Improving Contractor Cybersecurity Act

Summary

Improving Contractor Cybersecurity Act This bill prohibits an executive agency from entering into a contract for information technology unless the contractor maintains a vulnerability disclosure policy (VDP) and program. The contractor must report to the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security, within seven days after the VDP is published, information regarding any valid or credible report of a not previously known public vulnerability on a system that uses commercial software or services that affect, or are likely to affect, other parties in government or industry once a patch or viable mitigation is available; and any other situation where the contractor determines it would be helpful or necessary to involve CISA. CISA must submit vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database.

This text is taken from the official record. PoliticalRepo does not editorialize.

Timeline

1. 28 May 2021

   Introduced

   Referred to the House Committee on Oversight and Reform.

   Source: IntroReferral

2. 28 May 2021

   Introduced

   Introduced in House

   Source: IntroReferral

3. 28 May 2021

   Introduced

   Introduced in House

   Source: IntroReferral

Votes

No vote records are attached yet.

Versions

• Introduced in House · 28 May 2021 · Official file

Documents

3 official files

• Introduced in House (text)

  Introduced in House · EN · 28 May 2021

  ViewDownloadOpen at official source

• Introduced in House (PDF)

  Introduced in House · EN · 28 May 2021

  ViewDownloadOpen at official source

• Introduced in House

  summary · EN · 28 May 2021

  Open at official source

Sponsors

• Rep. Lieu, Ted [D-CA-36] · D · Sponsor
• · hsgo00 · Standing

Related records

• related to → Improving Contractor Cybersecurity Act