Appendices - Hampton Roads Transportation Planning Organization

Information Security Policy
APPENDIX C
Information Security Policy Review and Publication Process
1. The ISO determines the need for a new or revised Information Security policy based
on VDOT employee, management or Information Security Advisory Committee input;
industry trends; or perceived vulnerabilities.
2. Tier 1 policies will address a broad mission area such as Information Security.
VDOT will have only one Tier 1 Information Security Policy.
3. Tier 2 policies will address a specific information security vulnerability or internal
control area.
4. Tier 3 policies will define a specific process to be implemented in support of a Tier 2
policy. In cases where the procedure is limited, it may be included as an appendix of
the Tier 2 policy.
5. When the ISO determines that an Information Security Policy needs to be
developed, the development of an initial draft will be assigned to an ISO staff member.
6. The initial draft will then be vetted throughout the ISO and presented to a Core
Review Team. The Core Review Team, made up of three to five members, will review
the draft policy. The membership of this team will typically include a representative from
the Internal Audit division and the Information Technology division as well as
representatives from the affected organizational unit(s) of VDOT.
7. The Core Review Team will review and/or comment on the proposed Information
Security policy for a minimum of 30 days. The Core Review Team will employ formal
review techniques such as a structured walk-thru. During the Core Review Team
review period, others (e.g., other VDOT, VITA) may be invited to participate in the
review virtually.
8. The Core Review Team will prepare the draft policy along with any unresolved
comments for review by the Information Security Advisory Committee.
9. The Information Security Advisory Committee will review the draft document and
recommend its publication by the ISO.
10. The ISO will publish Information Security Policies consistent with the advice of the
Information Security Advisory Committee. Policies will be published in a standard
format with an effective date. All ISO policies will be review and re-published annually.
29