Department of Veterans Affairs Information Technology Reform Act of 2019

116TH CONGRESS 2D SESSION S. 2336 AN ACT To improve the management of information technology projects and investments of the Department of Veterans Affairs, and for other purposes. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 2 † S 2336 ES SECTION 1. SHORT TITLE. 1 This Act may be cited as the ‘‘Department of Vet- 2 erans Affairs Information Technology Reform Act of 3 2019’’. 4 SEC. 2. MANAGEMENT OF DEPARTMENT OF VETERANS AF- 5 FAIRS INFORMATION TECHNOLOGY 6 PROJECTS. 7 (a) UPDATE OF REVIEW PROCESS AND INFORMA- 8 TION TECHNOLOGY DASHBOARD CHIEF INFORMATION 9 OFFICER RATINGS.— 10 (1) IN GENERAL.—Not later than 180 days 11 after the date of the enactment of this Act, the Sec- 12 retary of Veterans Affairs shall update the review 13 process for information technology projects of the 14 Department of Veterans Affairs to ensure that ac- 15 tive risks are factored into the Information Tech- 16 nology Dashboard Chief Information Officer ratings. 17 (2) REVIEW BY COMPTROLLER GENERAL OF 18 THE UNITED STATES.—Not later than one year after 19 the date on which the Secretary completes updating 20 the review process under paragraph (1), the Comp- 21 troller General of the United States shall complete 22 a review such process. 23 (b) ANNUAL REPORT ON PROJECT BUDGET DIS- 24 CREPANCIES.— 25 3 † S 2336 ES (1) IN GENERAL.—Each fiscal year, not later 1 than 120 days after the end of the previous fiscal 2 year, the Secretary shall submit to the Committee 3 on Veterans’ Affairs of the Senate and the Com- 4 mittee on Veterans’ Affairs of the House of Rep- 5 resentatives a report on covered information tech- 6 nology projects of the Department with respect to 7 which the amounts that were obligated and the 8 amounts expended by the Department in that fiscal 9 year were, in aggregate, 10 percent or more greater 10 or less than the amount budgeted for the project in 11 that fiscal year. 12 (2) COVERED INFORMATION TECHNOLOGY 13 PROJECTS.—For purposes of this subsection, a cov- 14 ered information technology project of the Depart- 15 ment is an information technology project of the De- 16 partment for which the Secretary estimates the De- 17 partment will expend or obligate $25,000,000 or 18 more for development and sustainment over a three- 19 year lifecycle. 20 (3) MITIGATION PLANS.—Each report sub- 21 mitted under paragraph (1) shall include, for each 22 project described in the report, a plan to rectify the 23 budget discrepancy and improve the accuracy of the 24 budget formulation process of the Department. 25 4 † S 2336 ES SEC. 3. PLAN FOR EXPENDITURES RELATING TO DEPART- 1 MENT OF VETERANS AFFAIRS INFORMATION 2 TECHNOLOGY PROJECTS AND INVESTMENTS. 3 (a) PLAN REQUIRED.— 4 (1) IN GENERAL.—The Secretary of Veterans 5 Affairs shall submit to the appropriate committees 6 of Congress a plan for expenditures of the Depart- 7 ment of Veterans Affairs relating to large informa- 8 tion technology projects and investments. 9 (2) CONTENTS.—The report submitted under 10 paragraph (1) shall include the following: 11 (A) Identification of each information tech- 12 nology project and investment planned by the 13 Secretary for which the Secretary estimates the 14 Department will expend or obligate 15 $25,000,000 or more for development and 16 sustainment over a three-year lifecycle. 17 (B) For each such project and investment, 18 a description of— 19 (i) the functional and performance ca- 20 pabilities to be delivered and the mission 21 benefits to be realized; 22 (ii) the estimated lifecycle cost, includ- 23 ing estimates for development as well as 24 maintenance and operations; and 25 (iii) key milestones to be met. 26 5 † S 2336 ES (C) Demonstration that each project and 1 investment is— 2 (i) consistent with the Information 3 Technology Modernization Plan of the De- 4 partment, or successor plan; 5 (ii) being managed in accordance with 6 applicable lifecycle management policies 7 and guidance; and 8 (iii) subject to applicable planning and 9 investment control requirements of the De- 10 partment. 