Media: Policy

Information Security: System and Communications Protection

July 9, 2024 - This policy and procedure is  intended to meet the control requirements outlined in SEC530, Section 8.18 IT System and Communications Protection Family, controls SC-1 through SC-50 as well as additional Commonwealth of Virginia controls.

Information Security: System and Services Acquisition

July 9, 2024 - This policy and procedure is  intended to meet the control requirements outlined in SEC530, Section 8.15 IT System and Services Acquisition Family, controls SA-1 through SA-22 as well as additional Commonwealth of Virginia controls.

Information Security: Security Risk Assessment

July 9, 2024 - This policy and procedure is intended to meet the control requirements outlined in SEC520 and SEC530, Section 8.16 Risk Assessment Family, controls RA-1 through RA-10 as well as additional Commonwealth of Virginia controls.

Information Security: Personnel Security

July 9, 2024 - This policy and procedure is  intended to meet the control requirements outlined in SEC530, Section 8.13 Personnel Security Family, controls PS-1 through PS-8 as well as additional Commonwealth of Virginia controls.

Information Security: Program Management

July 9, 2024 - This policy and procedure is to facilitate the effective implementation of the security program management requirements as stipulated by the COV ITRM Security Standard SEC530, Section 8.13 Program Management, PM-1 through PM-32, and security best practices.

Information Security: Access Control

July 9, 2024 - This policy and procedure is  intended to meet the control requirements outlined in SEC530, Section 8.1 Access Control Family, Controls AC-1 through AC-22, to include specific requirements for COV.

Information Security: System Maintenance

July 1, 2024 - This policy and procedure is intended to meet the control requirements outlined in SEC530, Section 8.9 System Maintenance Family, Controls MA-1 through MA-6.

Information Security: Incident Response

July 1, 2024 - This policy and procedure is to document the response procedure for potential information technology (IT) security incidents that threatens the Department of Forestry IT systems and services.

Information Security: Identification and Authentication

July 1, 2024 - This policy and procedure is intended to meet the control requirements outlined in SEC-530, Section 8.7 Identification and Authentication Family, Controls IA-1 through IA-12, to include specific requirements for the Commonwealth of Virginia.