(7) With respect to passwords used in connec-
tion with web applications, store the passwords for 
each system of the Department only in a well-hashed 
or encrypted format. 
(8) Implement two-factor authentication tech-
nology requirements throughout the Department. 
(9) If vulnerabilities in a web application are 
found, administer a full-source code review to deter-
mine if the vulnerabilities exist elsewhere within the 
code of the application. 
(10) Periodically review user access to networks 
and web applications to identify unnecessary, inac-
tive, or terminated user accounts. 
(11) Establish a single set of strong authentica-
tion and session management controls that meet all 
the authentication and session management require-
ments defined in the Application Security Verifica-
tion Standard of the Open Web Application Security 
Project. 
(12) Implement visibility and attribution meas-
ures to improve the process, architecture, and tech-
nical capabilities of the Department to monitor web 
applications used on the networks and computers of 
the Department to detect attack attempts, locate 
points of entry, identify already compromised ma-
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00018
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
chines, interrupt activities of infiltrated attackers, 
and gain information about the sources of an attack. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsection (b). 
SEC. 7. SECURITY OF THE VISTA SYSTEM. 
(a) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Secretary shall en-
sure that the Vista system is secure from vulnerabilities 
that could affect the confidentiality of sensitive personal 
information of veterans. 
(b) ACTIONS REQUIRED.—In carrying out subsection 
(a), the Secretary shall carry out the following activities: 
(1) Develop a remedial action plan to address 
the approaches to interoperability— 
(A) between multiple Vista systems; and 
(B) between the Vista system and external 
systems and software. 
(2) Update the policy, procedures, and govern-
ance of the Department with respect to system-to- 
system integration where users log on to external 
systems and then automatically connect to the Vista 
system and interact. 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00019
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
(3) Provide authentication for the machine-to- 
machine broker so that the Vista system ‘‘listener’’ 
verifies the identity of the calling system. 
(4) Establish and implement policy with respect 
to the authentication of external systems attempting 
to connect to the Vista system and criteria by which 
user authentication must be accomplished to ensure 
all applications that connect to the Vista system con-
vey accurate user information. 
(5) Establish a business requirement that sys-
tem-to-system integration connectivity across the 
wide-area network must consist of encrypted com-
munication and require external systems to securely 
identify themselves, or for the Vista system to se-
curely identify external systems that attempt to con-
nect to the system. 
(6) Establish a business requirement that exter-
nal systems communicate accurate user information 
to the Vista system relating to actions initiated by 
actual individuals and facilitate the revocation of ac-
cess by the Vista system relative to specific users or 
external systems attempting to connect. 
(7) Implement monthly project design reviews 
of the integration between systems and web applica-
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00020
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
tions to ensure that the effectiveness of the existing 
controls is sustained. 
(8) Assess the potential compromise to non-De-
partment networks that are interconnected with the 
network of the Department, including the networks 
of the Department of Defense and the Department 
of Health and Human Services. 
(9) Ensure that, in the near-term, software de-
velopment for the Vista system develops the critical 
enhancements and fixes to the system that are nec-
essary to ensure compliance with changes to patient 
enrollment. 
(10) Ensure that all systems of the Department 
have been given the ‘‘Authority to Operate’’ designa-
tion and have been properly certified by meeting all 
requirements, including a comprehensive assessment 
of management, operational, and technical security 
controls, to become operational, and restrict the use 
of waivers. 
(c) CERTIFICATION.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall 
submit to the congressional veterans committees written 
certification that the Secretary has commenced each ac-
tion described in subsection (b). 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00021
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS
SEC. 8. REPORT ON COMPLIANCE WITH INFORMATION SE-
CURITY REQUIREMENTS AND BEST PRAC-
TICES. 
Not later than 60 days after the date of the enact-
ment of this Act, the Secretary of Veterans Affairs shall 
submit to the congressional veterans committees the fol-
lowing: 
(1) Written certification that the Secretary is 
taking every action required to comply with— 
(A) subchapter III of chapter 57 of title 
38, United States Code; 
(B) subchapter III of chapter 35 of title 
44, United States Code; 
(C) special publications 800–53 and 800– 
111 of the National Institute of Standards and 
Technology, including with respect to encrypt-
ing databases; 
(D) applicable memoranda issued by the 
Director of Management and Budget regarding 
protecting personally identifiable information; 
and 
(E) any other relevant law or regulation 
regarding the information security of the De-
partment of Veterans Affairs. 
(2) How the Secretary is using and imple-
menting the principles and best practices regarding 
VerDate Mar 15 2010 
03:58 Apr 05, 2014
Jkt 039200
PO 00000
Frm 00022
Fmt 6652
Sfmt 6201
E:\BILLS\H4370.IH
H4370
rfrederick on DSK6VPTVN1PROD with BILLS