11 (D) A statement as to whether the plan 12 has been reviewed by the Comptroller General 13 of the United States. 14 (b) DEFINITION OF APPROPRIATE COMMITTEES OF 15 CONGRESS.—In this section, the term ‘‘appropriate com- 16 mittees of Congress’’ means— 17 (1) the Committee on Veterans’ Affairs and the 18 Committee on Appropriations of the Senate; and 19 (2) the Committee on Veterans’ Affairs and the 20 Committee on Appropriations of the House of Rep- 21 resentatives. 22 6 † S 2336 ES SEC. 4. BUDGET JUSTIFICATION FOR DEPARTMENT OF 1 VETERANS AFFAIRS INFORMATION TECH- 2 NOLOGY PROGRAMS. 3 The Secretary of Veterans Affairs shall ensure that 4 whenever the budget justification materials are submitted 5 to Congress in support of the Department of Veterans Af- 6 fairs budget for a fiscal year (as submitted with the budg- 7 et of the President for such fiscal year under section 8 1105(a) of title 31, United States Code), such budget jus- 9 tification materials include a specific accounting, including 10 life cycle costs, of all funds requested for the information 11 technology programs of the Department. 12 SEC. 5. DEPARTMENT OF VETERANS AFFAIRS COMPLIANCE 13 WITH OFFICE OF MANAGEMENT AND BUDGET 14 DATA CENTER OPTIMIZATION INITIATIVE. 15 (a) REQUIREMENT.—The Secretary of Veterans Af- 16 fairs shall ensure that the Department of Veterans Affairs 17 complies with all applicable requirements of the Data Cen- 18 ter Optimization Initiative (DCOI) of the Office of Man- 19 agement and Budget, including by— 20 (1) fully identifying the data center inventory of 21 the Department; and 22 (2) meeting any targets assigned by the Direc- 23 tor of the Office of Management and Budget pursu- 24 ant to such initiative regarding data center closures, 25 optimization savings, and optimization metrics. 26 7 † S 2336 ES (b) PLAN FOR COMPLIANCE.—Not later than 90 days 1 after the date of the enactment of this Act, the Secretary 2 shall submit to the Committee on Veterans’ Affairs of the 3 Senate and the Committee on Veterans’ Affairs of the 4 House of Representatives a plan to fully comply with the 5 requirements described in subsection (a). 6 (c) ANNUAL REPORT.—Not later than March 31, 7 2020, and in March of each year thereafter until the date 8 on which the Director of the Office of Management and 9 Budget determines that the Department is in full compli- 10 ance with the requirements of the initiative referred to in 11 subsection (a), the Secretary shall submit to the Com- 12 mittee on Veterans’ Affairs of the Senate and the Com- 13 mittee on Veterans’ Affairs of the House of Representa- 14 tives a report on the progress of the Secretary in carrying 15 out the plan submitted under subsection (b). 16 SEC. 6. ANNUAL LIST OF DEPARTMENT OF VETERANS AF- 17 FAIRS INFORMATION TECHNOLOGY 18 PROJECTS. 19 (a) ANNUAL LIST.—Not less frequently than once 20 each year, the Secretary of Veterans Affairs shall submit 21 to the appropriate committees of Congress a comprehen- 22 sive, prioritized list of all information technology projects 23 being funded by the Department of Veterans Affairs, 24 disaggregated by business line or portfolio division. 25 8 † S 2336 ES (b) DEFINITION OF APPROPRIATE COMMITTEES OF 1 CONGRESS.—In this section, the term ‘‘appropriate com- 2 mittees of Congress’’ means— 3 (1) the Committee on Veterans’ Affairs and the 4 Committee on Appropriations of the Senate; and 5 (2) the Committee on Veterans’ Affairs and the 6 Committee on Appropriations of the House of Rep- 7 resentatives. 8 SEC. 7. ASSESSMENT OF SUITABILITY OF DEPARTMENT OF 9 VETERANS AFFAIRS INFORMATION TECH- 10 NOLOGY INVESTMENTS FOR MIGRATION TO 11 CLOUD COMPUTING SERVICE. 