improving information security, including with re-
spect to such principles and practices described in 
the document titled ‘‘Framework for Improving Crit-
ical Infrastructure Cybersecurity’’ of the National 
Institute of Standards and Technology. 
SEC. 9. REPORTS ON IMPLEMENTATION. 
(a) BIANNUAL REPORTS.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, and 
every 180-day period thereafter, the Secretary shall 
submit to the congressional veterans committees a 
report on the implementation of this Act, including 
the amendments made by this Act. 
(2) MATTERS INCLUDED.—Each report under 
subsection (a) shall include the following: 
(A) A description of the actions taken by 
the Secretary to implement and comply with 
sections 2 through 7. 
(B) A timeline and project plan, both 
short-term and long-term, for implementing 
each of sections 2 through 7 and assigning roles 
and responsibilities under such plan. 
(C) Performance measures and bench-
marks to measure the results of the Secretary 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
in carrying out remediation efforts under sec-
tions 2 through 7. 
(D) A description of the best practices and 
lessons learned by the Secretary in carrying out 
sections 2 through 7. 
(E) The progress made by the Secretary 
during each month covered by the report with 
respect to reducing the total number of out-
dated operating systems, web application vul-
nerabilities, critical security vulnerabilities, and 
other matters covered by sections 2 through 7. 
(F) An appendix containing detailed re-
ports of the Department, including the enter-
prise information technology dashboard and re-
ports regarding security vulnerabilities, oper-
ating system trends, and web applications. 
(b) ANNUAL INSPECTOR GENERAL REPORT.—The 
Inspector General of the Department of Veterans Affairs 
shall submit to the congressional veterans committees an 
annual report that includes a comprehensive assessment 
of the adequacy and effectiveness of the implementation 
by the Secretary of Veterans Affairs of sections 2 through 
7, including the amendments made by this Act. 
(c) MONTHLY REPORTS.—On a monthly basis, the 
Secretary shall submit to the congressional veterans com-
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
mittees reports on security vulnerabilities discovered pur-
suant to the actions taken under section 4(b)(5). 
SEC. 10. APPLICATION. 
In carrying out this Act, including the amendments 
made by this Act, the Secretary of Veterans Affairs may 
substitute a new technology or process relating to informa-
tion security for a specific technology or process relating 
to information security described in this Act, including the 
amendments made by this Act, if the Secretary determines 
that such new technology or process— 
(1) is a successor to the specific technology or 
process described in this Act, including the amend-
ments made by this Act; and 
(2) provides a greater amount of information 
security than would be provided if the Secretary did 
not make such substitution. 
SEC. 11. DEFINITIONS. 
In this Act: 
(1) The term ‘‘Authority to Operate’’ means the 
official management decision given by a senior offi-
cial of the Department to authorize operation of an 
information system and to explicitly accept the risk 
to the operations of the Department (including with 
respect to the mission, functions, image, or reputa-
tion of the Department), the assets and individuals 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
of the Department, other elements of the Federal 
Government, and the United States based on the im-
plementation of an agreed-upon set of security con-
trols. 
(2) The terms ‘‘confidentiality’’ has the mean-
ing given that term in section 5727 of title 38, 
United States Code. 
(3) The term ‘‘congressional veterans commit-
tees’’ means the Committees on Veterans’ Affairs of 
the House of Representatives and the Senate. 
(4) The term ‘‘critical network infrastructure’’ 
means information technology hardware that pro-
vides— 
(A) vital network services to the Depart-
ment that is vital to carrying out the mission 
of the Department; and 
(B) communications, security, transpor-
tation, access, and authentication services and 
capabilities. 
(5) The term ‘‘domain controller’’ means a 
server that responds to security authentication re-
quests responsible for allowing host access to domain 
resources by authenticating users, sorting user ac-
count information, and enforcing security policy. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(6) The term ‘‘general purpose computer’’ 
means a computer that, given the appropriate appli-
cation and required time, should be able to perform 
most common computing tasks. Such term includes 
personal computers, including desktops, notebooks, 
smart phones, and tablets. 
(7) The term ‘‘image’’ means a standard set of 
software (including the operating system and other 
software) that is installed on a computer. 
(8) The term ‘‘information security’’ has the 
meaning given that term in section 5727 of title 38, 
United States Code. 
(9) The term ‘‘information system’’ has the 
meaning given that term in section 5727 of title 38, 
United States Code. 
(10) The term ‘‘sensitive personal information’’ 
has the meaning given that term in section 5727 of 
title 38, United States Code. 
(11) The term ‘‘Vista system’’ means the Vet-
erans Health Information Systems and Technology 
Architecture of the Department of Veterans Affairs 
that allows for an integrated inpatient and out-
patient electronic health record for patients and pro-
vides administrative tools to employees of the De-
partment. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(12) The term ‘‘web application’’ means an ap-
plication in which all or some parts of the software 
are downloaded from the Internet each time the soft-
ware is accessed, including web browser-based soft-
ware that run within a web browser, desktop soft-
ware that does not use a web browser, and mobile 
software that accesses the Internet for additional in-
formation. 
(13) The term ‘‘well-hashed’’ means the process 
of using a mathematical algorithm against data to 
produce a numeric value that is representative of 
that data. 
Æ 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6301
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS