,i #aad? ,,congress #a/ ,session ,h4 ,r4 #aabh ,,9 ,,! ,,h\se ,,( ,,repres5tatives ,febru>y #bf1 #bjae ,mrs4 ,kirkpatrick introduc$ ! foll[+ bill2 :i* 0 ref]r$ to ! ,committee on ,vet]ans' ,affairs ,a ,,bill ,to am5d title #ch1 ,unit$ ,/ates ,code1 to make c]ta9 improvem5ts 9 ! in=mation security ( ! ,dep>tm5t ( ,vet]ans ,affairs1 & = o!r purposes4 #a4 ,%ort title ,?is ,act may be cit$ z ! ,dep>tm5t ( ,vet]ans ,affairs ,cyb] ,security ,protection ,act4 #b4 ,dep>tm5t ( ,vet]ans ,affairs in=mation security improvem5ts 7a7 ,submittal ( qu>t]ly in=mation security report to ,congress ,p>agraph 7#ad7 ( subsection 7b7 ( section #egbc ( title #ch1 ,unit$ ,/ates ,code1 is am5d$ by ins]t+ & to ! ,committees on ,vet]ans' ,affairs ( ! ,s5ate & ,h\se ( ,repres5tatives aft] to ! ,secret>y4 7b7 ,plan = address+ kn[n in=mation security vuln]abilities ,su* subsection is fur!r am5d$ by add+ at ! end ! foll[+ new p>agraph3 7#ag7 ,submitt+ to ! ,*airs & ,rank+ ,memb]s ( ! ,committees on ,vet]ans' ,affairs ( ! ,s5ate & ,h\se ( ,repres5tatives1 by n lat] ?an #cj days aft] ! la/ day ( ea* fiscal qu>t]1 a summ>y ( any plans ( action & mile/ones = any kn[n in=mation security vuln]ability1 z id5tifi$ pursuant to a widely accept$ indu/ry or ,gov]nm5t /&>d1 t includes-- 7,a7 specific in=mation ab\t ! indu/ry or ,gov]nm5t /&>d us$ to id5tify ! kn[n in=mation security vuln]ability2 7,b7 a detail$ timel9e ) specific deadl9es = address+ ! kn[n in=mation security vuln]ability2 & 7,c7 an update ( any previ\sly specifi$ timel9e & ! rationale = any deviations f su* timel9e4 4 7c7 ,plan = replac+ outdat$ op]at+ sy/ems ,su* subsection is fur!r am5d$ by add+ at ! end ! foll[+ new p>agraph3 7#ah7 ,submitt+ to ! ,committees on ,vet]ans' ,affairs ( ! ,s5ate & ,h\se ( ,repres5tatives1 by n lat] ?an ,janu>y #a ( ea* ye>1 a plan = id5tify+ & replac+ op]at+ sy/ems ( ! ,dep>tm5t t are unsupport$ & t includes-- 7,a7 9 ! case ( an op]at+ sy/em o!r ?an an op]at+ sy/em cov]$ "u subp>agraph 7,c71 requirem5ts t ! op]at+ sy/em be remov$ f ! network ( ! ,dep>tm5t no lat] ?an #ae days aft] ! date on :i* ! op]at+ sy/em is id5tifi$ z be+ out-(-date or unsupport$2 7,b7 in=mation conc]n+ ! numb] ( sy/ems s id5tifi$ dur+ ! ye> prec$+ ! ye> 9 :i* ! report is submitt$1 :5 ea* su* sy/em 0 s id5tifi$1 & :5 ea* sy/em s id5tifi$ 0 remov$ f ! network ( ! ,dep>tm5t2 & 7,c7 9 ! case ( an op]at+ sy/em ! ,secret>y det]m9es is ess5tial = ! prop] op]ation ( any m$ical device or equipm5t1 a description ( ! op]at+ sy/em & a detail$ discussion ( /eps tak5 to ensure ! security ( ! op]at+ sy/em4 4 7d7 ,s(tw>e security ,su* subsection is fur!r am5d$ by add+ at ! end ! foll[+ new p>agraph3 7#ai7 ,ensur+ t any s(tw>e or ,int]net applications us$ on sy/ems by ! ,dep>tm5t are z secure z practicable f any kn[n vuln]abilities t c\ld affect ! confid5tiality ( s5sitive p]sonal in=mation ( vet]ans4 4 7e7 ,?ird p>ty validation ,n lat] ?an #fj days aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y ( ,vet]ans ,affairs %all submit to ! ,committees on ,vet]ans' ,affairs ( ! ,s5ate & ,h\se ( ,repres5tatives a report on ?ird p>ty validation ( ,dep>tm5t ( ,vet]ans ,affairs security4 ,su* report %all include-- 7#a7 a description ( any /eps ! ,secret>y has tak5 to provide = a sy/emic & ongo+ evaluation ( ! in=mation security ( ! ,dep>tm5t by a non-,dep>tm5t entity2 & 7#b7 a description ( any /eps ! ,secret>y plans to take to provide = su* evaluation4 #c4 ,in=mation te*nology report+ requirem5ts 7a7 ,9 g5]al ,*apt] #eg ( title #ch1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 by r$esignat+ sections #egbg & #egbh z sections #egbi & #egcj1 respectively2 & 7#b7 by ins]t+ aft] section #egbf ! foll[+ new sections3 #egbg4 ,report+ requirem5ts ,n lat] ?an #cj days aft] ! la/ day ( ea* fiscal qu>t]1 ! ,secret>y %all submit to ! ,committees on ,vet]ans' ,affairs ( ! ,s5ate & ,h\se ( ,repres5tatives a report t includes ! foll[+ in=mation = t