,,ii  #aai? ,,congress  #a/ ,session    
,s4 #ahii  ,,9 ,,! ,,s5ate ,,( ,,!      
,,unit$ ,,/ates  ,may #bb1 #bjbe,mr4    
,w>n] introduc$ ! foll[+ bill2 :i* 0    
read twice & ref]r$ to ! ,committee on  
,homel& ,security & ,gov]nm5tal ,affairs
  ,a ,,bill  ,to require ,f$]al         
contractors to implem5t a vuln]ability  
disclosure policy consi/5t ) ,,ni/      
guidel9es1 & = o!r purposes4  #a4 ,%ort 
title ,?is ,act may be cit$ z ! ,f$]al  
,contractor ,cyb]security ,vuln]ability 
,r$uction ,act ( #bjbe4  #b4 ,f$]al     
contractor vuln]ability disclosure      
policy  7a7 ,recomm5dations  7#a7 ,9    
g5]al ,n lat] ?an #ahj days aft] ! date 
( ! enactm5t ( ?is ,act1 ! ,director ( !
 ,(fice ( ,managem5t & ,budget1 9       
consultation ) ! ,director ( !          
,cyb]security & ,infra/ructure ,security
 ,ag5cy1 ! ,national ,cyb] ,director1 ! 
,director ( ! ,national ,in/itute (     
,/&>ds & ,te*nology1 & any o!r          
appropriate head ( an ,executive        
dep>tm5t1 %all-- 7,a7 review ! ,f$]al   

,acquisition ,regulation 7,,f>7 contract
 requirem5ts & language = contractor    
vuln]ability disclosure programs2 &     
7,b7 recomm5d updates to su* requirem5ts
 & language to ! ,f$]al ,acquisition    
,regulation ,c\ncil4  7#b7 ,cont5ts ,!  
recomm5dations requir$ by p>agraph 7#a7 
%all include updates to su* requirem5ts 
design$ to ensure t cov]$ contractors   
implem5t a vuln]ability disclosure      
policy consi/5t ) ,national ,in/itute ( 
,/&>ds & ,te*nology 7,,ni/7 guidel9es = 
contractors z requir$ "u section #e ( ! 
,io,t ,cyb]security ,improvem5t ,act (  
#bjbj 7#ae ,u4,s4,c4 #bgh;g-#c;c74  7b7 
,procurem5t requirem5ts ,n lat] ?an #ahj
 days aft] ! date on :i* ! recomm5d$    
contract language develop$ pursuant to  
subsection 7a7 is receiv$1 ! ,f$]al     
,acquisition ,regulation ,c\ncil %all   
review ! recomm5d$ contract language &  
am5d ! ,,f> z necess>y to incorporate   
requirem5ts = cov]$ contractors to      
solicit & address in=mation ab\t        
pot5tial security vuln]abilities relat+ 

to an in=mation sy/em own$ or controll$ 
by ! contractor t is us$ 9 p]=mance ( a 
,f$]al contract4  7c7 ,elem5ts ,! update
 to ! ,,f> pursuant to subsection 7b7   
%all-- 7#a7 to ! maximum ext5t          
practicable1 align ) ! security         
vuln]ability disclosure process &       
coord9at$ disclosure requirem5ts relat+ 
to ,f$]al in=mation sy/ems "u sections  
#e & #f ( ! ,io,t ,cyb]security         
,improvem5t ,act ( #bjbj 7#ae ,u4,s4,c4 
#bgh;g-#c;c1 #bgh;g-#c;d72 &  7#b7 to ! 
maximum ext5t practicable1 be align$ )  
indu/ry be/ practices & ,/&>ds #biadg & 
#cjaaa ( ! ,int]national ,/&>ds         
,organization 7or any successor /&>d7 or
 any o!r appropriate1 relevant1 & widely
 us$ /&>d4  7d7 ,waiv] ,! head ( an     
ag5cy may waive ! security vuln]ability 
disclosure policy requirem5t "u         
subsection 7b7 if ! ag5cy ,*ief         
,in=mation ,(fic]-- 7#a7 det]m9es t !   
waiv] is necess>y 9 ! int]e/ ( national 
security or rese>* purposes2 &  7#b7 n  
lat] ?an #cj days aft] grant+ ! waiv]1  

submits a notification & ju/ification1  
includ+ in=mation ab\t ! duration ( !   
waiv]1 to ! ,committee on ,homel&       
,security & ,gov]nm5tal ,affairs ( !    
,s5ate & ! ,committee on ,ov]sight &    
,re=m ( ! ,h\se ( ,repres5tatives4  7e7 
,def9itions ,9 ?is section3 7#a7 ,ag5cy 
,! t]m ag5cy has ! mean+ giv5 ! t]m 9   
section #cejb ( title #dd1 ,unit$ ,/ates
 ,code4  7#b7 ,cov]$ contractor ,! t]m  
cov]$ contractor means a contractor 7z  
def9$ 9 section #gaja ( title #da1      
,unit$ ,/ates ,code7-- 7,a7 ^: contract 
is 9 an am\nt ! same z or great] ?an !  
simplifi$ acquisition ?re%old2 or  7,b7 
t uses1 op]ates1 manages1 or ma9ta9s a  
,f$]al in=mation sy/em 7z def9$ by      
section #aacca ( title #dj1 ,unit$ ,/at$
 ,code7 on behalf ( an ag5cy4  7#c7     
,executive dep>tm5t ,! t]m ,executive   
dep>tm5t has ! mean+ giv5 t t]m 9       
section #aja ( title #e1 ,unit$ ,/ates  
,code4  7#d7 ,security vuln]ability ,!  
t]m security vuln]ability has ! mean+   
giv5 t t]m 9 section #bbjj ( ! ,homel&  

,security ,act ( #bjjb 7#f ,u4,s4,c4    
#fej74  7#e7 ,simplifi$ acquisition     
?re%old ,! t]m simplifi$ acquisition    
?re%old has ! mean+ giv5 t t]m 9 section
 #acd ( title #da1 ,unit$ ,/ates ,code4 
#c4 ,no additional fund+ ,no additional 
funds are au?oriz$ to be appropriat$ = !
 purpose ( c>ry+ out ?is ,act4