; and (2) the Committee on Veterans' Affairs and the Committee on Appropriations of the House of Representatives. 8. Department of Veterans Affairs information technology management policies with respect to role of Chief Information Officer The Secretary of Veterans Affairs shall ensure that the information technology management policies of the Department of Veterans Affairs address the role of the Chief Information Officer of the Department with respect to the following key responsibilities: (1) Information technology strategic planning. (2) Information technology workforce. (3) Information technology planning, programming, and budgeting. (4) Information technology investment management. (5) Innovations and emerging technologies. 9. Continuous monitoring strategy to improve information security programs of Department of Veterans Affairs In order to improve information security programs of the Department of Veterans Affairs, the Secretary of Veterans Affairs shall develop a continuous monitoring strategy that addresses the following: (1) Organization-defined metrics. (2) Frequency of monitoring metrics. (3) Ongoing status monitoring of metrics. (4) Reporting of security status. 10. Revision of processes of Department of Veterans Affairs Office of Information and Technology relating to risk management (a) In general Not later than 90 days after the date of the enactment of this Act, the Secretary of Veterans Affairs, acting through the Chief Information Officer of the Department of Veterans Affairs, shall revise the processes of the Office of Information and Technology of the Department relating to risk management to include the following: (1) Determining costs and benefits of implementing the risk mitigation plan for each risk. (2) Collecting performance measures on risk handling activities. (b) Review by Comptroller General of the United States Not later than 180 days after the date of the enactment of this Act, the Comptroller General of the United States shall complete a review of the processes revised