IIB 
117TH CONGRESS 
2D SESSION 
H. R. 7299 
IN THE SENATE OF THE UNITED STATES 
NOVEMBER 17, 2022 
Received; read twice and referred to the Committee on Veterans’ Affairs 
AN ACT 
To require the Secretary of Veterans Affairs to obtain an 
independent cybersecurity assessment of information sys-
tems of the Department of Veterans Affairs, and for 
other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
VerDate Sep 11 2014 
06:04 Nov 18, 2022
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.RFS
H7299
kjohnson on DSK79L0C42PROD with BILLS
HR 7299 RFS
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Strengthening VA Cy-
bersecurity Act of 2022’’ or the ‘‘SVAC Act of 2022’’. 
SEC. 2. INDEPENDENT CYBERSECURITY ASSESSMENT OF 
INFORMATION SYSTEMS OF DEPARTMENT OF 
VETERANS AFFAIRS. 
(a) INDEPENDENT ASSESSMENT REQUIRED.— 
(1) IN GENERAL.—Not later than 60 days after 
the date of the enactment of this Act, the Secretary 
of Veterans Affairs shall seek to enter into an agree-
ment with a federally funded research and develop-
ment center to provide to the Secretary an inde-
pendent cybersecurity assessment of— 
(A) five high-impact information systems 
of the Department of Veterans Affairs; and 
(B) the effectiveness of the information se-
curity program and information security man-
agement system of the Department. 
(2) DETAILED ANALYSIS.—The independent cy-
bersecurity assessment provided under paragraph 
(1) shall include a detailed analysis of the ability of 
the Department— 
(A) to ensure the confidentiality, integrity, 
and availability of the information, information 
systems, and devices of the Department; and 
(B) to protect against— 
VerDate Sep 11 2014 
06:04 Nov 18, 2022
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.RFS
H7299
kjohnson on DSK79L0C42PROD with BILLS
HR 7299 RFS
(i) advanced persistent cybersecurity 
threats; 
(ii) ransomware; 
(iii) denial of service attacks; 
(iv) insider threats; 
(v) threats from foreign actors, in-
cluding state sponsored criminals and 
other foreign based criminals; 
(vi) phishing; 
(vii) credential theft; 
(viii) cybersecurity attacks that target 
the supply chain of the Department; 
(ix) threats due to remote access and 
telework activity; and 
(x) other cyber threats. 
(3) TYPES OF SYSTEMS.—The independent cy-
bersecurity assessment provided under paragraph 
(1) shall cover on-premises, remote, cloud-based, and 
mobile information systems and devices used by, or 
in support of, Department activities. 
(4) SHADOW INFORMATION TECHNOLOGY.—The 
independent 
cybersecurity 
assessment 
provided 
under paragraph (1) shall include an evaluation of 
the use of information technology systems, devices, 
and services by employees and contractors of the De-
VerDate Sep 11 2014 
06:04 Nov 18, 2022
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.RFS
H7299
kjohnson on DSK79L0C42PROD with BILLS
HR 7299 RFS
partment who do so without the heads of the ele-
ments of the Department that are responsible for in-
formation technology at the Department knowing or 
approving of such use. 
(5) METHODOLOGY.—In conducting the cyber-
security assessment to be provided under paragraph 
(1), the federally funded research and development 
center shall take into account industry best practices 
and the current state-of-the-art in cybersecurity 
evaluation and review. 
(b) PLAN.— 
(1) IN
GENERAL.—Not later than 120 days 
after the date on which an independent assessment 
is provided to the Secretary by a federally funded re-
search and development center pursuant to an 
agreement entered into under subsection (a), the 
Secretary shall submit to the Committees on Vet-
erans’ Affairs of the House of Representatives and 
the Senate a plan to address the findings of the fed-
erally funded research and development center set 
forth in such assessment. 
(2) ELEMENTS.—The plan submitted under 
paragraph (1) shall include the following: 
VerDate Sep 11 2014 
06:04 Nov 18, 2022
Jkt 039200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.RFS
H7299
kjohnson on DSK79L0C42PROD with BILLS
HR 7299 RFS
(A) the independent cybersecurity assess-
ment provided under subsection (a); and 
(B) the response of the Department to 
such assessment; and 
(2) provide to the Committees on Veterans’ Af-
fairs of the House of Representatives and the Senate 
a briefing on the results of the evaluation and re-
view, including any recommendations made to the 
Secretary regarding the matters covered by the 
briefing. 
Passed the House of Representatives November 17, 
2022. 
Attest: 
CHERYL L. JOHNSON, 
Clerk. 
VerDate Sep 11 2014 
06:04 Nov 18, 2022
Jkt 039200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H7299.RFS
H7299
kjohnson on DSK79L0C42PROD with BILLS