I 
117TH CONGRESS 
2D SESSION 
H. R. 7299 
To require the Secretary of Veterans Affairs to obtain an independent cyberse-
curity assessment of information systems of the Department of Veterans 
Affairs, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
MARCH 30, 2022 
Mr. MRVAN (for himself, Mrs. LEE of Nevada, Ms. MACE, and Mr. 
GARBARINO) introduced the following bill; which was referred to the Com-
mittee on Veterans’ Affairs 
A BILL 
To require the Secretary of Veterans Affairs to obtain an 
independent cybersecurity assessment of information sys-
tems of the Department of Veterans Affairs, and for 
other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Strengthening VA Cy-
bersecurity Act of 2022’’ or the ‘‘SVAC Act of 2022’’. 
VerDate Sep 11 2014 
05:27 Apr 02, 2022
Jkt 029200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.IH
H7299
pbinns on DSKJLVW7X2PROD with BILLS
SEC. 2. INDEPENDENT CYBERSECURITY ASSESSMENT OF 
INFORMATION SYSTEMS OF DEPARTMENT OF 
VETERANS AFFAIRS. 
(a) INDEPENDENT ASSESSMENT REQUIRED.— 
(1) IN GENERAL.—Not later than 60 days after 
the date of the enactment of this Act, the Secretary 
of Veterans Affairs shall enter into an agreement 
with a federally funded research and development 
center to provide the Secretary with an independent 
cybersecurity assessment of— 
(A) not more than 10 and not fewer than 
three high-impact information systems of the 
Department of Veterans Affairs; and 
(B) the effectiveness of the information se-
curity program and information security man-
agement system of the Department. 
(2) DETAILED ANALYSIS.—The independent cy-
bersecurity assessment provided under paragraph 
(1) shall include a detailed analysis of the ability of 
the Department— 
(A) to ensure the confidentiality, integrity, 
and availability of the information, information 
systems, and devices of the Department; and 
(B) to protect against— 
(i) advanced persistent cybersecurity 
threats; 
VerDate Sep 11 2014 
05:27 Apr 02, 2022
Jkt 029200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.IH
H7299
pbinns on DSKJLVW7X2PROD with BILLS
(ii) ransomware; 
(iii) denial of service attacks; 
(iv) insider threats; 
(v) threats from foreign actors, in-
cluding 
state-sponsored 
criminals 
and 
other foreign based criminals; 
(vi) phishing; 
(vii) credential theft; 
(viii) cybersecurity attacks that target 
the supply chain of the Department; 
(ix) threats due to remote access and 
telework activity; and 
(x) other cyber threats. 
(3) TYPES OF SYSTEMS.—The independent cy-
bersecurity assessment provided under paragraph 
(1) shall cover on-premises, remote, cloud-based, and 
mobile information systems and devices used by, or 
in support of, Department activities. 
(4) SHADOW INFORMATION TECHNOLOGY.—The 
independent 
cybersecurity 
assessment 
provided 
under paragraph (1) shall include an evaluation of 
the use of information technology systems, devices, 
and services by employees and contractors of the De-
partment who do so without the elements of the De-
partment that are responsible for information tech-
VerDate Sep 11 2014 
05:27 Apr 02, 2022
Jkt 029200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.IH
H7299
pbinns on DSKJLVW7X2PROD with BILLS
nology at the Department knowing or approving of 
such use. 
(5) METHODOLOGY.—In conducting the cyber-
security assessment provided under paragraph (1), 
the federally funded research and development cen-
ter shall take into account industry best practices 
and the current state-of-the-art in cybersecurity 
evaluation and review. 
(b) PLAN.— 
(1) IN
GENERAL.—Not later than 120 days 
after the date on which an independent assessment 
is provided to the Secretary pursuant to an agree-
ment entered into under subsection (a) with a feder-
ally funded research and development center, the 
Secretary shall submit to Congress a plan to address 
the findings of the federally funded research and de-
velopment center set forth in such assessment. 
(2) ELEMENTS.—The plan submitted under 
paragraph (1) shall include the following: 
(A) A cost estimate for implementing the 
plan. 
(B) A timeline for implementing the plan. 
(C) Such other elements as the Secretary 
considers appropriate. 
VerDate Sep 11 2014 
05:27 Apr 02, 2022
Jkt 029200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.IH
H7299
pbinns on DSKJLVW7X2PROD with BILLS
(c) COMPTROLLER
GENERAL
OF
THE
UNITED 
STATES REVIEW.—Not later than 180 days after the date 
of the submission of the plan under subsection (b)(1), the 
Comptroller General of the United States shall— 
(1) commence a review of— 
(A) the independent cybersecurity assess-
ment provided under subsection (a); and 
(B) the response of the Department to 
such assessment; and 
(2) submit to Congress a report of the results 
of that review commenced under paragraph (1), in-
cluding any recommendations made to the Secretary 
regarding the matters covered by the report. 
Æ 
VerDate Sep 11 2014 
05:27 Apr 02, 2022
Jkt 029200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6301
E:\BILLS\H7299.IH
H7299
pbinns on DSKJLVW7X2PROD with BILLS