HB 1557

1	A bill to be entitled
2	An act relating to state information technology; creating
3	s. 14.204, F.S.; creating the Agency for Enterprise
4	Information Technology within the Executive Office of the
5	Governor; providing for the Governor and Cabinet to be the
6	head of the agency; requiring that the agency be a
7	separate budget entity that is not subject to the control
8	of the Executive Office of the Governor; providing for an
9	executive director of the agency to be subject to
10	confirmation by the Senate; providing for the executive
11	director to be the chief information officer of the state
12	and the executive sponsor for all enterprise information
13	technology projects; specifying the duties and
14	responsibilities of the agency, which include defining
15	architecture standards for information technology and
16	developing a strategic information technology plan;
17	requiring each state agency and the Agency Chief
18	Information Officers Council to participate in the
19	activities of the Agency for Enterprise Information
20	Technology; amending s. 20.22, F.S.; removing the State
21	Technology Office within the Department of Management
22	Services; amending s. 216.0446, F.S.; revising the duties
23	of the Technology Review Workgroup within the Legislature
24	to conform to the transfer of duties concerning the
25	management of information technology for state agencies;
26	amending s. 282.0041, F.S.; revising and providing
27	definitions; creating s. 282.0055, F.S.; providing for the
28	Agency for Enterprise Information Technology to oversee
29	information technology services that are common to all
30	executive branch agencies and for agency information
31	technology services to be responsible for information
32	technology within an individual state agency; creating s.
33	282.0056, F.S.; requiring the Agency for Enterprise
34	Information Technology to develop a work plan; requiring
35	that the work plan be approved by the Governor and Cabinet
36	and submitted to the Legislature; requiring that certain
37	specified policies be included in the initial work plan;
38	requiring that the agency develop policy recommendations
39	and strategies for consolidating computer rooms and data
40	centers; requiring each state agency to provide assistance
41	in the development of the work plan upon request; amending
42	s. 282.20, F.S.; transferring management of the Technology
43	Resource Center from the State Technology Office to the
44	Department of Management Services; revising the duties of
45	the center to conform to changes made by the act;
46	requiring that the center submit its service rates and
47	cost-allocation plan to the Agency for Enterprise
48	Information Technology for review and approval; amending
49	s. 282.3055, F.S.; revising the duties of state agencies
50	with respect to providing assistance to the Agency for
51	Enterprise Information Technology; revising the duties of
52	the agency chief information officers; amending s.
53	282.315, F.S.; revising the duties of the Agency Chief
54	Information Officers Council; requiring that the council
55	assist the Agency for Enterprise Information Technology in
56	developing strategies for information technology services
57	and projects and make policy recommendations and that the
58	agency provide administrative support to the council;
59	revising the membership of the council; providing for the
60	appointment of a chair, vice chair, and secretary;
61	amending s. 282.318, F.S.; providing duties of the Agency
62	for Enterprise Information Technology with respect to the
63	security of data and information technology resources;
64	requiring state agencies to conduct a comprehensive risk
65	analysis at specified intervals, develop and update
66	internal policies and procedures, and ensure compliance
67	with certain security requirements; requiring the Agency
68	for Enterprise Information Technology to designate a chief
69	information security officer, develop standards for risk
70	analyses and security audits, and provide training for
71	agency information security managers; deleting provisions
72	specifying duties of the Department of Management Services
73	to conform to changes made by the act; amending s.
74	282.322, F.S.; requiring that the Agency for Enterprise
75	Information Technology perform contract monitoring duties
76	formerly performed by the Enterprise Project Management
77	Office of the State Technology Office; amending s.
78	216.023, F.S.; requiring that certain legislative budget
79	requests include the statutory reference to the policy
80	requiring a new information technology project; providing
81	for the transfer of specified duties from the State
82	Technology Office to the Department of Management
83	Services; repealing ss. 186.022, 282.005, 282.101,
84	282.102, 282.23, 282.3031, 282.3032, 282.3063, 282.310,
85	287.057(24), 288.1092, and 288.1093, F.S., relating to
86	information technology strategic plans, duties of the
87	State Technology Office, the State Strategic Information
88	Technology Alliance, information resources management
89	responsibilities, guiding principles, the Agency Annual
90	Enterprise Resource Planning and Management Report, the
91	State Annual Report on Enterprise Resource Planning and
92	Management, state strategic information technology
93	alliances, and the One-Stop Permitting System Grant
94	Program and the Quick Permitting County Designation
95	Program within the State Technology Office; amending ss.
96	215.95, 215.96, 282.103, 282.107, 288.0655, 339.155,
97	381.90, 403.973, 408.05, 420.0003, 420.511, 943.08, and
98	1001.26, F.S., relating to the Financial Management
99	Information Board and its coordination council, the SUNCOM
100	Network, the Rural Infrastructure Fund, transportation
101	planning, the Health Information Systems Council,
102	expedited permitting, the Florida Center for Health
103	Information and Policy Analysis, the state housing
104	strategy and the Florida Housing Finance Corporation, the
105	Criminal and Juvenile Justice Information System Council,
106	and the public broadcasting program system; conforming
107	cross-references and other references to provisions
108	repealed by the act; providing appropriations and
109	providing additional positions; authorizing the Agency for
110	Enterprise Information Technology to provide training for
111	agency chief information officers; providing an effective
112	date.
113
114	Be It Enacted by the Legislature of the State of Florida:
115
116	Section 1.  Section 14.204, Florida Statutes, is created to
117	read:
118	14.204  Agency for Enterprise Information Technology.--The
119	Agency for Enterprise Information Technology is created within
120	the Executive Office of the Governor. The head of the agency
121	shall be the Governor and Cabinet. The agency shall be a
122	separate budget entity that is not subject to control,
123	supervision, or direction by the Executive Office of the
124	Governor in any manner, including, but not limited to,
125	purchasing, transactions involving real or personal property,
126	personnel, or budgetary matters.
127	(1)  The executive director of the agency shall be
128	appointed by the Governor and Cabinet, is subject to
129	confirmation by the Senate, and shall serve at the pleasure of
130	the Governor and Cabinet. The executive director shall be the
131	chief information officer of the state and the executive sponsor
132	for all enterprise information technology projects.
133	(2)  The agency shall have the following duties and
134	responsibilities:
135	(a)  Develop and implement strategies for the design,
136	delivery, and management of the enterprise information
137	technology services established in law.
138	(b)  Manage the operation of the enterprise information
139	technology services as identified in law, which includes
140	executing service-level agreements, managing the procurement of
141	enterprise information technology resources, and managing
142	contracts with enterprise information technology service
143	providers.
144	(c)  Make recommendations to the agency head and the
145	Legislature concerning other information technology services
146	that should be designed, delivered, and managed at the
147	enterprise level as defined in s. 282.0041(6).
148	(d)  Plan and manage statutorily authorized enterprise
149	information technology projects, which includes developing
150	business cases that, when applicable, include the components
151	identified in s. 287.0574; establishing and coordinating
152	project-management teams; establishing formal risk-assessment
153	and mitigation processes; and monitoring projects for
154	recommending corrective actions.
155	(e)  Provide project-management resources and assistance to
156	state agencies for information technology projects that are
157	designated as high-risk pursuant to s. 282.322.
158	(f)  Define the architecture standards for enterprise
159	information technology and develop implementation approaches for
160	statewide migration to those standards.
161	(g)  Analyze the effect of new investments of enterprise
162	information technology on existing information technology and
163	complete assessments of the capability of the enterprise
164	information technology.
165	(h)  Identify needs for professional development and
166	training and provide opportunities for agency chief information
167	officers which focus on aligning the operational activities of
168	each state agency's information technology with best practices,
169	standards, and project-management methodologies that promote
170	sustainable and repeatable processes.
171	(i)  Develop and publish an enterprise strategic
172	information technology plan that identifies and recommends
173	strategies for how information technology will deliver effective
174	and efficient government services to state residents and improve
175	the operations of state agencies.
176	(3)  The agency shall operate in such a manner as to ensure
177	participation and representation of state agencies and the
178	Agency Chief Information Officers Council established in s.
179	282.315.
180	Section 2.  Section 20.22, Florida Statutes, is amended to
181	read:
182	20.22  Department of Management Services.--There is created
183	a Department of Management Services.
184	(1)  The head of the Department of Management Services is
185	the Secretary of Management Services, who shall be appointed by
186	the Governor, subject to confirmation by the Senate, and shall
187	serve at the pleasure of the Governor.
188	(2)  The following divisions and programs within the
189	Department of Management Services are established:
190	(a)  Facilities Program.
191	(b)  State Technology Office.
192	(b)(c)  Workforce Program.
193	(c)(d)1.  Support Program.
194	2.  Federal Property Assistance Program.
195	(d)(e)  Administration Program.
196	(e)(f)  Division of Administrative Hearings.
197	(f)(g)  Division of Retirement.
198	(g)(h)  Division of State Group Insurance.
199	(3)  The State Technology Office shall operate and manage
200	the Technology Resource Center.
201	(3)(4)  The duties of the Chief Labor Negotiator shall be
202	determined by the Secretary of Management Services, and must
203	include, but need not be limited to, the representation of the
204	Governor as the public employer in collective bargaining
205	negotiations pursuant to the provisions of chapter 447.
206	Section 3.  Section 216.0446, Florida Statutes, is amended
207	to read:
208	216.0446  Review of information technology resources
209	management needs.--
210	(1)  There is created within the Legislature the Technology
211	Review Workgroup. The workgroup and the State Technology Office
212	shall independently review and make recommendations with respect
213	to the portion of agencies' long-range program plans which
214	pertains to information technology resources management needs
215	and with respect to agencies' legislative budget requests for
216	information technology and related resources. The Technology
217	Review Workgroup shall report such recommendations, together
218	with the findings and conclusions on which such recommendations
219	are based, to the Legislative Budget Commission. The State
220	Technology Office shall report such recommendations, together
221	with the findings and conclusions on which such recommendations
222	are based, to the Executive Office of the Governor and to the
223	chairs of the legislative appropriations committees.
224	(2)  In addition to its primary duty specified in
225	subsection (1), the Technology Review Workgroup shall have
226	powers and duties that include, but are not limited to, the
227	following:
228	(a)  To evaluate the information technology resource
229	management needs identified in the agency long-range program
230	plans for consistency with the State Annual Report on Enterprise
231	Resource Planning and Management and statewide policies
232	recommended by the State Technology Office, and make
233	recommendations to the Legislative Budget Commission.
234	(b)  To review and make recommendations to the  Legislative
235	Budget Commission on proposed budget amendments and agency
236	transfers associated with information technology initiatives or
237	projects that involve more than one agency, that have an outcome
238	that impacts another agency, that exceed $500,000 in total cost
239	over a 1-year period, or that are requested by the Legislative
240	Budget Commission to be reviewed.
241	Section 4.  Section 282.0041, Florida Statutes, is amended
242	to read:
243	282.0041  Definitions.--For the purposes of this part, the
244	term:
245	(1)  "Agency" means those entities described in s.
246	216.011(1)(qq).
247	(2)  "Agency Annual Enterprise Resource Planning and
248	Management Report" means the report prepared by each Agency
249	Chief Information Officer as required by s. 282.3063.
250	(2)(3)  "Agency Chief Information Officer" means the person
251	appointed by the agency head State Technology Office to
252	coordinate and manage the information technology functions
253	policies and responsibilities activities applicable to that
254	agency and to participate and represent his or her agency in
255	developing strategies for implementing enterprise information
256	technology services identified in law and developing
257	recommendations for enterprise information technology policy.
258	(3)(4)  "Agency Chief Information Officers Council" means
259	the council created in s. 282.315 to facilitate the sharing and
260	coordination of information technology issues and initiatives
261	among the agencies.
262	(4)  "Agency for Enterprise Information Technology" means
263	the agency created in s. 14.204.
264	(5)  "Agency information technology service" means a
265	service that directly helps the agency fulfill its statutory or
266	constitutional responsibilities and policy objectives and is
267	usually associated with the agency's primary or core business
268	functions.
269	(6)  "Enterprise level" means all executive branch agencies
270	created or authorized in statute to perform legislatively
271	delegated functions.
272	(7)  "Enterprise information technology service" means an
273	information technology service that is common among agencies and
274	is designed, delivered, and managed at the enterprise level.
275	(8)  "Data center service" means the enterprise information
276	technology service that provides the centralized operation and
277	management of data centers and server rooms.
278	(9)  "E-mail, messaging, and calendaring service" means the
279	enterprise information technology service that enables users to
280	send, receive, file, store, manage, and retrieve electronic
281	messages, attachments, appointments, and addresses.
282	(5)  "Enterprise resources management infrastructure" means
283	the hardware, software, networks, data, human resources,
284	policies, standards, facilities, maintenance, and related
285	materials and services that are required to support the business
286	processes of an agency or state enterprise.
287	(6)  "Enterprise resource planning and management" means
288	the planning, budgeting, acquiring, developing, organizing,
289	directing, training, control, and related services associated
290	with government information technology. The term encompasses
291	information and related resources, as well as the controls
292	associated with their acquisition, development, dissemination,
293	and use.
294	(10)(7)  "Information technology" means equipment,
295	hardware, software, firmware, programs, systems, networks,
296	infrastructure, media, and related material used to
297	automatically, electronically, and wirelessly collect, receive,
298	access, transmit, display, store, record, retrieve, analyze,
299	evaluate, process, classify, manipulate, manage, assimilate,
300	control, communicate, exchange, convert, converge, interface,
301	switch, or disseminate information of any kind or form.
302	(11)  "Information technology policy" means statements that
303	describe clear choices for how information technology will
304	deliver effective and efficient government services to residents
305	and improve state agency operations. Such a policy may relate to
306	investments, business applications, architecture, or
307	infrastructure. A policy describes its rationale, implications
308	of compliance or noncompliance, the timeline for implementation,
309	metrics for determining compliance, and the accountable
310	structure responsible for its implementation.
311	(12)(8)  "Project" means an undertaking directed at the
312	accomplishment of a strategic objective relating to enterprise
313	resources management or a specific appropriated program.
314	(9)  "State Annual Report on Enterprise Resource Planning
315	and Management" means the report prepared by the State
316	Technology Office as defined in s. 282.102.
317	(13)(10)  "Standards" means the use of current, open,
318	nonproprietary, or non-vendor-specific technologies.
319	(11)  "State Technology Office" or "office" means the
320	office created in s. 282.102.
321	(14)(12)  "Total cost" means all costs associated with
322	information technology projects or initiatives, including, but
323	not limited to, value of hardware, software, service,
324	maintenance, incremental personnel, and facilities.  Total cost
325	of a loan or gift of information technology resources to an
326	agency includes the fair market value of the resources, except
327	that the total cost of loans or gifts of information technology
328	to state universities to be used in instruction or research does
329	not include fair market value.
330	Section 5.  Section 282.0055, Florida Statutes, is created
331	to read:
332	282.0055  Assignment of information technology.--In order
333	to ensure the most effective and efficient use of the state's
334	information technology and information technology resources and
335	notwithstanding other provisions of law to the contrary, the
336	design, delivery, and management of the enterprise information
337	technology services defined in s. 282.0041(7) shall be the
338	responsibility of the Agency for Enterprise Information
339	Technology for executive branch agencies created or authorized
340	in statute to perform legislatively delegated functions. The
341	design, delivery, and management of the agency information
342	technology services defined in s. 282.0041(5) shall be the
343	responsibility of the individual state agency.
344	Section 6.  Section 282.0056, Florida Statutes, is created
345	to read:
346	282.0056  Development of work plan.--
347	(1)  For purposes of carrying out its responsibilities set
348	forth in s. 282.0055, the Agency for Enterprise Information
349	Technology shall develop a work plan describing the activities
350	that the agency intends to undertake and the proposed outcomes.
351	The work plan must be approved by the agency head and submitted
352	to the President of the Senate and the Speaker of the House of
353	Representatives. The work plan may be amended as needed to
354	ensure that the enterprise information technology services will
355	be provided in an efficient, effective, and accountable manner.
356	For the 2007-2008 fiscal year, the agency's work plan shall
357	include the development of recommended information technology
358	policies, as defined in s. 282.0041(11), and implementation
359	plans for each of the following:
360	(a)  Consolidation of the deployment, management, and
361	operation of state-owned or state-operated computer rooms and
362	data centers.
363	(b)  A shared or consolidated enterprise information
364	technology service delivery and support model for the e-mail,
365	messaging, and calendaring service defined in s. 282.0041(9).
366	(c)  Information security.
367	(2)  In developing policy recommendations and
368	implementation plans for current and proposed enterprise
369	information technology services, the agency shall describe the
370	scope of operation, conduct costs and requirements analyses,
371	conduct an inventory of all existing information technology
372	resources that are associated with each service, and develop
373	strategies and timeframes for statewide migration. For purposes
374	of consolidating state-owned or state-operated computer rooms
375	and data centers, the Agency for Enterprise Information
376	Technology shall develop a migration plan that ensures the
377	migration of at least three computer rooms or data centers each
378	fiscal year.
379	(3)  For the purpose of completing its work activities,
380	each state agency shall provide to the Agency for Enterprise
381	Information Technology all requested information, including, but
382	not limited to, the agency's costs, service requirements, and
383	equipment inventories.
384	Section 7.  Section 282.20, Florida Statutes, is amended to
385	read:
386	282.20  Technology Resource Center.--
387	(1)(a)  The Department of Management Services State
388	Technology Office shall operate and manage the Technology
389	Resource Center.
390	(b)  For the purposes of this section, the term:
391	1.  "Information-system utility" means a full-service
392	information-processing facility offering hardware, software,
393	operations, integration, networking, and consulting services.
394	2.  "Customer" means a state agency or other entity which
395	is authorized to utilize the SUNCOM Network pursuant to this
396	part.
397	(2)  The Technology Resource Center shall:
398	(a)  Serve the office and other customers as an
399	information-system utility.
400	(b)  Cooperate with customers to offer, develop, and
401	support a wide range of services and applications needed by
402	users of the Technology Resource Center.
403	(c)  Cooperate with the Florida Legal Resource Center of
404	the Department of Legal Affairs and other state agencies to
405	develop and provide access to repositories of legal information
406	throughout the state.
407	(c)(d)  Cooperate with the Agency for Enterprise
408	Information Technology office to identify and facilitate
409	interdepartmental networking and integration of network services
410	for its customers.
411	(d)(e)  Assist customers in testing and evaluating new and
412	emerging technologies that could be used to meet the needs of
413	the state.
414	(3)  The department office may contract with customers to
415	provide any combination of services necessary for agencies to
416	fulfill their responsibilities and to serve their users.
417	(4)  The Technology Resource Center may plan, design,
418	establish pilot projects for, and conduct experiments with
419	information technology resources, and may implement enhancements
420	in services when such implementation is cost-effective. Funding
421	for experiments and pilot projects shall be derived from service
422	revenues and may not exceed 5 percent of the service revenues
423	for the Technology Resource Center for any single fiscal year.
424	Any experiment, pilot project, plan, or design must be approved
425	by the Agency for Enterprise Information Technology Chief
426	Information Officer.
427	(5)  Beginning in the 2007-2008 fiscal year and annually
428	thereafter, the Technology Resource Center shall submit to the
429	Agency for Enterprise Information Technology for its review and
430	approval a copy of its service rates and cost-allocation plan.
431	When appropriate, the Agency for Enterprise Information
432	Technology shall request review and comment from the customers
433	and Agency Chief Information Officers Council concerning the
434	center's proposed rate structure.
435	(5)  Notwithstanding the provisions of s. 216.272, the
436	Technology Resource Center may spend funds in the reserve
437	account of the Technology Enterprise Operating Trust Fund for
438	enhancements to center operations or for information technology
439	resources. Any expenditure of reserve account funds must be
440	approved by the Chief Information Officer. Any funds remaining
441	in the reserve account at the end of the fiscal year may be
442	carried forward and spent as approved by the Chief Information
443	Officer, provided that such approval conforms to any applicable
444	provisions of chapter 216.
445	Section 8.  Section 282.3055, Florida Statutes, is amended
446	to read:
447	282.3055  Agency chief information officer; appointment;
448	duties.--
449	(1)(a)  In order to assist the State Technology Officer in
450	carrying out agency information technology the enterprise
451	resource planning and management responsibilities and assist the
452	Agency for Enterprise Information Technology in developing
453	strategies for implementing the enterprise information
454	technology services established by law, each agency head shall,
455	the Chief Information Officer may appoint or contract for an
456	agency chief information officer. This position may be full time
457	or part time.
458	(b)  The agency chief information officer must, at a
459	minimum, have knowledge and experience in both management and
460	information technology resources.
461	(2)  The duties of the agency chief information officer
462	include, but are not limited to:
463	(a)  Coordinating and facilitating the agency enterprise
464	resource planning and management of agency information
465	technology services projects and initiatives.
466	(b)  Preparing an agency annual report on enterprise
467	resource planning and management pursuant to s. 282.3063.
468	(b)(c)  Developing and Implementing agency information
469	technology enterprise resource planning and management policies,
470	procedures, guidelines, and standards that are consistent with
471	the procedures and standards adopted by the Agency for
472	Enterprise Information Technology, including specific policies
473	and procedures for review and approval of the agency's purchases
474	of information technology resources in accordance with the
475	office's policies and procedures.
476	(c)(d)  Advising agency senior management as to the
477	information technology enterprise resource planning and
478	management needs of the agency for inclusion in planning
479	documents required by law.
480	(d)(e)  Assisting in the development and prioritization of
481	the information technology enterprise resource needs for
482	planning and management schedule of the agency's legislative
483	budget request.
484	(e)  Assisting the Agency for Enterprise Information
485	Technology in the development of strategies for implementing the
486	utility information technology services established in law and
487	developing recommendations for enterprise information technology
488	policy.
489	Section 9.  Section 282.315, Florida Statutes, is amended
490	to read:
491	282.315  Agency Chief Information Officers Council;
492	creation.--The Legislature finds that enhancing communication,
493	consensus building, coordination, and facilitation with respect
494	to issues concerning of statewide enterprise information
495	technology resources resource planning and management issues is
496	essential to improving the state management of such resources.
497	(1)  There is created an Agency Chief Information Officers
498	Council to:
499	(a)  Enhance communication and collaboration among the
500	Agency Chief Information Officers and the Agency for Enterprise
501	Information Technology by sharing enterprise resource planning
502	and management experiences and exchanging ideas.
503	(b)  Identify and recommend Facilitate the sharing of best
504	practices that are characteristic of highly successful
505	technology organizations, as well as exemplary information
506	technology applications for use by of state agencies, and assist
507	the Agency for Enterprise Information Technology in developing
508	strategies for implementing the utility information technology
509	services and enterprise information technology projects
510	established in law and developing recommendations for enterprise
511	information technology policy.
512	(c)  Identify efficiency opportunities among state agencies
513	and make recommendations for action to the Agency for Enterprise
514	Information Technology.
515	(d)  Serve as an educational forum for enterprise resource
516	planning and management issues.
517	(d)(e)  Assist the Agency for Enterprise Information
518	Technology State Technology Office in identifying critical
519	enterprise information technology statewide issues and, when
520	appropriate, make recommendations for solving enterprise
521	resource planning and management deficiencies.
522	(2)  Members of the council shall include the Agency Chief
523	Information Officers, including the Chief Information Officers
524	of the agencies and governmental entities enumerated in s.
525	282.0055 s. 282.3031, except that there shall be one Chief
526	Information Officer selected by the state attorneys and one
527	Chief Information Officer selected by the public defenders. The
528	council shall appoint a chair, vice chair, and secretary from
529	among its members to a 1-year term each. The council shall
530	establish procedures governing council business. The chairs, or
531	their designees, of the Florida Financial Management Information
532	System Coordinating Council, the Criminal and Juvenile Justice
533	Information Systems Council, and the Health Information Systems
534	Council shall represent their respective organizations on the
535	Chief Information Officers Council as voting members.
536	(3)  The Agency for Enterprise Information Technology State
537	Technology Office shall provide administrative support to the
538	council.
539	Section 10.  Section 282.318, Florida Statutes, is amended
540	to read:
541	282.318  Security of data and information technology
542	resources.--
543	(1)  This section may be cited as the "Security of Data and
544	Information Technology Infrastructure Resources Act."
545	(2)(a)  The Agency for Enterprise Information Technology
546	State Technology Office, in consultation with each agency head,
547	is responsible and accountable for assessing and recommending
548	minimum operating procedures for ensuring assuring an adequate
549	level of security for all data and information technology
550	resources for executive branch agencies created or authorized in
551	statute to perform legislatively delegated functions. To assist
552	the agency in carrying out this responsibility, of each agency
553	head and, to carry out this responsibility, shall, at a minimum:
554	1.  Designate an information security manager who shall
555	administer the security program of the each agency for its data
556	and information technology resources.
557	2.  Conduct, and periodically update every 3 years, a
558	comprehensive risk analysis to determine the security threats to
559	the data, information, and information technology resources of
560	the each agency. The risk analysis information is confidential
561	and exempt from the provisions of s. 119.07(1), except that such
562	information shall be available to the Auditor General and the
563	Agency for Enterprise Information Technology in performing his
564	or her postauditing duties.
565	3.  Develop, and periodically update, written internal
566	policies and procedures that are consistent with the standard
567	operating procedures adopted by the Agency for Enterprise
568	Information Technology in order to ensure to assure the security
569	of the data, information, and information technology resources
570	of the each agency. The internal policies and procedures that
571	which, if disclosed, could facilitate the unauthorized
572	modification, disclosure, or destruction of data or information
573	technology resources are confidential information and exempt
574	from the provisions of s. 119.07(1), except that such
575	information shall be available to the Auditor General and the
576	Agency for Enterprise Information Technology in performing his
577	or her postauditing duties.
578	4.  Implement appropriate cost-effective safeguards to
579	reduce, eliminate, or recover from the identified risks to the
580	data, information, and information technology resources of the
581	each agency.
582	5.  Ensure that periodic internal audits and evaluations of
583	the agency's each security program for the data, information,
584	and information technology resources of the agency are
585	conducted. The results of such internal audits and evaluations
586	are confidential information and exempt from the provisions of
587	s. 119.07(1), except that such information shall be available to
588	the Auditor General and the Agency for Enterprise Information
589	Technology in performing his or her postauditing duties.
590	6.  Include appropriate security requirements, as
591	determined by the State Technology Office, in consultation with
592	each agency head, in the written specifications for the
593	solicitation of information technology and information
594	technology resources which are consistent with the standard
595	security operating procedures adopted by the Agency for
596	Enterprise Information Technology.
597	(b)  In those instances under this subsection in which the
598	state agency or department State Technology Office develops
599	state contracts for use by state agencies, the state agency or
600	department office shall include appropriate security
601	requirements in the specifications for the solicitation for
602	state contracts for procuring information technology or
603	information technology resources.
604	(3)  The Agency for Enterprise Information Technology shall
605	designate a chief information security officer.
606	(4)  The Agency for Enterprise Information Technology shall
607	develop standards and templates for conducting comprehensive
608	risk analyses and information security audits by state agencies,
609	assist agencies in their compliance with the provisions of this
610	section, pursue appropriate funding provided for the purpose of
611	enhancing domestic security, establish minimum guidelines and
612	procedures for the recovery of information technology following
613	a disaster, and provide training for agency information security
614	managers.
615	(3)  Notwithstanding subsection (2), the Department of
616	Management Services, hereafter referred to as the "department,"
617	in consultation with each agency head, is responsible for
618	coordinating, assessing, and recommending minimum operating
619	procedures for ensuring an adequate level of security for data
620	and information technology resources. To assist the department
621	in carrying out this responsibility, each agency shall, at a
622	minimum:
623	(a)  Designate an information security manager who shall
624	administer the security program of the agency for its data and
625	information technology resources.
626	(b)  Conduct, and update every 3 years, a comprehensive
627	risk analysis to determine the security threats to the data,
628	information, and information technology resources of the agency.
629	The risk analysis information made confidential and exempt under
630	subparagraph (2)(a)2. shall be available to the Auditor General
631	in performing his or her postauditing duties.
632	(c)  Develop, and periodically update, written internal
633	policies and procedures that are consistent with the standard
634	operating procedures recommended by the department to ensure the
635	security of the data and information technology resources of the
636	agency. The internal policies and procedures that, if disclosed,
637	could facilitate the unauthorized modification, disclosure, or
638	destruction of data or information technology resources made
639	confidential and exempt under subparagraph (2)(a)3. shall be
640	available to the Auditor General in performing his or her
641	postauditing duties.
642	(d)  Implement appropriate cost-effective safeguards to
643	reduce, eliminate, or recover from the identified risks to the
644	data and information technology resources of the agency.
645	(e)  Ensure that periodic internal audits and evaluations
646	of the security program for the data, information, and
647	information technology resources of the agency are conducted.
648	The results of such internal audits and evaluations made
649	confidential and exempt under subparagraph (2)(a)5. shall be
650	available to the Auditor General in performing his or her
651	postauditing duties.
652	(f)  Include appropriate security requirements in the
653	written specifications for the solicitation of information
654	technology resources that are consistent with the standard
655	security operating procedures as recommended by the department.
656	(g)  This subsection expires July 1, 2007.
657
658	In those instances under this subsection in which the department
659	develops state contracts for use by state agencies, the
660	department shall include appropriate security requirements in
661	the specifications for the solicitation for state contracts for
662	procuring information technology resources.
663	(4)  In order to ensure the security of data, information,
664	and information technology resources, the department shall
665	establish the Office of Information Security and shall designate
666	a Chief Information Security Officer as the head of the office.
667	The office shall coordinate its activities with the Agency Chief
668	Information Officers Council as established in s. 282.315. The
669	office is responsible for developing a strategic plan for
670	information technology security which shall be submitted by
671	March 1, 2007, to the Executive Office of the Governor, the
672	President of the Senate, and the Speaker of the House of
673	Representatives; developing standards and templates for
674	conducting comprehensive risk analyses and information security
675	audits by state agencies; assisting agencies in their compliance
676	with the provisions of this section; establishing minimum
677	standards for the recovery of information technology following a
678	disaster; and conducting training for agency information
679	security managers. This subsection expires July 1, 2007.
680	Section 11.  Subsection (2) of section 282.322, Florida
681	Statutes, is amended to read:
682	282.322  Special monitoring process for designated
683	information resources management projects.--
684	(2)  The Agency for Enterprise Information Technology
685	Project Management Office of the State Technology Office shall
686	report on any information technology project that the
687	Legislature projects the office identifies as high-risk to the
688	Executive Office of the Governor, the President of the Senate,
689	the Speaker of the House of Representatives, and the chairs of
690	the appropriations committees. Within the limits of current
691	appropriations, the Agency for Enterprise Information Technology
692	Project Management Office shall monitor and report on such high-
693	risk information technology projects, and assess the levels of
694	risks associated with proceeding to the next stage of the
695	project.
696	Section 12.  Paragraph (a) of subsection (4) of section
697	216.023, Florida Statutes, is amended to read:
698	216.023  Legislative budget requests to be furnished to
699	Legislature by agencies.--
700	(4)(a)  The legislative budget request must contain for
701	each program:
702	1.  The constitutional or statutory authority for a
703	program, a brief purpose statement, and approved program
704	components.
705	2.  Information on expenditures for 3 fiscal years (actual
706	prior-year expenditures, current-year estimated expenditures,
707	and agency budget requested expenditures for the next fiscal
708	year) by appropriation category.
709	3.  Details on trust funds and fees.
710	4.  The total number of positions (authorized, fixed, and
711	requested).
712	5.  An issue narrative describing and justifying changes in
713	amounts and positions requested for current and proposed
714	programs for the next fiscal year.
715	6.  Information resource requests.
716	7.  Supporting information, including applicable cost-
717	benefit analyses, business case analyses, performance
718	contracting procedures, service comparisons, and impacts on
719	performance standards for any request to outsource or privatize
720	agency functions. The cost-benefit and business case analyses
721	must include an assessment of the impact on each affected
722	activity from those identified in accordance with paragraph (b).
723	Performance standards must include standards for each affected
724	activity and be expressed in terms of the associated unit of
725	activity.
726	8.  An evaluation of any major outsourcing and
727	privatization initiatives undertaken during the last 5 fiscal
728	years having aggregate expenditures exceeding $10 million during
729	the term of the contract. The evaluation shall include an
730	assessment of contractor performance, a comparison of
731	anticipated service levels to actual service levels, and a
732	comparison of estimated savings to actual savings achieved.
733	Consolidated reports issued by the Department of Management
734	Services may be used to satisfy this requirement.
735	9.  Supporting information for any proposed consolidated
736	financing of deferred-payment commodity contracts including
737	guaranteed energy performance savings contracts.  Supporting
738	information must also include narrative describing and
739	justifying the need, baseline for current costs, estimated cost
740	savings, projected equipment purchases, estimated contract
741	costs, and return on investment calculation.
742	10.  In accordance with the instructions for legislative
743	budget requests for new information technology projects that
744	exceed $5 million in total cost, the statutory reference of the
745	existing or proposed substantive policy that establishes and
746	defines the project's governance structure, scope, main business
747	objectives that must be achieved, and completion timeframes.
748	Information technology budget requests for the continuance of
749	existing hardware and software maintenance agreements, renewal
750	of existing software licensing agreements, or the replacement of
751	desktop units with new technology that is similar to the
752	technology currently in use are exempt from this requirement.
