(2) MATTERS INCLUDED.—Each report under 
subsection (a) shall include the following: 
(A) A description of the actions taken by 
the Secretary to implement and comply with 
sections 2 through 7. 
(B) A timeline and project plan, both 
short-term and long-term, for implementing 
each of sections 2 through 7 and assigning roles 
and responsibilities under such plan. 
(C) Performance measures, defined met-
rics, and benchmarks to measure the results of 
the Secretary in carrying out remediation ef-
forts under sections 2 through 7. 
(D) A description of the best practices and 
lessons learned by the Secretary in carrying out 
sections 2 through 7. 
(E) The progress made by the Secretary 
during each month covered by the report with 
respect to reducing the total number of out-
dated operating systems, web application vul-
nerabilities, critical security vulnerabilities, and 
other matters covered by sections 2 through 7. 
(F) An appendix containing detailed re-
ports of the Department, including the enter-
prise information technology dashboard and re-
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
ports regarding security vulnerabilities, oper-
ating system trends, and web applications. 
(b) ANNUAL INSPECTOR GENERAL REPORT.—The 
Inspector General of the Department of Veterans Affairs 
shall submit to the congressional veterans committees an 
annual report that includes a comprehensive assessment 
of the adequacy and effectiveness of the implementation 
by the Secretary of Veterans Affairs of sections 2 through 
7, including the amendments made by this Act. 
(c) MONTHLY REPORTS.—On a monthly basis, the 
Secretary shall submit to the congressional veterans com-
mittees reports on security vulnerabilities discovered pur-
suant to the actions taken under section 4(b)(5). 
SEC. 10. APPLICATION. 
In carrying out this Act, including the amendments 
made by this Act, the Secretary of Veterans Affairs may 
substitute a new technology or process relating to informa-
tion security for a specific technology or process relating 
to information security described in this Act, including the 
amendments made by this Act, if the Secretary determines 
that such new technology or process— 
(1) is a successor to the specific technology or 
process described in this Act, including the amend-
ments made by this Act; and 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(2) provides a greater amount of information 
security than would be provided if the Secretary did 
not make such substitution. 
SEC. 11. DEFINITIONS. 
In this Act: 
(1) The term ‘‘Authority to Operate’’ means the 
official management decision given by a senior offi-
cial of the Department to authorize operation of an 
information system and to explicitly accept the risk 
to the operations of the Department (including with 
respect to the mission, functions, image, or reputa-
tion of the Department), the assets and individuals 
of the Department, other elements of the Federal 
Government, and the United States based on the im-
plementation of an agreed-upon set of security con-
trols. 
(2) The term ‘‘confidentiality’’ has the meaning 
given that term in section 5727 of title 38, United 
States Code. 
(3) The term ‘‘congressional veterans commit-
tees’’ means the Committees on Veterans’ Affairs of 
the House of Representatives and the Senate. 
(4) The term ‘‘critical network infrastructure’’ 
means information technology hardware that pro-
vides— 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(A) vital network services to the Depart-
ment that is vital to carrying out the mission 
of the Department; and 
(B) communications, security, transpor-
tation, access, and authentication services and 
capabilities. 
(5) The term ‘‘domain controller’’ means a 
server that responds to security authentication re-
quests responsible for allowing host access to domain 
resources by authenticating users, sorting user ac-
count information, and enforcing security policy. 
(6) The term ‘‘general purpose computer’’ 
means a computer that, given the appropriate appli-
cation and required time, should be able to perform 
most common computing tasks. Such term includes 
personal computers, including desktops, notebooks, 
smart phones, and tablets. 
(7) The term ‘‘image’’ means a standard set of 
software (including the operating system and other 
software) that is installed on a computer. 
(8) The term ‘‘information security’’ has the 
meaning given that term in section 5727 of title 38, 
United States Code. 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(9) The term ‘‘information system’’ has the 
meaning given that term in section 5727 of title 38, 
United States Code. 
(10) The term ‘‘sensitive personal information’’ 
has the meaning given that term in section 5727 of 
title 38, United States Code. 
(11) The term ‘‘VistA system’’ means the Vet-
erans Health Information Systems and Technology 
Architecture of the Department of Veterans Affairs 
that allows for an integrated inpatient and out-
patient electronic health record for patients and pro-
vides administrative tools to employees of the De-
partment. 
(12) The term ‘‘web application’’ means an ap-
plication in which all or some parts of the software 
are downloaded from the Internet each time the soft-
ware is accessed, including web browser-based soft-
ware that run within a web browser, desktop soft-
ware that does not use a web browser, and mobile 
software that accesses the Internet for additional in-
formation. 
(13) The term ‘‘well-hashed’’ means the process 
of using a mathematical algorithm against data to 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
produce a numeric value that is representative of 
that data. 
Æ 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6301
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS