I 
113TH CONGRESS 
2D SESSION 
H. R. 4370 
To improve the information security of the Department of Veterans Affairs 
by directing the Secretary of Veterans Affairs to carry out certain actions 
to improve the transparency and the governance of the information 
security program of the Department, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
APRIL 2, 2014 
Mrs. WALORSKI (for herself, Mr. COFFMAN, Mr. WENSTRUP, and Mr. 
NUGENT) introduced the following bill; which was referred to the Com-
mittee on Veterans’ Affairs 
A BILL 
To improve the information security of the Department of 
Veterans Affairs by directing the Secretary of Veterans 
Affairs to carry out certain actions to improve the trans-
parency and the governance of the information security 
program of the Department, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE; TABLE OF CONTENTS. 
(a) SHORT TITLE.—This Act may be cited as the 
‘‘Veterans Information Security Improvement Act’’. 
(b) TABLE OF CONTENTS.—The table of contents for 
this Act is as follows: 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
Sec. 1. Short title; table of contents. 
Sec. 2. Governance of information security program of Department of Veterans 
Affairs. 
Sec. 3. Security of critical network infrastructure, including domain controller, 
of Department of Veterans Affairs. 
Sec. 4. Security of computers and servers of Department of Veterans Affairs. 
Sec. 5. Upgrade or phase-out of unsupported or outdated operating systems. 
Sec. 6. Security of web applications from vital vulnerabilities. 
Sec. 7. Security of the Vista system. 
Sec. 8. Report on compliance with information security requirements and best 
practices. 
Sec. 9. Reports on implementation. 
Sec. 10. Application. 
Sec. 11. Definitions. 
SEC. 2. GOVERNANCE OF INFORMATION SECURITY PRO-
GRAM OF DEPARTMENT OF VETERANS AF-
FAIRS. 
(a) REQUIREMENTS FOR CERTAIN OFFICIALS AND 
STAFF.— 
(1) IN GENERAL.—Subchapter III of chapter 
57 of title 38, United States Code, is amended by 
inserting after section 5723 the following new sec-
tion: 
‘‘§ 5723A. Governance of information security pro-
gram 
‘‘(a) IN GENERAL.—The Secretary shall carry out 
this section to improve the transparency and the coordina-
tion of the information security program of the Depart-
ment. 
‘‘(b) OFFICE OF INFORMATION AND TECHNOLOGY.— 
(1) The Secretary shall ensure that the Assistant Sec-
retary for Information and Technology, as the Chief Infor-
mation Officer of the Department, possesses— 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
‘‘(A) the appropriate education and at least 10 
concurrent years of validated experience and capa-
bilities in the management of information technology 
organizations; 
‘‘(B) an industry recognized certification in in-
formation security and cyber security defense; and 
‘‘(C) demonstrated, sound technical capabilities. 
‘‘(2) The Secretary shall ensure that the staff of the 
Office of Information and Technology who perform secu-
rity functions, including the assessment and analysis of 
risk, security auditing, security operations, and security 
engineering, are assigned to the Office of Information Se-
curity. 
‘‘(3) The Secretary shall ensure that subordinate of-
fices of the Office of Information and Technology, in co-
ordination with the head of the Office of Information Se-
curity, maintain appropriate information security func-
tions within each such office to— 
‘‘(A) incorporate secure software assurance 
processes into the software development lifecycle for 
all software development activities; 
‘‘(B) validate that each third-party developed 
software used in any information system of the De-
partment meets the standards of the National Insti-
tute of Standards and Technology with respect to 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
security, safety, reliability, functionality and extensi-
bility; 
‘‘(C) maintain established information security 
baseline controls for such information systems, and 
immediately remediate systems determined to be out 
of compliance with established baseline controls to 
the maximum extent possible; 
‘‘(D) ensure that the security architecture of 
the Department is documented and fully integrated 
into the overall enterprise architecture strategy of 
the Department; and 
‘‘(E) develop and implement a policy that re-
stricts the development of new data warehouses and 
data marts holding sensitive personal information of 
veterans and reduces the number of data marts 
holding such information. 
