7 that    
uses1 operates1 manages1 or maintains a 
,federal information system 7as defined 
by section #aacca of title #dj1 ,united 
,stated ,code7 on behalf of an agency4  
7#c7 ,executive department ,the term    
,executive department has the meaning   
given that term in section #aja of title
 #e1 ,united ,states ,code4  7#d7       
,security vulnerability ,the term       
security vulnerability has the meaning  
given that term in section #bbjj of the 
,homeland ,security ,act of #bjjb 7#f   
,u4,s4,c4 #fej74  7#e7 ,simplified      
acquisition threshold ,the term         
simplified acquisition threshold has the
 meaning given that term in section #acd
 of title #da1 ,united ,states ,code4   
#c4 ,no additional funding ,no          
additional funds are authorized to be   
appropriated for the purpose of carrying

 out this ,act4