(i) advanced persistent cybersecurity 
threats; 
(ii) ransomware; 
(iii) denial of service attacks; 
(iv) insider threats; 
(v) threats from foreign actors, in-
cluding state sponsored criminals and 
other foreign based criminals; 
(vi) phishing; 
(vii) credential theft; 
(viii) cybersecurity attacks that target 
the supply chain of the Department; 
(ix) threats due to remote access and 
telework activity; and 
(x) other cyber threats. 
(3) TYPES OF SYSTEMS.—The independent cy-
bersecurity assessment provided under paragraph 
(1) shall cover on-premises, remote, cloud-based, and 
mobile information systems and devices used by, or 
in support of, Department activities. 
(4) SHADOW INFORMATION TECHNOLOGY.—The 
independent 
cybersecurity 
assessment 
provided 
under paragraph (1) shall include an evaluation of 
the use of information technology systems, devices, 
and services by employees and contractors of the De-
partment who do so without the heads of the ele-
ments of the Department that are responsible for in-
formation technology at the Department knowing or 
approving of such use. 
(5) METHODOLOGY.—In conducting the cyber-
security assessment to be provided under paragraph 
(1), the federally funded research and development 
center shall take into account industry best practices 
and the current state-of-the-art in cybersecurity 
evaluation and review. 
(b) PLAN.— 
(1) IN
GENERAL.—Not later than 120 days 
after the date on which an independent assessment 
is provided to the Secretary by a federally funded re-
search and development center pursuant to an 
agreement entered into under subsection (a), the 
Secretary shall submit to the Committees on Vet-
erans’ Affairs of the House of Representatives and 
the Senate a plan to address the findings of the fed-
erally funded research and development center set 
forth in such assessment. 
(2) ELEMENTS.—The plan submitted under 
paragraph (1) shall include the following:
(A) Improvements to the security controls 
of the information systems of the Department 
assessed under subsection (a) to— 
(i) achieve the goals specified in sub-
paragraph (A) of paragraph (2) of such 
subsection; and 
(ii) protect against the threats speci-
fied in subparagraph (B) of such para-
graph. 
(B) Improvements to the information secu-
rity program and information security manage-
ment system of the Department to achieve such 
goals and protect against such threats. 
(C) A cost estimate for implementing the 
plan. 
(D) A timeline for implementing the plan. 
(E) Such other elements as the Secretary 
considers appropriate. 
(c) COMPTROLLER
GENERAL
OF
THE
UNITED 
STATES EVALUATION AND REVIEW.—Not later than 180 
days after the date of the submission of the plan under 
subsection (b)(1), the Comptroller General of the United 
States shall— 
(1) commence an evaluation and review of—
(A) the independent cybersecurity assess-
ment provided under subsection (a); and 
(B) the response of the Department to 
such assessment; and 
(2) provide to the Committees on Veterans’ Af-
fairs of the House of Representatives and the Senate 
a briefing on the results of the evaluation and re-
view, including any recommendations made to the 
Secretary regarding the matters covered by the 
briefing. 
Passed the House of Representatives November 17, 
2022. 
Attest: 
Clerk.
117TH CONGRESS 
2D SESSION 
H. R. 7299 
AN ACT 
To require the Secretary of Veterans Affairs to ob-
tain an independent cybersecurity assessment of 
information systems of the Department of Vet-
erans Affairs, and for other purposes.