IIB 
109TH CONGRESS 
2D SESSION 
H. R. 5835 
IN THE SENATE OF THE UNITED STATES 
SEPTEMBER 27, 2006 
Received 
NOVEMBER 13, 2006 
Read twice and referred to the Committee on Veterans’ Affairs 
AN ACT 
To amend title 38, United States Code, to improve informa-
tion management within the Department of Veterans 
Affairs, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Veterans Identity and 
Credit Security Act of 2006’’. 
SEC. 2. FEDERAL AGENCY DATA BREACH NOTIFICATION 
REQUIREMENTS. 
(a) AUTHORITY OF DIRECTOR OF OFFICE OF MAN-
AGEMENT AND BUDGET TO ESTABLISH DATA BREACH 
POLICIES.—Section 3543(a) of title 44, United States 
Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following: 
‘‘(9) establishing policies, procedures, and 
standards for agencies to follow in the event of a 
breach of data security involving the disclosure of 
sensitive personal information and for which harm to 
an individual could reasonably be expected to result, 
specifically including— 
‘‘(A) a requirement for timely notice to be 
provided to those individuals whose sensitive 
personal information could be compromised as a 
result of such breach, except no notice shall be 
required if the breach does not create a reason-
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
able risk of identity theft, fraud, or other un-
lawful conduct regarding such individual; 
‘‘(B) guidance on determining how timely 
notice is to be provided; and 
‘‘(C) guidance regarding whether addi-
tional special actions are necessary and appro-
priate, including data breach analysis, fraud 
resolution services, identity theft insurance, and 
credit protection or monitoring services.’’. 
(b) AUTHORITY OF CHIEF INFORMATION OFFICER 
TO ENFORCE DATA BREACH POLICIES AND DEVELOP 
AND MAINTAIN INVENTORIES.—Section 3544(a)(3) of 
title 44, United States Code, is amended— 
(1) by inserting after ‘‘authority to ensure com-
pliance with’’ the following: ‘‘and, to the extent de-
termined necessary and explicitly authorized by the 
head of the agency, to enforce’’; 
(2) by striking ‘‘and’’ at the end of subpara-
graph (D); 
(3) by inserting ‘‘and’’ at the end of subpara-
graph (E); and 
(4) by adding at the end the following: 
‘‘(F) developing and maintaining an inven-
tory of all personal computers, laptops, or any 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
other hardware containing sensitive personal in-
formation;’’. 
(c) INCLUSION OF DATA BREACH NOTIFICATION IN 
AGENCY INFORMATION SECURITY PROGRAMS.—Section 
3544(b) of title 44, United States Code, is amended— 
(1) by striking ‘‘and’’ at the end of paragraph 
(7); 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (8); and 
(3) by adding at the end the following: 
‘‘(9) procedures for notifying individuals whose 
sensitive personal information is compromised con-
sistent with policies, procedures, and standards es-
tablished under section 3543(a)(9) of this title.’’. 
(d) AUTHORITY OF AGENCY CHIEF HUMAN CAPITAL 
OFFICERS TO ASSESS FEDERAL PERSONAL PROPERTY.— 
Section 1402(a) of title 5, United States Code, is amend-
ed— 
(1) by striking ‘‘, and’’ at the end of paragraph 
(5) and inserting a semicolon; 
(2) by striking the period and inserting ‘‘; and’’ 
at the end of paragraph (6); and 
(3) by adding at the end the following: 
‘‘(7) prescribing policies and procedures for exit 
interviews of employees, including a full accounting 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
of all Federal personal property that was assigned to 
the employee during the course of employment.’’. 
(e) SENSITIVE PERSONAL INFORMATION DEFINI-
TION.—Section 3542(b) of title 44, United States Code, 
is amended by adding at the end the following new para-
graph: 
‘‘(4) The term ‘sensitive personal information’, 
with respect to an individual, means any information 
about the individual maintained by an agency, in-
cluding— 
‘‘(A) education, financial transactions, 
medical history, and criminal or employment 
history; 
‘‘(B) information that can be used to dis-
tinguish or trace the individual’s identity, in-
cluding name, social security number, date and 
place of birth, mother’s maiden name, or bio-
metric records; or 
‘‘(C) any other personal information that 
is linked or linkable to the individual.’’. 
SEC. 3. UNDER SECRETARY FOR INFORMATION SERVICES. 
(a) UNDER SECRETARY.—Chapter 3 of title 38, 
United States Code, is amended by inserting after section 
307 the following new section: 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘§ 307A. Under Secretary for Information Services 
‘‘(a) UNDER SECRETARY.—There is in the Depart-
ment an Under Secretary for Information Services, who 
is appointed by the President, by and with the advice and 
consent of the Senate. The Under Secretary shall be the 
head of the Office of Information Services and shall per-
form such functions as the Secretary shall prescribe. 
