(C) reverse engineering of attack methods, 
exploits, and malware; 
(D) understanding of common hacking 
techniques such as initial infiltration, expan-
sion, persistence, and exfiltration, as well as the 
forensic and analysis methods to detect each of 
these stages; and 
(E) planned and exercised methods for net-
work triage including isolation of individual sys-
tems or entire network segments, mass pass-
word resets, and deployment of emergency fire-
wall or network changes meant to limit Internet 
connectivity to only critical services. 
(2) If the Secretary determines that any critical 
network infrastructure device or service has been 
compromised, restore the device or service to the last 
known noncompromised state and determine the 
cause of the compromise. 
(3) If the Secretary determines that com-
promised devices or services must be used for a lim-
ited time, conduct such use in accordance with the 
guidance established by the National Security Agen-
cy under the document titled ‘‘Information Assur-
ance Guidance for Operating on a Compromised 
Network’’, or successor document. 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(e) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsections (b), (c), and (d). 
SEC. 4. SECURITY OF COMPUTERS AND SERVERS OF DE-
PARTMENT OF VETERANS AFFAIRS. 
(a) IN GENERAL.—The Secretary shall ensure the se-
curity of each general purpose computer and server of the 
Department. 
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following actions: 
(1) Formalize and enforce a Department-wide 
process to monitor software installed on general pur-
pose computers and servers of the Department, pre-
vent the unauthorized installation of software, and 
remove any unauthorized software that has been in-
stalled. 
(2) Not later than 45 days after the date of the 
enactment of this Act, implement automated patch-
ing tools and processes that ensure that security 
patches are installed for any software or operating 
system on a computer by not later than 48 hours 
after the patch is made available. 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(3) Employ automated tools to continuously 
monitor general purpose computers, servers, and 
mobile devices for active, up-to-date anti-malware 
protection with antivirus, antispyware, personal fire-
walls, and host-based intrusion prevention system 
functionality. 
(4) Centralize oversight and control to effec-
tively administer patch management processes (but 
the responsibility for testing and applying patches to 
specific systems may be decentralized to the compo-
nent level). 
(5) Perform regular scans of general purpose 
computers and servers to discover security vulnera-
bilities and log the results of such scans. 
(6) Perform a patch-focused risk assessment to 
evaluate each system, database, and general purpose 
computer for threats, vulnerabilities, and its criti-
cality to the mission of the Department. 
(7) If the Secretary determines any security 
vulnerability— 
(A) develop a test for the vulnerability and 
determine the cause of the vulnerability; 
(B) address the vulnerability, including by 
patching, implementing a compensating control, 
or documenting and accepting a reasonable 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
business risk (in accordance with industry ac-
cepted best practices) with respect to the vul-
nerability; and 
(C) perform a post remediation scan to 
verify that the vulnerability was so addressed. 
(8) Establish and ensure the use of standard, 
secure configurations of each operating system in 
use on the computers of the Department. 
(9) Employ system-scanning tools that check 
computers daily for software version, patch levels, 
and configuration files. 
(10) Deploy a security content automation pro-
tocol tool that is validated by the National Institute 
of Standards and Technology to use specific stand-
ards to enable automated vulnerability management, 
measurement, and policy compliance evaluation. 
(11) Standardize policies, procedures, and tools 
for effective patch management, including by assign-
ing roles and responsibilities, performing risk assess-
ments, and testing patches. 
(12) Test each patch against all system con-
figurations of the Department in a test environment 
to determine any effect on the network before de-
ploying the patch to the affected systems and mon-
itor the status of the patches after deployment. 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
(13) Establish and maintain an inventory of all 
hardware equipment, software packages, services, 
and other technologies installed and used by the De-
partment for patch management. 
(14) Establish a policy for security fixes that is 
clearly communicated to computer users to ensure 
that the users are aware of— 
(A) the versions of software or operating 
systems that are supported with respect to se-
curity fixes; and 
(B) when software, operating systems, or 
other products are scheduled to no longer be 
maintained. 
(15) Ensure that— 
(A) the staff or contractors of the Depart-
ment who are involved in patch management 
have the skills and knowledge needed to per-
form the responsibilities relating to such man-
agement; and 
(B) system administrators are trained in 
identifying new patches and vulnerabilities. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS