,i  #aac? ,,congress  #b;d ,session  ,h4
 ,r4 #dcgj  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,april #b1 #bjad ,mrs4
 ,walorski 7= h]self1 ,mr4 ,c(fman1 ,mr4
 ,w5/rup1 & ,mr4 ,nug5t7 introduc$ !    
foll[+ bill2 :i* 0 ref]r$ to !          
,committee on ,vet]ans' ,affairs  ,a    
,,bill  ,to improve ! in=mation security
 ( ! ,dep>tm5t ( ,vet]ans ,affairs by   
direct+ ! ,secret>y ( ,vet]ans ,affairs 
to c>ry out c]ta9 actions to improve !  
transp>5cy & ! gov]nance ( ! in=mation  
security program ( ! ,dep>tm5t1 & = o!r 
purposes4  #a4 ,%ort title2 table (     
cont5ts  7a7 ,%ort title  ,?is ,act may 
be cit$ z ! ,vet]ans ,in=mation         
,security ,improvem5t ,act4  7b7 ,table 
( cont5ts  ,! table ( cont5ts = ?is ,act
 is z foll[s3  ,sec4 #a4 ,%ort title2   
table ( cont5ts4 ,sec4 #b4 ,gov]nance ( 
in=mation security program ( ,dep>tm5t (
 ,vet]ans ,affairs4 ,sec4 #c4 ,security 
( critical network infra/ructure1       
includ+ doma9 controll]1 ( ,dep>tm5t (  
,vet]ans ,affairs4 ,sec4 #d4 ,security (

 comput]s & s]v]s ( ,dep>tm5t ( ,vet]ans
 ,affairs4 ,sec4 #e4 ,upgrade or        
phase-out ( unsupport$ or outdat$ op]at+
 sy/ems4 ,sec4 #f4 ,security ( web      
applications f vital vuln]abilities4    
,sec4 #g4 ,security ( ! ,vi/a sy/em4    
,sec4 #h4 ,report on compliance )       
in=mation security requirem5ts & be/    
practices4 ,sec4 #i4 ,reports on        
implem5tation4 ,sec4 #aj4 ,application4 
,sec4 #aa4 ,def9itions4  #b4 ,gov]nance 
( in=mation security program ( ,dep>tm5t
 ( ,vet]ans ,affairs  7a7 ,requirem5ts =
 c]ta9 (ficials & /aff  7#a7 ,9 g5]al   
,sub*apt] ,,iii ( *apt] #eg ( title #ch1
 ,unit$ ,/ates ,code1 is am5d$ by ins]t+
 aft] section #egbc ! foll[+ new        
section3  #egbc;,a4  ,gov]nance (       
in=mation security program  7a7 ,9 g5]al
  ,! ,secret>y %all c>ry out ?is section
 to improve ! transp>5cy & ! coord9ation
 ( ! in=mation security program ( !     
,dep>tm5t4  7b7 ,(fice ( ,in=mation &   
,te*nology  7#a7 ,! ,secret>y %all      
ensure t ! ,assi/ant ,secret>y =        

,in=mation & ,te*nology1 z ! ,*ief      
,in=mation ,(fic] ( ! ,dep>tm5t1        
possesses--  7,a7 ! appropriate         
education & at lea/ #aj concurr5t ye>s (
 validat$ exp]i5ce & capabilities 9 !   
managem5t ( in=mation te*nology         
organizations2  7,b7 an indu/ry         
recogniz$ c]tification 9 in=mation      
security & cyb] security def5se2 &  7,c7
 demon/rat$1 s\nd te*nical capabilities4
  7#b7 ,! ,secret>y %all ensure t ! /aff
 ( ! ,(fice ( ,in=mation & ,te*nology :o
 p]=m security functions1 includ+ !     
assessm5t & analysis ( risk1 security   
audit+1 security op]ations1 & security  
eng9e]+1 are assign$ to ! ,(fice (      
,in=mation ,security4  7#c7 ,! ,secret>y
 %all ensure t subord9ate (fices ( !    
,(fice ( ,in=mation & ,te*nology1 9     
coord9ation ) ! head ( ! ,(fice (       
,in=mation ,security1 ma9ta9 appropriate
 in=mation security functions )9 ea* su*
 (fice to--  7,a7 incorporate secure    
s(tw>e assurance processes into ! s(tw>e
 developm5t lifecycle = all s(tw>e      

