Authorization of appropriations to the Office of Information and Technology of the Department of Veterans Affairs for certain purposes

(a) Authorization of appropriations There is authorized to be appropriated, and there is appropriated, to the Secretary of Veterans Affairs $500,000,000 for fiscal year 2026, to remain available until September 30, 2031, for deposit into the accounts of the Office of Information and Technology of the Department of Veterans Affairs for the purposes described in subsection (b). (b) Use of funds Funds shall be allocated and expended only as follows: (1) $150,000,000 for Enterprise Logistics and Supply Chain Visibility — To develop and deploy integrated, real-time enterprise-wide logistics systems, inventory visibility, pharmaceutical tracking, and medical supply chain resiliency capabilities. These systems shall support both routine veteran care operations and 4th Mission medical surge, patient movement, and emergency distribution requirements in consultation with DoD, FEMA, and other agencies. (2) $200,000,000 for Cybersecurity and Operational Resiliency — For zero trust architecture implementation, threat detection, secure cloud hardening, endpoint protection, continuity of operations (COOP) platforms, and protection of mission-essential systems against cyber and physical disruptions. Funds shall prioritize high-risk legacy systems and medical device security. (3) $150,000,000 for Resilient Communications and Digital Records Modernization — For interoperable, survivable communications infrastructure and targeted digitization/automation of high-volume paper-based workflows (claims, correspondence, administrative records) to reduce fraud risk and improve continuity during degraded or emergency environments. Funds shall not be used for broad Electronic Health Record Modernization expansion. (c) Oversight and protection of sensitive information (1) The Secretary may obligate and expend amounts under this section in classified, controlled, or protected environments consistent with applicable law. (2) Not later than 90 days after the date of enactment of this Act, and annually thereafter until September 30, 2031, the Secretary shall provide to the Committees on Veterans’ Affairs of the House of Representatives and the Senate a briefing and report on— (A) activities carried out using funds made available under this section; (B) progress on improving cybersecurity, resiliency, continuity, logistics, communications, digitization, and mission assurance capabilities; and (C) coordination with other Federal agencies, as appropriate. Such reports may include a classified annex. (3) Detailed implementation plan and quarterly briefings (A) Not later than 90 days after the date of enactment of this Act, the Secretary, acting through the Office of Information and Technology, shall submit to the Committees on Veterans’ Affairs of the House of Representatives and the Senate a comprehensive implementation plan. The plan shall include— (i) specific milestones, deliverables, and performance metrics for each category of activities in subsection (b); (ii) a zero trust architecture strategy with timelines and technical requirements; (iii) a detailed expenditure plan by fiscal quarter and by activity category; and(iv) any proposed interagency or private-sector partnerships. (B) Not later than 30 days after the end of each fiscal quarter through September 30, 2031, the Secretary shall provide the Committees a briefing and written report on— (i) obligations and expenditures to date, by category; (ii) progress against the implementation plan; (iii) any deviations from the plan and corrective actions; and (iv) updated projections for remaining funds. The initial briefing shall be in person; subsequent briefings may be virtual unless otherwise requested by the Committees. Reports may include a classified annex. (d) Limitation Funds made available under this section may not be used for any purpose unrelated to information technology modernization, cybersecurity, operational resilience, logistics modernization, communications modernization, digitization, or fraud prevention activities of the Department. (e) Supplement, not supplant Amounts made available under this section shall supplement and not supplant other amounts otherwise authorized to be appropriated for the Office of Information and Technology of the Department of Veterans Affairs. (f) Rule of construction Nothing in this section shall be construed to require the public disclosure of classified information, controlled unclassified information, operational details, cybersecurity architecture, contingency planning information, mission-essential system design, or information otherwise protected from disclosure under Federal law or Executive Order. (g) Reauthorization and sunset (1) Reauthorization required The authority provided under this section to obligate or expend amounts appropriated pursuant to subsection (a) shall terminate on September 30, 2031, unless subsequently reauthorized by law. (2) Limitation on new obligations after sunset Beginning on October 1, 2031, the Secretary may not initiate, award, enter into, renew, extend, or otherwise obligate funds for any new program, project, activity, contract, task order, or operational capability carried out pursuant to this section unless expressly authorized by a subsequent Act of Congress. (3) Continuation of existing activities Nothing in paragraph (2) shall be construed to prohibit the Secretary from— (A) maintaining, sustaining, securing, operating, completing, or supporting any program, project, activity, contract, system, platform, infrastructure capability, or operational activity lawfully initiated using amounts obligated before September 30, 2031; or (B) carrying out similar information technology modernization, cybersecurity, continuity of operations, logistics modernization, communications modernization, operational resiliency, or mission assurance activities using amounts otherwise authorized and appropriated under any other provision of law. (h) Use of existing contracting authorities The Secretary shall carry out the activities authorized under this section, to the maximum extent practicable, through contracts, task orders, delivery orders, interagency agreements, cooperative agreements, or other agreements entered into under existing authorities of title 38, United States Code, as applicable. Amounts made available under this section shall not be used to establish a new full-time equivalent position, hire additional employees of the Department, or otherwise increase the number of full-time equivalent employees of the Department, except to the extent the Secretary determines that such personnel are necessary for the oversight, management, cybersecurity supervision, acquisition administration, or operational integration of activities carried out under this section.