VA security bill that hardens FISMA passes
Connecting state and local government leaders
The House passed a bill aimed at protecting veterans' personal data and which also requires all federal agencies to notify the public when breaches of sensitive information occur.
The House last night passed a bill aimed at protecting veterans' personal data and which also requires all federal agencies to notify the public when breaches of sensitive information occur. H.R. 5835, the Veterans Identity and Credit Security Act of 2006, now moves to the Senate for approval.
The bill, approved by voice vote, amends and strengthens the Federal Information Security Management Act by giving CIOs enforcement authority over IT containing personal data.
The House Veterans Affairs and Government Reform committees worked together to produce the legislation.
If the Senate does not act on the bill, House Government Reform chairman Tom Davis (R-Va.) said he will try to move his bill separately in November.
'If new policies and procedures are not forthcoming quickly, or if they lack teeth to get the job done, I will revisit this matter with additional legislation,' he said.
Davis' language attached to the bill yesterday, in the form of H.R. 6163, the Federal Agency Data Breach Protect Act, directs the Office of Management and Budget to establish procedures for agencies to follow if personal information is lost or stolen. It also would require that individuals be notified if their personal information could be compromised by a breach of data security at a federal agency.
Davis' bill also would give CIOs the power to ensure, when authorized by an agency head, that agency personnel comply with information security laws. Federal agencies would have to ensure that costly equipment containing sensitive information is accounted for and secure.
Similar but less detailed language from Davis' earlier bill, H.R. 5838, the Federal Agency Data Breach Notification Act, was incorporated into the VA bill during the summer.
Last week, the Commerce Department revealed that it couldn't account for 1,100 laptops, including some containing personal Census Bureau data. The disclosure came among summaries of past data breaches that Davis had requested from all agencies following numerous data breaches reported earlier this year.
House Veterans' Affairs Committee chairman Steve Buyer (R-Ind.) introduced the VA bill in response to weaknesses in IT and data management at the Veterans Affairs Department that contributed to the loss in May of personal data belonging to millions of veterans and service members. The legislation calls for remediation of identity theft for a veteran or other individuals whose personal information is compromised by VA.
"This legislation will safeguard the personal information of veterans. It addresses the problems that caused the data theft in May and provides VA a definite course of action to follow, should a data breach occur in the future," Buyer said.
Under the bill, VA's department CIO has the authority to enforce information security in the VA IT department. It also requires a monthly briefing to the VA secretary on VA's compliance with the Federal Information Security Management Act.
The bill will also create a new undersecretary of information services, who will also bear responsibilities as VA's CIO. Three new deputy undersecretaries for security, operations and management, and policy and planning would report to the new undersecretary.
H.R. 5835, as amended, requires notification to Congress and people affected in the event of a data breach. The bill would require VA to conduct data breach analysis and, if necessary, provide credit protection services and fraud resolution services upon the request of those affected. This protection may include a credit freeze, identity theft insurance and/or credit monitoring.
In congressional hearings during the summer, VA secretary Jim Nicholson said he was determined to change VA's culture. Among steps to improve VA data security, he signed a directive that placed authority over all information management functions, including enforcement, with the department CIO, a move many security experts had advocated.
Yesterday, Robert Howard, awaiting Senate confirmation as the new VA CIO, told lawmakers on the Senate Veterans Affairs Committee that VA had installed encryption software on 15,000 laptops and was implementing the Data Security Assessment and Strengthening Controls Program to remedy many of the department's security weaknesses.