{"formats":[{"name":"JSON","format":"json","url":"\/downloads\/2025\/code-json\/2.2-2009.json"},{"name":"Plain Text","format":"text","url":"\/downloads\/2025\/code-text\/2.2-2009.txt"},{"name":"XML","format":"xml","url":"\/downloads\/2025\/code-xml\/2.2-2009.xml"},{"name":"HTML","format":"html","url":"\/downloads\/2025\/code-html\/2.2-2009.html"}],"law_id":57889,"edition_id":1,"section_id":57889,"structure_id":15207,"section_number":"2.2-2009","catch_line":"Additional duties of the CIO relating to security of government information","history":"2000, c. 961, \u00a7\u00a7 2.1-563.42 - 2.1-563.44; 2001, c. 844, \u00a7\u00a7 2.2-136 - 2.2-138; 2002, c. 247, \u00a7 2.2-226.1; 2003, cc. 981, 1021; 2004, c. 638; 2007, cc. 769, 775; 2010, cc. 136, 145; 2015, c. 768; 2016, c. 296; 2017, c. 664; 2018, c. 775; 2019, c. 302; 2020, c. 717; 2022, cc. 626, 627; 2023, c. 768.","full_text":"A\n\nTo provide for the security of state government electronic information from unauthorized uses, intrusions or other security threats, the CIO shall direct the development of policies, standards, and guidelines for assessing security risks, determining the appropriate security measures and performing security audits of government electronic information. Such policies, standards, and guidelines shall apply to the Commonwealth’s executive, legislative, and judicial branches and independent agencies. The CIO shall work with representatives of the Chief Justice of the Supreme Court and Joint Rules Committee of the General Assembly to identify their needs. Such policies, standards, and guidelines shall, at a minimum:1\n\nAddress the scope and frequency of security audits. In developing and updating such policies, standards, and guidelines, the CIO shall designate a government entity to oversee, plan, and coordinate the conduct of periodic security audits of all executive branch agencies and independent agencies. The CIO shall coordinate these audits with the Auditor of Public Accounts and the Joint Legislative Audit and Review Commission. The Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly shall determine the most appropriate methods to review the protection of electronic information within their branches;2\n\nControl unauthorized uses, intrusions, or other security threats;3\n\nProvide for the protection of confidential data maintained by state agencies against unauthorized access and use in order to ensure the security and privacy of citizens of the Commonwealth in their interaction with state government. Such policies, standards, and guidelines shall include requirements that (i) any state employee or other authorized user of a state technology asset provide passwords or other means of authentication to use a technology asset and access a state-owned or state-operated computer network or database and (ii) a digital rights management system or other means of authenticating and controlling an individual’s ability to access electronic records be utilized to limit access to and use of electronic records that contain confidential information to authorized individuals;4\n\nAddress the creation and operation of a risk management program designed to identify information technology security gaps and develop plans to mitigate the gaps. All agencies in the Commonwealth shall cooperate with the CIO, including (i) providing the CIO with information required to create and implement a Commonwealth risk management program, (ii) creating an agency risk management program, and (iii) complying with all other risk management activities; and5\n\nRequire that any contract for information technology entered into by the Commonwealth’s executive, legislative, and judicial branches and independent agencies require compliance with applicable federal laws and regulations pertaining to information security and privacy.B\n\n1. The CIO shall annually report to the Governor, the Secretary, and General Assembly on the results of security audits, the extent to which security policy, standards, and guidelines have been adopted by executive branch and independent agencies, and a list of those executive branch agencies and independent agencies that have not implemented acceptable security and risk management regulations, policies, standards, and guidelines to control unauthorized uses, intrusions, or other security threats. For any executive branch agency or independent agency whose security audit results and plans for corrective action are unacceptable, the CIO shall report such results to (i) the Secretary, (ii) any other affected cabinet secretary, (iii) the Governor, and (iv) the Auditor of Public Accounts. Upon review of the security audit results in question, the CIO may take action to suspend the executive branch agency’s or independent agency’s information technology projects pursuant to subsection B of \u00a7 2.2-2016.1, limit additional information technology investments pending acceptable corrective actions, and recommend to the Governor and Secretary any other appropriate actions.2\n\nExecutive branch agencies and independent agencies subject to such audits as required by this section shall fully cooperate with the entity designated to perform such audits and bear any associated costs. Public bodies that are not required to but elect to use the entity designated to perform such audits shall also bear any associated costs.C\n\nIn addition to coordinating security audits as provided in subdivision B 1, the CIO shall conduct an annual comprehensive review of cybersecurity policies of every executive branch agency, with a particular focus on any breaches in information technology that occurred in the reviewable year and any steps taken by agencies to strengthen cybersecurity measures. Upon completion of the annual review, the CIO shall issue a report of his findings to the Chairmen of the House Committee on Appropriations and the Senate Committee on Finance and Appropriations. Such report shall not contain technical information deemed by the CIO to be security sensitive or information that would expose security vulnerabilities.D\n\nThe provisions of this section shall not infringe upon responsibilities assigned to the Comptroller, the Auditor of Public Accounts, or the Joint Legislative Audit and Review Commission by other provisions of the Code of Virginia.E\n\nThe CIO shall promptly receive reports from public bodies in the Commonwealth made in accordance with § 2.2-5514 and shall take such actions as are necessary, convenient, or desirable to ensure the security of the Commonwealth’s electronic information and confidential data.F\n\nThe CIO shall provide technical guidance to the Department of General Services in the development of policies, standards, and guidelines for the recycling and disposal of computers and other technology assets. Such policies, standards, and guidelines shall include the expunging, in a manner as determined by the CIO, of all confidential data and personal identifying information of citizens of the Commonwealth prior to such sale, disposal, or other transfer of computers or other technology assets.G\n\nThe CIO shall provide all directors of agencies and departments with all such information, guidance, and assistance required to ensure that agencies and departments understand and adhere to the policies, standards, and guidelines developed pursuant to this section.H\n\nThe CIO shall promptly notify all public bodies as defined in § 2.2-5514 of hardware, software, or services that have been prohibited pursuant to Chapter 55.3 (§ 2.2-5514 et seq.). The CIO shall restrict access to prohibited applications and websites in accordance with the provisions of § 2.2-5514.1.I\n\n1. This subsection applies to the Commonwealth’s executive, legislative, and judicial branches and independent agencies.2\n\nIn collaboration with the heads of executive branch and independent agencies and representatives of the Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly, the CIO shall develop and annually update a curriculum and materials for training all state employees in information security awareness and in proper procedures for detecting, assessing, reporting, and addressing information security threats. The curriculum shall include activities, case studies, hypothetical situations, and other methods of instruction (i) that focus on forming good information security habits and procedures among state employees and (ii) that teach best practices for detecting, assessing, reporting, and addressing information security threats.3\n\nEvery state agency shall provide annual information security training for each of its employees using the curriculum and materials developed by the CIO pursuant to subdivision 2. Employees shall complete such training within 30 days of initial employment and by January 31 each year thereafter.\n\t\t\t\tState agencies may develop additional training materials that address specific needs of such agency, provided that such materials do not contradict the training curriculum and materials developed by the CIO.