12 (a) ASSESSMENT REQUIRED.—Not later than one 13 year after the date of the enactment of this Act, the Sec- 14 retary of Veterans Affairs, acting through the Chief Infor- 15 mation Officer of the Department of Veterans Affairs, 16 shall complete an assessment, in accordance with guidance 17 from the Office of Management and Budget, of all infor- 18 mation technology investments of the Department of Vet- 19 erans Affairs to determine the suitability of the invest- 20 ments for migration to a cloud computing service. 21 (b) MECHANISM TO TRACK SAVINGS.—The Sec- 22 retary shall create a consistent and repeatable mechanism 23 to track savings and cost avoidances from— 24 9 † S 2336 ES (1) migration of information technology invest- 1 ments to cloud computing services; and 2 (2) deployment of cloud computing services. 3 (c) REPORT ON SPENDING.—Not later than 180 days 4 after the date of the enactment of this Act, the Secretary, 5 acting through the Chief, shall submit to the appropriate 6 committees of Congress a report on spending by the De- 7 partment on information technology investments, 8 disaggregated by information technology investment. 9 (d) DEFINITION OF APPROPRIATE COMMITTEES OF 10 CONGRESS.—In this section, the term ‘‘appropriate com- 11 mittees of Congress’’ means— 12 (1) the Committee on Veterans’ Affairs and the 13 Committee on Appropriations of the Senate; and 14 (2) the Committee on Veterans’ Affairs and the 15 Committee on Appropriations of the House of Rep- 16 resentatives. 17 SEC. 8. DEPARTMENT OF VETERANS AFFAIRS INFORMA- 18 TION TECHNOLOGY MANAGEMENT POLICIES 19 WITH RESPECT TO ROLE OF CHIEF INFORMA- 20 TION OFFICER. 21 The Secretary of Veterans Affairs shall ensure that 22 the information technology management policies of the 23 Department of Veterans Affairs address the role of the 24 10 † S 2336 ES Chief Information Officer of the Department with respect 1 to the following key responsibilities: 2 (1) Information technology strategic planning. 3 (2) Information technology workforce. 4 (3) Information technology planning, program- 5 ming, and budgeting. 6 (4) Information technology investment manage- 7 ment. 8 (5) Innovations and emerging technologies. 9 SEC. 9. CONTINUOUS MONITORING STRATEGY TO IMPROVE 10 INFORMATION SECURITY PROGRAMS OF DE- 11 PARTMENT OF VETERANS AFFAIRS. 12 In order to improve information security programs of 13 the Department of Veterans Affairs, the Secretary of Vet- 14 erans Affairs shall develop a continuous monitoring strat- 15 egy that addresses the following: 16 (1) Organization-defined metrics. 17 (2) Frequency of monitoring metrics. 18 (3) Ongoing status monitoring of metrics. 19 (4) Reporting of security status. 20 11 † S 2336 ES SEC. 10. REVISION OF PROCESSES OF DEPARTMENT OF 1 VETERANS AFFAIRS OFFICE OF INFORMA- 2 TION AND TECHNOLOGY RELATING TO RISK 3 MANAGEMENT. 4 (a) IN GENERAL.—Not later than 90 days after the 5 date of the enactment of this Act, the Secretary of Vet- 6 erans Affairs, acting through the Chief Information Offi- 7 cer of the Department of Veterans Affairs, shall revise the 8 processes of the Office of Information and Technology of 9 the Department relating to risk management to include 10 the following: 11 (1) Determining costs and benefits of imple- 12 menting the risk mitigation plan for each risk. 13 (2) Collecting performance measures on risk 14 handling activities. 15 (b) REVIEW BY COMPTROLLER GENERAL OF THE 16 UNITED STATES.—Not later than 180 days after the date 17 of the enactment of this Act, the Comptroller General of 18 the United States shall complete a review of the processes 19 revised pursuant to subsection (a). 20 Passed the Senate July 30, 2020. Attest: Secretary. 116TH CONGRESS 2D SESSION S. 2336 AN ACT To improve the management of information tech- nology projects and investments of the Depart- ment of Veterans Affairs, and for other purposes.