Handbook  Enterprise Information Security Policies

The EOTSS Enterprise Risk Management Office is responsible for writing, publishing, and updating all Enterprise Information Security Policies that apply to all Executive Department offices and agencies. This is a compilation of those policies. 

EOTSS Standards may be located at:

EOTSS Technology Standards and Guidelines

While the EOTSS Standards were historically located on the ERM Information Security webpage,  they are currently undergoing revisions by EOTSS’ Operations, Security (SOC) and Technology teams.  In 2025 the ownership of these Standards will transfer from ERM to our Operations, SOC and Technology teams.  The ownership of the Enterprise Information Security Policies will remain with the Commonwealth CISO and the ERM team.  Please check back for updates.