Page 95

_ 95 Item Details($) Appropriations($) ITEM 81. First Year Second Year First Year Second Year FY2025 FY2026 FY2025 FY2026 funds as needed to support implementation costs associated with House Bill 2541 of the 2025 General Assembly. 82. Information Technology Security Oversight (82900) $11,552,120 $11,552,120 $13,893,120 Technology Security Oversight Services (82901) $7,828,676 $7,828,676 Information Technology Security Service Center (82902) $3,008,926 $3,008,926 $3,849,926 Cloud Based Services Oversight (82903) $714,518 $714,518 $2,214,518 Fund Sources: General $318,676 $318,676 Special $295,414 $295,414 Internal Service $10,938,030 $10,938,030 $13,279,030 Authority: Title 2.2, Chapter 20.1, Code of Virginia. A. Out of this appropriation, $7,631,481 the first year and $7,631,481 the second year for Technology Security Oversight Services is sum sufficient and amounts shown are estimates from an internal service fund which shall be paid solely from charges to other programs within this agency. B.1. The Virginia Information Technologies Agency shall operate an information technology security service center to support the information technology security needs of agencies electing to participate in the information technology security service center. Support for participating agencies shall include, but not be limited to, vulnerability scans, information technology security audits, and Information Security Officer services. Participating agencies shall cooperate with the Virginia Information Technologies Agency by transferring such records and functions as may be required. 2.a. The Virginia Information Technologies Agency shall perform vulnerability scans of all public-facing websites and systems operated by state agencies. All state agencies which operate such websites and systems shall cooperate with the Virginia Information Technologies Agency in order to complete the vulnerability scans. However, the State Corporation Commission shall not be required to disable, in full or in part, any software system, process, or other tool utilized to protect such public-facing websites and systems. All state agencies shall mitigate or resolve website risks and vulnerabilities identified by the Virginia Information Technologies Agency. b. Out of this appropriation, $318,676 the first year and $318,676 the second year from the general fund shall be used to support vulnerability scanning of public-facing websites and systems of the Commonwealth. 3. Agencies electing to participate in the information technology security service center shall enter into a memorandum of understanding with the Virginia Information Technologies Agency. Such memorandums shall outline the services to be provided by the Virginia Information Technologies Agency and the costs to provide those services. If a participating agency elects to not renew its memorandum of understanding, the agency shall notify the Virginia Information Technologies Agency twelve months prior to the scheduled renewal date of its intent to become a non-participating agency. 4. Non-participating agencies shall be required by July 1 each year to notify the Chief Information Officer of the Commonwealth that the agency has met the requirements of the Commonwealth's information security standards. If the agency has not met the requirements of the Commonwealth's information security standards, the agency shall report to the Chief Information Officer of the Commonwealth the steps and procedures the agency is implementing in order to satisfy the requirements. 5. Out of this appropriation, $2,690,250 the first year and $2,690,2503,531,250 the second year for Information Technology Security Service Center is sum sufficient and amounts shown are estimates from an internal service fund which shall be paid solely from internal service fund revenues.