Va. Code § 23.1-1018
Subject to the terms of the management agreement, each covered institution may be exempt from the provisions governing the Virginia Information Technologies Agency, Chapter 20.1 (§ 2.2-2005 et seq.) of Title 2.2, and the provisions governing the Information Technology Advisory Council, Article 35 (§ 2.2-2699.5 et seq.) of Chapter 26 of Title 2.2, if the governing board of such covered institution adopts and the covered institution complies with (i) policies for the procurement of information technology goods and services, including professional services, that are consistent with the requirements of § 23.1-1017 and include provisions addressing cooperative arrangements for such procurement as described in § 23.1-1017 and (ii) institutional policies and professional best practices regarding strategic planning for information technology, project management, security, budgeting, infrastructure, and ongoing operations.
Va. Code § 23.1-1018