the authentication and session management require-
ments defined in the Application Security Verifica-
tion Standard of the Open Web Application Security 
Project. 
(12) Implement visibility and attribution meas-
ures to improve the process, architecture, and tech-
nical capabilities of the Department to monitor web 
applications used on the networks and computers of 
the Department to detect attack attempts, locate 
points of entry, identify already compromised ma-
chines, interrupt activities of infiltrated attackers, 
and gain information about the sources of an attack. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsection (b). 
SEC. 7. SECURITY OF THE VISTA SYSTEM. 
(a) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Secretary shall en-
sure that the VistA system is secure from vulnerabilities 
that could affect the confidentiality of sensitive personal 
information of veterans. 
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following activities: 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(1) Develop a remedial action plan to address 
the approaches to interoperability— 
(A) between multiple VistA systems; and 
(B) between the VistA system and external 
systems and software. 
(2) Update the policy, procedures, and govern-
ance of the Department with respect to system-to- 
system integration where users log on to external 
systems and then automatically connect to the VistA 
system and interact. 
(3) Provide authentication for the machine-to- 
machine broker so that the VistA system ‘‘listener’’ 
verifies the identity of the calling system. 
(4) Establish and implement policy with respect 
to the authentication of external systems attempting 
to connect to the VistA system and criteria by which 
user authentication must be accomplished to ensure 
all applications that connect to the VistA system 
convey accurate user information. 
(5) Establish a business requirement that sys-
tem-to-system integration connectivity across the 
wide-area network must consist of encrypted com-
munication and require external systems to securely 
identify themselves, or for the VistA system to se-
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
curely identify external systems that attempt to con-
nect to the system. 
(6) Establish a business requirement that exter-
nal systems communicate accurate user information 
to the VistA system relating to actions initiated by 
actual individuals and facilitate the revocation of ac-
cess by the VistA system relative to specific users or 
external systems attempting to connect. 
(7) Implement monthly project design reviews 
of the integration between systems and web applica-
tions to ensure that the effectiveness of the existing 
controls is sustained. 
(8) Assess the potential compromise to non-De-
partment networks that are interconnected with the 
network of the Department, including the networks 
of the Department of Defense and the Department 
of Health and Human Services. 
(9) Ensure that, in the near-term, software de-
velopment for the VistA system develops the critical 
enhancements and fixes to the system that are nec-
essary to ensure compliance with changes to patient 
enrollment. 
(10) Ensure that all systems of the Department 
have been given the ‘‘Authority to Operate’’ designa-
tion and have been properly certified by meeting all 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
requirements, including a comprehensive assessment 
of management, operational, and technical security 
controls, to become operational, and restrict the use 
of waivers. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsection (b). 
SEC. 8. REPORT ON COMPLIANCE WITH INFORMATION SE-
CURITY REQUIREMENTS AND BEST PRAC-
TICES. 
Not later than 60 days after the date of the enact-
ment of this Act, the Secretary of Veterans Affairs shall 
submit to the congressional veterans committees the fol-
lowing: 
(1) Written certification that the Secretary is 
taking every action required to comply with— 
(A) subchapter III of chapter 57 of title 
38, United States Code; 
(B) subchapter III of chapter 35 of title 
44, United States Code; 
(C) special publications 800–53 and 800– 
111 of the National Institute of Standards and 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
Technology, including with respect to encrypt-
ing databases; 
(D) applicable memoranda issued by the 
Director of Management and Budget regarding 
protecting personally identifiable information 
and continuous monitoring; and 
(E) any other relevant law or regulation 
regarding the information security of the De-
partment of Veterans Affairs. 
(2) How the Secretary is using and imple-
menting the principles and best practices regarding 
improving information security, including with re-
spect to such principles and practices described in 
the document titled ‘‘Framework for Improving Crit-
ical Infrastructure Cybersecurity’’ of the National 
Institute of Standards and Technology. 
SEC. 9. REPORTS ON IMPLEMENTATION. 
(a) BIANNUAL REPORTS.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, and 
every 180-day period thereafter, the Secretary shall 
submit to the congressional veterans committees a 
report on the implementation of this Act, including 
the amendments made by this Act. 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS