1. Short title This Act may be cited as the Federal Cybersecurity Vulnerability Reduction Act of 2023 . 2. Federal contractor vulnerability disclosure policy (a) In general Not later than 180 days after the date of the enactment of this Act, the Director of the Office of Management and Budget, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, the National Cyber Director, the Director of the National Institute of Standards and Technology, and any other appropriate head of an Executive department, shall review the Federal Acquisition Regulation contract requirements and language for contractor vulnerability disclosure programs and recommend updates to such requirements and language to the Federal Acquisition Regulation Council. The recommendations shall include updates to such requirements designed to ensure that covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines for contractors as required under section 5 of the IoT Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3c; Public Law 116–207 ). (b) Procurement requirements Not later than 60 days after the date on which the recommended contract language developed pursuant to subsection (a) is received, the FAR Council shall review the recommended contract language and update the FAR as necessary to incorporate requirements for covered contractors to receive information about a potential security vulnerability relating to an information system owned or controlled by a contractor. (c) Elements The update to the FAR pursuant to subsection (b) shall— (1) to the maximum extent practicable, be aligned with the NIST guidelines and OMB implementation for contractors as required under sections 5 and 6 of the IoT Cybersecurity Improvement Act of 2020 ( Public Law 116–207 ; 15 U.S.C. 278g–3c and 278g–3d)