Security Categories
Use the cyber incident reporting form to report cybersecurity incidents in the Commonwealth.
Learn more about the State and Local Cybersecurity Grant Program (SLCGP).
In the COV RAMP Approved Applications list you will find the supplier name, product and brief SaaS/PaaS description.
Browse All Topics
Cybersecurity Grants
The State and Local Cybersecurity Grant Program (SLCGP) is a pioneering federal initiative aimed at bolstering cybersecurity for state and local governments.
Virginia Cybersecurity Planning Committee (VCPC)
The mission of the VCPC is to develop, implement, and maintain Virginia’s statewide cybersecurity plan, prioritize grant funding, and prevent redundant efforts.
Information Security Conference
An annual event hosted by the Commonwealth Information Security Council provides a platform for information security professionals to learn, network, and share best practices.
ISOAG Meetings
The monthly Information Security Officer’s Advisory Group (ISOAG) meetings provide opportunities for knowledge-sharing, training, and key cybersecurity discussions.
IS Council
The Information Security (IS) Council provides strategic guidance, education, and collaboration on statewide security and privacy initiatives.
IS Orientation
The Information Security (IS) Orientation is a small group session exploring cybersecurity principles, career opportunities, and compliance requirements.
Service Tower SOC Report Review Meetings
Service Tower SOC Report Review Meetings provide a dedicated forum for agencies to review the supplier SOC2 reports from the previous fiscal year.
Information Security Policies
Explore policies that help agencies safeguard Commonwealth data and systems.
Cyber Awareness
Find valuable tools and resources designed to strengthen cyber awareness and promote stronger security practices.
Archer
Access the Commonwealth of Virginia (COV) governance, risk, and compliance (GRC) management tool.
Archer User Manual (PDF)
Provides step-by-step guidance on how to add, modify, retire, search, and report on applications and AI records in Archer.
Annual Reports
Access VITA’s annual security reports which provide a comprehensive review of cybersecurity policies and initiatives across the Commonwealth.
Information Security FAQs Find quick answers to common questions about VITA's information security policies and programs.
ITRM Policies, Standards & Guidelines can be found in the Policy & Governance section.
Yes, the agency head is ultimately responsible for the security of the agency's information technology systems and data.
Specific responsibilities of the agency head, per the IT Information Security Standard (SEC501-10.1) PDF "Key Information Security Roles and Responsibilities", are to:
Designate an Information Security Officer (ISO) for the agency, biennially.
Ensure that an agency information security program is maintained, that is sufficient to protect the agency's IT systems, and that is documented and effectively communicated.
Review and approve the agency's Business Impact Analyses (BIA), Risk Assessments (RAs), and Continuity of Operations Plan (COOP), to include an IT Disaster Recovery Plan, if applicable.
Review and approve the System Security Plans for all agency IT systems classified as sensitive.
Ensure that an Information Security Audit Program is established. Note: Please see the IT Security Audit Standard (COV ITRM Standard SEC502-00) for the agency heads specifics responsibilities regarding audit program compliance.
Ensure a program of Information Security Program is established.
Ensure an Information Security Awareness and Training Program is established.
Provide the resources to enable employees to carry out their responsibilities for securing IT systems and data.
Identify a System Owner, generally the Business Owner, for each agency sensitive system.
Prevent conflict of interests by adhering to the security concept of separation of duties for the Information Security Officer, System/Data Owners and System Administrators.
Ensure that data breaches are reported to the Chief Information Security Officer. (Only applicable for Executive Branch agencies.)
The agency head may delegate all Information Security responsibilities, with the exception of the following:
Designating an Information Security Officer.
Ensuring the implementation of an Information Security Program.
Ensuring the implementation an Audit Program.
Note: The delegated party must copy the agency head on email submissions to the Chief Information Security Officer.
The ISO is designated by submittal of the ISO and back-up ISO name, title, and contact information to the Chief Information Security Officer (CISO) biennially by the agency head. For additional details see the IT Information Security Standard (SEC501-10.1) PDF "Key Information Security Roles and Responsibilities".
If the submission is sent by email, the submittal will be accepted from someone other than the agency head, if the agency head is copied.
Your agency Information Technology (IT) security audit plan should be developed based on the direction given in the IT Security Audit Standard (SEC 502) "Planning for IT Security Audits" and IT Security Audit Guideline (SEC 512.00) "IT Security Audit Plan". Please use the IT Security Audit Plan Template to complete your plan.
The agency head or designee must submit the audit plan annually to the Chief Information Security Officer (CISO). If the submittal is emailed by the designee, the agency head must be copied.
Your agency Information Technology (IT) security corrective action plan should be developed based on the direction given in the IT Security Audit Standard (SEC 502) "Documentation of IT Security Audits" and IT Security Audit Guideline (SEC 512.00) "Corrective Action Plan" and "CAP Periodic Reporting". Please use the Corrective Action Plan Template to complete your plan.
The agency head or designee must submit the corrective action plan quarterly to the Chief Information Security Officer (CISO) of the Commonwealth.
If the plan contains sensitive information, email CommonwealthSecurity@VITA.Virginia.Gov to request assistance with identifying an efficient and secure manner of transmitting the plan.
If you require additional access in the network environment to applications, network drives, etc, have your agency information technology resource (AITR) or information security officer (ISO) email the request to the VITA Customer Care Center (VCCC) at vccc@vita.virginia.gov.
Please feel free to use the "Duhs of Security" video in your information security awareness efforts. We are glad that you see enough value in our product to add it to your program.
Commonwealth Security and Risk Management can be contacted in the following ways:
Mail: Chief Information Security Officer, Virginia Information Technologies Agency, 7325 Beaufont Springs Drive, Richmond, VA 23225
There are two primary ways to submit a suspected or known security incident. One way to submit a security incident is to complete the online reporting form located here: Report a Cyber Incident.
The second way to submit a security incident is to call the VITA Customer Care Center (VCCC) at 1-866-637-8482. The VCCC will accept security incident reports for both IT partnership and non-IT partnership agencies.
It is imperative that you do not touch or turn off the computer until you receive instructions.
If an agency head determines that compliance with the provisions of the information security standards would adversely impact a business process of the agency, the agency head may request approval to deviate from a specific requirement by submitting an exception request to the Chief Information Security Officer. Please use the COV Security Standard Exception Form to submit an exception.
The exception request should be submitted to the Chief Information Security Officer (CISO). If the submission is sent by email, the ISO may send the email and copy the agency head.
If the exception contains sensitive information, email CommonwealthSecurity@VITA.Virginia.Gov to request assistance with identifying an efficient and secure manner of transmitting the exception.