753	Section 13.  Unless otherwise specified in this act, the
754	Department of Management Services, established in s. 20.22,
755	Florida Statutes, shall assume the duties and responsibilities
756	of the State Technology Office as set forth in ss. 215.322(2),
757	282.103, 282.104, 282.105, 282.106, 282.107, 282.1095, 282.111,
758	282.21, 282.22, 288.1092, 288.1093, 365.171, 365.172, 365.173,
759	and 943.0313, Florida Statutes.
760	Section 14.  Sections 186.022, 282.005, 282.101, 282.102,
761	282.23, 282.3031, 282.3032, 282.3063, and 282.310, Florida
762	Statutes, subsection (24) of section 287.057, Florida Statutes,
763	and sections 288.1092 and 288.1093, Florida Statutes, are
764	repealed.
765	Section 15.  Paragraph (d) of subsection (2) of section
766	215.95, Florida Statutes, is amended to read:
767	215.95  Financial Management Information Board.--
768	(2)  To carry out its duties and responsibilities, the
769	board shall by majority vote:
770	(d)  By March 1 of each year, approve a strategic plan
771	pursuant to the requirements set forth in s. 186.022(9).
772	Section 16.  Paragraph (a) of subsection (3) of section
773	215.96, Florida Statutes, is amended to read:
774	215.96  Coordinating council and design and coordination
775	staff.--
776	(3)  The coordinating council, assisted by the design and
777	coordination staff, shall have the following duties, powers, and
778	responsibilities pertaining to the Florida Financial Management
779	Information System:
780	(a)  To conduct such studies and to establish committees,
781	workgroups, and teams to develop recommendations for rules,
782	policies, procedures, principles, and standards to the board as
783	necessary to assist the board in its efforts to design,
784	implement, and perpetuate a financial management information
785	system, including, but not limited to, the establishment of
786	common data codes, and the development of integrated financial
787	management policies that address the information and management
788	needs of the functional owner subsystems, and the development of
789	a strategic plan pursuant to the requirements set forth in s.
790	186.022. The coordinating council shall make available a copy of
791	the approved plan in writing or through electronic means to each
792	of the coordinating council members, the fiscal committees of
793	the Legislature, and any interested person.
794	Section 17.  Subsection (1) of section 282.103, Florida
795	Statutes, is amended to read:
796	282.103  SUNCOM Network; exemptions from the required
797	use.--
798	(1)  There is created within the State Technology Office
799	the SUNCOM Network which shall be developed to serve as the
800	state communications system for providing local and long-
801	distance communications services to state agencies, political
802	subdivisions of the state, municipalities, state universities,
803	and nonprofit corporations pursuant to ss. 282.103-282.111 ss.
804	282.101-282.111. The SUNCOM Network shall be developed to
805	transmit all types of communications signals, including, but not
806	limited to, voice, data, video, image, and radio. State agencies
807	shall cooperate and assist in the development and joint use of
808	communications systems and services.
809	Section 18.  Subsection (1) of section 282.107, Florida
810	Statutes, is amended to read:
811	282.107  SUNCOM Network; criteria for usage.--
812	(1)  The State Technology Office shall periodically review
813	the qualifications of subscribers using the state SUNCOM Network
814	and shall terminate services provided to any facility not
815	qualified pursuant to ss. 282.103-282.111 ss. 282.101-282.111 or
816	rules adopted hereunder.  In the event of nonpayment of invoices
817	by subscribers whose SUNCOM Network invoices are paid from
818	sources other than legislative appropriations, such nonpayment
819	represents good and sufficient reason to terminate service.
820	Section 19.  Paragraph (e) of subsection (2) of section
821	288.0655, Florida Statutes, is amended to read:
822	288.0655  Rural Infrastructure Fund.--
823	(2)
824	(e)  To enable local governments to access the resources
825	available pursuant to s. 403.973(18)(19), the office may award
826	grants for surveys, feasibility studies, and other activities
827	related to the identification and preclearance review of land
828	which is suitable for preclearance review. Authorized grants
829	under this paragraph shall not exceed $75,000 each, except in
830	the case of a project in a rural area of critical economic
831	concern, in which case the grant shall not exceed $300,000. Any
832	funds awarded under this paragraph must be matched at a level of
833	50 percent with local funds, except that any funds awarded for a
834	project in a rural area of critical economic concern must be
835	matched at a level of 33 percent with local funds. In evaluating
836	applications under this paragraph, the office shall consider the
837	extent to which the application seeks to minimize administrative
838	and consultant expenses.
839	Section 20.  Paragraph (b) of subsection (3) and subsection
840	(4) of section 339.155, Florida Statutes, are amended to read:
841	339.155  Transportation planning.--
842	(3)  FORMAT, SCHEDULE, AND REVIEW.--The Florida
843	Transportation Plan shall be a unified, concise planning
844	document that clearly defines the state's long-range
845	transportation goals and objectives and documents the
846	department's short-range objectives developed to further such
847	goals and objectives. The plan shall include a glossary that
848	clearly and succinctly defines any and all phrases, words, or
849	terms of art included in the plan, with which the general public
850	may be unfamiliar and shall consist of, at a minimum, the
851	following components:
852	(b)  A short-range component documenting the short-term
853	objectives and strategies necessary to implement the goals and
854	long-term objectives contained in the long-range component. The
855	short-range component must define the relationship between the
856	long-range goals and the short-range objectives, specify those
857	objectives against which the department's achievement of such
858	goals will be measured, and identify transportation strategies
859	necessary to efficiently achieve the goals and objectives in the
860	plan. It must provide a policy framework within which the
861	department's legislative budget request, the strategic
862	information resource management plan, and the work program are
863	developed. The short-range component shall serve as the
864	department's annual agency strategic plan pursuant to s.
