II
117th CONGRESS
2d Session
S. 3863
IN THE SENATE OF THE UNITED STATES
March 17, 2022
Ms. Rosen (for herself and Mrs. Blackburn) introduced the following bill; which was read twice and referred to the Committee on Veterans' Affairs
A BILL
To require the Secretary of Veterans Affairs to obtain an independent cybersecurity assessment of information systems of the Department of Veterans Affairs, and for other purposes.
Short title
This Act may be cited as the Strengthening VA Cybersecurity Act of 2022
.
Independent cybersecurity assessment of information systems of Department of Veterans Affairs
Independent assessment required
In general
Not later than 60 days after the date of the enactment of this Act, the Secretary of Veterans Affairs shall enter into an agreement with a federally funded research and development center to provide the Secretary with an independent cybersecurity assessment of—
not more than 10 and not fewer than three high-impact information systems of the Department of Veterans Affairs; and
the effectiveness of the information security program and information security management system of the Department.
Detailed analysis
The independent cybersecurity assessment provided under paragraph (1) shall include a detailed analysis of the ability of the Department—
to ensure the confidentiality, integrity, and availability of the information, information systems, and devices of the Department; and
to protect against—
advanced persistent cybersecurity threats;
ransomware;
denial of service attacks;
insider threats;
threats from foreign actors, including State sponsored criminals and other foreign based criminals;
phishing;
credential theft;
cybersecurity attacks that target the supply chain of the Department;
threats due to remote access and telework activity; and
other cyber threats.
Types of systems
The independent cybersecurity assessment provided under paragraph (1) shall cover on-premises, remote, cloud-based, and mobile information systems and devices used by, or in support of, Department activities.
Shadow information technology
The independent cybersecurity assessment provided under paragraph (1) shall include an evaluation of the use of information technology systems, devices, and services by employees and contractors of the Department who do so without the elements of the Department that are responsible for information technology at the Department knowing or approving of such use.
Methodology
In conducting the cybersecurity assessment provided under paragraph (1), the federally funded research and development center shall take into account industry best practices and the current state-of-the-art in cybersecurity evaluation and review.
Plan
In general
Not later than 120 days after the date on which an independent assessment is provided to the Secretary pursuant to an agreement entered into under subsection (a) with a federally funded research and development center, the Secretary shall submit to Congress a plan to address the findings of the federally funded research and development center set forth in such assessment.
Elements
The plan submitted under paragraph (1) shall include the following:
A cost estimate for implementing the plan.
A timeline for implementing the plan.
Such other elements as the Secretary considers appropriate.
Comptroller General of the United States review
Not later than 180 days after the date of the submission of the plan under (b)(1), the Comptroller General of the United States shall—
commence a review of—
the independent cybersecurity assessment provided under subsection (a); and
the response of the Department to such assessment; and
submit to Congress a report of the results of that review commenced under paragraph (1), including any recommendations made to the Secretary regarding the matters covered by the report.