fiscal qu>t]3 7#a7 ,a detail$ description ( any incid5ts ( failure to comply ) e/abli%$ in=mation security policies t occurr$ dur+ t qu>t]4 7#b7 ,any actions tak5 9 response to su* an incid5t4 7#c7 ,any reports made "u p>agraphs 7#h7 ?r\gh 7#aj7 ( subsection 7b7 ( section #egbc ( ?is title dur+ t qu>t]4 7#d7 ,writt5 c]tification t ! requirem5ts ( section #egbb7;c7 ( ?is title 7 foll[$ dur+ t qu>t]4 7#e7 ,a detail$ discussion ( :e!r ea* recomm5dation made by ! ,national ,in/itute ( ,/&>ds & ,te*nology1 ! ,(fice ( ,managem5t & ,budget1 or ! ,dep>tm5t ( ,homel& ,security relat+ to in=mation security h be5 implem5t$ by ! ,dep>tm5t1 & if n1 an explanation ( :y su* recomm5dation 0 n implem5t$4 7#f7 ,/eps tak5 to ensure ! security ( ! ,vet]ans ,heal? ,in=mation ,sy/ems & ,te*nology ,ar*itecture ( ! ,dep>tm5t t all[s = an integrat$ inpati5t & outpati5t electronic heal? record = pati5ts & provides adm9i/rative tools to employees ( ! ,dep>tm5t tak5 dur+ t qu>t]4 #egbh4 ,in=mation security /rategic plan 7a7 ,plan requir$ ,n lat] ?an "o ye> aft] ! date ( ! enactm5t ( ?is section1 ! ,secret>y %all submit to ! ,committees on ,vet]ans' ,affairs ( ! ,s5ate & ,h\se ( ,repres5tatives a /rategic plan = improv+ ! in=mation security & in=mation te*nology infra/ructure ( ! ,dep>tm5t4 ,su* plan %all address-- 7#a7 an in=mation security plan = protect+ ! s5sitive p]sonal in=mation ( vet]ans :ile n unduly int]f]+ ) ! ability ( ! ,dep>tm5t to provide b5efits & s]vices to vet]ans & _! dep5d5ts2 7#b7 h[ ! ,dep>tm5t c improve its compliance ) in=mation security requirem5ts2 7#c7 tra9+ & recruitm5t ( employees ) ! necess>y exp]tise & abilities 9 in=mation security2 & 7#d7 ! in/itutional capability ( ! ,dep>tm5t to address in=mation security ?reats & to implem5t be/ practices relat$ to in=mation security4 7b7 ,biannual updates ,! ,secret>y %all submit to ! ,committees on ,vet]ans' ,affairs ( ! ,s5ate & ,h\se ( ,repres5tatives biannual updates to ! plan requir$ by subsection 7a74 4 7b7 ,cl]ical am5dm5ts ,! table ( sections at ! beg9n+ ( su* *apt] is am5d$ by /rik+ ! items relat+ to sections #egbg & #egbh & ins]t+ ! foll[+ new items3 #egbg4 ,report+ requirem5ts4 #egbh4 ,in=mation security /rategic plan4 #egbi4 ,def9itions4 #egcj4 ,au?orization ( appropriations4 4 #d4 ,requirem5ts = ,dep>tm5t ( ,vet]ans ,affairs contracts = data process+ or ma9t5ance 7a7 ,9 g5]al ,section #egbe7;a7 ( title #ch1 ,unit$ ,/ates ,code1 is am5d$-- 7#a7 9 p>agraph 7#b71 by /rik+ ! p]iod & ins]t+ 2 &2 & 7#b7 by add+ at ! end ! foll[+ new p>agraph3 7#c7 ! contractor %all provide protective measures to safegu>d f possible in=mation security ?reats any in=mation provid$ by ! ,dep>tm5t t w be resid5t on or transit+ ?r\gh in=mation sy/ems controll$ by ! contractor4 4 7b7 ,applicability ,p>agraph 7#c7 ( section #egbe7;a7 ( title #ch1 ,unit$ ,/ates ,code1 %all apply ) respect to a contract ent]$ into aft] ! date ( ! enactm5t ( ?is ,act4 #e4 ,report on dep>tm5tal organization & response to in=mation security incid5ts ,n lat] ?an five ye>s aft] ! date ( ! enactm5t ( ?is ,act1 ! ,secret>y ( ,vet]ans ,affairs %all submit to ! ,committees on ,vet]ans' ,affairs ( ! ,s5ate & ,h\se ( ,repres5tatives a report on in=mation security protection & ! acc\ntability ( ! ,dep>tm5t ( ,vet]ans ,affairs = in=mation security bree*es & incid5ts4 ,su* report %all include-- 7#a7 a discussion ( any organizational *anges t c\ld be made )9 ! ,dep>tm5t to provide = an increas$ level ( in=mation security protection = vet]ans2 7#b7 a discussion ( any organizational *anges t c\ld be made )9 ! ,dep>tm5t to provide = great] acc\ntability & responsibility = in=mation security2 & 7#c7 a plan to develop a sy/em ( bett] assign+ co/s associat$ ) data bree*es & in=mation security incid5ts1 includ+ ! co/s associat$ ) notifications & cr$it monitor+ s]vices1 :]e applicable1 to ! (fices & subdivisions ( ! ,dep>tm5t responsible = su* bree*es & incid5ts4