‘‘(c) OFFICE OF INFORMATION SECURITY.—(1) The 
Secretary shall ensure that the head of the Office of Infor-
mation Security possesses— 
‘‘(A) the appropriate education and at least 10 
concurrent years of experience with respect to vali-
dated information security; and 
‘‘(B) an industry recognized certification in 
cyber security defense; 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
‘‘(C) demonstrated, sound technical capabilities; 
and 
‘‘(D) other relevant experience. 
‘‘(2) The Secretary shall ensure that all of the field 
staff of the Office of Information Security, including rel-
evant staff of the Office of Information Technology, whose 
primary responsibility is the protection of personally iden-
tifiable information of veterans maintain current informa-
tion security training and possess a certain level of infor-
mation security, cyber security defense, and technical ca-
pabilities and certifications as appropriate.’’. 
(2) CLERICAL AMENDMENT.—The table of sec-
tions at the beginning of such chapter is amended 
by inserting after the item relating to section 5723 
the following new item: 
‘‘5723A. Governance of information security program.’’. 
(b) DEFINITIONS.—Section 5721 of title 38, United 
States Code, is amended by adding at the end the fol-
lowing new paragraphs: 
‘‘(24) DATA
MART.—The term ‘data mart’ 
means a subset of a data warehouse that contains 
information for a specific department or entity of an 
organization rather than the entire organization. 
‘‘(25) DATA
WAREHOUSE.—The term ‘data 
warehouse’ means a collection of data designed to 
support management decision making that contains 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
a wide variety of data that present a coherent pic-
ture of business conditions for an entire organization 
at a single point in time and whose development in-
cludes the development of systems to extract data 
from operating systems plus installation of a ware-
house database system that provides managers flexi-
ble access to the data.’’. 
SEC. 3. SECURITY OF CRITICAL NETWORK INFRASTRUC-
TURE, INCLUDING DOMAIN CONTROLLER, OF 
DEPARTMENT OF VETERANS AFFAIRS. 
(a) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Secretary of Vet-
erans Affairs shall ensure the security and safeguard of 
the network infrastructure of the Department of Veterans 
Affairs. 
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following actions: 
(1) Maintain the awareness and complete phys-
ical and logical control of the critical network infra-
structure, including routers, switches, domain nam-
ing systems, firewalls, load balancers, proxy devices, 
authentication services, telecommunications, domain 
controllers, and any device that is part of the trust-
ed Internet connection system. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(2) If the Secretary determines that any critical 
network infrastructure device or service has been 
compromised, restore the device or service to the last 
known noncompromised state and determine the 
cause of the compromise. 
(3) If the Secretary determines that com-
promised devices or services must be used for a lim-
ited time, conduct such use in accordance with the 
guidance established by the National Security Agen-
cy under the document titled ‘‘Information Assur-
ance Guidance for Operating on a Compromised 
Network’’, or successor document. 
(4) Provide special security configurations for 
protecting critical infrastructure devices and serv-
ices. 
(5) Implement policies and security measures 
that minimize the threats to critical infrastructure 
devices and services. 
(6) Ensure that critical infrastructure devices 
and services, including the domain controller set-
tings, are in compliance with the Server Security 
Plan of the Department under the Department of 
Veterans Affairs Handbook 6500. 
(7) Establish access rights, permissions, and 
multifactor authentication for the critical infrastruc-
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
ture devices and services, including the domain con-
troller, for specific users or groups of users. 
(8) Ensure that proper physical security meas-
ures are taken to safeguard the critical infrastruc-
ture devices and services and limit physical access to 
such location to a limited number of authorized indi-
viduals. 
(9) Limit the access from network connections 
to critical infrastructure devices and services and 
only configure services and software that are needed 
by the devices and services. 
(10) Disable or delete any service or software 
from critical infrastructure devices and services that 
is unnecessary. 