‘‘(b) SERVICE AS CHIEF INFORMATION OFFICER.— 
Notwithstanding any other provision of law, the Under 
Secretary for Information Services shall serve as the Chief 
Information Officer of the Department under section 310 
of this title.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by inserting 
after the item relating to section 307 the following new 
item: 
‘‘307A. Under Secretary for Information Services.’’. 
(c) CONFORMING AMENDMENT.—Section 308(b) of 
such title is amended by striking paragraph (5) and redes-
ignating paragraphs (6) through (11) as paragraphs (5) 
through (10), respectively. 
SEC. 4. DEPARTMENT OF VETERANS AFFAIRS INFORMA-
TION SECURITY. 
(a) INFORMATION SECURITY.—Chapter 57 of title 
38, United States Code, is amended by adding at the end 
the following new subchapter: 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘SUBCHAPTER III—INFORMATION SECURITY 
‘‘§ 5721. Definitions 
‘‘For the purposes of this subchapter: 
‘‘(1) The term ‘sensitive personal information’, 
with respect to an individual, means any information 
about the individual maintained by an agency, in-
cluding— 
‘‘(A) education, financial transactions, 
medical history, and criminal or employment 
history; 
‘‘(B) information that can be used to dis-
tinguish or trace the individual’s identity, in-
cluding name, social security number, date and 
place of birth, mother’s maiden name, or bio-
metric records; or 
‘‘(C) any other personal information that 
is linked or linkable to the individual. 
‘‘(2) The term ‘data breach’ means the loss, 
theft, or other unauthorized access to data con-
taining sensitive personal information, in electronic 
or printed form, that results in the potential com-
promise of the confidentiality or integrity of the 
data. 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(3) The term ‘data breach analysis’ means the 
identification of any misuse of sensitive personal in-
formation involved in a data breach. 
‘‘(4) The term ‘fraud resolution services’ means 
services to assist an individual in the process of re-
covering and rehabilitating the credit of the indi-
vidual after the individual experiences identity theft. 
‘‘(5) The term ‘identity theft’ has the meaning 
given such term under section 603 of the Fair Cred-
it Reporting Act (15 U.S.C. 1681a). 
‘‘(6) The term ‘identity theft insurance’ means 
any insurance policy that pays benefits for costs, in-
cluding travel costs, notary fees, and postage costs, 
lost wages, and legal fees and expenses associated 
with the identity theft of the insured individual. 
‘‘(7) The term ‘principal credit reporting agen-
cy’ means a consumer reporting agency as described 
in section 603(p) of the Fair Credit Reporting Act 
(15 U.S.C. 1681a(p)). 
‘‘§ 5722. Office of the Under Secretary for Information 
Services 
‘‘(a) DEPUTY UNDER SECRETARIES.—The Office of 
the Under Secretary for Information Services shall consist 
of the following: 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(1) The Deputy Under Secretary for Informa-
tion Services for Security, who shall serve as the 
Senior Information Security Officer of the Depart-
ment. 
‘‘(2) The Deputy Under Secretary for Informa-
tion Services for Operations and Management. 
‘‘(3) The Deputy Under Secretary for Informa-
tion Services for Policy and Planning. 
‘‘(b) APPOINTMENTS.—Appointments under sub-
section (a) shall be made by the Secretary, notwith-
standing the limitations of section 709 of this title. 
‘‘(c) QUALIFICATIONS.—At least one of positions es-
tablished and filled under subsection (a) shall be filled by 
an individual who has at least five years of continuous 
service in the Federal civil service in the executive branch 
immediately preceding the appointment of the individual 
as a Deputy Under Secretary. For purposes of deter-
mining such continuous service of an individual, there 
shall be excluded any service by such individual in a posi-
tion— 
‘‘(1) of a confidential, policy-determining, pol-
icy-making, or policy-advocating character; 
‘‘(2) in which such individual served as a non-
career appointee in the Senior Executive Service, as 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
such term is defined in section 3132(a)(7) of title 5; 
or 
‘‘(3) to which such individual was appointed by 
the President. 
‘‘§ 5723. Information security management 
‘‘(a) RESPONSIBILITIES OF CHIEF INFORMATION OF-
FICER.—To support the economical, efficient, and effec-
tive execution of subtitle III of chapter 35 of title 44, and 
policies and plans of the Department, the Secretary shall 
ensure that the Chief Information Officer of the Depart-
ment has the authority and control necessary to develop, 
approve, implement, integrate, and oversee the policies, 
procedures, processes, activities, and systems of the De-
partment relating to that subtitle, including the manage-
ment of all related mission applications, information re-
sources, personnel, and infrastructure. 
‘‘(b) ANNUAL COMPLIANCE REPORT.—Not later than 
March 1 of each year, the Secretary shall submit to the 
Committees on Veterans’ Affairs of the Senate and House 
of Representatives, the Committee on Government Reform 
of the House of Representatives, and the Committee on 
Homeland Security and Governmental Affairs of the Sen-
ate, a report on the Department’s compliance with subtitle 
III of chapter 35 of title 44. The information in such re-
port shall be displayed in the aggregate and separately for 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
each Administration, office, and facility of the Depart-
ment. 
‘‘(c) REPORTS TO SECRETARY OF COMPLIANCE DE-
FICIENCIES.—(1) At least once every month, the Chief In-
formation Officer shall report to the Secretary any defi-
ciency in the compliance with subtitle III of chapter 35 
of title 44 of the Department or any Administration, of-
fice, or facility of the Department. 
‘‘(2) The Chief Information Officer shall immediately 
report to the Secretary any significant deficiency in such 
compliance. 
‘‘(d) DATA BREACHES.—(1) The Chief Information 
Officer shall immediately provide notice to the Secretary 
of any data breach. 
‘‘(2) Immediately after receiving notice of a data 
breach under paragraph (1), the Secretary shall provide 
notice of such breach to the Director of the Office of Man-
agement and Budget, the Inspector General of the Depart-
ment, and, if appropriate, the Federal Trade Commission 
and the United States Secret Service. 
‘‘(e) BUDGETARY MATTERS.—When the budget for 
any fiscal year is submitted by the President to Congress 
under section 1105 of title 31, the Secretary shall submit 
to Congress a report that identifies amounts requested for 
Department implementation and remediation of and com-
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
pliance with this subchapter and subtitle III of chapter 
35 of title 44. The report shall set forth those amounts 
both for each Administration within the Department and 
for the Department in the aggregate and shall identify, 
for each such amount, how that amount is aligned with 
and supports such implementation and compliance. 
‘‘§ 5724. Congressional reporting and notification of 
data breaches 
‘‘(a) QUARTERLY REPORTS.—(1) Not later than 30 
days after the last day of a fiscal quarter, the Secretary 
shall submit to the Committees on Veterans’ Affairs of 
the Senate and House of Representatives a report on any 
data breach with respect to sensitive personal information 
processed or maintained by the Department that occurred 
during that quarter. 
‘‘(2) Each report submitted under paragraph (1) 
shall identify, for each data breach covered by the report, 
the Administration and facility of the Department respon-
sible for processing or maintaining the sensitive personal 
information involved in the data breach. 
‘‘(b) 
NOTIFICATION
OF
SIGNIFICANT
DATA 
BREACHES.—(1) In the event of a data breach with re-
spect to sensitive personal information processed or main-
tained by the Secretary that the Secretary determines is 
significant, the Secretary shall provide notice of such 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
breach to the Committees on Veterans’ Affairs of the Sen-
ate and House of Representatives. 
‘‘(2) Notice under paragraph (1) shall be provided 
promptly following the discovery of such a data breach and 
the implementation of any measures necessary to deter-
mine the scope of the breach, prevent any further breach 
or unauthorized disclosures, and reasonably restore the in-
tegrity of the data system. 
‘‘§ 5725. Data breaches 
‘‘(a) INDEPENDENT RISK ANALYSIS.—(1) In the 
event of a data breach with respect to sensitive personal 
information that is processed or maintained by the Sec-
retary, the Secretary shall ensure that, as soon as possible 
after the data breach, a non-Department entity conducts 
an independent risk analysis of the data breach to deter-
mine the level of risk associated with the data breach for 
the potential misuse of any sensitive personal information 
involved in the data breach. 
‘‘(2) If the Secretary determines, based on the find-
ings of a risk analysis conducted under paragraph (1), 
that a reasonable risk exists for the potential misuse of 
sensitive information involved in a data breach, the Sec-
retary shall provide credit protection services in accord-
ance with section 5726 of this title. 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(b) NOTIFICATION.—(1) In the event of a data 
breach with respect to sensitive personal information that 
is processed or maintained by the Secretary, the Secretary 
shall provide to an individual whose sensitive personal in-
formation is involved in that breach notice of the data 
breach— 
‘‘(A) in writing; or 
‘‘(B) by email, if— 
‘‘(i) the Department’s primary method of 
communication with the individual is by email; 
and 
‘‘(ii) the individual has consented to receive 
such notification. 
‘‘(2) Notice provided under paragraph (1) shall— 
‘‘(A) describe the circumstances of the data 
breach and the risk that the breach could lead to 
misuse, including identity theft, involving the sen-
sitive personal information of the individual; 
‘‘(B) describe the specific types of sensitive per-
sonal information that was compromised as a part of 
the data breach; 
‘‘(C) describe the actions the Department is 
taking to remedy the data breach; 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(D) inform the individual that the individual 
may request a fraud alert and credit security freeze 
under this section; 
‘‘(E) clearly explain the advantages and dis-
advantages to the individual of receiving fraud alerts 
and credit security freezes under this section; and 
‘‘(F) includes such other information as the 
Secretary determines is appropriate. 
