; . 12. Vulnerability disclosure policies (a) In general Chapter 35 of title 44, United States Code, is amended by inserting after section 3559A, as added by this Act, the following: 3559B. Federal vulnerability disclosure policies (a) Purpose; sense of Congress (1) Purpose The purpose of Federal vulnerability disclosure policies is to create a mechanism to enable the public to inform agencies of vulnerabilities in Federal information systems. (2) Sense of Congress It is the sense of Congress that, in implementing the requirements of this section, the Federal Government should take appropriate steps to reduce real and perceived burdens in communications between agencies and security researchers. (b) Definitions In this section: (1) Contractor The term contractor has the meaning given the term in section 3591. (2) Internet of things The term internet of things has the meaning given the term in Special Publication 800–213 of the National Institute of Standards and Technology, entitled IoT Device Cybersecurity Guidance for the Federal Government: Establishing IoT Device Cybersecurity Requirements , or any successor document. (3) Security vulnerability The term security vulnerability has the meaning given the term in section 102 of the Cybersecurity Information Sharing Act of 2015 ( 6 U.S.C. 1501 ). (4) Submitter The term submitter means an individual that submits a vulnerability disclosure report pursuant to the vulnerability disclosure process of an agency. (5) Vulnerability disclosure report The term vulnerability disclosure report means a disclosure of a security vulnerability made to an agency by a submitter. (c) Guidance The Director shall issue guidance to agencies that includes— (1) use of the information system security vulnerabilities disclosure process guidelines established under section 4(a)(1) of the IoT Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3b(a)(1))