Federal Contractor Cybersecurity Vulnerability Reduction Act of 2024

This bill requires federal contractors to implement a vulnerability disclosure policy consistent with NIST guidelines, and for other purposes.

Sec. 2, Federal contractor vulnerability disclosure policy: Within 180 days of enactment, the Director of the Office of Management and Budget, consulting with other agency heads, must review and recommend updates to Federal Acquisition Regulation (FAR) contract requirements for contractor vulnerability disclosure programs. The recommendations must ensure covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines under the IoT Cybersecurity Improvement Act of 2020. Within 180 days of receiving the recommendations, the FAR Council must amend the FAR to require covered contractors to solicit and address information about potential security vulnerabilities in information systems used for federal contracts. The update must align with the IoT Cybersecurity Improvement Act's vulnerability disclosure process and, to the maximum extent practicable, with industry best practices and ISO standards 29147 and 30111. An agency head may waive the requirement if the agency Chief Information Officer determines it is necessary for national security or research, and notifies Congress within 30 days. The section defines key terms: 'agency' (44 U.S.C. 3502), 'covered contractor' (a contractor with a contract at or above the simplified acquisition threshold or that uses a federal information system on behalf of an agency), 'Executive department' (5 U.S.C. 101), 'security vulnerability' (6 U.S.C. 650), and 'simplified acquisition threshold' (41 U.S.C. 134).

Sec. 3, No additional funding: No additional funds are authorized to be appropriated for carrying out this Act.