Appendices - Hampton Roads Transportation Planning Organization

Information Security Policy
RESPONSIBILITIES:
Security and Emergency Management Division’s (SEMD) Information Security Office (ISO) is
responsible for:
1. developing and implementing Information Security policies,
2. providing oversight of policy interpretation and compliance reviews, and
3. advising VDOT management and employees concerning the use and distribution of VDOT
information assets.
Data Owners are responsible for:
1. classifying all information based on its sensitivity,
2. defining what information may be shared with other departments, divisions, agencies, and
the public, and
3. approving user access to the information and supporting system for which they are
responsible.
VDOT Managers are responsible for:
1. exercising due care when authorizing the use of and access to VDOT information and,
2. authorizing access using the principle of least privilege.
VDOT employees, contractors, consultants, and third-party employees are responsible for:
1. accessing only the information assets to which they are authorized,
2. reasonably protecting VDOT information against unauthorized activities performed under
their user ID, and
3. assuring information maintained on computer equipment or on paper is physically
protected from security threats and environmental hazards.
VITA is responsible for:
1. developing procedures to guarantee controls are in place to prevent users from other
connected networks access to sensitive areas of the VDOT’s network,
2. developing procedures to guarantee remote connections to a computer are made through
a managed central point-of-entry,
3. updating the VDOT Active Directory and network access controls,
4. ensuring network and mainframe accounts for the Central Office and Districts comply with
this Access Control Policy,
5. removing of inactive accounts promptly, and
6. reporting actions to inactivate/delete accounts to the VDOT supervisory chain.
VDOT Information Technology Division is responsible for:
1. developing procedures to guarantee access to source code for applications and systems
is limited to authorized VDOT staff, contractors, consultants, and third-party employees,
and for only those applications and systems they directly support,
2. ensuring application accounts for the Central Office and Districts comply with this Access
Control Policy,
3. remove inactive accounts promptly, and
4. reporting actions to inactivate/delete accounts to the VDOT supervisory chain.
33