Cyber leaders weigh in on proposed vulnerability disclosure policy

The U.S. House of Representatives has passed the Federal Contractor Cybersecurity Vulnerability Reduction Act of 2025, which mandates federal contractors to implement vulnerability disclosure policies (VDP). This bipartisan initiative, championed by Nancy Mace and Shontel Brown, aims to facilitate responsible reporting of cybersecurity vulnerabilities. The bill requires alignment with NIST guidelines and consultation with key cybersecurity agencies. This legislation is supported by cybersecurity experts who emphasize the necessity of VDPs in improving security practices and creating safe environments for reporting. However, other dimensions of risk management also warrant attention.

Every company building or implementing technology and services needs a VDP, and this is a significant milestone in aligning contractors with industry best practices.

While ensuring application vulnerability is managed effectively is important, it's just one risk dimension and perhaps not the most important.

Read at Securitymagazine