How do I complete and submit corrective action plan (CAP)?
Your agency Information Technology (IT) security corrective action plan should be developed based on the direction given in the IT Security Audit Standard (SEC 502-00) – “Documentation of IT Security Audits” and IT Security Audit Guideline (SEC 512-00) – “Corrective Action Plan” and “CAP Periodic Reporting”. Please use the Corrective Action Plan Template to complete your plan. The agency head or designee must submit the corrective action plan quarterly to the Chief Information Security Officer (CISO) of the Commonwealth. For contact information, see response #1. If the plan contains sensitive information, email CommonwealthSecurity@VITA.Virginia.Gov to request assistance with identifying an efficient and secure manner of transmitting the plan.