‘‘(3) The notice required under paragraph (1) shall 
be provided promptly following the discovery of a data 
breach and the implementation of any measures necessary 
to determine the scope of the breach, prevent any further 
breach or unauthorized disclosures, and reasonably restore 
the integrity of the data system. 
‘‘(c) REPORT.—For each data breach with respect to 
sensitive personal information processed or maintained by 
the Secretary, the Secretary shall promptly submit to the 
Committees on Veterans’ Affairs of the Senate and House 
of Representatives a report containing the findings of any 
independent risk analysis conducted under subsection 
(a)(1), any determination of the Secretary under sub-
section (a)(2), and a description of any credit protection 
services provided under section 5726 of this title. 
‘‘(d) FINAL DETERMINATION.—Notwithstanding sec-
tions 511 and 7104(a) of this title, any determination of 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
the Secretary under subsection (a)(2) with respect to the 
reasonable risk for the potential misuse of sensitive infor-
mation involved in a data breach is final and conclusive 
and may not be reviewed by any other official, administra-
tive body, or court, whether by an action in the nature 
of mandamus or otherwise. 
‘‘(e) FRAUD ALERTS.—(1) In the event of a data 
breach with respect to sensitive personal information that 
is processed or maintained by the Secretary, the Secretary 
shall arrange, upon the request of an individual whose sen-
sitive personal information is involved in the breach to a 
principal credit reporting agency with which the Secretary 
has entered into a contract under section 5726(d) and at 
no cost to the individual, for the principal credit reporting 
agency to provide fraud alert services for that individual 
for a period of not less than one year, beginning on the 
date of such request, unless the individual requests that 
such fraud alert be removed before the end of such period, 
and the agency receives appropriate proof of the identity 
of the individual for such purpose. 
‘‘(2) The Secretary shall arrange for each principal 
credit reporting agency referred to in paragraph (1) to 
provide any alert requested under such subsection in the 
file of the individual along with any credit score generated 
in using that file, for a period of not less than one year, 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
beginning on the date of such request, unless the indi-
vidual requests that such fraud alert be removed before 
the end of such period, and the agency receives appro-
priate proof of the identity of the individual for such pur-
pose. 
‘‘(f) CREDIT SECURITY FREEZE.— (1) In the event 
of a data breach with respect to sensitive personal infor-
mation that is processed or maintained by the Secretary, 
the Secretary shall arrange, upon the request of an indi-
vidual whose sensitive personal information is involved in 
the breach and at no cost to the individual, for each prin-
cipal credit reporting agency to apply a security freeze to 
the file of that individual for a period of not less than 
one year, beginning on the date of such request, unless 
the individual requests that such security freeze be re-
moved before the end of such period, and the agency re-
ceives appropriate proof of the identity of the individual 
for such purpose. 
‘‘(2) The Secretary shall arrange for a principal cred-
it reporting agency applying a security freeze under para-
graph (1)— 
‘‘(A) to send a written confirmation of the security 
freeze to the individual within five business days of apply-
ing the freeze; 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(B) to refer the information regarding the security 
freeze to other consumer reporting agencies; 
‘‘(C) to provide the individual with a unique personal 
identification number or password to be used by the indi-
vidual when providing authorization for the release of the 
individual’s credit for a specific party or period of time; 
and 
‘‘(D) upon the request of the individual, to tempo-
rarily lift the freeze for a period of time specified by the 
individual, beginning not later than three business days 
after the date on which the agency receives the request. 
‘‘§ 5726. Provision of credit protection services 
‘‘(a) COVERED INDIVIDUAL.—For purposes of this 
section, a covered individual is an individual whose sen-
sitive personal information that is processed or maintained 
by the Department (or any third-party entity acting on 
behalf of the Department) is involved, on or after August 
1, 2005, in a data breach for which the Secretary deter-
mines a reasonable risk exists for the potential misuse of 
sensitive personal information under section 5725(a)(2) of 
this title. 
‘‘(b) NOTIFICATION.—(1) In addition to any notice 
required under subsection 5725(b) of this title, the Sec-
retary shall provide to a covered individual notice in writ-
ing that— 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(A) the individual may request credit protec-
tion services under this section; 
‘‘(B) clearly explains the advantages and dis-
advantages to the individual of receiving credit pro-
tection services under this section; 
‘‘(E) includes a notice of which principal credit 
reporting agency the Secretary has entered into a 
contract with under subsection (d), and information 
about requesting services through that agency; 
‘‘(C) describes actions the individual can or 
should take to reduce the risk of identity theft; and 
‘‘(D) includes such other information as the 
Secretary determines is appropriate. 