developm5t activities2  7,b7 validate t 
ea* ?ird-p>ty develop$ s(tw>e us$ 9 any 
in=mation sy/em ( ! ,dep>tm5t meets !   
/&>ds ( ! ,national ,in/itute ( ,/&>ds &
 ,te*nology ) respect to security1      
safety1 reliability1 functionality &    
ext5sibility2  7,c7 ma9ta9 e/abli%$     
in=mation security basel9e controls =   
su* in=mation sy/ems1 & imm$iately      
rem$iate sy/ems det]m9$ to be out (     
compliance ) e/abli%$ basel9e controls  
to ! maximum ext5t possible2  7,d7      
ensure t ! security ar*itecture ( !     
,dep>tm5t is docum5t$ & fully integrat$ 
into ! ov]all ent]prise ar*itecture     
/rategy ( ! ,dep>tm5t2 &  7,e7 develop &
 implem5t a policy t re/ricts !         
developm5t ( new data w>eh\ses & data   
m>ts hold+ s5sitive p]sonal in=mation ( 
vet]ans & r$uces ! numb] ( data m>ts    
hold+ su* in=mation4  7c7 ,(fice (      
,in=mation ,security  7#a7 ,! ,secret>y 
%all ensure t ! head ( ! ,(fice (       
,in=mation ,security possesses--  7,a7 !
 appropriate education & at lea/ #aj    

concurr5t ye>s ( exp]i5ce ) respect to  
validat$ in=mation security2 &  7,b7 an 
indu/ry recogniz$ c]tification 9 cyb]   
security def5se2  7,c7 demon/rat$1 s\nd 
te*nical capabilities2 &  7,d7 o!r      
relevant exp]i5ce4  7#b7 ,! ,secret>y   
%all ensure t all ( ! field /aff ( !    
,(fice ( ,in=mation ,security1 includ+  
relevant /aff ( ! ,(fice ( ,in=mation   
,te*nology1 ^: prim>y responsibility is 
! protection ( p]sonally id5tifiable    
in=mation ( vet]ans ma9ta9 curr5t       
in=mation security tra9+ & possess a    
c]ta9 level ( in=mation security1 cyb]  
security def5se1 & te*nical capabilities
 & c]tifications z appropriate4  4  7#b7
 ,cl]ical am5dm5t ,! table ( sections at
 ! beg9n+ ( su* *apt] is am5d$ by ins]t+
 aft] ! item relat+ to section #egbc !  
foll[+ new item3  #egbc;,a4 ,gov]nance (
 in=mation security program4  4  7b7    
,def9itions ,section #egba ( title #ch1 
,unit$ ,/ates ,code1 is am5d$ by add+ at
 ! end ! foll[+ new p>agraphs3  7#bd7   
,data m>t ,! t]m data m>t means a subset

 ( a data w>eh\se t conta9s in=mation = 
a specific dep>tm5t or entity ( an      
organization r ?an ! entire             
organization4  7#be7 ,data w>eh\se ,!   
t]m data w>eh\se means a collection (   
data design$ to support managem5t       
decision mak+ t conta9s a wide v>iety ( 
data t pres5t a coh]5t picture ( bus9ess
 conditions = an entire organization at 
a s+le po9t 9 "t & ^: developm5t        
includes ! developm5t ( sy/ems to       
extract data f op]at+ sy/ems plus       
in/allation ( a w>eh\se database sy/em t
 provides manag]s flexible access to !  
data4  4  #c4 ,security ( critical      
network infra/ructure1 includ+ doma9    
controll]1 ( ,dep>tm5t ( ,vet]ans       
,affairs  7a7 ,9 g5]al  ,n lat] ?an #ij 
days aft] ! date ( ! enactm5t ( ?is     
,act1 ! ,secret>y ( ,vet]ans ,affairs   
%all ensure ! security & safegu>d ( !   
network infra/ructure ( ! ,dep>tm5t (   
,vet]ans ,affairs4  7b7 ,actions requir$
  ,9 c>ry+ out subsection 7a71 !        
,secret>y %all c>ry out ! foll[+        

actions3  7#a7 ,ma9ta9 ! aw>5ess &      
complete physical & logical control ( ! 
critical network infra/ructure1 includ+ 
r\t]s1 swit*es1 doma9 nam+ sy/ems1      
firewalls1 load balanc]s1 proxy devices1
 au!ntication s]vices1                  
telecommunications1 doma9 controll]s1 & 
any device t is "p ( ! tru/$ ,int]net   
connection sy/em4  7#b7 ,if ! ,secret>y 
det]m9es t any critical network         
infra/ructure device or s]vice has be5  
compromis$1 re/ore ! device or s]vice to
 ! la/ kn[n noncompromis$ /ate & det]m9e
 ! cause ( ! compromise4  7#c7 ,if !    
,secret>y det]m9es t compromis$ devices 
or s]vices mu/ be us$ = a limit$ "t1    
conduct su* use 9 accordance ) !        
guidance e/abli%$ by ! ,national        
,security ,ag5cy "u ! docum5t titl$     
,in=mation ,assurance ,guidance =       
,op]at+ on a ,compromis$ ,network1 or   
successor docum5t4  7#d7 ,provide       
special security configurations =       
protect+ critical infra/ructure devices 
& s]vices4  7#e7 ,implem5t policies &   

