I 
114TH CONGRESS 
1ST SESSION H. R. 1017 
To improve the information security of the Department of Veterans Affairs 
by directing the Secretary of Veterans Affairs to carry out certain actions 
to improve the transparency and the governance of the information 
security program of the Department, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
FEBRUARY 20, 2015 
Mrs. WALORSKI introduced the following bill; which was referred to the 
Committee on Veterans’ Affairs 
A BILL 
To improve the information security of the Department of 
Veterans Affairs by directing the Secretary of Veterans 
Affairs to carry out certain actions to improve the trans-
parency and the governance of the information security 
program of the Department, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Veterans Information Security Improvement Act’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
Sec. 1. Short title; table of contents. 
Sec. 2. Governance of information security program of Department of Veterans 
Affairs. 
Sec. 3. Security of critical network infrastructure, including domain controller, 
of Department of Veterans Affairs. 
Sec. 4. Security of computers and servers of Department of Veterans Affairs. 
Sec. 5. Upgrade or phase-out of unsupported or outdated operating systems. 
Sec. 6. Security of web applications from vital vulnerabilities. 
Sec. 7. Security of the VistA system. 
Sec. 8. Report on compliance with information security requirements and best 
practices. 
Sec. 9. Reports on implementation. 
Sec. 10. Application. 
Sec. 11. Definitions. 
SEC. 2. GOVERNANCE OF INFORMATION SECURITY PRO-
GRAM OF DEPARTMENT OF VETERANS AF-
FAIRS. 
(a) REQUIREMENTS FOR CERTAIN OFFICIALS AND 
STAFF.— 
(1) IN GENERAL.—Subchapter III of chapter 
57 of title 38, United States Code, is amended by 
inserting after section 5723 the following new sec-
tion: 
‘‘§ 5723A. Governance of information security pro-
gram 
‘‘(a) IN GENERAL.—The Secretary shall improve the 
transparency and the coordination of the information se-
curity program of the Department in accordance with this 
section. 
‘‘(b) OFFICE OF INFORMATION AND TECHNOLOGY.— 
(1) The Secretary shall ensure that the Assistant Sec-
retary for Information and Technology, as the Chief Infor-
mation Officer of the Department, possesses— 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
‘‘(A) the appropriate education, validated expe-
rience, and capabilities in the management of infor-
mation technology organizations; 
‘‘(B) an industry recognized certification in in-
formation security and cyber security defense; and 
‘‘(C) demonstrated, sound technical and busi-
ness capabilities. 
‘‘(2) The Secretary shall ensure that the staff of the 
Office of Information and Technology who perform secu-
rity functions, including the assessment and analysis of 
risk, security auditing, security operations, and security 
engineering, are assigned to the Office of Information Se-
curity. 
‘‘(3) The Secretary shall ensure that subordinate of-
fices of the Office of Information and Technology, in co-
ordination with the head of the Office of Information Se-
curity, maintain appropriate information security func-
tions within each such office to— 
‘‘(A) incorporate secure software assurance 
processes into the software development lifecycle for 
all software development activities; 
‘‘(B) validate that each third-party developed 
software used in any information system of the De-
partment meets the standards of the National Insti-
tute of Standards and Technology with respect to 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
security, safety, reliability, functionality and extensi-
bility; 
‘‘(C) maintain established information security 
baseline controls for such information systems, and 
immediately remediate systems determined to be out 
of compliance with established baseline controls to 
the maximum extent possible; 
‘‘(D) ensure that the security architecture of 
the Department is documented and fully integrated 
into the overall enterprise architecture strategy of 
the Department; 
‘‘(E) deploy and maintain centralized security 
monitoring capabilities capable of detecting and 
alerting upon security events within the environ-
ment; 
‘‘(F) design and deploy an effective incident re-
sponse capability including retention of industry ex-
perts in forensics, threat intelligence, and malware 
analysis; 
‘‘(G) develop and implement a policy that re-
stricts the development of new data warehouses and 
data marts holding sensitive personal information of 
veterans and reduces the number of data marts 
holding such information; 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
‘‘(H) protect sensitive Department and veterans 
information to a defined data classification policy in 
accordance with governance and compliance require-
ments, leveraging digital signature (authenticity and 
integrity) and digital rights management (confiden-
tiality, authorization and audit) technology where 
appropriate; and 
‘‘(I) develop working relationships with other 
Federal departments whose IT security efforts inter-
sect in any way with the Department. 
‘‘(c) OFFICE OF INFORMATION SECURITY.—(1) The 
Secretary shall ensure that the head of the Office of Infor-
mation Security possesses— 
‘‘(A) the appropriate education and validated 
experience with respect to information security; 
‘‘(B) an industry recognized certification in 
cyber security defense; 
‘‘(C) demonstrated, sound technical and busi-
ness capabilities; and 
‘‘(D) other relevant experience. 
‘‘(2) The Secretary shall ensure that all of the field 
staff of the Office of Information Security, including rel-
evant staff of the Office of Information Technology, whose 
primary responsibility is the protection of personally iden-
tifiable information of veterans maintain current informa-
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS
tion security training and possess a certain level of infor-
mation security, cyber security defense, and technical ca-
pabilities and certifications as appropriate.’’. 
(2) CLERICAL AMENDMENT.—The table of sec-
tions at the beginning of such chapter is amended 
by inserting after the item relating to section 5723 
the following new item: 
‘‘5723A. Governance of information security program.’’. 
(b) DEFINITIONS.—Section 5721 of title 38, United 
States Code, is amended by adding at the end the fol-
lowing new paragraphs: 
‘‘(24) DATA
MART.—The term ‘data mart’ 
means a subset of a data warehouse that contains 
information for a specific department or entity of an 
organization rather than the entire organization. 
‘‘(25) DATA
WAREHOUSE.—The term ‘data 
warehouse’ means a collection of data designed to 
support management decisionmaking that contains a 
wide variety of data that present a coherent picture 
of business conditions for an entire organization at 
a single point in time and whose development in-
cludes the development of systems to extract data 
from operating systems plus installation of a ware-
house database system that provides managers flexi-
ble access to the data.’’. 
VerDate Sep 11 2014 
20:18 Mar 06, 2015
Jkt 049200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H1017.IH
H1017
asabaliauskas on DSK5VPTVN1PROD with BILLS