US Government Mandates Vulnerability Disclosure for IoT

This briefing explains how the IoT Cybersecurity Improvement Act, informed by NIST SP 800-53 Revision 5 and related guidance, requires IoT vendors and contractors selling to the U.S. government to adopt formal vulnerability disclosure policies (VDPs) and follow ISO/NIST standards within defined timelines — with OMB oversight — and highlights vendor compliance implications and available vendor assistance (e.g., HackerOne).