Policies, Standards & Guidelines

Pursuant to Governor Youngkin’s Executive Order 30 (EO 30 PDF | news release), visit VITA's Artificial Intelligence section to learn more about the Virginia standards on Artificial Intelligence use by state agencies.

Achieving the ultimate enterprise architecture (EA) requires collaboration, cooperation and coordination among agency business stakeholders, systems developers, partners and technology infrastructure providers. EA contributes to this collegial environment through EA policies (EA 200), EA standards (EA 225) and EA reports containing guidelines, recommendations and best practices which address all components of commonwealth EA. The policies, standards and reports provide requisite guidance and technical direction for the Commonwealth towards achieving an envisioned and evolving to be EA.

Executive branch agencies shall comply with the direction provided by the EA when developing and implementing technology solutions and the corresponding IT infrastructure required in supporting the business needs of the Commonwealth.

It is the intent of EA to standardize and simplify the many technologies and products in use throughout the commonwealth which generally results in a reduction in the number of technologies and products used to develop and support production systems. To support the intent of EA, we will continue ongoing development and implementation of EA and related standards.

Please refer to the following documents for guidance and direction:

• Enterprise Architecture Policy (EA200)
• Enterprise Architecture Standard (EA225)
• Cloud Based Hosting Services IT Solutions Policy (EA300) (02/26/2022) (Word version)
• Enterprise Data Standards

 

• Model Virginia Map Accuracy Standards Guideline (ITRM Guideline OTH701-00)
• Road Center Line Standard (OTH 703-00)
• VGIN Administrative Boundary Data Standard (OTH 702-00)

Information Security Policies

• IT Information Security Policy - SEC519
• Prohibited Hardware, Software and Services Policy - SEC528

Information Security Standards

• Information Security Standard (SEC530) (Word) (Excel)
• IT Risk Management Standard (SEC520)
• IT Security Audit Standard (SEC502)  
• Security Awareness Training Standard (SEC527)
• IT Standard Use of Non-Commonwealth Computing Devices to Telework (SEC511)  
• Removal of Commonwealth Data from Electronic Media Standard (SEC514)
• Secure Remote Access to Online Court Documents Standard (SEC503-02.2)
• Virginia Real Property Electronic Recording Standard (SEC505)

Superseded Standards

• Hosted Environment Information Security Standard (SEC525)
• Information Security Standard (SEC501)

Tools and Templates

• Agency Security Awareness Training Solution Form
• Agency Security Awareness Training Verification and Compliance Form
• Annual Risk Assessment Review and Certification
• Application Template
• Archer User Manual
• Audit Remediation Plan Template  (also called Audit Corrective Action Plan (CAP))
• BIA Template
• COV ISO Certification and Continuing Education Requirements
• Data Set Template
• Data Removal
• Exception Request Form - COV IT Security Policy and Standard  
• Interoperability Security Agreement Template
• IT Risk Assessment Plan Template  
• IT Security Audit Plan Template - Word
• IT Security Audit Plan Template - Excel
• IT Security Audit Resources Template  
• IT Security Policy & Procedure Templates
• SEC527 Crosswalk 2024
• Mission Essential Function Identification Worksheets
• Public Kiosk Guideline Template
• Resources for the Removal of Commonwealth Data from Electronic Media
• Risk Treatment Plan Template
• Scan Treatment Plan Template
• Risk Treatment Plan Template SEC530
• SEC530 Control Summaries
• SEC530 SSP Template - All Controls
• SEC530 SSP Template - Organization Controls
• SEC530 SSP Template - Non-Sensitive System Controls
• SEC530 SSP Template - Sensitive System Controls
• Security Roles and Responsibilities Template  
• System Inventory and Definition Template
• VDEM Continuity Plan Template  
• VDEM Guide to Identifying Mission Essential Functions  
• Vulnerability Scanning and Intrusion Detection System (IDS) Reporting FAQs

• Commonwealth Project Management Guideline (CPM 110-05) (Word version)
• Project Management Standard (CPM112)
• Project Manager Selection and Training Standard (CPM 111)

Visit Project Management for more information.

• Technology Management Policy (GOV105-05)
• Information Technology Investment Management Standard (CPM-516) (Word version)

Visit IT Investment Management for more information.

• Cloud Third Party Use Policy

Visit COV Cloud for more information.