#aagth ,,congress  #b;d ,session  ,h4   
,r4 #gbii  ,,an ,,act  ,to require the  
,secretary of ,veterans ,affairs to     
obtain an independent cybersecurity     
assessment of information systems of the
 ,department of ,veterans ,affairs1 and 
for other purposes4  #a4 ,short title   
,this ,act may be cited as the          
,strengthening ,,va ,cybersecurity ,act 
of #bjbb or the ,,svac ,act of #bjbb4   
#b4 ,independent cybersecurity          
assessment of information systems of    
,department of ,veterans ,affairs  7a7  
,independent assessment required  7#a7  
,in general ,not later than #fj days    
after the date of the enactment of this 
,act1 the ,secretary of ,veterans       
,affairs shall seek to enter into an    
agreement with a federally funded       
research and development center to      
provide to the ,secretary an independent
 cybersecurity assessment of--  7,a7    
five high-impact information systems of 
the ,department of ,veterans ,affairs2  
and  7,b7 the effectiveness of the      

information security program and        
information security management system  
of the ,department4  7#b7 ,detailed     
analysis ,the independent cybersecurity 
assessment provided under paragraph 7#a7
 shall include a detailed analysis of   
the ability of the ,department-- 7,a7 to
 ensure the confidentiality1 integrity1 
and availability of the information1    
information systems1 and devices of the 
,department2 and  7,b7 to protect       
against-- 7i7 advanced persistent       
cybersecurity threats2  7ii7 ransomware2
  7iii7 denial of service attacks2  7iv7
 insider threats2  7v7 threats from     
foreign actors1 including state         
sponsored criminals and other foreign   
based criminals2  7vi7 phishing2  7vii7 
credential theft2  7viii7 cybersecurity 
attacks that target the supply chain of 
the ,department2  7ix7 threats due to   
remote access and telework activity2 and
  7x7 other cyber threats4  7#c7 ,types 
of systems ,the independent             
cybersecurity assessment provided under 

paragraph 7#a7 shall cover on-premises1 
remote1 cloud-based1 and mobile         
information systems and devices used by1
 or in support of1 ,department          
activities4  7#d7 ,shadow information   
technology ,the independent             
cybersecurity assessment provided under 
paragraph 7#a7 shall include an         
evaluation of the use of information    
technology systems1 devices1 and        
services by employees and contractors of
 the ,department who do so without the  
heads of the elements of the ,department
 that are responsible for information   
technology at the ,department knowing or
 approving of such use4  7#e7           
,methodology ,in conducting the         
cybersecurity assessment to be provided 
under paragraph 7#a71 the federally     
funded research and development center  
shall take into account industry best   
practices and the current               
state-of-the-art in cybersecurity       
evaluation and review4  7b7 ,plan  7#a7 
,in general ,not later than #abj days   

after the date on which an independent  
assessment is provided to the ,secretary
 by a federally funded research and     
development center pursuant to an       
agreement entered into under subsection 
7a71 the ,secretary shall submit to the 
,committees on ,veterans' ,affairs of   
the ,house of ,representatives and the  
,senate a plan to address the findings  
of the federally funded research and    
development center set forth in such    
assessment4  7#b7 ,elements ,the plan   
submitted under paragraph 7#a7 shall    
include the following3  7,a7            
,improvements to the security controls  
of the information systems of the       
,department assessed under subsection   
7a7 to-- 7i7 achieve the goals specified
 in subparagraph 7,a7 of paragraph 7#b7 
of such subsection2 and  7ii7 protect   
against the threats specified in        
subparagraph 7,b7 of such paragraph4    
7,b7 ,improvements to the information   
security program and information        
security management system of the       

,department to achieve such goals and   
protect against such threats4  7,c7 ,a  
cost estimate for implementing the plan4
  7,d7 ,a timeline for implementing the 
plan4  7,e7 ,such other elements as the 
,secretary considers appropriate4  7c7  
,comptroller ,general of the ,united    
,states evaluation and review ,not later
 than #ahj days after the date of the   
submission of the plan under subsection 
7b77#a71 the ,comptroller ,general of   
the ,united ,states shall--  7#a7       
commence an evaluation and review of--  
7,a7 the independent cybersecurity      
assessment provided under subsection    
7a72 and  7,b7 the response of the      
,department to such assessment2 and     
7#b7 provide to the ,committees on      
,veterans' ,affairs of the ,house of    
,representatives and the ,senate a      
briefing on the results of the          
evaluation and review1 including any    
recommendations made to the ,secretary  
regarding the matters covered by the    
briefing4  ,passed the ,house of        

,representatives ,november #ag1         
#bjbb4;,clerk4