Improving Contractor Cybersecurity Act

The Improving Contractor Cybersecurity Act (HR 5310) requires federal information technology contractors to establish a public process for reporting security flaws. This process must allow anonymous submissions, prohibit lawsuits for accidental policy violations during reporting, and include clear timeframes for responding to reports. Contractors must also report certain vulnerabilities to the Cybersecurity and Infrastructure Security Agency (CISA), which will then share them with national security databases. The law applies to all new federal IT contracts entered into after its effective date.