security measures t m9imize ! ?reats to 
critical infra/ructure devices &        
s]vices4  7#f7 ,ensure t critical       
infra/ructure devices & s]vices1 includ+
 ! doma9 controll] sett+s1 are 9        
compliance ) ! ,s]v] ,security ,plan ( !
 ,dep>tm5t "u ! ,dep>tm5t ( ,vet]ans    
,affairs ,h&book #fejj4  7#g7 ,e/abli%  
access rights1 p]missions1 & multifactor
 au!ntication = ! critical infra/ructure
 devices & s]vices1 includ+ ! doma9     
controll]1 = specific us]s or gr\ps (   
us]s4  7#h7 ,ensure t prop] physical    
security measures are tak5 to safegu>d !
 critical infra/ructure devices &       
s]vices & limit physical access to su*  
location to a limit$ numb] ( au?oriz$   
individuals4  7#i7 ,limit ! access f    
network connections to critical         
infra/ructure devices & s]vices & only  
configure s]vices & s(tw>e t are ne$$ by
 ! devices & s]vices4  7#aj7 ,disable or
 delete any s]vice or s(tw>e f critical 
infra/ructure devices & s]vices t is    
unnecess>y4  7#aa7 ,:]e feasible1 secure

 critical infra/ructure devices &       
s]vices ) ho/-bas$ & network$-bas$      
security controls & limit ! numb] (     
ports t are op5$ betwe5 critical        
infra/ructure devices & s]vices1 includ+
 any device reque/+ access to network   
res\rces & s]vices4  7#ab7 ,conduct     
regul> audits & te/+ ( ! backups &      
re/ore ev5ts ( ! critical infra/ructure 
devices & s]vices4  7#ac7 ,ensure t =   
any device to access & communicate )    
critical infra/ructure devices & s]vices
 )9 ! doma91 ! au!ntication traffic has 
to be sign$ & encrypt$4  7#ad7 ,limit ! 
adm9i/rator acc\nt f access+ critical   
infra/ructure devices & s]vices1 includ+
 doma9 controll]s1 ?r\gh\t ! network &  
use su* acc\nt only = em]g5cies4  7#ae7 
,re/rict remote access to local         
adm9i/rator acc\nts & use firewall rules
 to re/rict lat]al movem5t on ! network4
  7#af7 ,conduct regul> =mal p5etration 
te/+ to te/ = pot5tial security         
weaknesses & resolve su* weaknesses by n
 lat] ?an sev5 days aft] id5tify+ su*   

weaknesses4  7c7 ,c]tification ,n lat]  
?an #cj days aft] ! date ( ! enactm5t ( 
?is ,act1 ! ,secret>y %all submit to !  
congressional vet]ans committees writt5 
c]tification t ! ,secret>y has comm5c$  
ea* action describ$ 9 subsection 7b74   
#d4 ,security ( comput]s & s]v]s (      
,dep>tm5t ( ,vet]ans ,affairs  7a7 ,9   
g5]al ,! ,secret>y %all ensure !        
security ( ea* g5]al purpose comput] &  
s]v] ( ! ,dep>tm5t4  7b7 ,actions       
requir$ ,9 c>ry+ out subsection 7a71 !  
,secret>y %all c>ry out ! foll[+        
actions3  7#a7 ,=malize & en=ce a       
,dep>tm5t-wide process to monitor s(tw>e
 in/all$ on g5]al purpose comput]s &    
s]v]s ( ! ,dep>tm5t1 prev5t ! unau?oriz$
 in/allation ( s(tw>e1 & remove any     
unau?oriz$ s(tw>e t has be5 in/all$4    
7#b7 ,n lat] ?an #de days aft] ! date ( 
! enactm5t ( ?is ,act1 implem5t automat$
 pat*+ tools & processes t ensure t     
security pat*es are in/all$ = any s(tw>e
 or op]at+ sy/em on a comput] by n lat] 
?an #dh h\rs aft] ! pat* is made        

available4  7#c7 ,employ automat$ tools 
to cont9u\sly monitor g5]al purpose     
comput]s1 s]v]s1 & mobile devices =     
active1 up-to-date anti-malw>e          
protection ) antivirus1 antispyw>e1     
p]sonal firewalls1 & ho/-bas$ intrusion 
prev5tion sy/em functionality4  7#d7    
,c5tralize ov]sight & control to        
effectively adm9i/] pat* managem5t      
processes 7b ! responsibility = te/+ &  
apply+ pat*es to specific sy/ems may be 
dec5traliz$ to ! compon5t level74  7#e7 
,p]=m regul> scans ( g5]al purpose      
comput]s & s]v]s to discov] security    
vuln]abilities & log ! results ( su*    
scans4  7#f7 ,p]=m a pat*-focus$ risk   
assessm5t to evaluate ea* sy/em1        
database1 & g5]al purpose comput] =     
?reats1 vuln]abilities1 & its           
criticality to ! mission ( ! ,dep>tm5t4 
7#g7 ,if ! ,secret>y det]m9es any       
security vuln]ability--  7,a7 develop a 
te/ = ! vuln]ability & det]m9e ! cause (
 ! vuln]ability2  7,b7 address !        
vuln]ability1 includ+ by pat*+1         

