Appendices - Hampton Roads Transportation Planning Organization

Information Security Policy
SUBJECT: Information Security Policy Development
POLICY STATEMENT:
VDOT Information Security policies will be compliant with legislation, VITA policies and
other VDOT policies.
VDOT Information Security policies are initiated to address a security vulnerability or to
implement best practices and will follow a prescribed process that includes extensive
planning activities, a standard format and appropriate due diligence. Information
Security policies will be published only after thorough review and advice of the
Information Security Advisory Committee.
SCOPE:
This Policy is applicable to all VDOT employees, contractors, consultants, and all
others, including outsourced third parties, which have access to, or manage VDOT
information, networks, or applications.
This Policy encompasses all systems, automated and manual, for which the VDOT
Commissioner has administrative responsibility, including systems managed or hosted
by third parties on behalf of VDOT.
In all cases, applicable Federal and State statutes and regulations that guarantee either
protection or accessibility of VDOT information will take precedence over this Policy.
This policy is in addition to VITA policies.
RESPONSIBILITIES:
The Security and Emergency Management Division, Information Security Office (ISO)
will determine the need, develop, review, modify, publish and interpret VDOT’s
Information Security Policies. The ISO will ensure that new and revised policies and
procedures have been properly reviewed and approved prior to issuance.
VDOT employees may request the ISO to develop and/or modify Information Security
policies and may offer recommended content.
VDOT’s Information Security Advisory Committee will recommend publication of all
Information Security policies and procedures.
25