(11) Where feasible, secure critical infrastruc-
ture devices and services with host-based and 
networked-based security controls and limit the 
number of ports that are opened between critical in-
frastructure devices and services, including any de-
vice requesting access to network resources and serv-
ices. 
(12) Conduct regular audits and testing of the 
backups and restore events of the critical infrastruc-
ture devices and services. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(13) Ensure that for any device to access and 
communicate with critical infrastructure devices and 
services within the domain, the authentication traffic 
has to be signed and encrypted. 
(14) Limit the administrator account from ac-
cessing critical infrastructure devices and services, 
including domain controllers, throughout the net-
work and use such account only for emergencies. 
(15) Restrict remote access to local adminis-
trator accounts and use firewall rules to restrict lat-
eral movement on the network. 
(16) Conduct regular formal penetration testing 
to test for potential security weaknesses and resolve 
such weaknesses by not later than seven days after 
identifying such weaknesses. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsection (b). 
SEC. 4. SECURITY OF COMPUTERS AND SERVERS OF DE-
PARTMENT OF VETERANS AFFAIRS. 
(a) IN GENERAL.—The Secretary shall ensure the se-
curity of each general purpose computer and server of the 
Department. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following actions: 
(1) Formalize and enforce a Department-wide 
process to monitor software installed on general pur-
pose computers and servers of the Department, pre-
vent the unauthorized installation of software, and 
remove any unauthorized software that has been in-
stalled. 
(2) Not later than 45 days after the date of the 
enactment of this Act, implement automated patch-
ing tools and processes that ensure that security 
patches are installed for any software or operating 
system on a computer by not later than 48 hours 
after the patch is made available. 
(3) Employ automated tools to continuously 
monitor general purpose computers, servers, and 
mobile devices for active, up-to-date anti-malware 
protection with antivirus, antispyware, personal fire-
walls, and host-based intrusion prevention system 
functionality. 
(4) Centralize oversight and control to effec-
tively administer patch management processes (but 
the responsibility for testing and applying patches to 
specific systems may be decentralized to the compo-
nent level). 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(5) Perform regular scans of general purpose 
computers and servers to discover security vulnera-
bilities and log the results of such scans. 
(6) Perform a patch-focused risk assessment to 
evaluate each system, database, and general purpose 
computer for threats, vulnerabilities, and its criti-
cality to the mission of the Department. 
(7) If the Secretary determines any security 
vulnerability— 
(A) develop a test for the vulnerability and 
determine the cause of the vulnerability; 
(B) address the vulnerability, including by 
patching, implementing a compensating control, 
or documenting and accepting a reasonable 
business risk (in accordance with industry ac-
cepted best practices) with respect to the vul-
nerability; and 
(C) perform a post remediation scan to 
verify that the vulnerability was so addressed. 
(8) Establish and ensure the use of standard, 
secure configurations of each operating system in 
use on the computers of the Department. 
(9) Employ system-scanning tools that check 
computers daily for software version, patch levels, 
and configuration files. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(10) Deploy a security content automation pro-
tocol tool that is validated by the National Institute 
of Standards and Technology to use specific stand-
ards to enable automated vulnerability management, 
measurement, and policy compliance evaluation. 
(11) Standardize policies, procedures, and tools 
for effective patch management, including by assign-
ing roles and responsibilities, performing risk assess-
ments, and testing patches. 
(12) Test each patch against all system con-
figurations of the Department in a test environment 
to determine any effect on the network before de-
ploying the patch to the affected systems and mon-
itor the status of the patches after deployment. 
(13) Establish and maintain an inventory of all 
hardware equipment, software packages, services, 
and other technologies installed and used by the De-
partment for patch management. 
(14) Establish a policy for security fixes that is 
clearly communicated to computer users to ensure 
that the users are aware of— 
(A) the versions of software or operating 
systems that are supported with respect to se-
curity fixes; and 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(B) when software, operating systems, or 
other products are scheduled to no longer be 
maintained. 