‘‘(2) The notice required under paragraph (1) shall 
be made as promptly as possible and without unreasonable 
delay following the discovery of a data breach for which 
the Secretary determines a reasonable risk exists for the 
potential misuse of sensitive personal information under 
section 5725(a)(2) of this title and the implementation of 
any measures necessary to determine the scope of the 
breach, prevent any further breach or unauthorized disclo-
sures, and reasonably restore the integrity of the data sys-
tem. 
‘‘(3) The Secretary shall ensure that each notification 
under paragraph (1) includes a form or other means for 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
readily requesting the credit protection services under this 
section. Such form or other means may include a tele-
phone number, email address, or Internet website address. 
‘‘(c) AVAILABILITY OF SERVICES THROUGH OTHER 
GOVERNMENT AGENCIES.—If a service required to be pro-
vided under this section is available to a covered individual 
through another department or agency of the Government, 
the Secretary and the head of that department or agency 
may enter into an agreement under which the head of that 
department or agency agrees to provide that service to the 
covered individual. 
‘‘(d) CONTRACT WITH CREDIT REPORTING AGEN-
CY.—Subject to the availability of appropriations and not-
withstanding any other provision of law, the Secretary 
shall enter into contracts or other agreements as necessary 
with one or more principal credit reporting agencies in 
order to ensure, in advance, the provision of credit protec-
tion services under this section and fraud alerts and secu-
rity freezes under section 5725 of this title. Any such con-
tract or agreement may include provisions for the Sec-
retary to pay the expenses of such a credit reporting agen-
cy for the provision of such services. 
‘‘(e) DATA BREACH ANALYSIS.—The Secretary shall 
arrange, upon the request of a covered individual and at 
no cost to the individual, to provide data breach analysis 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
for the individual for a period of not less than one year, 
beginning on the date of such request. 
‘‘(f) PROVISION OF CREDIT MONITORING SERVICES 
AND IDENTITY THEFT INSURANCE.—During the one-year 
period beginning on the date on which the Secretary noti-
fies a covered individual that the individual’s sensitive per-
sonal information is involved in a data breach, the Sec-
retary shall arrange, upon the request of the individual 
and without charge to the individual, for the provision of 
credit monitoring services to the individual. Credit moni-
toring services under this subsection shall include each of 
the following: 
‘‘(1) One copy of the credit report of the indi-
vidual every three months. 
‘‘(2) Fraud resolution services for the indi-
vidual. 
‘‘(3) Identity theft insurance in a coverage 
amount that does not exceed $30,000 in aggregate 
liability for the insured. 
‘‘§ 5727. Contracts for data processing or mainte-
nance 
‘‘(a) CONTRACT REQUIREMENTS.—If the Secretary 
enters into a contract for the performance of any Depart-
ment function that requires access to sensitive personal 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
information, the Secretary shall require as a condition of 
the contract that— 
‘‘(1) the contractor shall not, directly or 
through an affiliate of the contractor, disclose such 
information to any other person unless the disclo-
sure is lawful and is expressly permitted under the 
contract; 
‘‘(2) the contractor, or any subcontractor for a 
subcontract of the contract, shall promptly notify the 
Secretary of any data breach that occurs with re-
spect to such information. 
‘‘(b) LIQUIDATED DAMAGES.—Each contract subject 
to the requirements of subsection (a) shall provide for liq-
uidated damages to be paid by the contractor to the Sec-
retary in the event of a data breach with respect to any 
sensitive personal information processed or maintained by 
the contractor or any subcontractor under that contract. 
‘‘(c) PROVISION
OF CREDIT PROTECTION SERV-
ICES.—Any amount collected by the Secretary under sub-
section (b) shall be deposited in or credited to the Depart-
ment account from which the contractor was paid and 
shall remain available for obligation without fiscal year 
limitation exclusively for the purpose of providing credit 
protection services in accordance with section 5726 of this 
title. 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘§ 5728. Authorization of appropriations 
‘‘There are authorized to be appropriated to carry out 
this subchapter such sums as may be necessary for each 
fiscal year.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by adding 
at the end the following new items: 
‘‘SUBCHAPTER III—INFORMATION SECURITY 
‘‘5721. Definitions. 
‘‘5722. Office of the Under Secretary for Information Services. 
‘‘5723. Information security management. 
‘‘5724. Congressional reporting and notification of data breaches. 
‘‘5725. Data breaches. 
‘‘5726. Provision of credit protection services. 
‘‘5727. Contracts for data processing or maintenance. 
‘‘5728. Authorization of appropriations.’’. 
(c) DEADLINE FOR REGULATIONS.—Not later than 
60 days after the date of the enactment of this Act, the 
Secretary of Veterans Affairs shall publish regulations to 
carry out subchapter III of chapter 57 of title 38, United 
States Code, as added by subsection (a). 
SEC. 5. REPORT ON FEASIBILITY OF USING PERSONAL 
IDENTIFICATION NUMBERS FOR IDENTIFICA-
TION. 
Not later than 180 days after the date of the enact-
ment of this Act, the Secretary of Veterans Affairs shall 
submit to Congress a report containing the assessment of 
the Secretary with respect to the feasibility of using per-
sonal identification numbers instead of Social Security 
numbers for the purpose of identifying individuals whose 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00023
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
sensitive personal information (as that term is defined in 
section 5721 of title 38, United States Code, as added by 
section 4) is processed or maintained by the Secretary. 
SEC. 6. DEADLINE FOR APPOINTMENTS. 
(a) DEADLINE.—Not later than 180 days after the 
date of the enactment of this Act— 
(1) the President shall nominate an individual 
to serve as the Under Secretary of Veterans Affairs 
for Information Services under section 307A of title 
38, United States Code, as added by section 3; and 
(2) the Secretary of Veterans Affairs shall ap-
point an individual to serve as each of the Deputy 
Under Secretaries of Veterans Affairs for Informa-
tion Services under section 5722 of such title, as 
added by section 4. 
(b) REPORT.—Not later than 30 days after the date 
of the enactment of this Act, and every 30 days thereafter 
until the appointments described in subsection (a) are 
made, the Secretary of Veterans Affairs shall submit to 
Congress a report describing the progress of such appoint-
ments. 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00024
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
SEC. 7. INFORMATION SECURITY EDUCATION ASSISTANCE 
PROGRAM. 
(a) PROGRAM REQUIRED.—Title 38, United States 
Code, is amended by inserting after chapter 78 the fol-
lowing new chapter: 
‘‘CHAPTER 79—INFORMATION SECURITY 
EDUCATION ASSISTANCE PROGRAM 
‘‘Sec. 
‘‘7901. Programs; purpose. 
‘‘7902. Scholarship program. 
‘‘7903. Education debt reduction program. 
‘‘7904. Preferences in awarding financial assistance. 
‘‘7905. Requirement of honorable discharge for veterans receiving assistance. 
‘‘7906. Regulations. 
‘‘7907. Termination. 
‘‘§ 7901. Programs; purpose 
‘‘(a) IN GENERAL.—To encourage the recruitment 
and retention of Department personnel who have the in-
formation security skills necessary to meet Department re-
quirements, the Secretary shall carry out programs in ac-
cordance with this chapter to provide financial support for 
education in computer science and electrical and computer 
engineering at accredited institutions of higher education. 
‘‘(b) TYPES OF PROGRAMS.—The programs author-
ized under this chapter are as follows: 
‘‘(1) Scholarships for pursuit of doctoral de-
grees in computer science and electrical and com-
puter engineering at accredited institutions of higher 
education. 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00025
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(2) Education debt reduction for Department 
personnel who hold doctoral degrees in computer 
science and electrical and computer engineering at 
accredited institutions of higher education. 
‘‘§ 7902. Scholarship program 
‘‘(a) AUTHORITY.—(1) Subject to the availability of 
appropriations, the Secretary shall establish a scholarship 
program under which the Secretary shall, subject to sub-
section (d), provide financial assistance in accordance with 
this section to a qualified person— 
‘‘(A) who is pursuing a doctoral degree in com-
puter science or electrical or computer engineering 
at an accredited institution of higher education; and 
‘‘(B) who enters into an agreement with the 
Secretary as described in subsection (b). 
‘‘(2)(A) Except as provided under subparagraph (B), 
the Secretary may provide financial assistance under this 
section to an individual for up to five years. 
‘‘(B) The Secretary may waive the limitation under 
subparagraph (A) if the Secretary determines that such 
a waiver is appropriate. 
‘‘(3)(A) The Secretary may award up to five scholar-
ships for any academic year to individuals who did not 
receive assistance under this section for the preceding aca-
demic year. 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00026
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(B) Not more than one scholarship awarded under 
subparagraph (A) may be awarded to an individual who 
is an employee of the Department when the scholarship 
is awarded. 
‘‘(b) SERVICE AGREEMENT FOR SCHOLARSHIP RE-
CIPIENTS.—(1) To receive financial assistance under this 
section an individual shall enter into an agreement to ac-
cept and continue employment in the Department for the 
period of obligated service determined under paragraph 
(2). 
‘‘(2) For the purposes of this subsection, the period 
of obligated service for a recipient of financial assistance 
under this section shall be the period determined by the 
Secretary as being appropriate to obtain adequate service 
in exchange for the financial assistance and otherwise to 
achieve the goals set forth in section 7901(a) of this title. 
In no event may the period of service required of a recipi-
ent be less than the period equal to two times the total 
period of pursuit of a degree for which the Secretary 
agrees to provide the recipient with financial assistance 
under this section. The period of obligated service is in 
addition to any other period for which the recipient is obli-
gated to serve on active duty or in the civil service, as 
the case may be. 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00027
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(3) An agreement entered into under this section by 
a person pursuing an doctoral degree shall include terms 
that provide the following: 
‘‘(A) That the period of obligated service begins 
on a date after the award of the degree that is de-
termined under the regulations prescribed under sec-
tion 7906 of this title. 
‘‘(B) That the individual will maintain satisfac-
tory academic progress, as determined in accordance 
with those regulations, and that failure to maintain 
such progress constitutes grounds for termination of 
the financial assistance for the individual under this 
section. 
‘‘(C) Any other terms and conditions that the 
Secretary determines appropriate for carrying out 
this section. 
‘‘(c) AMOUNT OF ASSISTANCE.—(1) The amount of 
the financial assistance provided for an individual under 
this section shall be the amount determined by the Sec-
retary as being necessary to pay— 
‘‘(A) the tuition and fees of the individual; and 
‘‘(B) $1500 to the individual each month (in-
cluding a month between academic semesters or 
terms leading to the degree for which such assist-
ance is provided or during which the individual is 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00028
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
not enrolled in a course of education but is pursuing 
independent research leading to such degree) for 
books, laboratory expenses, and expenses of room 
and board. 
‘‘(2) In no case may the amount of assistance pro-
vided for an individual under this section for an academic 
year exceed $50,000. 
‘‘(3) In no case may the total amount of assistance 
provided for an individual under this section exceed 
$200,000. 
‘‘(4) Notwithstanding any other provision of law, fi-
nancial assistance paid an individual under this section 
shall not be considered as income or resources in deter-
mining eligibility for, or the amount of benefits under, any 
Federal or federally assisted program. 
‘‘(d) REPAYMENT FOR PERIOD OF UNSERVED OBLI-
GATED SERVICE.—(1) An individual who receives financial 
assistance under this section shall repay to the Secretary 
an amount equal to the unearned portion of the financial 
assistance if the individual fails to satisfy the require-
ments of the service agreement entered into under sub-
section (b), except in certain circumstances authorized by 
the Secretary. 
‘‘(2) The Secretary may establish, by regulations, 
procedures for determining the amount of the repayment 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00029
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
required under this subsection and the circumstances 
under which an exception to the required repayment may 
be granted. 
‘‘(3) An obligation to repay the Secretary under this 
subsection is, for all purposes, a debt owed the United 
States. A discharge in bankruptcy under title 11 does not 
discharge a person from such debt if the discharge order 
is entered less than five years after the date of the termi-
nation of the agreement or contract on which the debt is 
based. 
‘‘(e) WAIVER OR SUSPENSION OF COMPLIANCE.— 
The Secretary shall prescribe regulations providing for the 
waiver or suspension of any obligation of a individual for 
service or payment under this section (or an agreement 
under this section) whenever noncompliance by the indi-
vidual is due to circumstances beyond the control of the 
individual or whenever the Secretary determines that the 
waiver or suspension of compliance is in the best interest 
of the United States. 
‘‘(f) INTERNSHIPS.—(1) The Secretary may offer a 
compensated internship to an individual for whom finan-
cial assistance is provided under this section during a pe-
riod between academic semesters or terms leading to the 
degree for which such assistance is provided. Compensa-
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00030
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
tion provided for such an internship shall be in addition 
to the financial assistance provided under this section. 
‘‘(2) An internship under this subsection shall not be 
counted toward satisfying a period of obligated service 
under this section. 
‘‘(g) INELIGIBILITY
OF INDIVIDUALS RECEIVING 
MONTGOMERY GI BILL EDUCATION ASSISTANCE PAY-
MENTS.—An individual who receives a payment of edu-
cational assistance under chapter 30, 31, 32, 34, or 35 
of this title or chapter 1606 or 1607 of title 10 for a 
month in which the individual is enrolled in a course of 
education leading to a doctoral degree in information secu-
rity is not eligible to receive financial assistance under this 
section for that month. 
‘‘§ 7903. Education debt reduction program 
‘‘(a) AUTHORITY.—(1) Subject to the availability of 
appropriations, the Secretary shall establish an education 
debt reduction program under which the Secretary shall 
make education debt reduction payments under this sec-
tion to qualified individuals eligible under subsection (b) 
for the purpose of reimbursing such individuals for pay-
ments by such individuals of principal and interest on 
loans described in paragraph (2) of that subsection. 
‘‘(2)(A) For each fiscal year, the Secretary may ac-
cept up to five individuals into the program established 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00031
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
under paragraph (1)who did not receive such a payment 
during the preceding fiscal year. 
‘‘(B) Not more than one individual accepted into the 
program for a fiscal year under subsection (A) shall be 
a Department employee as of the date on which the indi-
vidual is accepted into the program. 
