,i  #aacth ,,congress  #b;d ,session    
,h4 ,r4 #dcef  ,,in ,,the ,,house ,,of  
,,representatives  ,april #a1 #bjad     
,mrs4 ,kirkpatrick 7for herself and ,mr4
 ,michaud7 introduced the following     
bill2 which was referred to the         
,committee on ,veterans' ,affairs  ,a   
,,bill  ,to amend title #ch1 ,united    
,states ,code1 to make certain          
improvements in the information security
 of the ,department of ,veterans        
,affairs1 and for other purposes4  #a4  
,short title ,this ,act may be cited as 
the ,department of ,veterans ,affairs   
,information ,security ,protection ,act4
  #b4 ,department of ,veterans ,affairs 
information security improvements  7a7  
,submittal of quarterly information     
security report to ,congress ,paragraph 
7#ad7 of subsection 7b7 of section #egbc
 of title #ch1 ,united ,states ,code1 is
 amended by inserting and to the        
,committees on ,veterans' ,affairs of   
the ,senate and ,house of               
,representatives after to the           

,secretary4  7b7 ,plan for addressing   
known information security              
vulnerabilities ,such subsection is     
further amended by adding at the end the
 following new paragraph3  7#ag7        
,submitting to the ,chairs and ,ranking 
,members of the ,committees on          
,veterans' ,affairs of the ,senate and  
,house of ,representatives1 by not later
 than #cj days after the date of the    
enactment of this paragraph1 and        
quarterly thereafter1 a plan of action  
to address critical known information   
security vulnerabilities that includes--
  7,a7 specific milestones regarding    
timelines to address such               
vulnerabilities2  7,b7 a summary of any 
reports provided to the ,assistant      
,secretary for ,information and         
,technology pursuant to subsection      
7e77#c7 during the period covered by the
 report2  7,c7 a discussion of any risk 
assessment analysis undertaken by the   
,department that led to the inclusion of
 any such vulnerability2 and  7,d7 a    

summary of such plan of action that     
could be made publicly available4  4    
7c7 ,plan for replacing outdated        
operating systems ,such subsection is   
further amended by adding at the end the
 following new paragraph3  7#ah7        
,submitting to the ,committees on       
,veterans' ,affairs of the ,senate and  
,house of ,representatives1 by not later
 than ,january #a of each year1 a plan  
for identifying and replacing operating 
systems of the ,department that are     
out-of-date or unsupported and that     
includes--  7,a7 requirements that such 
an operating system be removed from the 
network of the ,department no later than
 #ae days after the date on which the   
operating system was identified as being
 out-of-date or unsupported2 and  7,b7  
information concerning the number of    
systems so identified during the year   
preceding the year in which the report  
is submitted1 when each such system was 
so identified1 and when each system so  
identified was removed from the network 

of the ,department4  4  7d7 ,software   
security ,such subsection is further    
amended by adding at the end the        
following new paragraph3  7#ai7         
,ensuring that any software or ,internet
 applications used on systems by the    
,department are secure from             
vulnerabilities that could affect the   
confidentiality of sensitive personal   
information of veterans4  4  #c4        
,information technology reporting       
requirements  7a7 ,in general ,chapter  
#eg of title #ch1 ,united ,states ,code1
 is amended--  7#a7 by redesignating    
sections #egbg and #egbh as sections    
#egbi and #egcj1 respectively2 and  7#b7
 by inserting after section #egbf the   
following new sections3  #egbg4         
,reporting requirements ,not later than 
#cj days after the last day of each     
fiscal quarter1 the ,secretary shall    
submit to the ,committees on ,veterans' 
,affairs of the ,senate and ,house of   
,representatives a report that includes 
the following information for that      

fiscal quarter3  7#a7 ,a detailed       
description of any incidents of failure 
to comply with established information  
security policies that occurred during  
that quarter4  7#b7 ,any actions taken  
in response to such an incident4  7#c7  
,any reports made under paragraphs 7#h7 
through 7#aj7 of subsection 7b7 of      
section #egbc of this title during that 
quarter4  7#d7 ,written certification   
that the requirements of section        
#egbb7;c7 of this title were followed   
during that quarter4  7#e7 ,a detailed  
discussion of whether each              
recommendation made by the ,national    
,institute of ,standards and            
,technology1 the ,office of ,management 
and ,budget1 or the ,department of      
,homeland ,security relating to         
information security have been          
implemented by the ,department1 and if  
not1 an explanation of why such         
recommendation was not implemented4     
7#f7 ,steps taken to ensure the security
 of the ,veterans ,health ,information  

,systems and ,technology ,architecture  
of the ,department that allows for an   
integrated inpatient and outpatient     
electronic health record for patients   
and provides administrative tools to    
employees of the ,department taken      
during that quarter4  #egbh4            
,information security strategic plan    
7a7 ,plan required ,not later than one  
year after the date of the enactment of 
this section1 the ,secretary1 in        
consultation with the ,secretary of     
,homeland ,security1 the ,director of   
the ,office of ,management and ,budget1 
the ,secretary of ,defense1 the         
,director of the ,national ,institute of
 ,standards and ,technology1 the heads  
of other appropriate ,federal agencies1 
veterans groups1 and appropriate        
industry specialists1 shall submit to   
the ,committees on ,veterans' ,affairs  
of the ,senate and ,house of            
,representatives a strategic plan for   
improving the information security of   
the ,department4 ,such plan shall       

address--  7#a7 methods of protecting   
the sensitive personal information of   
veterans while not unduly interfering   
with the ability of the ,department to  
provide benefits and services to        
veterans and their dependents2  7#b7 how
 the ,department can improve its        
compliance with information security    
requirements2  7#c7 training and        
recruitment of employees with the       
necessary expertise and abilities in    
information security2 and  7#d7 the     
institutional capability of the         
,department to address information      
security threats and to implement best  
practices related to information        
security4  7b7 ,biannual updates ,the   
,secretary shall submit to the          
,committees on ,veterans' ,affairs of   
the ,senate and ,house of               
,representatives biannual updates to the
 plan required by subsection 7a74  4    
7b7 ,clerical amendments ,the table of  
sections at the beginning of such       
chapter is amended by striking the items

 relating to sections #egbg and #egbh   
and inserting the following new items3  
#egbg4 ,reporting requirements4 #egbh4  
,information security strategic plan4   
#egbi4 ,definitions4 #egcj4             
,authorization of appropriations4  4    
#d4 ,requirements for ,department of    
,veterans ,affairs contracts for data   
processing or maintenance  7a7 ,in      
general ,section #egbe7;a7 of title #ch1
 ,united ,states ,code1 is amended--    
7#a7 in paragraph 7#b71 by striking the 
period and inserting 2 and2 and  7#b7 by
 adding at the end the following new    
paragraph3  7#c7 the contractor shall   
provide protective measures to safeguard
 from possible information security     
threats any information provided by the 
,department that will be resident on or 
transiting through information systems  
controlled by the contractor4  4  7b7   
,applicability ,paragraph 7#c7 of       
section #egbe7;a7 of title #ch1 ,united 
,states ,code1 shall apply with respect 
to a contract entered into after the    

date of the enactment of this ,act4