implem5t+ a comp5sat+ control1 or       
docum5t+ & accept+ a reasonable bus9ess 
risk 79 accordance ) indu/ry accept$ be/
 practices7 ) respect to ! vuln]ability2
 &  7,c7 p]=m a po/ rem$iation scan to  
v]ify t ! vuln]ability 0 s address$4    
7#h7 ,e/abli% & ensure ! use ( /&>d1    
secure configurations ( ea* op]at+ sy/em
 9 use on ! comput]s ( ! ,dep>tm5t4     
7#i7 ,employ sy/em-scann+ tools t *eck  
comput]s daily = s(tw>e v]sion1 pat*    
levels1 & configuration files4  7#aj7   
,deploy a security cont5t automation    
protocol tool t is validat$ by !        
,national ,in/itute ( ,/&>ds &          
,te*nology to use specific /&>ds to     
enable automat$ vuln]ability managem5t1 
measurem5t1 & policy compliance         
evaluation4  7#aa7 ,/&>dize policies1   
proc$ures1 & tools = effective pat*     
managem5t1 includ+ by assign+ roles &   
responsibilities1 p]=m+ risk assessm5ts1
 & te/+ pat*es4  7#ab7 ,te/ ea* pat*    
aga9/ all sy/em configurations ( !      
,dep>tm5t 9 a te/ environm5t to det]m9e 

any effect on ! network be=e deploy+ !  
pat* to ! affect$ sy/ems & monitor !    
/atus ( ! pat*es aft] deploym5t4  7#ac7 
,e/abli% & ma9ta9 an inv5tory ( all     
h>dw>e equipm5t1 s(tw>e packages1       
s]vices1 & o!r te*nologies in/all$ & us$
 by ! ,dep>tm5t = pat* managem5t4  7#ad7
 ,e/abli% a policy = security fixes t is
 cle>ly communicat$ to comput] us]s to  
ensure t ! us]s are aw>e (--  7,a7 !    
v]sions ( s(tw>e or op]at+ sy/ems t are 
support$ ) respect to security fixes2 & 
7,b7 :5 s(tw>e1 op]at+ sy/ems1 or o!r   
products are s*$ul$ to no long] be      
ma9ta9$4  7#ae7 ,ensure t--  7,a7 ! /aff
 or contractors ( ! ,dep>tm5t :o are    
involv$ 9 pat* managem5t h ! skills & k 
ne$$ to p]=m ! responsibilities relat+  
to su* managem5t2 &  7,b7 sy/em         
adm9i/rators are tra9$ 9 id5tify+ new   
pat*es & vuln]abilities4  7c7           
,c]tification ,n lat] ?an #cj days aft] 
! date ( ! enactm5t ( ?is ,act1 !       
,secret>y %all submit to ! congressional
 vet]ans committees writt5 c]tification 

t ! ,secret>y has comm5c$ ea* action    
describ$ 9 subsection 7b74  #e4 ,upgrade
 or phase-out ( unsupport$ or outdat$   
op]at+ sy/ems  7a7 ,9 g5]al ,n lat] ?an 
#ij days aft] ! date ( ! enactm5t ( ?is 
,act1 ! ,secret>y %all ensure t !       
,secret>y upgrades or phases out outdat$
 or unsupport$ op]at+ sy/ems to protect 
comput]s ( ! ,dep>tm5t f h>mful viruses1
 spyw>e1 & o!r malici\s s(tw>e t c\ld   
affect ! confid5tiality ( s5sitive      
p]sonal in=mation ( vet]ans4  7b7       
,actions requir$ ,9 c>ry+ out subsection
 7a71 ! ,secret>y %all c>ry out ! foll[+
 activities3  7#a7 ,e/abli% a plan =    
phas+ out outdat$ or unsupport$ op]at+  
sy/ems us$ by ! ,dep>tm5t4  7#b7        
,e/abli% a policy to ensure t outdat$ & 
unsupport$ op]at+ sy/ems us$ by !       
,dep>tm5t d n connect to ! network ( !  
,dep>tm5t by n lat] ?an #ae days aft] ! 
date on :i* su* op]at+ sy/ems are s     
outdat$ or unsupport$1 z det]m9$        
appropriate by ! ,secret>y4  7#c7       
,e/abli% a configuration managem5t      