\n\t\t\t\tThe CIO shall coordinate with and assist state agencies in implementing the annual information security training requirement.4\n\nEach state agency shall (i) monitor and certify the training activity of its employees to ensure compliance with the annual information security training requirement, (ii) evaluate the efficacy of the information security training program, and (iii) forward to the CIO such certification and evaluation, together with any suggestions for improving the curriculum and materials, or any other aspects of the training program. The CIO shall consider such evaluations when it annually updates its curriculum and materials.","order_by":null,"text":{"0":{"id":212060,"text":"To provide for the security of state government electronic information from unauthorized uses, intrusions or other security threats, the CIO shall direct the development of policies, standards, and guidelines for assessing security risks, determining the appropriate security measures and performing security audits of government electronic information. Such policies, standards, and guidelines shall apply to the Commonwealth’s executive, legislative, and judicial branches and independent agencies. The CIO shall work with representatives of the Chief Justice of the Supreme Court and Joint Rules Committee of the General Assembly to identify their needs. Such policies, standards, and guidelines shall, at a minimum:","type":"section","prefixes":["A"],"prefix":"A","entire_prefix":"A","prefix_anchor":"A","level":1,"next_prefix":"A1"},"1":{"id":212061,"text":"Address the scope and frequency of security audits. In developing and updating such policies, standards, and guidelines, the CIO shall designate a government entity to oversee, plan, and coordinate the conduct of periodic security audits of all executive branch agencies and independent agencies. The CIO shall coordinate these audits with the Auditor of Public Accounts and the Joint Legislative Audit and Review Commission. The Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly shall determine the most appropriate methods to review the protection of electronic information within their branches;","type":"section","prefixes":["A","1"],"prefix":"1","entire_prefix":"A1","prefix_anchor":"A1","level":2,"prior_prefix":"A","next_prefix":"A2"},"2":{"id":212062,"text":"Control unauthorized uses, intrusions, or other security threats;","type":"section","prefixes":["A","2"],"prefix":"2","entire_prefix":"A2","prefix_anchor":"A2","level":2,"prior_prefix":"A1","next_prefix":"A3"},"3":{"id":212063,"text":"Provide for the protection of confidential data maintained by state agencies against unauthorized access and use in order to ensure the security and privacy of citizens of the Commonwealth in their interaction with state government. Such policies, standards, and guidelines shall include requirements that (i) any state employee or other authorized user of a state technology asset provide passwords or other means of authentication to use a technology asset and access a state-owned or state-operated computer network or database and (ii) a digital rights management system or other means of authenticating and controlling an individual’s ability to access electronic records be utilized to limit access to and use of electronic records that contain confidential information to authorized individuals;","type":"section","prefixes":["A","3"],"prefix":"3","entire_prefix":"A3","prefix_anchor":"A3","level":2,"prior_prefix":"A2","next_prefix":"A4"},"4":{"id":212064,"text":"Address the creation and operation of a risk management program designed to identify information technology security gaps and develop plans to mitigate the gaps. All agencies in the Commonwealth shall cooperate with the CIO, including (i) providing the CIO with information required to create and implement a Commonwealth risk management program, (ii) creating an agency risk management program, and (iii) complying with all other risk management activities; and","type":"section","prefixes":["A","4"],"prefix":"4","entire_prefix":"A4","prefix_anchor":"A4","level":2,"prior_prefix":"A3","next_prefix":"A5"},"5":{"id":212065,"text":"Require that any contract for information technology entered into by the Commonwealth’s executive, legislative, and judicial branches and independent agencies require compliance with applicable federal laws and regulations pertaining to information security and privacy.","type":"section","prefixes":["A","5"],"prefix":"5","entire_prefix":"A5","prefix_anchor":"A5","level":2,"prior_prefix":"A4","next_prefix":"B"},"6":{"id":212066,"text":"1. The CIO shall annually report to the Governor, the Secretary, and General Assembly on the results of security audits, the extent to which security policy, standards, and guidelines have been adopted by executive branch and independent agencies, and a list of those executive branch agencies and independent agencies that have not implemented acceptable security and risk management regulations, policies, standards, and guidelines to control unauthorized uses, intrusions, or other security threats. For any executive branch agency or independent agency whose security audit results and plans for corrective action are unacceptable, the CIO shall report such results to (i) the Secretary, (ii) any other affected cabinet secretary, (iii) the Governor, and (iv) the Auditor of Public Accounts. Upon review of the security audit results in question, the CIO may take action to suspend the executive branch agency’s or independent agency’s information technology projects pursuant to subsection B of \u00a7 2.2-2016.1, limit additional information technology investments pending acceptable corrective actions, and recommend to the Governor and Secretary any other appropriate actions.","type":"section","prefixes":["B"],"prefix":"B","entire_prefix":"B","prefix_anchor":"B","level":1,"prior_prefix":"A5","next_prefix":"B2"},"7":{"id":212067,"text":"Executive branch agencies and independent agencies subject to such audits as required by this section shall fully cooperate with the entity designated to perform such audits and bear any associated costs. Public bodies that are not required to but elect to use the entity designated to perform such audits shall also bear any associated costs.","type":"section","prefixes":["B","2"],"prefix":"2","entire_prefix":"B2","prefix_anchor":"B2","level":2,"prior_prefix":"B","next_prefix":"C"},"8":{"id":212068,"text":"In addition to coordinating security audits as provided in subdivision B 1, the CIO shall conduct an annual comprehensive review of cybersecurity policies of every executive branch agency, with a particular focus on any breaches in information technology that occurred in the reviewable year and any steps taken by agencies to strengthen cybersecurity measures. Upon completion of the annual review, the CIO shall issue a report of his findings to the Chairmen of the House Committee on Appropriations and the Senate Committee on Finance and Appropriations. Such report shall not contain technical information deemed by the CIO to be security sensitive or information that would expose security vulnerabilities.","type":"section","prefixes":["C"],"prefix":"C","entire_prefix":"C","prefix_anchor":"C","level":1,"prior_prefix":"B2","next_prefix":"D"},"9":{"id":212069,"text":"The provisions of this section shall not infringe upon responsibilities assigned to the Comptroller, the Auditor of Public Accounts, or the Joint Legislative Audit and Review Commission by other provisions of the Code of Virginia.","type":"section","prefixes":["D"],"prefix":"D","entire_prefix":"D","prefix_anchor":"D","level":1,"prior_prefix":"C","next_prefix":"E"},"10":{"id":212070,"text":"The CIO shall promptly receive reports from public bodies in the Commonwealth made in accordance with § 2.2-5514 and shall take such actions as are necessary, convenient, or desirable to ensure the security of the Commonwealth’s electronic information and confidential data.","type":"section","prefixes":["E"],"prefix":"E","entire_prefix":"E","prefix_anchor":"E","level":1,"prior_prefix":"D","next_prefix":"F"},"11":{"id":212071,"text":"The CIO shall provide technical guidance to the Department of General Services in the development of policies, standards, and guidelines for the recycling and disposal of computers and other technology assets. Such policies, standards, and guidelines shall include the expunging, in a manner as determined by the CIO, of all confidential data and personal identifying information of citizens of the Commonwealth prior to such sale, disposal, or other transfer of computers or other technology assets.","type":"section","prefixes":["F"],"prefix":"F","entire_prefix":"F","prefix_anchor":"F","level":1,"prior_prefix":"E","next_prefix":"G"},"12":{"id":212072,"text":"The CIO shall provide all directors of agencies and departments with all such information, guidance, and assistance required to ensure that agencies and departments understand and adhere to the policies, standards, and guidelines developed pursuant to this section.","type":"section","prefixes":["G"],"prefix":"G","entire_prefix":"G","prefix_anchor":"G","level":1,"prior_prefix":"F","next_prefix":"H"},"13":{"id":212073,"text":"The CIO shall promptly notify all public bodies as defined in § 2.2-5514 of hardware, software, or services that have been prohibited pursuant to Chapter 55.3 (§ 2.2-5514 et seq.). The CIO shall restrict access to prohibited applications and websites in accordance with the provisions of § 2.2-5514.1.","type":"section","prefixes":["H"],"prefix":"H","entire_prefix":"H","prefix_anchor":"H","level":1,"prior_prefix":"G","next_prefix":"I"},"14":{"id":212074,"text":"1. This subsection applies to the Commonwealth’s executive, legislative, and judicial branches and independent agencies.","type":"section","prefixes":["I"],"prefix":"I","entire_prefix":"I","prefix_anchor":"I","level":1,"prior_prefix":"H","next_prefix":"I2"},"15":{"id":212075,"text":"In collaboration with the heads of executive branch and independent agencies and representatives of the Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly, the CIO shall develop and annually update a curriculum and materials for training all state employees in information security awareness and in proper procedures for detecting, assessing, reporting, and addressing information security threats. The curriculum shall include activities, case studies, hypothetical situations, and other methods of instruction (i) that focus on forming good information security habits and procedures among state employees and (ii) that teach best practices for detecting, assessing, reporting, and addressing information security threats.","type":"section","prefixes":["I","2"],"prefix":"2","entire_prefix":"I2","prefix_anchor":"I2","level":2,"prior_prefix":"I","next_prefix":"I3"},"16":{"id":212076,"text":"Every state agency shall provide annual information security training for each of its employees using the curriculum and materials developed by the CIO pursuant to subdivision 2. Employees shall complete such training within 30 days of initial employment and by January 31 each year thereafter.\n\t\t\t\tState agencies may develop additional training materials that address specific needs of such agency, provided that such materials do not contradict the training curriculum and materials developed by the CIO.\n\t\t\t\tThe CIO shall coordinate with and assist state agencies in implementing the annual information security training requirement.","type":"section","prefixes":["I","3"],"prefix":"3","entire_prefix":"I3","prefix_anchor":"I3","level":2,"prior_prefix":"I2","next_prefix":"I4"},"17":{"id":212077,"text":"Each state agency shall (i) monitor and certify the training activity of its employees to ensure compliance with the annual information security training requirement, (ii) evaluate the efficacy of the information security training program, and (iii) forward to the CIO such certification and evaluation, together with any suggestions for improving the curriculum and materials, or any other aspects of the training program. The CIO shall consider such evaluations when it annually updates its curriculum and materials.","type":"section","prefixes":["I","4"],"prefix":"4","entire_prefix":"I4","prefix_anchor":"I4","level":2,"prior_prefix":"I3"}},"ancestry":[{"id":15207,"edition_id":1,"name":"General Provisions","identifier":"1","label":"article","depth":5,"order_by":1,"parent_id":14335,"metadata":{},"date_created":"2026-06-26 03:52:58","date_modified":"2026-06-26 03:52:58","permalink":{"id":173433,"object_type":"structure","relational_id":15207,"identifier":"1","token":"2.2\/I\/C\/20.1\/1","url":"\/2.2\/I\/C\/20.1\/1\/","edition_id":1,"permalink":0,"preferred":1}},{"id":14335,"edition_id":1,"name":"Virginia Information Technologies Agency","identifier":"20.1","label":"chapter","depth":4,"order_by":1,"parent_id":13092,"metadata":{},"date_created":"2026-06-26 03:47:47","date_modified":"2026-06-26 03:47:47","permalink":{"id":173431,"object_type":"structure","relational_id":14335,"identifier":"20.1","token":"2.2\/I\/C\/20.1","url":"\/2.2\/I\/C\/20.1\/","edition_id":1,"permalink":0,"preferred":1}},{"id":13092,"edition_id":1,"name":"State Agencies Related to the General Operation of Government","identifier":"C","label":"part","depth":3,"order_by":1,"parent_id":12784,"metadata":{},"date_created":"2026-06-26 03:44:16","date_modified":"2026-06-26 03:44:16","permalink":{"id":172453,"object_type":"structure","relational_id":13092,"identifier":"C","token":"2.2\/I\/C","url":"\/2.2\/I\/C\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12784,"edition_id":1,"name":"Organization of State Government","identifier":"I","label":"subtitle","depth":2,"order_by":1,"parent_id":12749,"metadata":{},"date_created":"2026-06-26 03:43:53","date_modified":"2026-06-26 03:43:53","permalink":{"id":171455,"object_type":"structure","relational_id":12784,"identifier":"I","token":"2.2\/I","url":"\/2.2\/I\/","edition_id":1,"permalink":0,"preferred":1}},{"id":12749,"edition_id":1,"name":"Administration of Government","identifier":"2.2","label":"title","depth":1,"order_by":1,"parent_id":null,"metadata":{},"date_created":"2026-06-26 03:43:51","date_modified":"2026-06-26 03:43:51","permalink":{"id":171453,"object_type":"structure","relational_id":12749,"identifier":"2.2","token":"2.2","url":"\/2.2\/","edition_id":1,"permalink":0,"preferred":1}}],"structure_contents":[{"id":73383,"structure_id":15207,"section_number":"2.2-2005","catch_line":"Creation of Agency; appointment of Chief Information Officer","url":"\/2.2-2005\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2005","metadata":false},{"id":67174,"structure_id":15207,"section_number":"2.2-2006","catch_line":"Definitions","url":"\/2.2-2006\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2006","metadata":false},{"id":80478,"structure_id":15207,"section_number":"2.2-2007","catch_line":"Powers of the CIO","url":"\/2.2-2007\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2007","metadata":false},{"id":63438,"structure_id":15207,"section_number":"2.2-2007.1","catch_line":"Additional duties of the CIO relating to information technology planning and budgeting","url":"\/2.2-2007.1\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2007.1","metadata":false},{"id":82467,"structure_id":15207,"section_number":"2.2-2008","catch_line":"Repealed","url":"\/2.2-2008\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2008","metadata":false},{"id":57889,"structure_id":15207,"section_number":"2.2-2009","catch_line":"Additional duties of the CIO relating to security of government information","url":"\/2.2-2009\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2009","metadata":false},{"id":80320,"structure_id":15207,"section_number":"2.2-2010","catch_line":"Repealed","url":"\/2.2-2010\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2010","metadata":false},{"id":62483,"structure_id":15207,"section_number":"2.2-2011","catch_line":"Additional powers and duties relating to development, management, and operation of information technology","url":"\/2.2-2011\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2011","metadata":false},{"id":74110,"structure_id":15207,"section_number":"2.2-2012","catch_line":"Additional powers and duties related to the procurement of information technology","url":"\/2.2-2012\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2012","metadata":false},{"id":60730,"structure_id":15207,"section_number":"2.2-2012.1","catch_line":"Major information technology project procurement; terms and conditions","url":"\/2.2-2012.1\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2012.1","metadata":false},{"id":61119,"structure_id":15207,"section_number":"2.2-2013","catch_line":"Internal service and special funds","url":"\/2.2-2013\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2013","metadata":false},{"id":78759,"structure_id":15207,"section_number":"2.2-2014","catch_line":"Submission of information technology plans by state agencies and public institutions of higher education; designation of technology resource","url":"\/2.2-2014\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2014","metadata":false},{"id":83513,"structure_id":15207,"section_number":"2.2-2015","catch_line":"Repealed","url":"\/2.2-2015\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2015","metadata":false}],"previous_section":{"id":82467,"structure_id":15207,"section_number":"2.2-2008","catch_line":"Repealed","url":"\/2.2-2008\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2008","metadata":false},"next_section":{"id":80320,"structure_id":15207,"section_number":"2.2-2010","catch_line":"Repealed","url":"\/2.2-2010\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2010","metadata":false},"metadata":false,"official_url":"https:\/\/law.lis.virginia.gov\/vacode\/2.2-2009\/","history_text":"

This law was first created in 2000. The record of its establishment is cataloged in chapter 961<\/a> of that year\u2019s edition of \u201cActs of Assembly,\u201d the annual state publication listing all changes made to the Code of Virginia in that year. It has been modified 14 times. Those modifications are cataloged by \u201cThe Acts of Assembly,\u201d a state publication, by year and chapter. Those modifications that can be read on the General Assembly\u2019s website will be linked accordingly. Those modifications are as follows: in 2001, chapter 844<\/a>; in 2002, chapter 247<\/a>; in 2003, chapters 981<\/a> and 1021<\/a>; in 2004, chapter 638<\/a>; in 2007, chapters 769<\/a> and 775<\/a>; in 2010, chapters 136<\/a> and 145<\/a>; in 2015, chapter 768<\/a>; in 2016, chapter 296<\/a>; in 2017, chapter 664<\/a>; in 2018, chapter 775<\/a>; in 2019, chapter 302<\/a>; in 2020, chapter 717<\/a>; in 2022, chapters 626<\/a> and 627<\/a>; in 2023, chapter 768<\/a>.<\/p>","references":[{"id":55551,"section_number":"2.2-2036","catch_line":"Definitions","order_by":null,"url":"\/2.2-2036\/"},{"id":62796,"section_number":"2.2-2041","catch_line":"Workforce program evaluations; sharing of certain data; prohibited uses; civil penalty","order_by":null,"url":"\/2.2-2041\/"}],"refers_to":[{"id":81399,"section_number":"2.2-2016.1","catch_line":"Additional powers and duties of the CIO relating to project management","order_by":null,"url":"\/2.2-2016.1\/"},{"id":87153,"section_number":"2.2-5514","catch_line":"Prohibited products and services and required incident reporting","order_by":null,"url":"\/2.2-5514\/"}],"permalink":{"id":173455,"object_type":"law","relational_id":57889,"identifier":"2.2-2009","token":"2.2\/I\/C\/20.1\/1\/2.2-2009","url":"\/2.2-2009\/","edition_id":1,"permalink":0,"preferred":1},"url":"\/2.2-2009\/","token":"2.2\/I\/C\/20.1\/1\/2.2-2009","dublin_core":{"Title":"Additional duties of the CIO relating to security of government information","Type":"Text","Format":"text\/html","Identifier":"\u00a7 2.2-2009","Relation":"Code of Virginia"},"html":"\n\t\t\t\t\t\t

A.<\/span> To provide for the security of state government electronic information from unauthorized uses, intrusions or other security threats, the CIO shall direct the development of policies, standards, and guidelines for assessing security risks, determining the appropriate security measures and performing security audits of government electronic information. Such policies, standards, and guidelines shall apply to the Commonwealth’s executive, legislative, and judicial branches and independent agencies. The CIO shall work with representatives of the Chief Justice of the Supreme Court<\/span> and Joint Rules Committee of the General Assembly to identify their needs. Such policies, standards, and guidelines shall, at a minimum: <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

1.<\/span> Address the scope and frequency of security audits. In developing and updating such policies, standards, and guidelines, the CIO shall designate a government entity to oversee, plan, and coordinate the conduct of periodic security audits of all executive branch agencies and independent agencies. The CIO shall coordinate these audits with the Auditor of Public Accounts and the Joint Legislative Audit and Review Commission. The Chief Justice of the Supreme Court<\/span> and the Joint Rules Committee of the General Assembly shall determine the most appropriate methods to review the protection of electronic information within their branches; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Control unauthorized uses, intrusions, or other security threats; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Provide for the protection of confidential data<\/span> maintained by state agencies against unauthorized access and use in order<\/span> to ensure the security and privacy of citizens of the Commonwealth in their interaction with state government. Such policies, standards, and guidelines shall include requirements that (i) any state employee or other authorized user of a state technology asset<\/span> provide passwords or other means of authentication to use a technology asset<\/span> and access a state-owned or state-operated computer network or database and (ii) a digital rights management system or other means of authenticating and controlling an individual’s ability to access electronic records be utilized to limit access to and use of electronic records that contain confidential information to authorized individuals; <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Address the creation and operation of a risk management program designed to identify information technology<\/span> security gaps and develop plans to mitigate the gaps. All agencies in the Commonwealth shall cooperate with the CIO, including (i) providing the CIO with information required to create and implement a Commonwealth risk management program, (ii) creating an agency<\/span> risk management program, and (iii) complying with all other risk management activities; and <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

