The Subcommittee on Technology Modernization Oversight Hearing by the U.S. House Committee on Veterans' Affairs convened on November 21, 2024, to address critical issues surrounding cybersecurity within the Department of Veterans Affairs (VA). The meeting highlighted the increasing threats posed by cyberattacks on healthcare systems, particularly those affecting veterans.

The hearing began with an acknowledgment of the alarming statistics regarding data breaches in the healthcare sector, with over 519 million health records exposed in the past 15 years. The chairman emphasized the VA's responsibility to protect sensitive medical, personal, and financial information for millions of veterans and their families. He noted that while Congress has consistently provided cybersecurity resources, improvements within the VA have been slow, as indicated by the Office of Inspector General (OIG) reports.

The chairman expressed concern over the VA's cybersecurity posture, citing a recent audit that revealed persistent deficiencies. He pointed out that the VA had received 25 recommendations from the OIG, with disputes over 10 of them, and stressed the need for accountability in addressing these vulnerabilities. The MITRE Corporation's cybersecurity assessment, commissioned by Congress, further underscored the inadequacies in the VA's cybersecurity measures, revealing gaps in governance, processes, and staffing.

The discussion also touched on the VA's transition to a "zero trust" cybersecurity model, which requires verification for all users and systems. The chairman called for measurable goals to ensure that veterans' data is adequately protected and criticized the potential for ongoing funding without tangible results.

Ranking member Sheriff Liz McCormick echoed these sentiments, highlighting the systemic issues within the VA's cybersecurity efforts despite incremental funding increases. She urged a holistic approach to cybersecurity that encompasses not only the VA's internal systems but also its contractors and community partners, who are increasingly targeted by cyber threats.

The hearing featured testimony from key witnesses, including VA officials and representatives from the OIG and MITRE. VA's Chief Information Officer, Kurt Del Bene, outlined the department's cybersecurity initiatives and acknowledged the challenges posed by budget constraints and the recruitment of skilled personnel. He emphasized the importance of continuous improvement in cybersecurity practices to protect veteran data.

The OIG's representative reiterated the complexity of managing cybersecurity within the VA, noting that many of the concerns raised in previous audits remain unaddressed. The OIG has expanded its inspection program to evaluate compliance at various VA facilities, reporting that while some improvements have been made, significant vulnerabilities persist.

In conclusion, the hearing underscored the urgent need for the VA to enhance its cybersecurity measures to safeguard veterans' information. The subcommittee members expressed their commitment to ongoing oversight and collaboration to ensure that the VA can effectively address these challenges and protect the data of those who have served the nation.