Review - HR 1258 Introduced – Contractor VDP

Back in February Rep Lieu (D,CA) introduced HR 1258, the Improving Contractor Cybersecurity Act. The bill would require federal contractors to have a vulnerability disclosure program (VDP). No new funding is provided.

The bill is essentially the same as HR 5310 that was introduced by Liew in August, 2023. No action was taken on that bill in the 118^th Congress.

The bill would amend Chapter 47, of division C, of subtitle I, of 41 USC, adding a new §4715, Vulnerability disclosure policy and program required.

Moving Forward

Lieu is not a member of the House Oversight and Government Reform Committee to which this bill was assigned for consideration. This means that there is probably not sufficient influence for the bill to be considered in Committee, the same problem that Lieu had with HR 5310 in the 118^th Congress. I suspect that there would be some Republicans that would oppose this bill as an unneeded, and potentially expensive, requirement for federal contractors. While there may possibly be sufficient bipartisan support for this bill to pass in Committee, I am not sure that there would be the necessary leadership interest to see this bill move forward.

Commentary

While the definition of ‘information technology’ used in this bill is broadly enough written to include control systems and operational technologies, there is an interesting shortcoming; it only applies to “the equipment [that] is used by the executive agency directly or is used by a contractor under a contract with the executive agency that requires the use” of the equipment. It specifically excludes any equipment acquired by a federal contractor incidental to a federal contract.” Thus, devices networked to ‘federally required equipment’ need not be included in the required VDP.

 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-1258-introduced - subscription required.

Review - Bills Introduced – 2-12-25

Yesterday, with both the House and Senate in session, there were 103 bills introduced. Four of those bills may receive additional coverage in this blog:

HR 1223 To require a plan to improve the cybersecurity and telecommunications of the U.S. Academic Research Fleet, and for other purposes. Fong, Vince [Rep.-R-CA-20]

HR 1258 To amend title 41, United States Code, to require information technology contractors to maintain a vulnerability disclosure policy and program, and for other purposes. Lieu, Ted [Rep.-D-CA-36]

HJ Res 40 Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Department of Defense relating to "Cybersecurity Maturity Model Certification (CMMC) Program". Clyde, Andrew S. [Rep.-R-GA-9]

HJ Res 46 Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Environmental Protection Agency relating to "Decabromodiphenyl Ether and Phenol, Isopropylated Phosphate (3:1); Revision to the Regulation of Persistent, Bioaccumulative, and Toxic Chemicals Under the Toxic Substances Control Act (TSCA)". Clyde, Andrew S. [Rep.-R-GA-9]

 

For more information on these proposed bills, including a history of similar bills in the 118^th Congress, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-2-12-25 - subscription required.

Bills Introduced – 02-28-17

With both the House and Senate in session today there were 53 bills introduced. Of those there was one that may be of specific interest to readers of this blog:

HR 1258 To make technical corrections to the Homeland Security Act of 2002. Rep. Perry, Scott [R-PA-4]

I’ll be watching this bill for any significant ‘technical corrections’ relating to chemical facility security, hazmat transportation security or cybersecurity. I will be surprised if there are any significant changes.