Virginia Law

Article 1. General Provisions.

A. There is hereby created the Virginia Information Technologies Agency (VITA), which shall serve as the agency responsible for administration and enforcement of the provisions of this Chapter.

B. The Governor shall appoint a Chief Information Officer of the Commonwealth (the CIO) to oversee the operation of VITA. The CIO shall exercise the powers and perform the duties conferred or imposed upon him by law and perform such other duties as may be required by the Governor and the Secretary of Administration.

2003, cc. 981, 1021; 2009, c. 826; 2010, cc. 136, 145; 2016, c. 296; 2020, c. 738.

As used in this chapter, unless the context requires a different meaning:

"Commonwealth information technology project" means any state agency information technology project that is under Commonwealth governance and oversight.

"Commonwealth Project Management Standard" means a document developed and adopted by the Chief Information Officer (CIO) pursuant to § 2.2-2016.1 that describes the methodology for conducting information technology projects, and the governance and oversight used to ensure project success.

"Confidential data" means information made confidential by federal or state law that is maintained in an electronic format.

"Enterprise" means an organization with common or unifying business interests. An enterprise may be defined at the Commonwealth level or secretariat level for program and project integration within the Commonwealth, secretariats, or multiple agencies.

"Executive branch agency" or "agency" means any agency, institution, board, bureau, commission, council, public institution of higher education, or instrumentality of state government in the executive department listed in the appropriation act. However, "executive branch agency" or "agency" does not include the University of Virginia Medical Center, a public institution of higher education to the extent exempt from this chapter pursuant to the Restructured Higher Education Financial and Administrative Operations Act (§ 23.1-1000 et seq.) or other law, or the Virginia Port Authority.

"Information technology" means communications, telecommunications, automated data processing, applications, databases, data networks, the Internet, management information systems, and related information, equipment, goods, and services. The provisions of this chapter shall not be construed to hamper the pursuit of the missions of the institutions in instruction and research.

"ITAC" means the Information Technology Advisory Council created in § 2.2-2699.5.

"Major information technology project" means any Commonwealth information technology project that has a total estimated cost of more than $1 million or that has been designated a major information technology project by the CIO pursuant to the Commonwealth Project Management Standard developed under § 2.2-2016.1.

"Secretary" means the Secretary of Administration.

"Technology asset" means hardware and communications equipment not classified as traditional mainframe-based items, including personal computers, mobile computers, and other devices capable of storing and manipulating electronic data.

"Telecommunications" means any origination, transmission, emission, or reception of data, signs, signals, writings, images, and sounds or intelligence of any nature, by wire, radio, television, optical, or other electromagnetic systems.

1984, c. 746, § 2.1-563.13; 1997, c. 858; 2001, c. 844, § 2.2-1301; 2003, cc. 981, 1021; 2004, c. 145; 2007, c. 769; 2010, cc. 136, 145; 2011, c. 739; 2012, cc. 803, 835; 2014, cc. 37, 181; 2015, c. 768; 2016, c. 296; 2020, c. 738.

A. The CIO shall promulgate regulations necessary or incidental to the performance of duties or execution of powers conferred under this chapter. The CIO shall also develop policies, standards, and guidelines for the planning, budgeting, procurement, development, maintenance, security, and operations of information technology for executive branch agencies. Such policies, standards, and guidelines shall include those necessary to:

1. Support state and local government exchange, acquisition, storage, use, sharing, and distribution of data and related technologies.

2. Support the development of electronic transactions including the use of electronic signatures as provided in § 59.1-496.

3. Support a unified approach to information technology across the totality of state government, thereby assuring that the citizens and businesses of the Commonwealth receive the greatest possible security, value, and convenience from investments made in technology.

4. Ensure that the costs of information technology systems, products, data, and services are contained through the shared use of existing or planned equipment, data, or services.

5. Provide for the effective management of information technology investments through their entire life cycles, including identification, business case development, selection, procurement, implementation, operation, performance evaluation, and enhancement or retirement. Such policies, standards, and guidelines shall include, at a minimum, the periodic review by the CIO of agency Commonwealth information technology projects.

6. Establish an Information Technology Investment Management Standard based on acceptable technology investment methods to ensure that all executive branch agency technology expenditures are an integral part of the Commonwealth's performance management system, produce value for the agency and the Commonwealth, and are aligned with (i) agency strategic plans, (ii) the Governor's policy objectives, and (iii) the long-term objectives of the Council on Virginia's Future.

B. In addition to other such duties as the Secretary may assign, the CIO shall:

1. Oversee and administer the Virginia Technology Infrastructure Fund created pursuant to § 2.2-2023.

2. Report annually to the Governor, the Secretary, and the Joint Commission on Technology and Science created pursuant to § 30-85 on the use and application of information technology by executive branch agencies to increase economic efficiency, citizen convenience, and public access to state government.

3. Prepare annually a report for submission to the Secretary, the Information Technology Advisory Council, and the Joint Commission on Technology and Science on a prioritized list of Recommended Technology Investment Projects (RTIP Report) based upon major information technology projects submitted for business case approval pursuant to this chapter. As part of the RTIP Report, the CIO shall develop and regularly update a methodology for prioritizing projects based upon the allocation of points to defined criteria. The criteria and their definitions shall be presented in the RTIP Report. For each project recommended for funding in the RTIP Report, the CIO shall indicate the number of points and how they were awarded. For each listed project, the CIO shall also report (i) all projected costs of ongoing operations and maintenance activities of the project for the next three biennia following project implementation; (ii) a justification and description for each project baseline change; and (iii) whether the project fails to incorporate existing standards for the maintenance, exchange, and security of data. This report shall also include trends in current projected information technology spending by executive branch agencies and secretariats, including spending on projects, operations and maintenance, and payments to VITA. Agencies shall provide all project and cost information required to complete the RTIP Report to the CIO prior to May 31 immediately preceding any budget biennium in which the project appears in the Governor's budget bill.

4. Provide oversight for executive branch agency efforts to modernize the planning, development, implementation, improvement, operations and maintenance, and retirement of Commonwealth information technology, including oversight for the selection, development and management of enterprise information technology.

5. Develop statewide technical and data standards and specifications for information technology and related systems, including (i) the efficient exchange of electronic information and technology, including infrastructure, between the public and private sectors in the Commonwealth and (ii) the utilization of nationally recognized technical and data standards for health information technology systems or software purchased by an executive branch agency.

6. Direct the compilation and maintenance of an inventory of information technology, including but not limited to personnel, facilities, equipment, goods, and contracts for services.

7. Provide for the centralized marketing, provision, leasing, and executing of licensing agreements for electronic access to public information and government services through the Internet, wireless devices, personal digital assistants, kiosks, or other such related media on terms and conditions as may be determined to be in the best interest of the Commonwealth. VITA may fix and collect fees and charges for (i) public information, media, and other incidental services furnished by it to any private individual or entity, notwithstanding the charges set forth in § 2.2-3704, and (ii) such use and services it provides to any executive branch agency or local government. Nothing in this subdivision authorizing VITA to fix and collect fees for providing information services shall be construed to prevent access to the public records of any public body pursuant to the provisions of the Virginia Freedom of Information Act (§ 2.2-3700 et seq.). VITA is authorized, subject to the approval by the Secretary of Administration and any other affected Secretariat, to delegate the powers and responsibilities granted in this subdivision to any agency within the executive branch.

8. Periodically evaluate the feasibility of outsourcing information technology resources and services, and outsource those resources and services that are feasible and beneficial to the Commonwealth.

9. Have the authority to enter into and amend contracts, including contracts with one or more other public bodies, or public agencies or institutions or localities of the several states, of the United States or its territories, or the District of Columbia, for the provision of information technology services.

C. Consistent with § 2.2-2012, the CIO may enter into public-private partnership contracts to finance or implement information technology programs and projects. The CIO may issue a request for information to seek out potential private partners interested in providing programs or projects pursuant to an agreement under this subsection. The compensation for such services shall be computed with reference to and paid from the increased revenue or cost savings attributable to the successful implementation of the program or project for the period specified in the contract. The CIO shall be responsible for reviewing and approving the programs and projects and the terms of contracts for same under this subsection. The CIO shall determine annually the total amount of increased revenue or cost savings attributable to the successful implementation of a program or project under this subsection and such amount shall be deposited in the Virginia Technology Infrastructure Fund created in § 2.2-2023. The CIO is authorized to use moneys deposited in the Fund to pay private partners pursuant to the terms of contracts under this subsection. All moneys in excess of that required to be paid to private partners, as determined by the CIO, shall be reported to the Comptroller and retained in the Fund. The CIO shall prepare an annual report to the Governor, the Secretary, and General Assembly on all contracts under this subsection, describing each information technology program or project, its progress, revenue impact, and such other information as may be relevant.