process to ensure t--  7,a7 a secure    
image t is regul>ly updat$ is us$ to    
build all new comput]s us$ by !         
,dep>tm5t2 &  7,b7 any comput] us$ by ! 
,dep>tm5t t becomes compromis$ is       
re-imag$ us+ su* image4  7#d7 ,implem5t 
applicable op]at+ sy/ems bas$ on        
security guidance id5tifi$ by !         
,in=mation ,assurance ,directorate ( !  
,national ,security ,ag5cy4  7#e7       
,appropriately configure & te/ requir$  
s(tw>e t 0 design$ to be us$ on old]    
op]at+ sy/ems to ensure ! s(tw>e is     
usable on a new op]at+ sy/em us$ by !   
,dep>tm5t4  7#f7 ,limit adm9i/rative    
privileges to v few us]s :o h bo? !     
appropriate k & bus9ess ne$ to modify ! 
configuration ( ! op]at+ sy/em4  7#g7   
,until ! date on :i* an unsupport$      
op]at+ sy/em is replac$1 if a comput]   
uses su* op]at+ sy/em1 disable web br[s]
 plug-ins1 use a h>dw>e firewall1 & if  
practicable1 disconnect ! comput] f !   
network & d n use ! comput] to access ! 
,int]net4  7#h7 ,deploy a s(tw>e        

inv5tory tool to cov] ea* ( ! op]at+    
sy/ems 9 use by ! ,dep>tm5t to track--  
7,a7 ! type ( su* op]at+ sy/ems be+ us$ 
by ! ,dep>tm5t2 &  7,b7 ) respect to ea*
 comput] ( ! ,dep>tm5t--  7i7 ! type (  
op]at+ sy/em in/all$ & ! v]sion numb] & 
pat* level ( su* op]at+ sy/em2 &  7ii7 !
 s(tw>e be+ us$ on su* op]at+ sy/em4    
7#i7 ,regul>ly use file integrity *eck+ 
tools to *eck any *anges to critical    
op]at+ sy/ems1 s]vices1 & configuration 
files4  7c7 ,c]tification ,n lat] ?an   
#cj days aft] ! date ( ! enactm5t ( ?is 
,act1 ! ,secret>y %all submit to !      
congressional vet]ans committees writt5 
c]tification t ! ,secret>y has comm5c$  
ea* action describ$ 9 subsection 7b74   
#f4 ,security ( web applications f vital
 vuln]abilities  7a7 ,9 g5]al ,!        
,secret>y %all ensure t web applications
 us$ by ! ,dep>tm5t are secure f        
vuln]abilities t c\ld affect !          
confid5tiality ( s5sitive p]sonal       
in=mation ( vet]ans4  7b7 ,actions      
requir$ ,9 c>ry+ out subsection 7a71 !  

,secret>y %all c>ry out ! foll[+        
activities3  7#a7 ,n lat] ?an #fj days  
aft] ! date ( ! enactm5t ( ?is ,act1    
develop a plan1 includ+ requir$ actions 
& mile/ones1 to fully rem$iate all      
security vuln]abilities describ$ 9      
subsection 7a7 t exi/ z ( ! date ( !    
enactm5t ( ?is ,act4  7#b7 ,develop     
detail$ guidance = rem$iat+ ea* critical
 security vuln]ability4  7#c7 ,use be/  
practices & lessons le>n$1 includ+ su*  
practices & lessons describ$ by !       
,national ,in/itute ( ,/&>ds &          
,te*nology & ! ,op5 ,web ,application   
,security ,project1 to address !        
security vuln]abilities ( web           
applications4  7#d7 ,limit ! p]missions 
on ! database logon us$ by web          
applications to only :at is ne$$ to     
r$uce ! effectiv5ess ( any attack t     
exploits bugs 9 ! application4  7#e7    
,provide to web application develop]s-- 
7,a7 ?or\gh application developm5t      
guidance to ensure t new applications   
are design$ by tak+ into acc\nt         

security2 &  7,b7 detail$ guidance on   
te/+ exi/+ web applications = security  
vuln]abilities1 includ+ buff] ov]fl[s & 
cross-site script+4  7#f7 ,configure    
adm9i/rative passwords to be--  7,a7    
complex & consi/ only ( /r+s ( lett]s1  
numb]s1 & *>act]s t d n =m a            
recognizable ^w2 &  7,b7 *ang$ e #ij    
days1 9 accordance ) indu/ry be/        
practices4  7#g7 ,) respect to passwords
 us$ 9 connection ) web applications1   
/ore ! passwords = ea* sy/em ( !        
,dep>tm5t only 9 a well-ha%$ or encrypt$
 =mat4  7#h7 ,implem5t two-factor       
au!ntication te*nology requirem5ts      
?r\gh\t ! ,dep>tm5t4  7#i7 ,if          
vuln]abilities 9 a web application are  
f\nd1 adm9i/] a full-s\rce code review  
to det]m9e if ! vuln]abilities exi/     
else:]e )9 ! code ( ! application4      
7#aj7 ,p]iodically review us] access to 
networks & web applications to id5tify  
unnecess>y1 inactive1 or t]m9at$ us]    
acc\nts4  7#aa7 ,e/abli% a s+le set (   
/rong au!ntication & session managem5t  

