Bill > HR4356

This bill, titled the Department of Veterans Affairs Information Security Protection Act, aims to enhance the cybersecurity measures within the Department of Veterans Affairs (VA) by requiring more robust reporting and planning. Key provisions include mandating the VA to submit quarterly reports to Congress detailing actions taken to address critical information security vulnerabilities, including specific timelines and risk assessments, and to provide a publicly releasable summary of these plans. The bill also requires the VA to develop and submit an annual plan for identifying and replacing outdated or unsupported operating systems, with a strict deadline for removing them from the network, and to ensure all software and internet applications used by the VA are secure against vulnerabilities that could compromise veterans' sensitive personal information. Furthermore, it establishes new reporting requirements for the VA Secretary to submit quarterly reports to Congressional committees on information security compliance, incident responses, and the implementation of recommendations from federal agencies like the National Institute of Standards and Technology (NIST) and the Office of Management and Budget (OMB), and mandates the creation of a comprehensive, long-term strategic plan for improving the VA's information security, which will be updated biannually. Finally, the bill extends these security requirements to VA contractors, ensuring they implement protective measures for any VA data handled by their systems.