D. Executive branch agencies shall cooperate with VITA in identifying the development and operational requirements of proposed information technology systems, products, data, and services, including the proposed use, functionality, and capacity, and the total cost of acquisition, operation, and maintenance.

1999, cc. 412, 421, 433, § 2.1-51.47; 2000, c. 995; 2001, c. 844, § 2.2-226; 2002, c. 424; 2003, cc. 981, 1021; 2005, cc. 933, 945; 2007, cc. 276, 701; 2009, c. 86; 2010, cc. 136, 145; 2011, c. 739; 2015, c. 768; 2016, c. 296; 2020, c. 738.

A. The CIO shall have the following duties related to information technology planning:

1. Monitor trends and advances in information technology, plan and forecast future needs for information technology, and conduct studies and surveys of organizational structures and best management practices of information technology systems and procedures;

2. Evaluate the needs of executive branch agencies in the Commonwealth with regard to (i) a consistent, reliable, and secure information technology infrastructure; (ii) existing capabilities related to building and supporting that infrastructure; and (iii) recommendation of approaches to ensure the future development, maintenance, and financing of information technology infrastructure befitting the needs of executive branch agencies and the service level requirements of its citizens; and

3. Develop a comprehensive six-year Commonwealth strategic plan for information technology to include (i) specific projects that implement the plan; (ii) a plan for the acquisition, management, and use of information technology by executive branch agencies; (iii) a report of the progress of any ongoing enterprise information technology projects, any factors or risks that might affect their successful completion, and any changes to their projected implementation costs and schedules; and (iv) a report on the progress made by executive branch agencies toward accomplishing the Commonwealth strategic plan for information technology. The Commonwealth strategic plan for information technology shall be updated annually and submitted to the Secretary for approval.

B. The CIO shall have the following duties related to budgeting for information technology projects:

1. Develop policies, standards, and guidelines, in consultation with the Department of Planning and Budget, that are integrated into the Commonwealth's strategic planning and budgeting processes, and that executive branch agencies shall follow in developing information technology plans and technology-related budget requests. Such policies and procedures shall require consideration of the contribution of current and proposed technology expenditures to the support of executive branch agency priority functional activities, as well as current and future operating expenses, and shall be utilized by all state agencies in preparing budget requests.

2. Assist executive branch agencies in the development of information technology strategic plans pursuant to § 2.2-2014 and the preparation of budget requests for information technology that are consistent with the policies, standards, and guidelines developed pursuant to this section.

3. Review budget requests for information technology from executive branch agencies and recommend budget priorities to the Secretary. Review of such budget requests shall include all information technology projects for amounts exceeding $250,000 for which the contract or proposed contract would, as a means of payment for the project, require the Commonwealth to forgo certain revenue collections or would allow another party to collect fees, charges, or other revenues on behalf of the Commonwealth. For each information technology project, the agency shall provide the CIO (i) a summary of the terms, (ii) the anticipated duration, and (iii) the cost or charges to any user, whether a state agency or other party not directly a party to the project arrangements. The description shall also include any terms or conditions that bind the Commonwealth or restrict the Commonwealth's operations and the methods of procurement employed to reach such terms. Executive branch agencies and institutions shall submit to the CIO a projected biennial operations and maintenance budget for technology assets owned or licensed by the agency or institution and submit a budget decision package for any shortfalls. The provisions of this subdivision shall not apply to public institutions of higher education that meet the conditions prescribed in subsection A of § 23.1-1002.

2016, c. 296.

Repealed by Acts 2016, c. 296, cl. 2.