‘‘(b) ELIGIBILITY.—An individual is eligible to par-
ticipate in the program under this section if the indi-
vidual— 
‘‘(1) has completed a doctoral degree a doctoral 
degree in computer science or electrical or computer 
engineering at an accredited institution of higher 
education during the five-year period preceding the 
date on which the individual is hired; 
‘‘(2) is an employee of the Department who 
serves in a position related to information security 
(as determined by the Secretary); and 
‘‘(3) owes any amount of principal or interest 
under a loan, the proceeds of which were used by or 
on behalf of that individual to pay costs relating to 
a doctoral degree in computer science or electrical or 
computer engineering at an accredited institution of 
higher education. 
‘‘(c) AMOUNT OF ASSISTANCE.—(1) Subject to para-
graph (2), the amount of education debt reduction pay-
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00032
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
ments made to an individual under this section may not 
exceed $82,500 over a total of five years, of which not 
more than $16,500 of such payments may be made in each 
year. 
‘‘(2) The total amount payable to an individual under 
this section for any year may not exceed the amount of 
the principal and interest on loans referred to in sub-
section (b)(3) that is paid by the individual during such 
year. 
‘‘(d) PAYMENTS.—(1) The Secretary shall make edu-
cation debt reduction payments under this section on an 
annual basis. 
‘‘(2) The Secretary shall make such a payment— 
‘‘(A) on the last day of the one-year period be-
ginning on the date on which the individual is ac-
cepted into the program established under sub-
section (a); or 
‘‘(B) in the case of an individual who received 
a payment under this section for the preceding fiscal 
year, on the last day of the one-year period begin-
ning on the date on which the individual last re-
ceived such a payment. 
‘‘(3) Notwithstanding any other provision of law, edu-
cation debt reduction payments under this section shall 
not be considered as income or resources in determining 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00033
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
eligibility for, or the amount of benefits under, any Fed-
eral or federally assisted program. 
‘‘(e) PERFORMANCE REQUIREMENT.—The Secretary 
may make education debt reduction payments to an indi-
vidual under this section for a year only if the Secretary 
determines that the individual maintained an acceptable 
level of performance in the position or positions served by 
the individual during the year. 
‘‘(f) NOTIFICATION
OF TERMS
OF PROVISION
OF 
PAYMENTS.—The Secretary shall provide to an individual 
who receives a payment under this section notice in writ-
ing of the terms and conditions that apply to such a pay-
ment. 
‘‘(g) COVERED COSTS.—For purposes of subsection 
(b)(3), costs relating to a course of education or training 
include— 
‘‘(1) tuition expenses; and 
‘‘(2) all other reasonable educational expenses, 
including fees, books, and laboratory expenses; 
‘‘§ 7904. Preferences in awarding financial assistance 
‘‘In awarding financial assistance under this chapter, 
the Secretary shall give a preference to qualified individ-
uals who are otherwise eligible to receive the financial as-
sistance in the following order of priority: 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00034
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
‘‘(1) Veterans with service-connected disabil-
ities. 
‘‘(2) Veterans. 
‘‘(3) Persons described in section 4215(a)(B) of 
this title. 
‘‘(4) Individuals who received or are pursuing 
degrees at institutions designated by the National 
Security Agency as Centers of Academic Excellence 
in Information Assurance Education. 
‘‘(5) Citizens of the United States. 
‘‘§ 7905. Requirement of honorable discharge for vet-
erans receiving assistance 
‘‘No veteran shall receive financial assistance under 
this chapter unless the veteran was discharged from the 
Armed Forces under honorable conditions. 
‘‘§ 7906. Regulations 
‘‘The Secretary shall prescribe regulations for the ad-
ministration of this chapter. 
‘‘§ 7907. Termination 
‘‘The authority of the Secretary to make a payment 
under this chapter shall terminate on July 31, 2017.’’. 
(b) GAO REPORT.—Not later than three years after 
the date of the enactment of this Act, the Comptroller 
General shall submit to Congress a report on the scholar-
ship and education debt reduction programs under chapter 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00035
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS
HR 5835 RFS
79 of title 38, United States Code, as added by subsection 
(a). 
(c) APPLICABILITY
OF
SCHOLARSHIPS.—Section 
7902 of title 38, United States Code, as added by sub-
section (a), shall apply with respect to financial assistance 
provided for an academic semester or term that begins on 
or after August 1, 2007. 
(d) CLERICAL AMENDMENT.—The tables of chapters 
at the beginning of such title, and at the beginning of part 
V of such title, are amended by inserting after the item 
relating to chapter 78 the following new item: 
‘‘79. Information Security Education Assistance Program ...................... 7901’’. 
Passed the House of Representatives September 26, 
2006. 
Attest: 
KAREN L. HAAS, 
Clerk. 
VerDate Aug 31 2005 
04:27 Nov 15, 2006
Jkt 059200
PO 00000
Frm 00036
Fmt 6652
Sfmt 6201
E:\BILLS\H5835.RFS
H5835
hmoore on PROD1PC60 with BILLS