Federal contractors must now report security flaws to government
H.R. 872 — Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025 · Filed by Nancy Mace (R-SC) · 1 cosponsor · Introduced Jan 31, 2025 · Passed chamber
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires federal contractors to adopt vulnerability disclosure policies aligned with NIST standards, allowing them to report security flaws they discover in government systems. OMB and DoD have 180 days to update federal procurement rules to mandate this practice; agencies can waive the requirement only for national security reasons with congressional notification.
Why we flagged it
The bill's operative mechanism is a procurement-rule update mandating vulnerability disclosure policies for federal contractors. It is a regulatory standard-setting measure, not a subsidy, carve-out, or deregulation.
What the text implies
- Contractors may face increased compliance costs to establish and maintain vulnerability disclosure programs, which could be passed to government through higher contract bids.
- The 180-day implementation timeline is aggressive; contractors with legacy systems may struggle to comply, potentially creating competitive advantage for larger firms with existing security infrastructure.
- National security waivers, while requiring notification, are discretionary and may allow sensitive defense contracts to opt out without public disclosure of the waiver justification.
- Alignment with ISO standards 29147 and 30111 ties U.S. federal procurement to international standards, potentially harmonizing global cybersecurity practices but also creating dependencies on external standard-setting bodies.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
The bill strengthens cybersecurity defenses of federal information systems by requiring contractors to report vulnerabilities rather than exploit or conceal them, reducing breach risk and protecting citizen data held by government. The requirement is transparent, aligned with industry standards, and includes narrow national-security waivers with oversight.
Who stands to gain
- cybersecurity consulting firms
- vulnerability disclosure platform vendors
- IT security service providers
- large defense contractors with existing compliance infrastructure
Named in the bill
Office of Management and Budget (OMB), Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), National Cyber Director, Department of Defense (DoD), Federal Acquisition Regulation (FAR), Defense Federal Acquisition Regulation Supplement (DFARS), IoT Cybersecurity Improvement Act of 2020, International Standards Organization (ISO), House Committee on Armed Services
Where it stands
1 cosponsor: 1 Democrats.
- Jan 31, 2025 — Introduced · Congress.gov: “Introduced in House”
- Jan 31, 2025 — Referred to House Committee on Armed Services and House Committee on Oversight and Government Reform · Congress.gov: “Referred to the Committee on Oversight and Government Reform, and in addition to the Committee on Armed…”
- Mar 3, 2025 — Passed the House · Congress.gov: “Motion to reconsider laid on the table Agreed to without objection”
- Mar 3, 2025 — Floor vote scheduled · Congress.gov: “Mr. Comer moved to suspend the rules and pass the bill, as amended”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
Money around this bill
4 lobbying clients named this bill on 6 disclosure filings across 2 quarters, Dec 2025 to Jun 2026. Those filings disclosed $24,970,000 in lobbying spend. A filing names 40 bills on average, so that figure is what each filing reported, not a share belonging to this bill.
More lobbying clients named this bill than 72% of bills with at least one filing.
Nancy Mace, the sponsor, reported $8,000 in PAC receipts in the 2026 cycle.
- Chamber of Commerce of the U.S.A. — $17,960,000 on 1 filing
- Google Client Services LLC — $6,920,000 on 2 filings
- Red Hat Inc — $70,000 on 1 filing
- Hackerone — $20,000 on 2 filings
Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (5,855 characters) on Aug 20, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
Money — Senate Lobbying Disclosure Act filings whose specific-issue field names this bill for quarters ending Dec 2025 to Jun 2026. A filing's amount is reported whole beside the median number of bills a filing names; it is never divided across them. PAC receipts are FEC-reported contributions to the sponsor's candidate committee in the 2026 cycle.
As of — lobbying records through Jul 20, 2026 · page rendered 2026-10-20.
“Federal contractors must now report security flaws to government” QuorumCivic. https://share.quorumcivic.app/bill/119/hr872 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.