Federal contractors must now disclose security flaws—quietly.

What it does

This bill requires the federal government to update its contractor rules so that companies working on federal contracts must have policies for reporting and fixing cybersecurity vulnerabilities in their systems. Within 180 days, the Office of Management and Budget must recommend updates to federal contracting rules; within another 180 days, those rules must be formally adopted. Contractors above a certain contract size or those managing federal computer systems must follow these vulnerability-disclosure standards, aligned with existing government and international best practices, though agencies can waive the requirement for national security reasons.

Why we flagged it

The bill's core function is to mandate vulnerability-disclosure policies in federal contractor agreements. It is a procurement and cybersecurity governance measure, not a subsidy, deregulation, or commemorative act.

What the text implies

• Contractors may face increased compliance costs (audits, disclosure processes, remediation) that could be passed to the government through higher contract bids, indirectly raising federal spending.
• The 180-day timeline for OMB recommendations and FAR updates is aggressive; delays or incomplete implementation could leave gaps in contractor cybersecurity oversight.
• Waiver authority granted to agency CIOs with only 30-day notification to Congress creates a potential loophole for national-security claims that may not be scrutinized in real time.
• The bill aligns with NIST and ISO standards but does not specify enforcement mechanisms, penalties, or audit procedures, leaving implementation details to future rulemaking.

Who it affects

Ordinary citizens benefit from stronger cybersecurity in federal contractor systems, which reduces the risk of data breaches, system failures, and compromised government services. The bill imposes no new costs on the public and creates transparency and accountability mechanisms (waiver notifications to Congress) that strengthen oversight of federal spending.

Who stands to gain

• cybersecurity consulting firms
• IT compliance and audit service providers
• software vendors specializing in vulnerability management
• federal contractors (potential cost pass-through to government)

Named in the bill

Office of Management and Budget (OMB), Cybersecurity and Infrastructure Security Agency (CISA), National Cyber Director, National Institute of Standards and Technology (NIST), Federal Acquisition Regulation (FAR) Council, IoT Cybersecurity Improvement Act of 2020, International Standards Organization (ISO), Senate Committee on Homeland Security and Governmental Affairs, House Committee on Oversight and Reform, Verisk Analytics (VRSN), AMD, Hewlett Packard Enterprise (HPE) — and 2 more

Where it stands

1 cosponsor: 1 Republicans.

• May 22, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• May 22, 2025 — Referred to Senate Committee on Homeland Security and Governmental Affairs · Congress.gov: “Read twice and referred to the Committee on Homeland Security and Governmental Affairs”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

1 lobbying clients named this bill on 1 disclosure filings across 1 quarter, Dec 2025 to Dec 2025. Those filings disclosed $17,960,000 in lobbying spend. A filing names 290 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 0% of bills with at least one filing.

Mark Warner, the sponsor, reported $2,246,650 in PAC receipts in the 2026 cycle.

• Chamber of Commerce of the U.S.A. — $17,960,000 on 1 filing

Lobbying Disclosure Act filings through Jan 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.