Federal Cybersecurity Vulnerability Reduction Act of 2023

HR 5255 requires federal contractors with large contracts (over $250,000) to implement vulnerability disclosure policies aligned with NIST cybersecurity guidelines. It directs the Office of Management and Budget to update the Federal Acquisition Regulation (FAR) and Defense Department rules (DFARS) within 180 days to mandate that contractors report security flaws in their systems. The policy excludes small contractors below the simplified acquisition threshold and allows national security waivers for specific cases. This law aims to standardize how contractors handle and disclose cybersecurity risks across federal systems.