controls t meet all ! au!ntication &    
session managem5t requirem5ts def9$ 9 ! 
,application ,security ,v]ification     
,/&>d ( ! ,op5 ,web ,application        
,security ,project4  7#ab7 ,implem5t    
visibility & attribution measures to    
improve ! process1 ar*itecture1 &       
te*nical capabilities ( ! ,dep>tm5t to  
monitor web applications us$ on !       
networks & comput]s ( ! ,dep>tm5t to    
detect attack attempts1 locate po9ts (  
entry1 id5tify already compromis$       
ma*9es1 int]rupt activities ( infiltrat$
 attack]s1 & ga9 in=mation ab\t ! s\rces
 ( an attack4  7c7 ,c]tification ,n lat]
 ?an #cj days aft] ! date ( ! enactm5t (
 ?is ,act1 ! ,secret>y %all submit to ! 
congressional vet]ans committees writt5 
c]tification t ! ,secret>y has comm5c$  
ea* action describ$ 9 subsection 7b74   
#g4 ,security ( ! ,vi/a sy/em  7a7 ,9   
g5]al ,n lat] ?an #ij days aft] ! date (
 ! enactm5t ( ?is ,act1 ! ,secret>y %all
 ensure t ! ,vi/a sy/em is secure f     
vuln]abilities t c\ld affect !          

confid5tiality ( s5sitive p]sonal       
in=mation ( vet]ans4  7b7 ,actions      
requir$  ,9 c>ry+ out subsection 7a71 ! 
,secret>y %all c>ry out ! foll[+        
activities3  7#a7 ,develop a rem$ial    
action plan to address ! approa*es to   
int]op]ability--  7,a7 betwe5 multiple  
,vi/a sy/ems2 &  7,b7 betwe5 ! ,vi/a    
sy/em & ext]nal sy/ems & s(tw>e4  7#b7  
,update ! policy1 proc$ures1 & gov]nance
 ( ! ,dep>tm5t ) respect to             
sy/em-to-sy/em integration :]e us]s log 
on to ext]nal sy/ems & !n automatically 
connect to ! ,vi/a sy/em & int]act4     
7#c7 ,provide au!ntication = !          
ma*9e-to-ma*9e brok] s t ! ,vi/a sy/em  
li/5] v]ifies ! id5tity ( ! call+ sy/em4
  7#d7 ,e/abli% & implem5t policy )     
respect to ! au!ntication ( ext]nal     
sy/ems attempt+ to connect to ! ,vi/a   
sy/em & crit]ia by :i* us] au!ntication 
mu/ be accompli%$ to ensure all         
applications t connect to ! ,vi/a sy/em 
convey accurate us] in=mation4  7#e7    
,e/abli% a bus9ess requirem5t t         

sy/em-to-sy/em integration connectivity 
across ! wide-area network mu/ consi/ ( 
encrypt$ communication & require ext]nal
 sy/ems to securely id5tify !mselves1 or
 = ! ,vi/a sy/em to securely id5tify    
ext]nal sy/ems t attempt to connect to !
 sy/em4  7#f7 ,e/abli% a bus9ess        
requirem5t t ext]nal sy/ems communicate 
accurate us] in=mation to ! ,vi/a sy/em 
relat+ to actions initiat$ by actual    
individuals & facilitate ! revocation ( 
access by ! ,vi/a sy/em relative to     
specific us]s or ext]nal sy/ems attempt+
 to connect4  7#g7 ,implem5t mon?ly     
project design reviews ( ! integration  
betwe5 sy/ems & web applications to     
ensure t ! effectiv5ess ( ! exi/+       
controls is su/a9$4  7#h7 ,assess !     
pot5tial compromise to non-,dep>tm5t    
networks t are int]connect$ ) ! network 
( ! ,dep>tm5t1 includ+ ! networks ( !   
,dep>tm5t ( ,def5se & ! ,dep>tm5t (     
,heal? & ,human ,s]vices4  7#i7 ,ensure 
t1 9 ! ne>-t]m1 s(tw>e developm5t = !   
,vi/a sy/em develops ! critical         