A. To provide for the security of state government electronic information from unauthorized uses, intrusions or other security threats, the CIO shall direct the development of policies, standards, and guidelines for assessing security risks, determining the appropriate security measures and performing security audits of government electronic information. Such policies, standards, and guidelines shall apply to the Commonwealth's executive, legislative, and judicial branches and independent agencies. The CIO shall work with representatives of the Chief Justice of the Supreme Court and Joint Rules Committee of the General Assembly to identify their needs. Such policies, standards, and guidelines shall, at a minimum:

1. Address the scope and frequency of security audits. In developing and updating such policies, standards, and guidelines, the CIO shall designate a government entity to oversee, plan, and coordinate the conduct of periodic security audits of all executive branch agencies and independent agencies. The CIO shall coordinate these audits with the Auditor of Public Accounts and the Joint Legislative Audit and Review Commission. The Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly shall determine the most appropriate methods to review the protection of electronic information within their branches;

2. Control unauthorized uses, intrusions, or other security threats;

3. Provide for the protection of confidential data maintained by state agencies against unauthorized access and use in order to ensure the security and privacy of citizens of the Commonwealth in their interaction with state government. Such policies, standards, and guidelines shall include requirements that (i) any state employee or other authorized user of a state technology asset provide passwords or other means of authentication to use a technology asset and access a state-owned or state-operated computer network or database and (ii) a digital rights management system or other means of authenticating and controlling an individual's ability to access electronic records be utilized to limit access to and use of electronic records that contain confidential information to authorized individuals;

4. Address the creation and operation of a risk management program designed to identify information technology security gaps and develop plans to mitigate the gaps. All agencies in the Commonwealth shall cooperate with the CIO, including (i) providing the CIO with information required to create and implement a Commonwealth risk management program, (ii) creating an agency risk management program, and (iii) complying with all other risk management activities; and

5. Require that any contract for information technology entered into by the Commonwealth's executive, legislative, and judicial branches and independent agencies require compliance with applicable federal laws and regulations pertaining to information security and privacy.

B. 1. The CIO shall annually report to the Governor, the Secretary, and General Assembly on the results of security audits, the extent to which security policy, standards, and guidelines have been adopted by executive branch and independent agencies, and a list of those executive branch agencies and independent agencies that have not implemented acceptable security and risk management regulations, policies, standards, and guidelines to control unauthorized uses, intrusions, or other security threats. For any executive branch agency or independent agency whose security audit results and plans for corrective action are unacceptable, the CIO shall report such results to (i) the Secretary, (ii) any other affected cabinet secretary, (iii) the Governor, and (iv) the Auditor of Public Accounts. Upon review of the security audit results in question, the CIO may take action to suspend the executive branch agency's or independent agency's information technology projects pursuant to subsection B of § 2.2-2016.1, limit additional information technology investments pending acceptable corrective actions, and recommend to the Governor and Secretary any other appropriate actions.

2. Executive branch agencies and independent agencies subject to such audits as required by this section shall fully cooperate with the entity designated to perform such audits and bear any associated costs. Public bodies that are not required to but elect to use the entity designated to perform such audits shall also bear any associated costs.

C. In addition to coordinating security audits as provided in subdivision B 1, the CIO shall conduct an annual comprehensive review of cybersecurity policies of every executive branch agency, with a particular focus on any breaches in information technology that occurred in the reviewable year and any steps taken by agencies to strengthen cybersecurity measures. Upon completion of the annual review, the CIO shall issue a report of his findings to the Chairmen of the House Committee on Appropriations and the Senate Committee on Finance and Appropriations. Such report shall not contain technical information deemed by the CIO to be security sensitive or information that would expose security vulnerabilities.

D. The provisions of this section shall not infringe upon responsibilities assigned to the Comptroller, the Auditor of Public Accounts, or the Joint Legislative Audit and Review Commission by other provisions of the Code of Virginia.

E. The CIO shall promptly receive reports from public bodies in the Commonwealth made in accordance with § 2.2-5514 and shall take such actions as are necessary, convenient, or desirable to ensure the security of the Commonwealth's electronic information and confidential data.

F. The CIO shall provide technical guidance to the Department of General Services in the development of policies, standards, and guidelines for the recycling and disposal of computers and other technology assets. Such policies, standards, and guidelines shall include the expunging, in a manner as determined by the CIO, of all confidential data and personal identifying information of citizens of the Commonwealth prior to such sale, disposal, or other transfer of computers or other technology assets.

G. The CIO shall provide all directors of agencies and departments with all such information, guidance, and assistance required to ensure that agencies and departments understand and adhere to the policies, standards, and guidelines developed pursuant to this section.

