119th Congress Government Operations and Politics
H.R. 1258: Improving Contractor Cybersecurity Act
Introduced
- Introduced (completed)
- Passed House (not reached)
- Passed Senate (not reached)
- To the President (not reached)
- Became law (not reached)
Summary
This bill prohibits an executive agency from entering into a contract for information technology unless the contractor maintains a vulnerability disclosure policy (VDP) and program.
The contractor must report to the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security, within seven days after the VDP is published and on an ongoing basis as vulnerability reports are received, information regarding
- any valid or credible report of a not previously known public vulnerability on a system that uses commercial software or services that affect, or are likely to affect, other parties in government or industry once a patch or viable mitigation is available; and
- any other situation where the contractor determines it would be helpful or necessary to involve CISA.
Read the full summary
CISA must submit vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database.
Written by the Congressional Research Service, Library of Congress.
Roll calls
No roll call votes have been held on this bill.
Amendments
No amendments were offered to this bill.
Who scored on this bill
No member has earned points from it yet.
See all scorers and every scoring event
Introductions and cosponsorships count toward weekly caps and show no points.
Other bills by Ted Lieu
History
- Introduced in the House by Ted Lieu.
Show the full action history (2 actions)
- Introduced in House
- Referred to the House Committee on Oversight and Government Reform.