The FISMA Focus IPD

An internal investigation found the Department of Veterans  Affairs’ data security is so poor a data breach is “practically unavoidable”  within 18 months, according to a draft of the VA’s report.

“It’s practically unavoidable that a data breach to  financial, medical, and personal Veteran and employee protected information may  occur within the next 12 to 18 months, with no way of tracking the source of  the breach,” according to a report obtained by Military.com and first reported  by CNBC.

The  VA’s Office of Information & Technology Risk Management Team completed the  assessment in July and found the department was “non-compliant with its own  privacy and security policies and with federal laws and regulations,” the draft  report stated.

“The  VA cannot ensure the safety and privacy of Veteran and employee healthcare,  benefits, and financial information,” a heavily redacted version of the report  stated.

However,  the VA claimed the report may not be completely accurate. VA officials said the  assessment did not take into account all of the security factors the VA already  has in place for its systems and network.

The  VA emphasized the report was only an initial draft. VA leaders have since taken  steps to validate the concerns in the report or put in place additional  protections, an official said. The VA did not specify why the VA’s Information  & Technology Risk Management Team would not be aware of the full range of  the VA’s data security system.