Improving Contractor Cybersecurity Act

HR 1258, the Improving Contractor Cybersecurity Act, requires federal information technology contractors to implement standardized vulnerability disclosure policies. These policies must allow anonymous reporting of security flaws, prohibit lawsuits against researchers acting in good faith, and provide clear timelines for responding to reports and fixing issues. Contractors must also report significant new vulnerabilities to the Cybersecurity and Infrastructure Security Agency (CISA) within 7 days, and CISA will submit verified vulnerabilities to national databases like the National Vulnerability Database. The law directly affects companies bidding on federal IT contracts, mandating transparent security reporting processes to protect government and public systems.