I 
113TH CONGRESS 
2D SESSION 
H. R. 4356 
To amend title 38, United States Code, to make certain improvements in 
the information security of the Department of Veterans Affairs, and 
for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 1, 2014 
Mrs. KIRKPATRICK (for herself and Mr. MICHAUD) introduced the following 
bill; which was referred to the Committee on Veterans’ Affairs 
A BILL 
To amend title 38, United States Code, to make certain 
improvements in the information security of the Depart-
ment of Veterans Affairs, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Department of Vet-
erans Affairs Information Security Protection Act’’. 
SEC. 2. DEPARTMENT OF VETERANS AFFAIRS INFORMA-
TION SECURITY IMPROVEMENTS. 
(a) SUBMITTAL OF QUARTERLY INFORMATION SECU-
RITY REPORT TO CONGRESS.—Paragraph (14) of sub-
VerDate Mar 15 2010 
00:22 Apr 03, 2014
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4356.IH
H4356
tjames on DSK6SPTVN1PROD with BILLS
section (b) of section 5723 of title 38, United States Code, 
is amended by inserting ‘‘and to the Committees on Vet-
erans’ Affairs of the Senate and House of Representa-
tives’’ after ‘‘to the Secretary’’. 
(b) PLAN FOR ADDRESSING KNOWN INFORMATION 
SECURITY VULNERABILITIES.—Such subsection is further 
amended by adding at the end the following new para-
graph: 
‘‘(17) Submitting to the Chairs and Ranking 
Members of the Committees on Veterans’ Affairs of 
the Senate and House of Representatives, by not 
later than 30 days after the date of the enactment 
of this paragraph, and quarterly thereafter, a plan 
of action to address critical known information secu-
rity vulnerabilities that includes— 
‘‘(A) specific milestones regarding time-
lines to address such vulnerabilities; 
‘‘(B) a summary of any reports provided to 
the Assistant Secretary for Information and 
Technology pursuant to subsection (e)(3) dur-
ing the period covered by the report; 
‘‘(C) a discussion of any risk assessment 
analysis undertaken by the Department that led 
to the inclusion of any such vulnerability; and 
VerDate Mar 15 2010 
03:37 Apr 04, 2014
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4356.IH
H4356
tjames on DSK6SPTVN1PROD with BILLS
‘‘(D) a summary of such plan of action 
that could be made publicly available.’’. 
(c) PLAN FOR REPLACING OUTDATED OPERATING 
SYSTEMS.—Such subsection is further amended by adding 
at the end the following new paragraph: 
‘‘(18) Submitting to the Committees on Vet-
erans’ Affairs of the Senate and House of Rep-
resentatives, by not later than January 1 of each 
year, a plan for identifying and replacing operating 
systems of the Department that are out-of-date or 
unsupported and that includes— 
‘‘(A) requirements that such an operating 
system be removed from the network of the De-
partment no later than 15 days after the date 
on which the operating system was identified as 
being out-of-date or unsupported; and 
‘‘(B) information concerning the number of 
systems so identified during the year preceding 
the year in which the report is submitted, when 
each such system was so identified, and when 
each system so identified was removed from the 
network of the Department.’’. 
(d) SOFTWARE SECURITY.—Such subsection is fur-
ther amended by adding at the end the following new para-
graph: 
VerDate Mar 15 2010 
00:22 Apr 03, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4356.IH
H4356
tjames on DSK6SPTVN1PROD with BILLS
‘‘(19) Ensuring that any software or Internet 
applications used on systems by the Department are 
secure from vulnerabilities that could affect the con-
fidentiality of sensitive personal information of vet-
erans.’’. 
SEC. 3. INFORMATION TECHNOLOGY REPORTING REQUIRE-
MENTS. 
(a) IN GENERAL.—Chapter 57 of title 38, United 
States Code, is amended— 
(1) by redesignating sections 5727 and 5728 as 
sections 5729 and 5730, respectively; and 
(2) by inserting after section 5726 the following 
new sections: 
‘‘§ 5727. Reporting requirements 
‘‘Not later than 30 days after the last day of each 
fiscal quarter, the Secretary shall submit to the Commit-
tees on Veterans’ Affairs of the Senate and House of Rep-
resentatives a report that includes the following informa-
tion for that fiscal quarter: 
‘‘(1) A detailed description of any incidents of 
failure to comply with established information secu-
rity policies that occurred during that quarter. 
