I 

113TH CONGRESS 

2D SESSION H. R. 4356 

To amend title 38, United States Code, to make certain improvements in 

the information security of the Department of Veterans Affairs, and 

for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

APRIL 1, 2014 

Mrs. KIRKPATRICK (for herself and Mr. MICHAUD) introduced the following 

bill; which was referred to the Committee on Veterans’ Affairs 

A BILL 

To amend title 38, United States Code, to make certain 

improvements in the information security of the Department of Veterans Affairs, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Department of Vet5 erans Affairs Information Security Protection Act’’. 

6 SEC. 2. DEPARTMENT OF VETERANS AFFAIRS INFORMA7 TION SECURITY IMPROVEMENTS. 

8 (a) SUBMITTAL OF QUARTERLY INFORMATION SECU9 RITY REPORT TO CONGRESS.—Paragraph (14) of subVerDate Mar 15 2010 00:22 Apr 03, 2014 Jkt 039200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\H4356.IH H4356

tjames on DSK6SPTVN1PROD with BILLS
2 

•HR 4356 IH

1 section (b) of section 5723 of title 38, United States Code, 

2 is amended by inserting ‘‘and to the Committees on Vet3 erans’ Affairs of the Senate and House of Representa4 tives’’ after ‘‘to the Secretary’’. 

5 (b) PLAN FOR ADDRESSING KNOWN INFORMATION

6 SECURITY VULNERABILITIES.—Such subsection is further 

7 amended by adding at the end the following new para8 graph: 

9 ‘‘(17) Submitting to the Chairs and Ranking 

10 Members of the Committees on Veterans’ Affairs of 

11 the Senate and House of Representatives, by not 

12 later than 30 days after the date of the enactment 

13 of this paragraph, and quarterly thereafter, a plan 

14 of action to address critical known information secu15 rity vulnerabilities that includes— 

16 ‘‘(A) specific milestones regarding time17 lines to address such vulnerabilities; 

18 ‘‘(B) a summary of any reports provided to 

19 the Assistant Secretary for Information and 

20 Technology pursuant to subsection (e)(3) dur21 ing the period covered by the report; 

22 ‘‘(C) a discussion of any risk assessment 

23 analysis undertaken by the Department that led 

24 to the inclusion of any such vulnerability; and 


tjames on DSK6SPTVN1PROD with BILLS
3 

•HR 4356 IH

1 ‘‘(D) a summary of such plan of action 

2 that could be made publicly available.’’. 

3 (c) PLAN FOR REPLACING OUTDATED OPERATING

4 SYSTEMS.—Such subsection is further amended by adding 

5 at the end the following new paragraph: 

6 ‘‘(18) Submitting to the Committees on Vet7 erans’ Affairs of the Senate and House of Rep8 resentatives, by not later than January 1 of each 

9 year, a plan for identifying and replacing operating 

10 systems of the Department that are out-of-date or 

11 unsupported and that includes— 

12 ‘‘(A) requirements that such an operating 

13 system be removed from the network of the De14 partment no later than 15 days after the date 

15 on which the operating system was identified as 

16 being out-of-date or unsupported; and 

17 ‘‘(B) information concerning the number of 

18 systems so identified during the year preceding 

19 the year in which the report is submitted, when 

20 each such system was so identified, and when 

21 each system so identified was removed from the 

22 network of the Department.’’. 

23 (d) SOFTWARE SECURITY.—Such subsection is fur24 ther amended by adding at the end the following new para25 graph: 


tjames on DSK6SPTVN1PROD with BILLS
4 

•HR 4356 IH

1 ‘‘(19) Ensuring that any software or Internet 

2 applications used on systems by the Department are 

3 secure from vulnerabilities that could affect the con4 fidentiality of sensitive personal information of vet5 erans.’’. 

6 SEC. 3. INFORMATION TECHNOLOGY REPORTING REQUIRE7 MENTS. 

8 (a) IN GENERAL.—Chapter 57 of title 38, United 

9 States Code, is amended— 

10 (1) by redesignating sections 5727 and 5728 as 

11 sections 5729 and 5730, respectively; and 

12 (2) by inserting after section 5726 the following 

13 new sections: 

14 ‘‘§ 5727. Reporting requirements 

15 ‘‘Not later than 30 days after the last day of each 

16 fiscal quarter, the Secretary shall submit to the Commit17 tees on Veterans’ Affairs of the Senate and House of Rep18 resentatives a report that includes the following informa19 tion for that fiscal quarter: 

20 ‘‘(1) A detailed description of any incidents of 

21 failure to comply with established information secu22 rity policies that occurred during that quarter. 

