Federal Cybersecurity Vulnerability Reduction Act of 2023

This bill requires certain federal contractors to implement a vulnerability disclosure policy consistent with NIST guidelines, aiming to improve cybersecurity by ensuring contractors have a process to receive and address reports of security vulnerabilities in their information systems.

Sec. 2, Federal contractor vulnerability disclosure policy: Within 180 days of enactment, the Director of OMB, consulting with CISA, the National Cyber Director, NIST, and other agency heads, must review Federal Acquisition Regulation (FAR) contract requirements for contractor vulnerability disclosure programs and recommend updates to the FAR Council. These updates must ensure covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines under the IoT Cybersecurity Improvement Act of 2020. Within 60 days of receiving the recommendations, the FAR Council must review and update the FAR to require covered contractors to receive information about potential security vulnerabilities in their information systems. The updates must align with NIST guidelines and OMB implementation, industry best practices, and ISO standards 29147 and 30111, but do not apply to contracts below the simplified acquisition threshold. Agency CIOs may waive the requirement for national security or research purposes. The Secretary of Defense must similarly review and update the DFARS within 180 days, with revisions within 60 days, following the same elements and waiver provisions. Covered contractors are those with contracts at or above the simplified acquisition threshold.