Virginia Information Technologies Agency (VITA), IT Information Security Policy (SEC 519-00) (July 24, 2009) (full-text).