VA must show sustained progress with cybersecurity for auditors to give their seal of approval