enhancem5ts & fixes to ! sy/em t are    
necess>y to ensure compliance ) *anges  
to pati5t enrollm5t4  7#aj7 ,ensure t   
all sy/ems ( ! ,dep>tm5t h be5 giv5 !   
,au?ority to ,op]ate designation & h be5
 prop]ly c]tifi$ by meet+ all           
requirem5ts1 includ+ a compreh5sive     
assessm5t ( managem5t1 op]ational1 &    
te*nical security controls1 to become   
op]ational1 & re/rict ! use ( waiv]s4   
7c7 ,c]tification ,n lat] ?an #cj days  
aft] ! date ( ! enactm5t ( ?is ,act1 !  
,secret>y %all submit to ! congressional
 vet]ans committees writt5 c]tification 
t ! ,secret>y has comm5c$ ea* action    
describ$ 9 subsection 7b74  #h4 ,report 
on compliance ) in=mation security      
requirem5ts & be/ practices ,n lat] ?an 
#fj days aft] ! date ( ! enactm5t ( ?is 
,act1 ! ,secret>y ( ,vet]ans ,affairs   
%all submit to ! congressional vet]ans  
committees ! foll[+3  7#a7 ,writt5      
c]tification t ! ,secret>y is tak+ e    
action requir$ to comply )--  7,a7      
sub*apt] ,,iii ( *apt] #eg ( title #ch1 

,unit$ ,/ates ,code2  7,b7 sub*apt]     
,,iii ( *apt] #ce ( title #dd1 ,unit$   
,/ates ,code2  7,c7 special publications
 #hjj-ec & #hjj-aaa ( ! ,national       
,in/itute ( ,/&>ds & ,te*nology1 includ+
 ) respect to encrypt+ databases2  7,d7 
applicable memor&a issu$ by ! ,director 
( ,managem5t & ,budget reg>d+ protect+  
p]sonally id5tifiable in=mation2 &  7,e7
 any o!r relevant law or regulation     
reg>d+ ! in=mation security ( !         
,dep>tm5t ( ,vet]ans ,affairs4  7#b7 ,h[
 ! ,secret>y is us+ & implem5t+ !       
pr9ciples & be/ practices reg>d+ improv+
 in=mation security1 includ+ ) respect  
to su* pr9ciples & practices describ$ 9 
! docum5t titl$ ,framework = ,improv+   
,critical ,infra/ructure ,cyb]security (
 ! ,national ,in/itute ( ,/&>ds &       
,te*nology4  #i4 ,reports on            
implem5tation  7a7 ,biannual reports    
7#a7 ,9 g5]al ,n lat] ?an #ahj days aft]
 ! date ( ! enactm5t ( ?is ,act1 & e    
#ahj-;day p]iod !reaft]1 ! ,secret>y    
%all submit to ! congressional vet]ans  

committees a report on ! implem5tation (
 ?is ,act1 includ+ ! am5dm5ts made by   
?is ,act4  7#b7 ,matt]s includ$ ,ea*    
report "u subsection 7a7 %all include ! 
foll[+3  7,a7 ,a description ( ! actions
 tak5 by ! ,secret>y to implem5t &      
comply ) sections #b ?r\gh #g4  7,b7 ,a 
timel9e & project plan1 bo? %ort-t]m &  
long-t]m1 = implem5t+ ea* ( sections #b 
?r\gh #g & assign+ roles &              
responsibilities "u su* plan4  7,c7     
,p]=mance measures & b5*m>ks to measure 
! results ( ! ,secret>y 9 c>ry+ out     
rem$iation ef=ts "u sections #b ?r\gh   
#g4  7,d7 ,a description ( ! be/        
practices & lessons le>n$ by ! ,secret>y
 9 c>ry+ out sections #b ?r\gh #g4  7,e7
 ,! progress made by ! ,secret>y dur+   
ea* mon? cov]$ by ! report ) respect to 
r$uc+ ! total numb] ( outdat$ op]at+    
sy/ems1 web application vuln]abilities1 
critical security vuln]abilities1 & o!r 
matt]s cov]$ by sections #b ?r\gh #g4   
7,f7 ,an app5dix conta9+ detail$ reports
 ( ! ,dep>tm5t1 includ+ ! ent]prise     

in=mation te*nology da%bo>d & reports   
reg>d+ security vuln]abilities1 op]at+  
sy/em tr5ds1 & web applications4  7b7   
,annual ,inspector ,g5]al report ,!     
,inspector ,g5]al ( ! ,dep>tm5t (       
,vet]ans ,affairs %all submit to !      
congressional vet]ans committees an     
annual report t includes a compreh5sive 
assessm5t ( ! adequacy & effectiv5ess ( 
! implem5tation by ! ,secret>y (        
,vet]ans ,affairs ( sections #b ?r\gh   
#g1 includ+ ! am5dm5ts made by ?is ,act4
  7c7 ,mon?ly reports ,on a mon?ly      
basis1 ! ,secret>y %all submit to !     
congressional vet]ans committees reports
 on security vuln]abilities discov]$    
pursuant to ! actions tak5 "u section   
#d7;b77#e74  #aj4 ,application ,9 c>ry+ 
out ?is ,act1 includ+ ! am5dm5ts made by
 ?is ,act1 ! ,secret>y ( ,vet]ans       
,affairs may sub/itute a new te*nology  
or process relat+ to in=mation security 
= a specific te*nology or process relat+
 to in=mation security describ$ 9 ?is   
,act1 includ+ ! am5dm5ts made by ?is    

