PRIA Logo™
117-hr-7299117th CongressWALLET

SVAC Act of 2022

Sponsored By: Representative Mrvan, Frank J. [D-IN-1]

Became Law

Summary

Independent cybersecurity assessment of Department of Veterans Affairs information systems to test defenses across on-premises, cloud, mobile, and remote environments. A federally funded research and development center (FFRDC) will evaluate five high-impact systems and VA’s overall information security program against threats such as ransomware, advanced persistent threats, phishing, credential theft, insider threats, supply-chain attacks, denial-of-service, and risks from remote access and telework.

Show full summary
  • Veterans and families: The review will analyze VA’s ability to protect the confidentiality, integrity, and availability of personal and health records, focusing on threats that most often endanger those data.
  • VA IT staff and leaders: VA must seek an agreement with an FFRDC within 60 days and then deliver a plan within 120 days after the assessment that lists security improvements, an implementation timeline, and cost estimates.
  • Congressional oversight and accountability: The Comptroller General will start a review within 180 days after the plan is submitted and brief House and Senate Veterans’ Affairs committees with findings and recommendations.

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

1 provisions identified: 1 benefits, 0 costs, 0 mixed.

Independent Veterans Affairs cybersecurity review and fixes

The law requires the Department of Veterans Affairs to secure an agreement within 60 days with an independent federally funded research center. The center reviews five high‑impact VA systems and the VA’s overall security program. It examines on‑site, remote, cloud, and mobile systems, including shadow IT. It assesses defenses against ransomware, phishing, insider threats, foreign actors, denial‑of‑service, supply‑chain attacks, and telework risks. Within 120 days after the review, the Secretary sends Congress a plan with fixes, costs, and a timeline. Not later than 180 days after that plan is sent, the Comptroller General begins a review and briefs Congress.

Sponsors & CoSponsors

Sponsor

Mrvan, Frank J. [D-IN-1]

IN • D

Cosponsors

  • Rep. Lee, Susie [D-NV-3]

    NV • D

    Sponsored 3/30/2022

  • Rep. Mace, Nancy [R-SC-1]

    SC • R

    Sponsored 3/30/2022

  • Rep. Garbarino, Andrew R. [R-NY-2]

    NY • R

    Sponsored 3/30/2022

  • Del. Norton, Eleanor Holmes [D-DC-At Large]

    DC • D

    Sponsored 4/21/2022

  • Rep. Roybal-Allard, Lucille [D-CA-40]

    CA • D

    Sponsored 4/21/2022

  • Sen. Slotkin, Elissa [D-MI]

    MI • D

    Sponsored 11/17/2022

Roll Call Votes

No roll call votes available for this bill.

View on Congress.gov
Back to Legislation