H. The CIO shall promptly notify all public bodies as defined in § 2.2-5514 of hardware, software, or services that have been prohibited pursuant to Chapter 55.3 (§ 2.2-5514 et seq.). The CIO shall restrict access to prohibited applications and websites in accordance with the provisions of § 2.2-5514.1.

I. 1. This subsection applies to the Commonwealth's executive, legislative, and judicial branches and independent agencies.

2. In collaboration with the heads of executive branch and independent agencies and representatives of the Chief Justice of the Supreme Court and the Joint Rules Committee of the General Assembly, the CIO shall develop and annually update a curriculum and materials for training all state employees in information security awareness and in proper procedures for detecting, assessing, reporting, and addressing information security threats. The curriculum shall include activities, case studies, hypothetical situations, and other methods of instruction (i) that focus on forming good information security habits and procedures among state employees and (ii) that teach best practices for detecting, assessing, reporting, and addressing information security threats.

3. Every state agency shall provide annual information security training for each of its employees using the curriculum and materials developed by the CIO pursuant to subdivision 2. Employees shall complete such training within 30 days of initial employment and by January 31 each year thereafter.

State agencies may develop additional training materials that address specific needs of such agency, provided that such materials do not contradict the training curriculum and materials developed by the CIO.

The CIO shall coordinate with and assist state agencies in implementing the annual information security training requirement.

4. Each state agency shall (i) monitor and certify the training activity of its employees to ensure compliance with the annual information security training requirement, (ii) evaluate the efficacy of the information security training program, and (iii) forward to the CIO such certification and evaluation, together with any suggestions for improving the curriculum and materials, or any other aspects of the training program. The CIO shall consider such evaluations when it annually updates its curriculum and materials.

2000, c. 961, §§ 2.1-563.42 - 2.1-563.44; 2001, c. 844, §§ 2.2-136 - 2.2-138; 2002, c. 247, § 2.2-226.1; 2003, cc. 981, 1021; 2004, c. 638; 2007, cc. 769, 775; 2010, cc. 136, 145; 2015, c. 768; 2016, c. 296; 2017, c. 664; 2018, c. 775; 2019, c. 302; 2020, c. 717; 2022, cc. 626, 627; 2023, c. 768.

Repealed by Acts 2016, c. 296, cl. 2.

A. Unless specifically exempted by law, VITA shall be responsible for the development, operation, and management of information technology for every executive branch agency, pursuant to the provisions of this chapter.

B. The CIO shall have the following powers and duties concerning the development, operation, and management of information technology:

1. Manage, coordinate, and provide the information technology used by executive branch agencies;

2. Acquire, lease, or construct such land, facilities, and equipment as necessary to deliver comprehensive information technology services, and to maintain such land, facilities, and equipment owned or leased; and

3. Provide technical assistance to executive branch agencies in the planning, development, operation, and management of information technology.

1984, c. 746, §§ 2.1-563.16, 2.1-563.17, 2.1-563.18; 1985, c. 265; 1995, c. 357; 1997, c. 858; 1999, cc. 412, 421, 433; 2001, c. 844, § 2.2-1303; 2002, c. 579; 2003, cc. 981, 1021; 2016, c. 296.

A. The CIO shall develop policies, standards, and guidelines for the procurement of information technology of every description.

B. 1. Information technology shall be procured by (i) VITA for its own benefit or on behalf of other executive branch agencies or (ii) such other agencies to the extent authorized by VITA. Such procurements shall be made in accordance with the Virginia Public Procurement Act (§ 2.2-4300 et seq.), regulations that implement the electronic and information technology accessibility standards of the Rehabilitation Act of 1973 (29 U.S.C. § 794d), as amended, and any regulations, policies, procedures, standards, and guidelines of VITA. In no case shall such procurements exceed the requirements of the regulations that implement the electronic and information technology accessibility standards of the Rehabilitation Act of 1973, as amended.

2. The CIO shall review, and approve or disapprove, all executive branch agency procurements of information technology, including approval of all agreements and contracts prior to the execution of the procurement. The CIO may exempt from review requirements, but not from the Commonwealth's competitive procurement process, any executive branch agency that establishes, to the satisfaction of the CIO, (i) its ability and willingness to administer efficiently and effectively the procurement of information technology or (ii) that it has been subjected to another review process coordinated through or approved by the CIO.

