,i #aaith ,,congress #b;d ,session ,h4 ,r4 #iaeb ,,in ,,the ,,house ,,of ,,representatives ,june #d1 #bjbf,mr4 ,lawler introduced the following bill2 which was referred to the ,committee on ,veterans' ,affairs ,a ,,bill ,to direct the ,secretary of ,veterans ,affairs to carry out a pilot program to modernize digital identity proofing and authentication systems of the ,department of ,veterans ,affairs1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,veterans ,electronic ,trust and ,records ,authentication ,act or the ,,vetra ,act4 #b4 ,department of ,veterans ,affairs pilot program to modernize digital identity proofing and authentication systems 7a7 ,establishment of pilot program ,the ,secretary of ,veterans ,affairs shall1 in accordance with chapter #eg of title #ch1 ,united ,states ,code1 carry out a pilot program to modernize digital identity proofing and authentication systems of the ,department of ,veterans ,affairs4 ,under such pilot program1 the ,secretary shall be responsible for-- 7#a7 replacing legacy knowledge-based or single-factor identity verification mechanisms with multi-layered1 high-assurance digital identity solutions2 7#b7 reducing fraud and improper payments2 7#c7 improving secure access to digital service platforms of the ,department for veterans and other individuals eligible for benefits under laws administered by the ,secretary2 and 7#d7 assessing cost savings and operational efficiencies before carrying out a full-scale deployment of any digital identity solution developed pursuant to the pilot program4 7b7 ,selection ,the ,secretary shall select1 for participation in the pilot program1 not more than three high-volume digital service platforms of the ,department1 each of which may consist of one or more underlying systems1 applications1 or services1 including-- 7#a7 disability compensation claims system2 7#b7 veterans health care enrollment portal2 7#c7 the system to administer educational benefits2 or 7#d7 the system to administer home loan benefits4 7c7 ,risk-tiered implementation ,as part of the pilot1 the ,secretary shall-- 7#a7 map categories of digital transactions within participating platforms to graduated levels of identity assurance based on-- 7,a7 transaction sensitivity2 7,b7 fraud risk2 and 7,c7 potential harm2 7#b7 implement adaptive authentication mechanisms capable of adjusting authentication requirements based on contextual and behavioral risk signals2 and 7#c7 ensure1 to the extent practicable under applicable ,federal standards1 more rigorous authentication requirements are applied only where warranted by risk4 7d7 ,standards for digital identity solutions ,any digital identity solution implemented pursuant to the pilot program shall-- 7#a7 be commercially available and may not be developed exclusively for use by the ,department2 7#b7 be independently certified to meet or exceed ,identity ,assurance ,level #b 7,,ial#b71 as defined in ,national ,institute of ,standards and ,technology ,special ,publication #hjj-fc 7or any successor document72 7#c7 incorporate multi-factor authentication consistent with ,authentication ,assurance ,level #b 7,,aal#b71 as defined in ,,nist ,,sp #hjj-fc 7or any successor document71 or higher2 and 7#d7 comply with applicable ,federal cybersecurity and privacy requirements1 including-- 7,a7 chapter #eg of title #ch1 ,united ,states ,code2 7,b7 the ,privacy ,act of #aigd 7#e ,u4,s4,c4 #ebb;a72 and 7,c7 the ,federal ,information ,security ,modernization ,act of #bjad 7,public ,law #aac-bhc74 7e7 ,funding 7#a7 ,in general ,of amounts authorized to be appropriated for ,information ,technology ,systems under chapter #eg of title #ch1 ,united ,states ,code1 the ,secretary may obligate or expend not more than #be1jjj1jjj1 in the aggregate1 may be obligated to carry out the pilot program4 7#b7 ,no additional authorization ,no additional funds are authorized to be appropriated to carry out this section4 7f7 ,reporting requirements 7#a7 ,implementation plan ,not later than #abj days after the date of the enactment of this ,act1 the ,secretary shall submit to the ,committees on ,veterans' ,affairs of the ,house of ,representatives and the ,senate a plan for implementing the pilot program under this section4 7#b7 ,interim report ,not later than one year after the date on which the ,secretary commences the pilot program1 the ,secretary shall submit to such committees an interim performance report that includes-- 7,a7 a summary of-- 7i7 identity proofing completion rates2 7ii7 successful authentication rates2 7iii7 successful account recovery rates2 and 7iv7 abandonment rates during proofing1 authentication1 and recovery workflows1 for each participating digital service platform1 compared to the baseline rates in effect before commencement of the pilot program2 7,b7 fraud reduction metrics applicable to the digital service platforms of the ,department selected for participation in the pilot program2 7,c7 an assessment of the extent to which the pilot program has resulted in decreased overall costs to the ,department2 and 7,d7 cybersecurity performance indicators4 7#c7 ,final report ,not later than #ij days before the date specified in subsection 7i77#a71 the ,secretary shall submit to such committees a final report that includes-- 7,a7 a comprehensive evaluation of the pilot program2 and 7,b7 legislative recommendations with respect to modernizing digital identity and authentication systems of the ,department4 7g7 ,,gao evaluation and report ,not later than #ah months after the date of the enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall carry out an independent evaluation of the pilot program under this section and submit to the ,committees on ,veterans' ,affairs of the ,house of ,representatives and the ,senate a report that includes the findings of such evaluation4 ,such report shall include the following3 7#a7 ,an assessment of-- 7,a7 the extent to which the pilot program successfully implemented identity proofing and authentication mechanisms that meet or exceed ,identity ,assurance ,level #b 7,,ial#b7 and ,authentication ,assurance ,level #b 7,,aal#b7 standards under ,national ,institute of ,standards and ,technology ,special ,publication #hjj-fc 7or any successor document72 7,b7 the degree to which the pilot program reduced identity-related fraud1 improper payments1 or unauthorized account access across participating digital service platforms2 7,c7 the effect of the pilot program on veteran access to such digital service platforms1 including effects on-- 7i7 authentication success rates2 7ii7 account recovery and support requests2 and 7iii7 barriers to access for veterans-- 7,i7 residing in rural areas2 7,,ii7 with disabilities2 or 7,,iii7 with limited digital literacy2 7,d7 costs associated with implementation of the pilot program compared with the financial benefits to the ,department derived from fraud reduction1 administrative efficiencies1 and avoided improper payments2 7,e7 the extent to which the digital identity solutions used in the pilot program complied with applicable ,federal cybersecurity and privacy requirements2 7,f7 the extent to which the ,department successfully implemented risk-tiered authentication approaches that adjust identity verification requirements based on transaction sensitivity and fraud risk2 and 7,g7 the feasibility of scaling the pilot program across additional digital service platforms of the ,department1 including compatibility with existing ,department identity infrastructure and potential integration with ,government-wide identity verification services4 7#b7 ,recommendations of the ,comptroller ,general with respect to whether the pilot program should be-- 7,a7 expanded to additional digital service platforms of the ,department2 7,b7 modified to address operational or cybersecurity risks2 or 7,c7 discontinued4 7h7 ,authorization period 7#a7 ,termination date ,the authority of the ,secretary to carry out the pilot program under this section shall terminate on the date that is two years after the date of the enactment of this ,act4 7#b7 ,no presumption of continuation ,the ,secretary may not be expand the scope or funding cap beyond the levels described in this section unless expressly authorized by a subsequent ,act of ,congress4