Policy Approach

DoIT operates within a policy framework that establishes guidelines and operational requirements.   Services and products are provided and supported while adhering to standards that facilitate risk awareness, a security based focus and operational consistency while leveraging a wide range of information technology resources. 

The IT Policies included herein document a best practice based approach to conducting the business of state government that relies on information technology based resources in supporting and promoting the missions of various agencies and associated activities related to an effective state government operation. 

DoIT intends to follow, and expects its customers and partners who utilize DoIT provided solutions and associated resources to also adhere to, the policies that support our collective missions in a consistent and secure manner.

DoIT Website Privacy Information

Access to the Department of Innovation & Technology website is provided subject to the terms and conditions found on the Illinois Privacy Information page. Please read these terms carefully as use of this site constitutes acceptance of  these terms.

Enterprise Information Security Policies

NameEffective DateRevised Date
Acceptable Use Policy
​Access Control Policy
Accountability, Audit, and Risk Management Privacy Policy10.08.201810.01.2021
Audit and Accountability Policy
​Awareness and Training Policy
​CJIS Security Supplemental Policy
​Configuration Management Policy
Contingency Planning Policy
Data Minimization and Retention Privacy Policy​​10.08.2018​10.01.2021
​​Data Quality and Integrity Privacy Policy​10.08.2018​​10.01.2021
FTI Supplemental Policy
Identification and Authentication Policy
​Individual Participation and Redress Privacy Policy​10.08.2018​10.01.2021
Information Security Incident Management Policy
​Media Protection Policy
Overarching Enterprise Information Security Policy
​PCI Data Security Policy
​Personnel Security Policy
PHI Supplemental
Physical and Environmental Protection Policy
Privacy Security Policy
Program Management Policy
​Risk Assessment Policy
Security Assessment and Authorization Policy
Security Planning Policy
​System and Communication Protection Policy
System and Information Integrity Policy
System and Services Acquisition Policy
System Maintenance Policy 
Transparency, Authority, and Purpose Privacy Policy
Use Limitation Privacy Policy​

Supporting Definitions

Effective DateRevised Date
​DoIT Enterprise Information Security Policy Terminology Glossary​10.24.2018
DoIT Terminology Glossary 11.01.2008 10.27.2016 

General Policies

NameEffective DateRevised Date
Identity Protection Policy06.01.2011​​11.19.2019

Mobile Device Security Policy        

       BYOD Mobile Device Video:

Wireless Communication Device Policy
12.15.2008 02.04.2022