Federal IT contractors must now disclose security flaws—and protect researchers.
H.R. 1258 — Improving Contractor Cybersecurity Act · Filed by Ted Lieu (D-CA) · Introduced Feb 12, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires federal IT contractors to establish and maintain a vulnerability disclosure policy—a formal process allowing security researchers to report software flaws without legal risk. The policy must include clear submission procedures, timelines for response, protections for researchers (including anonymity and legal defense), and a public-facing webpage. Contractors must report serious vulnerabilities to the Department of Homeland Security's Cybersecurity and Infrastructure Security Agency (CISA), which will share them with national vulnerability databases. The requirement applies to all new federal IT contracts after enactment.
Why we flagged it
The bill's core mechanism is a regulatory requirement—not a subsidy, tax break, or deregulation—that mandates IT contractors adopt transparent vulnerability disclosure practices. It is a straightforward accountability measure designed to improve federal IT security.
What the text implies
- Contractors may face increased operational costs to establish and maintain disclosure programs, though the bill does not specify who bears these costs or whether they are reimbursable.
- The requirement to report vulnerabilities to CISA within 7 days of policy publication may create a flood of initial disclosures, potentially overwhelming CISA's capacity to process and remediate.
- Contractors may face liability exposure if they fail to properly defend researchers acting in good faith, creating new contractual and legal obligations not explicitly funded.
- The bill does not specify enforcement mechanisms, penalties for non-compliance, or how agencies will verify contractor adherence to the policy requirements.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Citizens depend on federal IT systems for benefits, services, and data security. Mandatory vulnerability disclosure policies improve the security of those systems by creating formal channels for researchers to report flaws before attackers exploit them, while protecting researchers from legal retaliation. This reduces breach risk and strengthens the security posture of federal infrastructure.
Who stands to gain
- cybersecurity consulting firms (policy development and implementation)
- vulnerability management software vendors
- legal services (policy drafting and researcher defense)
Named in the bill
Department of Homeland Security, Cybersecurity and Infrastructure Security Agency (CISA), MITRE Common Vulnerabilities and Exposures (CVE) database, National Institute of Standards and Technology (NIST), National Vulnerability Database, Federal IT contractors, Executive agencies
Where it stands
- Feb 12, 2025 — Introduced · Congress.gov: “Introduced in House”
- Feb 12, 2025 — Referred to House Committee on Oversight and Government Reform · Congress.gov: “Referred to the House Committee on Oversight and Government Reform”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (6,501 characters) on May 1, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-20.
“Federal IT contractors must now disclose security flaws—and protect researchers.” QuorumCivic. https://share.quorumcivic.app/bill/119/hr1258 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.