,act1 if ! ,secret>y det]m9es t su* new 
te*nology or process--  7#a7 is a       
successor to ! specific te*nology or    
process describ$ 9 ?is ,act1 includ+ !  
am5dm5ts made by ?is ,act2 &  7#b7      
provides a great] am\nt ( in=mation     
security ?an w\ld be provid$ if !       
,secret>y did n make su* sub/itution4   
#aa4 ,def9itions ,9 ?is ,act3  7#a7 ,!  
t]m ,au?ority to ,op]ate means ! (ficial
 managem5t decision giv5 by a s5ior     
(ficial ( ! ,dep>tm5t to au?orize       
op]ation ( an in=mation sy/em & to      
explicitly accept ! risk to ! op]ations 
( ! ,dep>tm5t 7includ+ ) respect to !   
mission1 functions1 image1 or reputation
 ( ! ,dep>tm5t71 ! assets & individuals 
( ! ,dep>tm5t1 o!r elem5ts ( ! ,f$]al   
,gov]nm5t1 & ! ,unit$ ,/ates bas$ on !  
implem5tation ( an agre$-^u set (       
security controls4  7#b7 ,! t]ms        
confid5tiality has ! mean+ giv5 t t]m 9 
section #egbg ( title #ch1 ,unit$ ,/ates
 ,code4  7#c7 ,! t]m congressional      
vet]ans committees means ! ,committees  

on ,vet]ans' ,affairs ( ! ,h\se (       
,repres5tatives & ! ,s5ate4  7#d7 ,! t]m
 critical network infra/ructure means   
in=mation te*nology h>dw>e t provides-- 
7,a7 vital network s]vices to !         
,dep>tm5t t is vital to c>ry+ out !     
mission ( ! ,dep>tm5t2 &  7,b7          
communications1 security1               
transportation1 access1 & au!ntication  
s]vices & capabilities4  7#e7 ,! t]m    
doma9 controll] means a s]v] t responds 
to security au!ntication reque/s        
responsible = all[+ ho/ access to doma9 
res\rces by au!nticat+ us]s1 sort+ us]  
acc\nt in=mation1 & en=c+ security      
policy4  7#f7 ,! t]m g5]al purpose      
comput] means a comput] t1 giv5 !       
appropriate application & requir$ "t1   
%\ld be able to p]=m mo/ common comput+ 
tasks4 ,su* t]m includes p]sonal        
comput]s1 includ+ desktops1 notebooks1  
sm>t phones1 & tablets4  7#g7 ,! t]m    
image means a /&>d set ( s(tw>e 7includ+
 ! op]at+ sy/em & o!r s(tw>e7 t is      
in/all$ on a comput]4  7#h7 ,! t]m      

in=mation security has ! mean+ giv5 t   
t]m 9 section #egbg ( title #ch1 ,unit$ 
,/ates ,code4  7#i7 ,! t]m in=mation    
sy/em has ! mean+ giv5 t t]m 9 section  
#egbg ( title #ch1 ,unit$ ,/ates ,code4 
7#aj7 ,! t]m s5sitive p]sonal in=mation 
has ! mean+ giv5 t t]m 9 section #egbg (
 title #ch1 ,unit$ ,/ates ,code4  7#aa7 
,! t]m ,vi/a sy/em means ! ,vet]ans     
,heal? ,in=mation ,sy/ems & ,te*nology  
,ar*itecture ( ! ,dep>tm5t ( ,vet]ans   
,affairs t all[s = an integrat$ inpati5t
 & outpati5t electronic heal? record =  
pati5ts & provides adm9i/rative tools to
 employees ( ! ,dep>tm5t4  7#ab7 ,! t]m 
web application means an application 9  
:i* all or "s p>ts ( ! s(tw>e are       
d[nload$ f ! ,int]net ea* "t ! s(tw>e is
 access$1 includ+ web br[s]-bas$ s(tw>e 
t run )9 a web br[s]1 desktop s(tw>e t  
does n use a web br[s]1 & mobile s(tw>e 
t accesses ! ,int]net = additional      
in=mation4  7#ac7 ,! t]m well-ha%$ means
 ! process ( us+ a ma!matical algori?m  
aga9/ data to produce a num]ic value t  

is repres5tative ( t data4