‘‘(2) Any actions taken in response to such an 
incident. 
VerDate Mar 15 2010 
00:22 Apr 03, 2014
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4356.IH
H4356
tjames on DSK6SPTVN1PROD with BILLS
‘‘(3) Any reports made under paragraphs (8) 
through (10) of subsection (b) of section 5723 of 
this title during that quarter. 
‘‘(4) Written certification that the requirements 
of section 5722(c) of this title were followed during 
that quarter. 
‘‘(5) A detailed discussion of whether each rec-
ommendation made by the National Institute of 
Standards and Technology, the Office of Manage-
ment and Budget, or the Department of Homeland 
Security relating to information security have been 
implemented by the Department, and if not, an ex-
planation of why such recommendation was not im-
plemented. 
‘‘(6) Steps taken to ensure the security of the 
Veterans Health Information Systems and Tech-
nology Architecture of the Department that allows 
for an integrated inpatient and outpatient electronic 
health record for patients and provides administra-
tive tools to employees of the Department taken dur-
ing that quarter. 
‘‘§ 5728. Information security strategic plan 
‘‘(a) PLAN REQUIRED.—Not later than one year 
after the date of the enactment of this section, the Sec-
retary, in consultation with the Secretary of Homeland Se-
VerDate Mar 15 2010 
00:22 Apr 03, 2014
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4356.IH
H4356
tjames on DSK6SPTVN1PROD with BILLS
curity, the Director of the Office of Management and 
Budget, the Secretary of Defense, the Director of the Na-
tional Institute of Standards and Technology, the heads 
of other appropriate Federal agencies, veterans groups, 
and appropriate industry specialists, shall submit to the 
Committees on Veterans’ Affairs of the Senate and House 
of Representatives a strategic plan for improving the in-
formation security of the Department. Such plan shall ad-
dress— 
‘‘(1) methods of protecting the sensitive per-
sonal information of veterans while not unduly inter-
fering with the ability of the Department to provide 
benefits and services to veterans and their depend-
ents; 
‘‘(2) how the Department can improve its com-
pliance with information security requirements; 
‘‘(3) training and recruitment of employees with 
the necessary expertise and abilities in information 
security; and 
‘‘(4) the institutional capability of the Depart-
ment to address information security threats and to 
implement best practices related to information se-
curity. 
‘‘(b) BIANNUAL UPDATES.—The Secretary shall sub-
mit to the Committees on Veterans’ Affairs of the Senate 
VerDate Mar 15 2010 
00:22 Apr 03, 2014
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4356.IH
H4356
tjames on DSK6SPTVN1PROD with BILLS
and House of Representatives biannual updates to the 
plan required by subsection (a).’’. 
(b) CLERICAL AMENDMENTS.—The table of sections 
at the beginning of such chapter is amended by striking 
the items relating to sections 5727 and 5728 and inserting 
the following new items: 
‘‘5727. Reporting requirements. 
‘‘5728. Information security strategic plan. 
‘‘5729. Definitions. 
‘‘5730. Authorization of appropriations.’’. 
SEC. 4. REQUIREMENTS FOR DEPARTMENT OF VETERANS 
AFFAIRS CONTRACTS FOR DATA PROCESSING 
OR MAINTENANCE. 
(a) IN GENERAL.—Section 5725(a) of title 38, 
United States Code, is amended— 
(1) in paragraph (2), by striking the period and 
inserting ‘‘; and’’; and 
(2) by adding at the end the following new 
paragraph: 
‘‘(3) the contractor shall provide protective 
measures to safeguard from possible information se-
curity threats any information provided by the De-
partment that will be resident on or transiting 
through information systems controlled by the con-
tractor.’’. 
(b) APPLICABILITY.—Paragraph (3) of section 
5725(a) of title 38, United States Code, shall apply with 
VerDate Mar 15 2010 
00:22 Apr 03, 2014
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4356.IH
H4356
tjames on DSK6SPTVN1PROD with BILLS
respect to a contract entered into after the date of the 
enactment of this Act. 
Æ 
VerDate Mar 15 2010 
00:22 Apr 03, 2014
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6301
E:\BILLS\H4356.IH
H4356
tjames on DSK6SPTVN1PROD with BILLS