5.<\/span> Require that any contract<\/span> for information technology<\/span> entered into by the Commonwealth’s executive, legislative, and judicial branches and independent agencies require compliance with applicable federal laws<\/span> and regulations pertaining to information security and privacy. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

B.<\/span> 1. The CIO shall annually report to the Governor, the Secretary<\/span>, and General Assembly on the results of security audits, the extent to which security policy, standards, and guidelines have been adopted by executive branch and independent agencies, and a list of those executive branch agencies and independent agencies that have not implemented acceptable security and risk management regulations, policies, standards, and guidelines to control unauthorized uses, intrusions, or other security threats. For any executive branch agency<\/span> or independent agency whose security audit results and plans for corrective action are unacceptable, the CIO shall report such results to (i) the Secretary<\/span>, (ii) any other affected cabinet secretary<\/span>, (iii) the Governor, and (iv) the Auditor of Public Accounts. Upon review of the security audit results in question, the CIO may take action to suspend the executive branch agency<\/span>’s or independent agency’s information technology<\/span> projects pursuant to subsection B of \u00a7 2.2-2016.1<\/a>, limit additional information technology<\/span> investments pending acceptable corrective actions, and recommend to the Governor and Secretary<\/span> any other appropriate actions. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> Executive branch agencies and independent agencies subject to such audits as required by this section shall fully cooperate with the entity designated to perform such audits and bear any associated costs. Public bodies that are not required to but elect to use the entity designated to perform such audits shall also bear any associated costs. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

C.<\/span> In addition to coordinating security audits as provided in subdivision B 1, the CIO shall conduct an annual comprehensive review of cybersecurity policies of every executive branch agency<\/span>, with a particular focus on any breaches in information technology<\/span> that occurred in the reviewable year and any steps taken by agencies to strengthen cybersecurity measures. Upon completion of the annual review, the CIO shall issue<\/span> a report of his findings<\/span> to the Chairmen of the House Committee on Appropriations and the Senate Committee on Finance and Appropriations. Such report shall not contain technical information deemed by the CIO to be security sensitive or information that would expose security vulnerabilities. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

D.<\/span> The provisions of this section shall not infringe upon responsibilities assigned to the Comptroller, the Auditor of Public Accounts, or the Joint Legislative Audit and Review Commission by other provisions of the Code of Virginia. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

E.<\/span> The CIO shall promptly receive reports from public bodies in the Commonwealth made in accordance with § 2.2-5514<\/a> and shall take such actions as are necessary, convenient, or desirable to ensure the security of the Commonwealth’s electronic information and confidential data<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

F.<\/span> The CIO shall provide technical guidance to the Department of General Services in the development of policies, standards, and guidelines for the recycling and disposal of computers and other technology assets<\/span>. Such policies, standards, and guidelines shall include the expunging, in a manner as determined by the CIO, of all confidential data<\/span> and personal identifying information of citizens of the Commonwealth prior to such sale, disposal, or other transfer of computers or other technology assets<\/span>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

G.<\/span> The CIO shall provide all directors of agencies and departments with all such information, guidance, and assistance required to ensure that agencies and departments understand and adhere to the policies, standards, and guidelines developed pursuant to this section. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