3. The CIO shall develop and administer a system to monitor and evaluate executed information technology contracts and billing and collection systems.

The CIO shall disapprove any procurement that does not conform to the Commonwealth strategic plan for information technology developed and approved pursuant to subdivision A 3 of § 2.2-2007.1 or to the individual strategic plans of executive branch agencies developed and approved pursuant to § 2.2-2014.

4. The CIO shall require that before any executive branch agency procures any computer system, equipment, or software, it shall consider whether the proposed system, equipment, or software is capable of producing products that facilitate the rights of the public to access public records under the Freedom of Information Act (§ 2.2-3700 et seq.) or other applicable law.

C. All statewide contracts and agreements made and entered into by VITA for the purchase of information technology shall provide for the inclusion of counties, cities, and towns in such contracts and agreements. Counties, cities, and towns and local school divisions are authorized to purchase information technology goods and services of every description from VITA and its vendors, provided that such purchases are not prohibited by the terms of contracts for such goods and services. Notwithstanding the provisions of § 2.2-4302.1, 2.2-4302.2, 2.2-4303.1, or 2.2-4303.2, VITA may enter into multiple vendor contracts for the referenced services, facilities, and goods and services.

D. VITA may establish contracts for the purchase of personal computers and related devices by licensed teachers employed in a full-time teaching capacity in Virginia public schools or in state educational facilities for use outside the classroom. The computers and related devices shall not be purchased with public funds, but shall be paid for and owned by teachers individually provided that no more than one such computer and related device per year shall be so purchased.

E. If VITA, or any executive branch agency authorized by VITA, elects to procure personal computers and related peripheral equipment pursuant to any type of blanket purchasing arrangement under which public bodies, as defined in § 2.2-4301, may purchase such goods from any vendor following competitive procurement but without the conduct of an individual procurement by or for the using agency or institution, it shall establish performance-based specifications for the selection of equipment. Establishment of such contracts shall emphasize performance criteria including price, quality, and delivery without regard to "brand name." All vendors meeting the Commonwealth's performance requirements shall be afforded the opportunity to compete for such contracts.

F. VITA shall allow private institutions of higher education that are (i)(a) chartered in Virginia or (b) chartered by an Act of Congress in 1821 and that have owned and operated since 1991 a campus with a significant presence in the Commonwealth and (ii) granted tax-exempt status under § 501(c)(3) of the Internal Revenue Code to purchase directly from contracts established for state agencies and public bodies by VITA.

G. This section shall not be construed or applied so as to infringe upon, in any manner, the responsibilities for accounting systems assigned to the Comptroller under § 2.2-803.

H. The Comptroller shall not issue any warrant upon any voucher issued by an executive branch agency covering the purchase of any information technology when such purchases are made in violation of any provision of this chapter or the Virginia Public Procurement Act (§ 2.2-4300 et seq.).

I. Intentional violations of centralized purchasing requirements for information technology pursuant to this chapter by an executive branch agency, continued after notice from the Governor to desist, shall constitute malfeasance in office and shall subject the officer responsible for the violation to suspension or removal from office, as may be provided in law in other cases of malfeasance.

1984, c. 746, §§ 2.1-563.16, 2.1-563.17, 2.1-563.18; 1985, c. 265; 1995, c. 357; 1997, c. 858; 1999, cc. 412, 421, 433; 2001, c. 844, § 2.2-1303; 2002, c. 579; 2003, cc. 352, 895, 981, 1021; 2004, cc. 237, 278; 2007, c. 630; 2010, cc. 136, 145; 2011, c. 739; 2012, cc. 803, 835; 2013, c. 583; 2014, cc. 36, 180; 2015, cc. 462, 760, 768, 776; 2016, c. 296.

A. For purposes of this section, "supplier" means an offeror with whom the Commonwealth has entered into a contract for a major information technology project.

B. Except as provided in subsection C, in any contract for a major information technology project, terms and conditions relating to the indemnification obligations and liability of a supplier shall be reasonable and shall not exceed in aggregate twice the value of the contract. There shall be no limitation on the liability of a supplier for (i) the intentional or willful misconduct, fraud, or recklessness of a supplier or any employee of a supplier or (ii) claims for bodily injury, including death, and damage to real property or tangible personal property resulting from the negligence of a supplier or any employee of a supplier.

