Your browser does not support JavaScript!

Archived Page: Executive Toolkit

Hello. You have reached an archived page. Content on this page is no longer being updated. Looking for a service? Please return to our home page.

Designate an information security officer and implement an information security program

Because the security of information is essential to citizen's trust and continuity of government services, the agency head bears the responsibility for the security of the agency's IT systems and data as set forth in the Information Security Standard (SEC501-01). To secure the agency's IT systems and data, the agency head is required to designate an information security officer (ISO) no less than biennially and, where feasible, a back-up ISO to implement a Commonwealth of Virginia (COV) compliant information security program that is properly documented and effectively communicated. The ISO and back-up ISO name, title and contact information must be submitted to Chief Information Security Officer of the Commonwealth at CommonwealthSecurity@vita.virginia.gov.

Implement an audit program

As the Commonwealth's reliance on information technology increases, it is imperative that agencies maintain compliance with Information Technology (IT) Security Audit Standard.

The agency head is responsible for the development and implementation of an agency plan for IT security audits, and for submitting this plan to the Chief Information Security Officer (CISO) of the Commonwealth at CommonwealthSecurity@VITA.virginia.gov. Overall compliance with the standard includes:

  • Requiring that the planned IT security audits are conducted on schedule,
  • Receiving reports of the results of IT security audits,
  • Requiring development of corrective action plans to address findings of IT security audits, and
  • Reporting to the CISO all IT security audit findings and progress in implementing corrective actions in response to IT security audit findings.

In addition, if the IT security audit shows no findings, this is to be reported to the CISO as well.

Report data breaches to the Chief Information Officer

Data breaches can be costly to organizations and severely damage their reputation; therefore, it is crucial that the agency head be diligent in reporting known data breaches. The Code of Virginia § 2.2-603.F, requires the director of every department in the executive branch of state government to report to the Chief Information Officer, all known incidents that threaten the security of the commonwealth's databases and data communications resulting in exposure of data protected by federal or state laws, or other incidents compromising the security of the commonwealth's information technology systems with the potential to cause major disruption to normal agency activities. Reports shall be made to the Chief Information Officer within 24 hours from when the department discovered or should have discovered the occurrence. To report and incident please use the online Report a Cyber Incident form.