SVAC Act of 2022

The SVAC Act of 2022 (HR7299) was introduced by Rep. Mrvan (D-IN-1) in March 2022, passed under suspension of the rules in November 2022, and was signed into law by the President on December 27, 2022. The law requires the Department of Veterans Affairs to enter into an agreement with a federally funded research and development center (FFRDC) to conduct an independent cybersecurity assessment of five high-impact VA information systems and the effectiveness of the VA's information security program. The VA must then submit a plan to Congress to address findings, and the GAO must review the assessment and the VA's response.

The money trail: The bill imposes a mandate but does not authorize or appropriate any specific dollar amount. The funding for the FFRDC agreement and any subsequent remediation activities must come from existing VA appropriations or future budget requests. This means the bill's market impact is indirect: it forces VA to prioritize cybersecurity spending, potentially reallocating funds from other IT programs. The VA's IT budget is substantial ($4-5 billion annually), and cybersecurity is a growing share. The bill essentially formalizes a process that will likely accelerate procurement of cybersecurity products and integration services.

Convergence: No related signals or procurement data were provided in this analysis. The related bills listed (S3863, HRES1464) share the same subject or are procedural, but since the bill is already law, they do not represent additional forward catalysts. However, the broader cybersecurity legislative trend (e.g., CISA enhancements, FedRAMP updates) provides tailwinds for the sector.

Structural winners: Cybersecurity pure-plays such as CrowdStrike ($CRWD), Palo Alto Networks ($PANW), and Fortinet ($FTNT) are positioned to supply endpoint, network, and cloud security solutions as the VA implements its remediation plan. Federal IT services integrators like Leidos ($LDOS) and SAIC ($SAIC) are likely to win task orders for assessment support, system integration, and managed security services, leveraging existing VA contract vehicles (e.g., T4NG). The FFRDC itself (e.g., MITRE, Aerospace Corp) is not publicly traded, but the downstream spending benefits multiple vendors.

Timeline: The law is already in effect. The VA was required to seek the FFRDC agreement within 60 days of enactment (by February 2023). The assessment and subsequent plan have likely been completed. The ongoing effect is the implementation of the remediation plan, which may extend over multiple years. For investors, the key monitoring point is VA cybersecurity procurement announcements and budget documents showing increased cybersecurity spending.