Virginia State Corporation Commission

The Virginia State Corporation Commission (VSCC) is the Commonwealth of Virginia’s primary regulatory agency tasked with overseeing the formation, operation, and dissolution of business entities operating within the state, including corporations, limited liability companies, partnerships, and trusts, while also administering the state’s securities, insurance, utilities, and financial services sectors to ensure compliance with Virginia law and protect public interests. In carrying out its mandate, the VSCC processes filings such as articles of incorporation, annual reports, and amendments, maintains public databases of business records, and enforces statutory requirements related to corporate governance, disclosure, and consumer protection, thereby facilitating a transparent and orderly marketplace for Virginia residents and enterprises. The agency also regulates public utilities, including electric, natural gas, water, and telecommunications providers, by reviewing rate applications, monitoring service quality, and enforcing safety and reliability standards to safeguard consumers and promote equitable access to essential services. Additionally, the VSCC supervises insurance companies and agents, reviewing policy forms, assessing solvency, and investigating complaints to maintain a stable insurance market that meets the needs of policyholders and adheres to state insurance statutes. Through its securities division, the commission registers offerings, licenses broker‑dealers and investment advisers, and pursues enforcement actions against fraudulent or manipulative practices, contributing to investor confidence and the integrity of Virginia’s capital markets.

The VSCC’s regulatory authority is derived directly from the Constitution and statutes of the Commonwealth of Virginia, positioning it as an arm of state government that reports to the Governor and operates under the oversight of the Virginia General Assembly, which establishes its budget and legislative framework. Its involvement in the 2020‑2021 SolarWinds Orion supply chain compromise highlighted the agency’s reliance on widely used IT infrastructure monitoring tools for managing its internal networks, a practice it discontinued after confirming the presence of malicious code in the affected version and initiating a coordinated response with state and federal cybersecurity authorities. The incident, which formed part of a broader espionage campaign targeting numerous governmental and private organizations—including cybersecurity firms such as Qualys and Fidelis—underscored the VSCC’s status as a valuable target due to its stewardship of sensitive business and regulatory data, even though the specific extent of any data exfiltration remained under assessment at the time of disclosure. Despite the breach, the VSCC continued to fulfill its regulatory duties, demonstrating resilience in maintaining essential services such as business filings, utility oversight, and consumer protection while working to strengthen its cybersecurity posture. As a state‑level entity wholly owned and funded by the Commonwealth of Virginia, the VSCC does not have a private parent or subsidiary structure, and its operational scope is confined to the jurisdictional boundaries of Virginia, where it serves as the central authority for corporate registration, securities regulation, insurance supervision, and utility oversight.