Garbarino, Mace unveil legislation to assess, improve VA’s cyber preparedness

U.S. Reps. Andrew Garbarino (R-NY) and Nancy Mace (R-SC) on Wednesday cosponsored a bipartisan bill to bolster cybersecurity at the U.S. Department of Veterans Affairs (VA) and protect the VA’s information technology systems and devices. 

“Given Russia’s recent aggression and invasion of Ukraine, it is more important than ever that we shore up America’s critical cybersecurity, including proactively protecting the healthcare of our veterans against possible cyber attacks from Russia,” Rep. Mace said.

The Strengthening VA Cybersecurity Act of 2022, H.R. 7299, which is sponsored by U.S. Rep. Frank Mrvan (D-IN), would require the VA to obtain an independent cybersecurity assessment of its most critical information systems and its overall cybersecurity posture, according to a bill summary provided by the lawmakers, and to develop a timeline and budget aimed at correcting any weaknesses and deficiencies identified by the report.  

“I’m highly concerned by the rising threat of cyberattacks and have been working closely with public and private stakeholders to ensure Americans are prepared to protect themselves online,” said Rep. Garbarino. “Veterans’ personal information can be appealing targets for foreign adversaries and cyber criminals, making it essential for the VA to engage in long overdue system upgrades and take proactive steps to mitigate cyber threats.”

If enacted, the measure would require that no later than 60 days after the bill’s enactment the VA Secretary shall enter into an agreement with a federally funded research and development center to provide the VA with an independent cybersecurity assessment of not more than 10 and not fewer than three high-impact information systems of the VA; and the effectiveness of the information security program and information security management system of the department, according to the text of the bill. 

The independent cybersecurity assessment must include a detailed analysis of the VA’s ability to ensure the confidentiality, integrity and availability of its information, information systems, and devices; and to protect against cyber threats such as ransomware, denial of service attacks, insider threats, threats from foreign actors, phishing, credential theft, cybersecurity attacks that target the VA’s supply chain, and threats due to remote access and telework activity, among others.

The same-named companion bill, S. 3863, was introduced on March 17 by U.S. Sens. Jacky Rosen (D-NV) and Marsha Blackburn (R-TN) in the U.S. Senate.