Section 2.2-2009 of the Code of Virginia mandates that the Chief Information Officer (CIO) is responsible for the development of policies, standards, and guidelines for assessing security risks, determining the appropriate security measures and performing security audits of government electronic information. Such policies, standards, and guidelines shall apply to the Commonwealth's executive, legislative, and judicial branches and independent agencies. Further, it requires that any contract for information technology entered into by the Commonwealth's executive, legislative, and judicial branches and independent agencies require compliance with applicable federal laws and regulations pertaining to information security and privacy. While agencies are required to comply with all security policies, standards and guidelines (PSGs), Security Standard SEC525 provides agency compliance requirements for non-CESC hosted cloud solutions. These PSGs are located at this URL: https://www.vita.virginia.gov/it-governance/itrm-policies-standards/
Furthermore, § 2.2-2009 requires the CIO to (i) conduct an annual comprehensive review of cybersecurity policies of every executive branch agency, with a particular focus on breaches in information technology that occurred in the reviewable year and any steps taken by agencies to strengthen cybersecurity measures, and (ii) issue a report of his findings to the Chairmen of the House Committee on Appropriations and the Senate Committee on Finance.
In addition to Security Standard SEC525, for any procurements for third-party (supplier- hosted) cloud services (i.e., Software as a Service), since agencies have $0 delegated authority to procure these types of solutions, there is a distinct process for obtaining VITA approval to procure. At the link above, refer to the Third Party Use Policy. Your agency's Information Security Officer or AITR can assist you in understanding this process and in obtaining the required documentation to include in your solicitation or contract. There are specially required Cloud Services terms and conditions that must be included in your solicitation and contract, and a questionnaire that must be included in the solicitation for bidders to complete and submit with their proposals. You may also contact: firstname.lastname@example.org.