House Passes HR 872 – Contractor VDP

Today, the House took up HR 872, the Federal Cybersecurity Vulnerability Reduction Act of 2023, under the suspension of the rules process. After 20 minutes of debate, the bill was passed by voice vote. The bill would require the OMB and DOD to review Federal Acquisition Regulations (FAR) to ensure that covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines for contractors as required by 15 USC 278g–3c. No funding is authorized by this legislation.

The bill will now be sent to the Senate for consideration. This legislation is not politically important enough to be considered under regular order in the Senate. There is a chance that this bill could reach the Seante floor under the unanimous consent process. Unfortunately, that process is subject to all sorts of political machinations that could draw an objection that has nothing to do with merits of the legislation. In years past, this bill would be a logical addition to a spending or authorization bill, that has become less likely since the Republicans took control of the House in 2022.