C. If the CIO believes that a major information technology project presents an exceptional risk to the Commonwealth, he shall conduct a risk assessment prior to the issuance of a Request for Proposal. Such risk assessment shall include consideration of the nature, processing, and use of sensitive or personally identifiable information. If the risk assessment concludes that the project presents an exceptional risk to the Commonwealth and the limitation of liability amount provided in subsection B is not reasonably adequate to protect the interest of the Commonwealth, the CIO may recommend and request approval by the Secretary of Administration to increase the limitation of liability amount.

The CIO shall make such recommendation in writing setting forth the reasons that the limitations in subsection B are not adequate to protect the Commonwealth's interests. The recommendation shall describe the risks presented to the Commonwealth and how those risks are not sufficiently mitigated by the expected terms and conditions associated with the Request for Proposal. The CIO shall recommend a reasonable maximum alternative limitation of liability amount that is a multiple of the contract value, with the same exceptions to the limitation as provided in subsection B.

The Secretary of Administration shall review and may approve any recommended maximum alternative limitation of liability amount to be included in any Request for Proposal issued for the project. The CIO shall annually publish a list of all approvals granted under this subsection pertaining to any Request for Proposal issued in the previous 12-month period.

D. Notwithstanding the provisions of this section, the Commonwealth may agree to a lower limitation for any contract subject to subsection B or C.

2019, cc. 605, 606.

A. There is established the Information Technology and Management Internal Service Fund to be administered by VITA.

B. There is established the Acquisition Services Special Fund to be administered by VITA and used to finance procurement and contracting activities and programs unallowable for federal fund reimbursement.

C. Upon written request of the CIO, the Joint Legislative Audit and Review Commission may direct the Comptroller to establish internal service fund accounts on his books and record the receipts and expenditures for appropriate functions of VITA. Charges for services rendered sufficient to offset costs involved in these operations shall be established.

D. All users of services provided for in this chapter administered by VITA shall be assessed a surcharge, which shall be deposited in the appropriate fund. This charge shall be an amount sufficient to allow VITA to finance the operations and staff of the services offered.

E. Additional moneys necessary to establish these funds or provide for the administration of the activities of VITA may be advanced from the general account of the state treasury.

F. The CIO shall direct that the following activities be conducted with respect to VITA's internal service funds:

1. VITA shall establish fee schedules for the collection of fees from users when general fund appropriations are not available for the services rendered.

2. VITA shall develop and implement information, billing, and collections methods that will assist state agencies in analyzing and effectively managing their use of VITA's services, and which will allow VITA to forecast service demands and balances of its internal service funds.

3. By September 1 of each year, VITA shall submit biennial projections of future revenues and expenditures for each internal service fund and estimates of any anticipated changes to fee schedules to the Joint Legislative Audit and Review Commission and the Department of Planning and Budget.

4. In the event that changes to fee schedules or rates are required, the CIO shall submit documentation to the Joint Legislative Audit and Review Commission and the Department of Planning and Budget no later than September 1 prior to the fiscal year in which the new or revised rates are to take effect so that the impact of the rate changes can be considered for inclusion in the executive budget submitted to the General Assembly pursuant to § 2.2-1508. In emergency circumstances, deviations from this approach shall be approved in advance by the Joint Legislative Audit and Review Commission.

1984, c. 746, §§ 2.1-563.19, 2.1-563.20, 2.1-563.21, 2.1-563.22; 2001, c. 844, § 2.2-1304; 2003, cc. 981, 1021; 2010, cc. 136, 145; 2012, cc. 55, 285; 2016, c. 296.

A. All executive branch agencies shall prepare and submit information technology strategic plans to the CIO for review and approval. All executive branch agencies shall maintain current information technology plans that have been approved by the CIO.

B. The head of each executive branch agency shall designate an existing employee to be the agency's information technology resource who shall be responsible for compliance with the policies, standards, and guidelines established by the CIO.

1999, cc. 412, 421, 433, § 2.1-51.47; 2000, c. 995; 2001, c. 844, § 2.2-226; 2002, c. 424; 2003, cc. 981, 1021; 2016, c. 296.

Repealed by Acts 2016, c. 296, cl. 2.