Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025

HR 872 requires federal contractors with contracts above $250,000 or those handling federal information systems to implement vulnerability disclosure policies aligned with NIST guidelines and international standards (like ISO 29147). Within 180 days, the OMB and agencies must update the Federal Acquisition Regulation (FAR) and Defense FAR (DFARS) to mandate these policies, ensuring contractors disclose security vulnerabilities in systems they manage for the government. The bill allows limited waivers for national security or research, requiring congressional notification within 30 days. It directly affects major federal contractors, aiming to standardize how security flaws are reported and addressed across government contracts.