§ 2.2-2009 of theCode of Virginia mandates that the Chief Information Officer (CIO) is responsible for the development of policies, standards, and guidelines for assessing security risks, determining the appropriate security measures and performing security audits of government electronic information. Such policies, standards, and guidelines shall apply to the Commonwealth's executive, legislative, and judicial branches and independent agencies.
Further, it requires that any contract for information technology entered into by the Commonwealth's executive, legislative, and judicial branches and independent agencies require compliance with applicable federal laws and regulations pertaining to information security and privacy. While agencies are required to comply with all security policies, standards and guidelines (PSGs), Security Standard SEC525-02 provides agency compliance requirements for non-CESC hosted cloud solutions. These PSGs are located at this URL: ITRM Policies, Standards & Guidelines
In addition to Security Standard SEC525-02, for any procurements for third-party (supplier-hosted) cloud services (i.e., Software as a Service), since agencies have $0 delegated authority to procure these types of solutions, there is a distinct process for obtaining VITA approval to procure. At the link above, refer to the Third Party Use Policy. Your agency’s Information Security Officer or AITR can assist you in understanding this process and in obtaining the required documentation to include in your solicitation or contract. There are specially required Cloud Services terms and conditions that must be included in your solicitation and contract, and a questionnaire that must be included in the solicitation for bidders to complete and submit with their proposals. In addition, if a procurement is a cloud-based procurement (i.e., off-premise hosting), following VITA’s selection of the best proposal(s) representing best value to the commonwealth, Supplier’s failure to successfully answer, negotiate and/or comply with any resulting security exceptions that may arise in order to approve Supplier’s cloud application, may result in removal from further consideration. Refer to Chapter 28 for more information. You may also contact: firstname.lastname@example.org