,,ii  #aagth ,,congress  #b;d ,session  
,s4 #chfc  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,march #ag1    
#bjbb,ms4 ,rosen 7for herself and ,mrs4 
,blackburn7 introduced the following    
bill2 which was read twice and referred 
to the ,committee on ,veterans' ,affairs
  ,a ,,bill  ,to require the ,secretary 
of ,veterans ,affairs to obtain an      
independent cybersecurity assessment of 
information systems of the ,department  
of ,veterans ,affairs1 and for other    
purposes4  #a4 ,short title ,this ,act  
may be cited as the ,strengthening ,,va 
,cybersecurity ,act of #bjbb4  #b4      
,independent cybersecurity assessment of
 information systems of ,department of  
,veterans ,affairs  7a7 ,independent    
assessment required  7#a7 ,in general   
,not later than #fj days after the date 
of the enactment of this ,act1 the      
,secretary of ,veterans ,affairs shall  
enter into an agreement with a federally
 funded research and development center 
to provide the ,secretary with an       

independent cybersecurity assessment    
of-- 7,a7 not more than #aj and not     
fewer than three high-impact information
 systems of the ,department of ,veterans
 ,affairs2 and  7,b7 the effectiveness  
of the information security program and 
information security management system  
of the ,department4  7#b7 ,detailed     
analysis ,the independent cybersecurity 
assessment provided under paragraph 7#a7
 shall include a detailed analysis of   
the ability of the ,department-- 7,a7 to
 ensure the confidentiality1 integrity1 
and availability of the information1    
information systems1 and devices of the 
,department2 and  7,b7 to protect       
against-- 7i7 advanced persistent       
cybersecurity threats2  7ii7 ransomware2
  7iii7 denial of service attacks2  7iv7
 insider threats2  7v7 threats from     
foreign actors1 including ,state        
sponsored criminals and other foreign   
based criminals2  7vi7 phishing2  7vii7 
credential theft2  7viii7 cybersecurity 
attacks that target the supply chain of 

the ,department2  7ix7 threats due to   
remote access and telework activity2 and
  7x7 other cyber threats4  7#c7 ,types 
of systems ,the independent             
cybersecurity assessment provided under 
paragraph 7#a7 shall cover on-premises1 
remote1 cloud-based1 and mobile         
information systems and devices used by1
 or in support of1 ,department          
activities4  7#d7 ,shadow information   
technology ,the independent             
cybersecurity assessment provided under 
paragraph 7#a7 shall include an         
evaluation of the use of information    
technology systems1 devices1 and        
services by employees and contractors of
 the ,department who do so without the  
elements of the ,department that are    
responsible for information technology  
at the ,department knowing or approving 
of such use4  7#e7 ,methodology ,in     
conducting the cybersecurity assessment 
provided under paragraph 7#a71 the      
federally funded research and           
development center shall take into      

account industry best practices and the 
current state-of-the-art in             
cybersecurity evaluation and review4    
7b7 ,plan  7#a7 ,in general ,not later  
than #abj days after the date on which  
an independent assessment is provided to
 the ,secretary pursuant to an agreement
 entered into under subsection 7a7 with 
a federally funded research and         
development center1 the ,secretary shall
 submit to ,congress a plan to address  
the findings of the federally funded    
research and development center set     
forth in such assessment4  7#b7         
,elements ,the plan submitted under     
paragraph 7#a7 shall include the        
following3 7,a7 ,a cost estimate for    
implementing the plan4  7,b7 ,a timeline
 for implementing the plan4  7,c7 ,such 
other elements as the ,secretary        
considers appropriate4  7c7 ,comptroller
 ,general of the ,united ,states review 
,not later than #ahj days after the date
 of the submission of the plan under    
7b77#a71 the ,comptroller ,general of   

the ,united ,states shall-- 7#a7        
commence a review of-- 7,a7 the         
independent cybersecurity assessment    
provided under subsection 7a72 and  7,b7
 the response of the ,department to such
 assessment2 and  7#b7 submit to        
,congress a report of the results of    
that review commenced under paragraph   
7#a71 including any recommendations made
 to the ,secretary regarding the matters
 covered by the report4