ECOS FAQs

Yes, If it is storing, processing or transmitting COV data. Also, if the data is “sensitive” for integrity or availability.  Each use case is different and you may need to submit your use case for evaluation

Review the ECOS applicability guidelines knowledge base article (KBA) on the VITA Service Portal.

You can find the ECOS Approved list by visiting our Approved Application List and ECOS Metrics page.

• Download: ECOS attachment A to standard form (1-003).
• You can also access the ECOS attachment A form on the Service Portal.
• The assessment form is also available on VITA's Online Customer Forms page under Commonwealth Security & Risk Management.

The Vendor/Supplier is to complete the form.

The Vendor/Supplier should provide the requested supporting documentation (this helps expedite the process).

If you would like to procure the application, you will need to send an email to the Enterprise Services mailbox and request a copy of the Approval email.

• Once you receive the email, you must file the applicable security exceptions and submit a request for Oversight, which will start the process for the completion of the Cloud Terms and Conditions.

Yes. Each Agency must complete the required security exceptions and cloud terms and conditions prior to purchasing.

Instructions on how to submit a request for oversight knowledge base article (KBA) can be found on the VITA Service Portal.

Security exceptions need to be sent to commonwealthsecurity@vita.virginia.gov

The process is dependent on the Vendor providing expedient responses to the request and the required documentation.

• The assessment process usually takes between 25 to 50 days to complete.

Please note: If the required documentation is provided at the time of submission, the process goes more quickly.

VITA has a pre-approved NDA completed for ECOS assessments for the vendors/suppliers.

• Download: ECOS confidentiality agreement
• You can a request a copy of the NDA by sending email to: Enterpriseservices@vita.virginia.gov
• The NDA is also available on VITA's Online Customer Forms page under Commonwealth Security & Risk Management