Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025

Summary

Requires the Office of Management and Budget (OMB) and the Federal Acquisition Regulation (FAR) Council to update federal contracting rules so covered contractors must run vulnerability disclosure programs that follow NIST guidance and international standards. OMB must recommend language within 180 days of enactment, the FAR Council must act within 180 days after receiving those recommendations, and agencies may grant limited waivers for national security or research reasons with timely notification to Congress. The law does not provide new funding and must be implemented with existing resources.

• OMB must recommend updated FAR contract language on vulnerability disclosure programs within 180 days of enactment.
• The FAR Council must review and amend the FAR within 180 days after receiving OMB's recommendations so covered contractors are required to accept and address security vulnerability reports.
• Required vulnerability disclosure policies must be consistent with NIST guidance and align, where practicable, with IoT Act provisions and ISO standards (29147 and 30111).
• Agencies may waive the requirement for national security or research reasons, but agency CIOs must justify waivers and notify specified Congressional committees within 30 days.
• No new appropriations are authorized; implementation must use existing funds.
• The rule change will affect contractors who control information systems used to perform federal contracts and will be implemented through FAR clause changes.
• The Act relies on existing statutory definitions for key terms and emphasizes alignment with established industry best practices.
• This is an administrative/procurement change rather than a new program or spending authorization.