1. Short title This Act may be cited as the Improving Contractor Cybersecurity Act . 2. Vulnerability disclosure policy and program required for information technology contractors (a) Amendment Chapter 47 of division C of subtitle I of title 41, United States Code, is amended by adding at the end the following new section: 4715. Vulnerability disclosure policy and program required (a) Requirements for information technology contractors The head of an executive agency may not enter into a contract for information technology unless the contractor maintains or does the following: (1) A vulnerability disclosure policy for information technology that— (A) includes— (i) a description of which systems are in scope; (ii) the type of information technology testing for each system that is allowed (or specifically not authorized); (iii) if a contractor includes systems that host sensitive information in the vulnerability disclosure policy, the contractor shall determine whether to impose restrictions on accessing, copying, transferring, storing, using, and retaining such information, including by— (I) prohibiting sensitive information from being saved, stored, transferred, or otherwise accessed after initial discovery; (II) directing that sensitive information be viewed only to the extent required to identify a vulnerability and that the information not be retained; or (III) limiting use of information obtained from interacting with the systems or services to be explored by the researcher to activities directly related to reporting security vulnerabilities; (iv) a description of how an individual may submit a vulnerability report that includes— (I) the location of where to send the report, such as a web form or email address; (II) a description of the type of information necessary to find and analyze the vulnerability (such as a description, the location, and potential impact of the vulnerability, the technical information needed to reproduce the vulnerability, and any proof of concept)