H.<\/span> The CIO shall promptly notify all public bodies as defined in § 2.2-5514<\/a> of hardware, software, or services that have been prohibited pursuant to Chapter 55.3 (§ 2.2-5514<\/a> et seq.). The CIO shall restrict access to prohibited applications and websites in accordance with the provisions of § 2.2-5514.1<\/a>. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

I.<\/span> 1. This subsection applies to the Commonwealth’s executive, legislative, and judicial branches and independent agencies. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

2.<\/span> In collaboration with the heads of executive branch and independent agencies and representatives of the Chief Justice of the Supreme Court<\/span> and the Joint Rules Committee of the General Assembly, the CIO shall develop and annually update a curriculum and materials<\/span> for training all state employees in information security awareness and in proper procedures for detecting, assessing, reporting, and addressing information security threats. The curriculum shall include activities, case studies, hypothetical situations, and other methods of instruction (i) that focus on forming good information security habits and procedures among state employees and (ii) that teach best practices for detecting, assessing, reporting, and addressing information security threats. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

3.<\/span> Every state agency<\/span> shall provide annual information security training for each of its employees using the curriculum and materials<\/span> developed by the CIO pursuant to subdivision 2. Employees shall complete such training within 30 days of initial employment and by January 31 each year thereafter.\n\t\t\t\tState agencies may develop additional training materials<\/span> that address specific needs of such agency, provided that such materials<\/span> do not contradict the training curriculum and materials<\/span> developed by the CIO.\n\t\t\t\tThe CIO shall coordinate with and assist state agencies in implementing the annual information security training requirement. <\/i><\/a><\/p><\/section>\n\t\t\t\t\t\t