23 ‘‘(2) Any actions taken in response to such an 

24 incident. 


tjames on DSK6SPTVN1PROD with BILLS
5 

•HR 4356 IH

1 ‘‘(3) Any reports made under paragraphs (8) 

2 through (10) of subsection (b) of section 5723 of 

3 this title during that quarter. 

4 ‘‘(4) Written certification that the requirements 

5 of section 5722(c) of this title were followed during 

6 that quarter. 

7 ‘‘(5) A detailed discussion of whether each rec8 ommendation made by the National Institute of 

9 Standards and Technology, the Office of Manage10 ment and Budget, or the Department of Homeland 

11 Security relating to information security have been 

12 implemented by the Department, and if not, an ex13 planation of why such recommendation was not im14 plemented. 

15 ‘‘(6) Steps taken to ensure the security of the 

16 Veterans Health Information Systems and Tech17 nology Architecture of the Department that allows 

18 for an integrated inpatient and outpatient electronic 

19 health record for patients and provides administra20 tive tools to employees of the Department taken dur21 ing that quarter. 

22 ‘‘§ 5728. Information security strategic plan 

23 ‘‘(a) PLAN REQUIRED.—Not later than one year 

24 after the date of the enactment of this section, the Sec25 retary, in consultation with the Secretary of Homeland SeVerDate Mar 15 2010 00:22 Apr 03, 2014 Jkt 039200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\H4356.IH H4356

tjames on DSK6SPTVN1PROD with BILLS
6 

•HR 4356 IH

1 curity, the Director of the Office of Management and 

2 Budget, the Secretary of Defense, the Director of the Na3 tional Institute of Standards and Technology, the heads 

4 of other appropriate Federal agencies, veterans groups, 

5 and appropriate industry specialists, shall submit to the 

6 Committees on Veterans’ Affairs of the Senate and House 

7 of Representatives a strategic plan for improving the in8 formation security of the Department. Such plan shall ad9 dress— 

10 ‘‘(1) methods of protecting the sensitive per11 sonal information of veterans while not unduly inter12 fering with the ability of the Department to provide 

13 benefits and services to veterans and their depend14 ents; 

15 ‘‘(2) how the Department can improve its com16 pliance with information security requirements; 

17 ‘‘(3) training and recruitment of employees with 

18 the necessary expertise and abilities in information 

19 security; and 

20 ‘‘(4) the institutional capability of the Depart21 ment to address information security threats and to 

22 implement best practices related to information se23 curity. 

24 ‘‘(b) BIANNUAL UPDATES.—The Secretary shall sub25 mit to the Committees on Veterans’ Affairs of the Senate 


tjames on DSK6SPTVN1PROD with BILLS
7 

•HR 4356 IH

1 and House of Representatives biannual updates to the 

2 plan required by subsection (a).’’. 

3 (b) CLERICAL AMENDMENTS.—The table of sections 

4 at the beginning of such chapter is amended by striking 

5 the items relating to sections 5727 and 5728 and inserting 

6 the following new items: 

‘‘5727. Reporting requirements. 

‘‘5728. Information security strategic plan. 

‘‘5729. Definitions. 

‘‘5730. Authorization of appropriations.’’. 

7 SEC. 4. REQUIREMENTS FOR DEPARTMENT OF VETERANS 

8 AFFAIRS CONTRACTS FOR DATA PROCESSING 

9 OR MAINTENANCE. 

10 (a) IN GENERAL.—Section 5725(a) of title 38, 

11 United States Code, is amended— 

12 (1) in paragraph (2), by striking the period and 

13 inserting ‘‘; and’’; and 

14 (2) by adding at the end the following new 

15 paragraph: 

16 ‘‘(3) the contractor shall provide protective 

17 measures to safeguard from possible information se18 curity threats any information provided by the De19 partment that will be resident on or transiting 

20 through information systems controlled by the con21 tractor.’’. 

22 (b) APPLICABILITY.—Paragraph (3) of section 

23 5725(a) of title 38, United States Code, shall apply with 


tjames on DSK6SPTVN1PROD with BILLS
8 

•HR 4356 IH

1 respect to a contract entered into after the date of the 

2 enactment of this Act. 

Æ 


tjames on DSK6SPTVN1PROD with BILLS