Cybersecurity incident occurs within a state company in Virginia

When a cybersecurity incident occurs within a state company in Virginia, it's crucial to follow specific reporting protocols. Here's a breakdown of the "how," "when," and "where" based on available information:

Key Reporting Points:

Virginia Fusion Intelligence Center:

This is the primary reporting destination for cybersecurity incidents affecting Virginia's state and local public bodies.

Reporting must occur within 24 hours of discovering the incident.   

Virginia Information Technologies Agency (VITA):

The Virginia Fusion Intelligence Center shares reports with VITA.   

Law Enforcement:

Depending on the severity and nature of the incident, reporting to law enforcement agencies like the Virginia State Police and the FBI may also be necessary.

How to Report:

Cyber Incident Form:

The Virginia government provides an online Cyber Incident Form for reporting. You can access it through the official website: reportcyber.virginia.gov.   

By Phone:

You can also report incidents by calling the Virginia Fusion Center at:

804-674-2196   

or 877-4VA-TIPS.

When to Report:

Within 24 Hours:

Virginia Code § 2.2-5514 mandates that incidents be reported to the Virginia Fusion Intelligence Center within 24 hours of discovery.   

Even if Resolved:

It is important to report the incident even if the issue has been resolved.

Where to Report:

Virginia Fusion Intelligence Center:

This is the central point for reporting cybersecurity incidents.   

Online:

Via the website: reportcyber.virginia.gov.   

Important Considerations:

The reporting requirements apply to incidents that:

Threaten the security of the Commonwealth's data or communications.

Result in the exposure of data protected by federal or state laws.   

Compromise the security of the public body's IT systems with the potential for major disruption.   

It is always better to err on the side of caution and report any suspicious activity.