H.R. 1258 explained · 119th Congress · Pending in Congress
Improving Contractor Cybersecurity Act
Cosponsors: none · per Congress.gov, 2026-10-12
Introduced: 2025-02-12
Latest action (2025-02-12): Referred to the House Committee on Oversight and Government Reform.
What H.R. 1258 does, in plain terms
Improving Contractor Cybersecurity Act This bill prohibits an executive agency from entering into a contract for information technology unless the contractor maintains a vulnerability disclosure policy (VDP) and program. The contractor must report to the Cybersecurity and Infrastructure Security Agency (CISA) of the Department of Homeland Security, within seven days after the VDP is published and on an ongoing basis as vulnerability reports are received, information regarding any valid or credible report of a not previously known public vulnerability on a system that uses commercial software or services that affect, or are likely to affect, other parties in government or industry once a patch or viable mitigation is available; and any other situation where the contractor determines it would be helpful or necessary to involve CISA. CISA must submit vulnerabilities to the MITRE Common Vulnerabilities and Exposures database and the National Institute of Standards and Technology National Vulnerability Database.
Official summary by the Congressional Research Service, via Congress.gov.
Constitution Index
“VFA Constitution grade”
Not graded yet
H.R. 1258 has not been graded yet. New measures with an official summary are graded daily under the published rubric.
What should pass
“VFA SI Solution”
No solution yet
A sourced SI draft appears here once it passes automated checks (Constitution citation, source verification, independent SI critic). How publication works.
For journalists and bloggers
“Embed this grade”
Free to use with the link back. The badge and card update when the grade changes. Embed terms →
