2006 Code of Virginia § 2.2-2009 - Additional duties of the CIO relating to security of government database

2.2-2009. Additional duties of the CIO relating to security of governmentdatabase.

A. To ensure the security of state government databases and datacommunications from unauthorized uses, intrusions or other security threats,the CIO shall direct the development of policies, procedures and standardsfor assessing security risks, determining the appropriate security measuresand performing security audits of government databases and datacommunications. At a minimum, these policies, procedures and standards shalladdress the scope of security audits and which public bodies are authorizedto conduct security audits. In developing and updating such policies,procedures and standards, the CIO shall consider, at a minimum, the adviceand recommendations of the Council on Technology Services created pursuant to 2.2-2651.

B. The CIO shall designate a government entity to oversee, plan andcoordinate the conduct of periodic security audits of all executive branchagencies and institutions of higher education regarding the protection ofgovernment databases and data communications.

1. Security audits may include, but are not limited to, on-site audits aswell as reviews of all written security procedures.

2. The designated entity may contract with a private firm or firms thatspecialize in conducting such audits subject to approval of the CIO.

C. All public bodies subject to such audits as required by this section shallfully cooperate with the entity designated to perform such audits.

D. The provisions of this section shall not infringe upon responsibilitiesassigned to the Comptroller, the Auditor of Public Accounts, or the JointLegislative Audit and Review Commission by other provisions of the Code ofVirginia.

E. The CIO shall promptly receive reports from directors of departments inthe executive branch of state government made in accordance with 2.2-603and shall take such actions as are necessary, convenient or desirable toensure the security of the Commonwealth's databases and data communications.

(2000, c. 961, 2.1-563.42 - 2.1-563.44; 2001, c. 844, 2.2-136 -2.2-138; 2002, c. 247, 2.2-226.1; 2003, cc. 981, 1021; 2004, c. 638.)