Way back in May 2006, a laptop containing the personal information of millions of veterans was stolen from the home of a Veterans Affairs employee. Since then the department set out to establish information security controls with 400 actions to improve security.

Robert Howard, Veterans Affairs' CIO, has announced that 40 percent of those actions have been completed. FCW.com reports that the department now requires all laptops to be encrypted and anyone who handles VA data on their personal computers to encrypt those, as well. It also is monitoring all ports for unauthorized devices and adequate antivirus protection.

In October, IT BusinessEdge blogger Susan Hall reported that the VA awarded Plateau Systems a $10 million one-year contract to train its employees on such topics as cyber-security and privacy. The VA is trying to change to the security culture of the department to one of social responsibility, publishing a handbook detailing rules of behavior and other data security guidelines.

But even as the VA makes its slow progress toward improved security, other agencies are making headlines for similar breaches.