Appendices - Hampton Roads Transportation Planning Organization

Information Security Policy
APPENDIX A
ASSOCIATED POLICY/PROCEDURES:
• Information Security Office Charter, February 3, 2006
• Information Security Advisory Committee Charter, February 3, 2006
• ITRM Policy 90.1 Information Technology Security Policy, dated December 7, 2001
• ITRM Policy SEC500-02 Information Technology Security Management Policy, 2005
draft
• ITRM Standard SEC2000-01.1 Information Technology Security, dated December 7,
2001
• ITRM Standard SEC500-01 Information Technology Security Management, 2005 draft
• ISO-2-Data Classification, January 2006 draft
AUTHORITY REFERENCE:
• Code of Virginia § 2.2-603, Security Incident Reporting
• Code of Virginia § 2.2-2009, Database Audit
• Code of Virginia § 2.2-3705, Exclusions to Application of Chapter (FOIA)
• Code of Virginia § 44-146.22, Development of Measures to Prevent or Reduce
Harmful Consequences of Disasters
• Executive Order 69, Virginia’s Secure Commonwealth Initiative
OTHER REFERENCES:
• VDOT Corporate Tenet # 3, Preserve the integrity and security of information
• ISO/ECI 17799.2000(e), Code of Practice for Information Security Management
• ISO 27001, Information Security Management - Specification With Guidance for Use
• 6 CFR Part 29 Procedures for Handling Critical Infrastructure Information
• 33 CFR Part 6 Protection and Security of Vessels, Harbors and Waterfront Facilities
• 49 CFR Part 1520 Protection of Sensitive Security Information
• Information Security Office Charter
• Information Security Committee Charter
35