4.<\/span> Each state agency<\/span> shall (i) monitor and certify the training activity of its employees to ensure compliance with the annual information security training requirement, (ii) evaluate the efficacy of the information security training program, and (iii) forward to the CIO such certification and evaluation, together with any suggestions for improving the curriculum and materials<\/span>, or any other aspects of the training program. The CIO shall consider such evaluations when it annually updates its curriculum and materials<\/span>. <\/i><\/a><\/p><\/section>","plain_text":" CODE OF VIRGINIA\n\nADDITIONAL DUTIES OF THE CIO RELATING TO SECURITY OF GOVERNMENT INFORMATION (\u00a7\n2.2-2009)\n\nA. To provide for the security of state government electronic information from\nunauthorized uses, intrusions or other security threats, the CIO shall direct\nthe development of policies, standards, and guidelines for assessing security\nrisks, determining the appropriate security measures and performing security\naudits of government electronic information. Such policies, standards, and\nguidelines shall apply to the Commonwealth’s executive, legislative, and\njudicial branches and independent agencies. The CIO shall work with\nrepresentatives of the Chief Justice of the Supreme Court and Joint Rules\nCommittee of the General Assembly to identify their needs. Such policies,\nstandards, and guidelines shall, at a minimum:\n\n 1. Address the scope and frequency of security audits. In developing and\n updating such policies, standards, and guidelines, the CIO shall designate a\n government entity to oversee, plan, and coordinate the conduct of periodic\n security audits of all executive branch agencies and independent agencies. The\n CIO shall coordinate these audits with the Auditor of Public Accounts and the\n Joint Legislative Audit and Review Commission. The Chief Justice of the\n Supreme Court and the Joint Rules Committee of the General Assembly shall\n determine the most appropriate methods to review the protection of electronic\n information within their branches;\n\n 2. Control unauthorized uses, intrusions, or other security threats;\n\n 3. Provide for the protection of confidential data maintained by state\n agencies against unauthorized access and use in order to ensure the security\n and privacy of citizens of the Commonwealth in their interaction with state\n government. Such policies, standards, and guidelines shall include\n requirements that (i) any state employee or other authorized user of a state\n technology asset provide passwords or other means of authentication to use a\n technology asset and access a state-owned or state-operated computer network\n or database and (ii) a digital rights management system or other means of\n authenticating and controlling an individual’s ability to access\n electronic records be utilized to limit access to and use of electronic\n records that contain confidential information to authorized individuals;\n\n 4. Address the creation and operation of a risk management program designed to\n identify information technology security gaps and develop plans to mitigate\n the gaps. All agencies in the Commonwealth shall cooperate with the CIO,\n including (i) providing the CIO with information required to create and\n implement a Commonwealth risk management program, (ii) creating an agency risk\n management program, and (iii) complying with all other risk management\n activities; and\n\n 5. Require that any contract for information technology entered into by the\n Commonwealth’s executive, legislative, and judicial branches and\n independent agencies require compliance with applicable federal laws and\n regulations pertaining to information security and privacy.\n\nB. 1. The CIO shall annually report to the Governor, the Secretary, and General\nAssembly on the results of security audits, the extent to which security policy,\nstandards, and guidelines have been adopted by executive branch and independent\nagencies, and a list of those executive branch agencies and independent agencies\nthat have not implemented acceptable security and risk management regulations,\npolicies, standards, and guidelines to control unauthorized uses, intrusions, or\nother security threats. For any executive branch agency or independent agency\nwhose security audit results and plans for corrective action are unacceptable,\nthe CIO shall report such results to (i) the Secretary, (ii) any other affected\ncabinet secretary, (iii) the Governor, and (iv) the Auditor of Public Accounts.\nUpon review of the security audit results in question, the CIO may take action\nto suspend the executive branch agency’s or independent agency’s\ninformation technology projects pursuant to subsection B of \u00a7 2.2-2016.1, limit\nadditional information technology investments pending acceptable corrective\nactions, and recommend to the Governor and Secretary any other appropriate\nactions.\n\n 2. Executive branch agencies and independent agencies subject to such audits\n as required by this section shall fully cooperate with the entity designated\n to perform such audits and bear any associated costs. Public bodies that are\n not required to but elect to use the entity designated to perform such audits\n shall also bear any associated costs.\n\nC. In addition to coordinating security audits as provided in subdivision B 1,\nthe CIO shall conduct an annual comprehensive review of cybersecurity policies\nof every executive branch agency, with a particular focus on any breaches in\ninformation technology that occurred in the reviewable year and any steps taken\nby agencies to strengthen cybersecurity measures. Upon completion of the annual\nreview, the CIO shall issue a report of his findings to the Chairmen of the\nHouse Committee on Appropriations and the Senate Committee on Finance and\nAppropriations. Such report shall not contain technical information deemed by\nthe CIO to be security sensitive or information that would expose security\nvulnerabilities.\n\nD. The provisions of this section shall not infringe upon responsibilities\nassigned to the Comptroller, the Auditor of Public Accounts, or the Joint\nLegislative Audit and Review Commission by other provisions of the Code of\nVirginia.\n\nE. The CIO shall promptly receive reports from public bodies in the Commonwealth\nmade in accordance with § 2.2-5514 and shall take such actions as are\nnecessary, convenient, or desirable to ensure the security of the\nCommonwealth’s electronic information and confidential data.\n\nF. The CIO shall provide technical guidance to the Department of General\nServices in the development of policies, standards, and guidelines for the\nrecycling and disposal of computers and other technology assets. Such policies,\nstandards, and guidelines shall include the expunging, in a manner as determined\nby the CIO, of all confidential data and personal identifying information of\ncitizens of the Commonwealth prior to such sale, disposal, or other transfer of\ncomputers or other technology assets.\n\nG. The CIO shall provide all directors of agencies and departments with all such\ninformation, guidance, and assistance required to ensure that agencies and\ndepartments understand and adhere to the policies, standards, and guidelines\ndeveloped pursuant to this section.\n\nH. The CIO shall promptly notify all public bodies as defined in § 2.2-5514\nof hardware, software, or services that have been prohibited pursuant to Chapter\n55.3 (§ 2.2-5514 et seq.). The CIO shall restrict access to prohibited\napplications and websites in accordance with the provisions of §\n2.2-5514.1.\n\nI. 1. This subsection applies to the Commonwealth’s executive,\nlegislative, and judicial branches and independent agencies.\n\n 2. In collaboration with the heads of executive branch and independent\n agencies and representatives of the Chief Justice of the Supreme Court and the\n Joint Rules Committee of the General Assembly, the CIO shall develop and\n annually update a curriculum and materials for training all state employees in\n information security awareness and in proper procedures for detecting,\n assessing, reporting, and addressing information security threats. The\n curriculum shall include activities, case studies, hypothetical situations,\n and other methods of instruction (i) that focus on forming good information\n security habits and procedures among state employees and (ii) that teach best\n practices for detecting, assessing, reporting, and addressing information\n security threats.\n\n 3. Every state agency shall provide annual information security training for\n each of its employees using the curriculum and materials developed by the CIO\n pursuant to subdivision 2. Employees shall complete such training within 30\n days of initial employment and by January 31 each year thereafter.\n \t\t\t\tState agencies may develop additional training materials that address\n specific needs of such agency, provided that such materials do not contradict\n the training curriculum and materials developed by the CIO.\n \t\t\t\tThe CIO shall coordinate with and assist state agencies in implementing\n the annual information security training requirement.\n\n 4. Each state agency shall (i) monitor and certify the training activity of\n its employees to ensure compliance with the annual information security\n training requirement, (ii) evaluate the efficacy of the information security\n training program, and (iii) forward to the CIO such certification and\n evaluation, together with any suggestions for improving the curriculum and\n materials, or any other aspects of the training program. The CIO shall\n consider such evaluations when it annually updates its curriculum and\n materials.\n\nHISTORY: 2000, c. 961, \u00a7\u00a7 2.1-563.42 - 2.1-563.44; 2001, c. 844, \u00a7\u00a7 2.2-136\n- 2.2-138; 2002, c. 247, \u00a7 2.2-226.1; 2003, cc. 981, 1021; 2004, c. 638; 2007,\ncc. 769, 775; 2010, cc. 136, 145; 2015, c. 768; 2016, c. 296; 2017, c. 664;\n2018, c. 775; 2019, c. 302; 2020, c. 717; 2022, cc. 626, 627; 2023, c. 768.","edition":{"id":1,"name":"2025","slug":"2025","date_created":"2026-06-21 22:39:22","date_modified":"2026-06-21 22:39:22","current":1,"order_by":1,"last_import":null}}