(15) Ensure that— 
(A) the staff or contractors of the Depart-
ment who are involved in patch management 
have the skills and knowledge needed to per-
form the responsibilities relating to such man-
agement; and 
(B) system administrators are trained in 
identifying new patches and vulnerabilities. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsection (b). 
SEC. 5. UPGRADE OR PHASE-OUT OF UNSUPPORTED OR 
OUTDATED OPERATING SYSTEMS. 
(a) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Secretary shall en-
sure that the Secretary upgrades or phases out outdated 
or unsupported operating systems to protect computers of 
the Department from harmful viruses, spyware, and other 
malicious software that could affect the confidentiality of 
sensitive personal information of veterans. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following activities: 
(1) Establish a plan for phasing out outdated 
or unsupported operating systems used by the De-
partment. 
(2) Establish a policy to ensure that outdated 
and unsupported operating systems used by the De-
partment do not connect to the network of the De-
partment by not later than 15 days after the date 
on which such operating systems are so outdated or 
unsupported, as determined appropriate by the Sec-
retary. 
(3) Establish a configuration management proc-
ess to ensure that— 
(A) a secure image that is regularly up-
dated is used to build all new computers used 
by the Department; and 
(B) any computer used by the Department 
that becomes compromised is re-imaged using 
such image. 
(4) Implement applicable operating systems 
based on security guidance identified by the Infor-
mation Assurance Directorate of the National Secu-
rity Agency. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(5) Appropriately configure and test required 
software that was designed to be used on older oper-
ating systems to ensure the software is usable on a 
new operating system used by the Department. 
(6) Limit administrative privileges to very few 
users who have both the appropriate knowledge and 
business need to modify the configuration of the op-
erating system. 
(7) Until the date on which an unsupported op-
erating system is replaced, if a computer uses such 
operating system, disable web browser plug-ins, use 
a hardware firewall, and if practicable, disconnect 
the computer from the network and do not use the 
computer to access the Internet. 
(8) Deploy a software inventory tool to cover 
each of the operating systems in use by the Depart-
ment to track— 
(A) the type of such operating systems 
being used by the Department; and 
(B) with respect to each computer of the 
Department— 
(i) the type of operating system in-
stalled and the version number and patch 
level of such operating system; and 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(ii) the software being used on such 
operating system. 
(9) Regularly use file integrity checking tools to 
check any changes to critical operating systems, 
services, and configuration files. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsection (b). 
SEC. 6. SECURITY OF WEB APPLICATIONS FROM VITAL 
VULNERABILITIES. 
(a) IN GENERAL.—The Secretary shall ensure that 
web applications used by the Department are secure from 
vulnerabilities that could affect the confidentiality of sen-
sitive personal information of veterans. 
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following activities: 
(1) Not later than 60 days after the date of the 
enactment of this Act, develop a plan, including re-
quired actions and milestones, to fully remediate all 
security vulnerabilities described in subsection (a) 
that exist as of the date of the enactment of this 
Act. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00016
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(2) Develop detailed guidance for remediating 
each critical security vulnerability. 
(3) Use best practices and lessons learned, in-
cluding such practices and lessons described by the 
National Institute of Standards and Technology and 
the Open Web Application Security Project, to ad-
dress the security vulnerabilities of web applications. 
(4) Limit the permissions on the database logon 
used by web applications to only what is needed to 
reduce the effectiveness of any attack that exploits 
bugs in the application. 
(5) Provide to web application developers— 
(A) 
thorough 
application 
development 
guidance to ensure that new applications are 
designed by taking into account security; and 
(B) detailed guidance on testing existing 
web applications for security vulnerabilities, in-
cluding buffer overflows and cross-site script-
ing. 
(6) Configure administrative passwords to be— 
(A) complex and consist only of strings of 
letters, numbers, and characters that do not 
form a recognizable word; and 
(B) changed every 90 days, in accordance 
with industry best practices. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00017
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS