I 
114TH CONGRESS 
1ST SESSION H. R. 1128 
To amend title 38, United States Code, to make certain improvements in 
the information security of the Department of Veterans Affairs, and 
for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 26, 2015 
Mrs. KIRKPATRICK introduced the following bill; which was referred to the 
Committee on Veterans’ Affairs 
A BILL 
To amend title 38, United States Code, to make certain 
improvements in the information security of the Depart-
ment of Veterans Affairs, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Department of Vet-
erans Affairs Cyber Security Protection Act’’. 
SEC. 2. DEPARTMENT OF VETERANS AFFAIRS INFORMA-
TION SECURITY IMPROVEMENTS. 
(a) SUBMITTAL OF QUARTERLY INFORMATION SECU-
RITY REPORT TO CONGRESS.—Paragraph (14) of sub-
VerDate Sep 11 2014 
23:27 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1128.IH
H1128
asabaliauskas on DSK5VPTVN1PROD with BILLS
section (b) of section 5723 of title 38, United States Code, 
is amended by inserting ‘‘and to the Committees on Vet-
erans’ Affairs of the Senate and House of Representa-
tives’’ after ‘‘to the Secretary’’. 
(b) PLAN FOR ADDRESSING KNOWN INFORMATION 
SECURITY VULNERABILITIES.—Such subsection is further 
amended by adding at the end the following new para-
graph: 
‘‘(17) Submitting to the Chairs and Ranking 
Members of the Committees on Veterans’ Affairs of 
the Senate and House of Representatives, by not 
later than 30 days after the last day of each fiscal 
quarter, a summary of any plans of action and mile-
stones for any known information security vulner-
ability, as identified pursuant to a widely accepted 
industry or Government standard, that includes— 
‘‘(A) specific information about the indus-
try or Government standard used to identify the 
known information security vulnerability; 
‘‘(B) a detailed timeline with specific dead-
lines for addressing the known information se-
curity vulnerability; and 
‘‘(C) an update of any previously specified 
timeline and the rationale for any deviations 
from such timeline.’’. 
VerDate Sep 11 2014 
23:27 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1128.IH
H1128
asabaliauskas on DSK5VPTVN1PROD with BILLS
ment, a description of the operating system and 
a detailed discussion of steps taken to ensure 
the security of the operating system.’’. 
(d) SOFTWARE SECURITY.—Such subsection is fur-
ther amended by adding at the end the following new para-
graph: 
‘‘(19) Ensuring that any software or Internet 
applications used on systems by the Department are 
as 
secure 
as 
practicable 
from 
any 
known 
vulnerabilities that could affect the confidentiality of 
sensitive personal information of veterans.’’. 
(e) THIRD PARTY VALIDATION.—Not later than 60 
days after the date of the enactment of this Act, the Sec-
retary of Veterans Affairs shall submit to the Committees 
on Veterans’ Affairs of the Senate and House of Rep-
resentatives a report on third party validation of Depart-
ment of Veterans Affairs security. Such report shall in-
clude— 
(1) a description of any steps the Secretary has 
taken to provide for a systemic and ongoing evalua-
tion of the information security of the Department 
by a non-Department entity; and 
(2) a description of any steps the Secretary 
plans to take to provide for such evaluation. 
VerDate Sep 11 2014 
23:27 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1128.IH
H1128
asabaliauskas on DSK5VPTVN1PROD with BILLS
SEC. 3. INFORMATION TECHNOLOGY REPORTING REQUIRE-
MENTS. 
(a) IN GENERAL.—Chapter 57 of title 38, United 
States Code, is amended— 
(1) by redesignating sections 5727 and 5728 as 
sections 5729 and 5730, respectively; and 
(2) by inserting after section 5726 the following 
new sections: 
‘‘§ 5727. Reporting requirements 
‘‘Not later than 30 days after the last day of each 
fiscal quarter, the Secretary shall submit to the Commit-
tees on Veterans’ Affairs of the Senate and House of Rep-
resentatives a report that includes the following informa-
tion for that fiscal quarter: 
‘‘(1) A detailed description of any incidents of 
failure to comply with established information secu-
rity policies that occurred during that quarter. 
‘‘(2) Any actions taken in response to such an 
incident. 
‘‘(3) Any reports made under paragraphs (8) 
through (10) of subsection (b) of section 5723 of 
this title during that quarter. 
‘‘(4) Written certification that the requirements 
of section 5722(c) of this title were followed during 
that quarter. 
VerDate Sep 11 2014 
23:27 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1128.IH
H1128
asabaliauskas on DSK5VPTVN1PROD with BILLS
‘‘(5) A detailed discussion of whether each rec-
ommendation made by the National Institute of 
Standards and Technology, the Office of Manage-
ment and Budget, or the Department of Homeland 
Security relating to information security have been 
implemented by the Department, and if not, an ex-
planation of why such recommendation was not im-
plemented. 
‘‘(6) Steps taken to ensure the security of the 
Veterans Health Information Systems and Tech-
nology Architecture of the Department that allows 
for an integrated inpatient and outpatient electronic 
health record for patients and provides administra-
tive tools to employees of the Department taken dur-
ing that quarter. 
‘‘§ 5728. Information security strategic plan 
‘‘(a) PLAN REQUIRED.—Not later than one year 
after the date of the enactment of this section, the Sec-
retary shall submit to the Committees on Veterans’ Affairs 
of the Senate and House of Representatives a strategic 
plan for improving the information security and informa-
tion technology infrastructure of the Department. Such 
plan shall address— 
‘‘(1) an information security plan for protecting 
the sensitive personal information of veterans while 
VerDate Sep 11 2014 
23:27 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1128.IH
H1128
asabaliauskas on DSK5VPTVN1PROD with BILLS
not unduly interfering with the ability of the Depart-
ment to provide benefits and services to veterans 
and their dependents; 
‘‘(2) how the Department can improve its com-
pliance with information security requirements; 
‘‘(3) training and recruitment of employees with 
the necessary expertise and abilities in information 
security; and 
‘‘(4) the institutional capability of the Depart-
ment to address information security threats and to 
implement best practices related to information se-
curity. 
‘‘(b) BIANNUAL UPDATES.—The Secretary shall sub-
mit to the Committees on Veterans’ Affairs of the Senate 
and House of Representatives biannual updates to the 
plan required by subsection (a).’’. 
(b) CLERICAL AMENDMENTS.—The table of sections 
at the beginning of such chapter is amended by striking 
the items relating to sections 5727 and 5728 and inserting 
the following new items: 
‘‘5727. Reporting requirements. 
‘‘5728. Information security strategic plan. 
‘‘5729. Definitions. 
‘‘5730. Authorization of appropriations.’’. 
VerDate Sep 11 2014 
23:27 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6211
E:\BILLS\H1128.IH
H1128
asabaliauskas on DSK5VPTVN1PROD with BILLS
SEC. 4. REQUIREMENTS FOR DEPARTMENT OF VETERANS 
AFFAIRS CONTRACTS FOR DATA PROCESSING 
OR MAINTENANCE. 
(a) IN GENERAL.—Section 5725(a) of title 38, 
United States Code, is amended— 
(1) in paragraph (2), by striking the period and 
inserting ‘‘; and’’; and 
(2) by adding at the end the following new 
paragraph: 
‘‘(3) the contractor shall provide protective 
measures to safeguard from possible information se-
curity threats any information provided by the De-
partment that will be resident on or transiting 
through information systems controlled by the con-
tractor.’’. 
(b) APPLICABILITY.—Paragraph (3) of section 
5725(a) of title 38, United States Code, shall apply with 
respect to a contract entered into after the date of the 
enactment of this Act. 
SEC. 5. REPORT ON DEPARTMENTAL ORGANIZATION AND 
RESPONSE TO INFORMATION SECURITY INCI-
DENTS. 
Not later than five years after the date of the enact-
ment of this Act, the Secretary of Veterans Affairs shall 
submit to the Committees on Veterans’ Affairs of the Sen-
ate and House of Representatives a report on information 
VerDate Sep 11 2014 
23:27 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H1128.IH
H1128
asabaliauskas on DSK5VPTVN1PROD with BILLS
security protection and the accountability of the Depart-
ment of Veterans Affairs for information security breeches 
and incidents. Such report shall include— 
(1) a discussion of any organizational changes 
that could be made within the Department to pro-
vide for an increased level of information security 
protection for veterans; 
(2) a discussion of any organizational changes 
that could be made within the Department to pro-
vide for greater accountability and responsibility for 
information security; and 
(3) a plan to develop a system of better assign-
ing costs associated with data breeches and informa-
tion security incidents, including the costs associated 
with notifications and credit monitoring services, 
where applicable, to the offices and subdivisions of 
the Department responsible for such breeches and 
incidents. 
Æ 
VerDate Sep 11 2014 
23:27 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6301
E:\BILLS\H1128.IH
H1128
asabaliauskas on DSK5VPTVN1PROD with BILLS