House Passes HR 872 – Contractor VDP

Today, the House took up HR 872, the Federal Cybersecurity Vulnerability Reduction Act of 2023, under the suspension of the rules process. After 20 minutes of debate, the bill was passed by voice vote. The bill would require the OMB and DOD to review Federal Acquisition Regulations (FAR) to ensure that covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines for contractors as required by 15 USC 278g–3c. No funding is authorized by this legislation.

The bill will now be sent to the Senate for consideration. This legislation is not politically important enough to be considered under regular order in the Senate. There is a chance that this bill could reach the Seante floor under the unanimous consent process. Unfortunately, that process is subject to all sorts of political machinations that could draw an objection that has nothing to do with merits of the legislation. In years past, this bill would be a logical addition to a spending or authorization bill, that has become less likely since the Republicans took control of the House in 2022. 

Review - HR 872 Introduced – Contractor VDP

Last month, Rep Mace (R,SC) introduced HR 872, the Federal Cybersecurity Vulnerability Reduction Act of 2023. The bill would require the OMB and DOD to review Federal Acquisition Regulations (FAR) to ensure that covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines for contractors as required by 15 USC 278g–3c. No funding is authorized by this legislation.

Note: The version of HR 872 linked to above is a committee print of a revised version of the bill that will be considered today under the House suspension of the rules process. The GPO has not yet published the introduced version of the bill. There are no paragraph-links available in the committee print, so I will be providing old style paragraph descriptions for quoted materials.

NOTE: Corrected two instances of type-disclexia in the bill number in each of the first two paragraphs. March 3rd, 2025 10:00 EST.

This bill is a substantial re-write of HR 5255 introduced by Mace in August of 2023, though the basic provisions remain the same. The House Oversight and Accountability Committee held a business meeting on May 15^th, 2024 that included consideration of this bill. The bill was ordered reported favorably by a vote of 42 to 0. The Committee report has not been published, nor has a reported version of the bill.

Moving Forward

The House is scheduled to consider the modified version of HR 872 this afternoon under the suspension of the rules process. That process limits debate, prohibits floor amendments to the bill, and requires a supermajority for passage. This bill will almost certainly pass with wide bipartisan support.

 

For more information on the provisions of this bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-872-introduced - subscription required.

Review – Bills Introduced – 1-31-25

Yesterday, with the House meeting in pro forma session and the Senate taking a break, there were 93 bills introduced. Four of those bills will receive additional coverage in this newsletter:

HR 853 To authorize the declaration of a hazardous train event, and for other purposes. Deluzio, Christopher R. [Rep.-D-PA-17]

HR 854 To direct the Secretary of Transportation to issue certain regulations to define high-hazard flammable train, and for other purposes. Deluzio, Christopher R. [Rep.-D-PA-17]

HR 866 To direct the Secretary of Commerce, acting through the Assistant Secretary of Commerce for Communications and Information, to conduct a study of the national security risks posed by consumer routers, modems, and devices that combine a modem and router, and for other purposes. Latta, Robert E. [Rep.-R-OH-5]

HR 872 To require covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines, and for other purposes. Mace, Nancy [Rep.-R-SC-1]

 

For more information on these bills, and a brief history of similar bills in the 118^th Congress, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/bills-introduced-1-31-25 - subscription required.