865	186.021. The short-range component shall be developed consistent
866	with the requirements of s. 186.022 and consistent with
867	available and forecasted state and federal funds. In addition to
868	those entities listed in s. 186.022, The short-range component
869	shall also be submitted to the Florida Transportation
870	Commission.
871	(4)  ANNUAL PERFORMANCE REPORT.--The department shall
872	develop an annual performance report evaluating the operation of
873	the department for the preceding fiscal year. The report, which
874	shall meet the requirements of s. 186.022, shall also include a
875	summary of the financial operations of the department and shall
876	annually evaluate how well the adopted work program meets the
877	short-term objectives contained in the short-range component of
878	the Florida Transportation Plan. In addition to the entities
879	listed in s. 186.022, This performance report shall also be
880	submitted to the Florida Transportation Commission and the
881	legislative appropriations and transportation committees.
882	Section 21.  Subsection (7) of section 381.90, Florida
883	Statutes, is amended to read:
884	381.90  Health Information Systems Council; legislative
885	intent; creation, appointment, duties.--
886	(7)  The council's duties and responsibilities include, but
887	are not limited to, the following:
888	(a)  By June 1 of each year, to develop and approve a
889	strategic plan pursuant to the requirements set forth in s.
890	186.022.
891	(a)(b)  To develop a mission statement, goals, and plan of
892	action, based on the guiding principles specified in s.
893	282.3032, for the identification, collection, standardization,
894	sharing, and coordination of health-related data across federal,
895	state, and local government and private-sector entities.
896	(b)(c)  To develop a review process to ensure cooperative
897	planning among agencies that collect or maintain health-related
898	data.
899	(c)(d)  To create ad hoc issue-oriented technical
900	workgroups, on an as-needed basis, to make recommendations to
901	the council.
902	Section 22.  Subsections (5) through (20) of section
903	403.973, Florida Statutes, are renumbered as subsections (4)
904	through (19), respectively, and current subsections (4), (7),
905	(8), (13), and (14) of that section are amended to read:
906	403.973  Expedited permitting; comprehensive plan
907	amendments.--
908	(4)  The office may delegate to a Quick Permitting County
909	designated under s. 288.1093 the responsibility for convening
910	regional permit teams and, in consultation with the office, for
911	certifying as eligible for expedited review projects that meet
912	the criteria of subsection (3) and that are consistent with the
913	economic goals of the county. In order to receive such a
914	delegation, the Quick Permitting County must hold the public
915	hearing required under subsection (7) and agree to execute a
916	memorandum of agreement for each qualified project.
917	(6)(7)  The local government shall hold a duly noticed
918	public hearing to execute a memorandum of agreement for each
919	qualified project. Notwithstanding any other provision of law,
920	and at the option of the local government, the workshop provided
921	for in subsection (5) (6) may be conducted on the same date as
922	the public hearing held under this subsection. The memorandum of
923	agreement that a local government signs shall include a
924	provision identifying necessary local government procedures and
925	time limits that will be modified to allow for the local
926	government decision on the project within 90 days. The
927	memorandum of agreement applies to projects, on a case-by-case
928	basis, that qualify for special review and approval as specified
929	in this section. The memorandum of agreement must make it clear
930	that this expedited permitting and review process does not
931	modify, qualify, or otherwise alter existing local government
932	nonprocedural standards for permit applications, unless
933	expressly authorized by law.
934	(7)(8)  At the option of the participating local
935	government, appeals of its final approval for a project may be
936	pursuant to the summary hearing provisions of s. 120.574,
937	pursuant to subsection (14) (15), or pursuant to other appellate
938	processes available to the local government. The local
939	government's decision to enter into a summary hearing must be
940	made as provided in s. 120.574 or in the memorandum of
941	agreement.
942	(12)(13)  The applicant, the regional permit action team,
943	and participating local governments may agree to incorporate
944	into a single document the permits, licenses, and approvals that
945	are obtained through the expedited permit process. This
946	consolidated permit is subject to the summary hearing provisions
947	set forth in subsection (14) (15).
948	(13)(14)  Notwithstanding any other provisions of law:
949	(a)  Local comprehensive plan amendments for projects
950	qualified under this section are exempt from the twice-a-year
951	limits provision in s. 163.3187; and
952	(b)  Projects qualified under this section are not subject
953	to interstate highway level-of-service standards adopted by the
954	Department of Transportation for concurrency purposes. The
955	memorandum of agreement specified in subsection (5) (6) must
956	include a process by which the applicant will be assessed a fair
957	share of the cost of mitigating the project's significant
958	traffic impacts, as defined in chapter 380 and related rules.
959	The agreement must also specify whether the significant traffic
960	impacts on the interstate system will be mitigated through the
961	implementation of a project or payment of funds to the
962	Department of Transportation. Where funds are paid, the
963	Department of Transportation must include in the 5-year work
964	program transportation projects or project phases, in an amount
965	equal to the funds received, to mitigate the traffic impacts
966	associated with the proposed project.
967	Section 23.  Paragraph (h) of subsection (8) of section
968	408.05, Florida Statutes, is amended to read:
969	408.05  Florida Center for Health Information and Policy
970	Analysis.--
971	(8)  STATE CONSUMER HEALTH INFORMATION AND POLICY ADVISORY
972	COUNCIL.--
973	(h)  The council's duties and responsibilities include, but
974	are not limited to, the following:
975	1.  To develop a mission statement, goals, and a plan of
976	action based on the guiding principles specified in s. 282.3032
977	for the identification, collection, standardization, sharing,
978	and coordination of health-related data across federal, state,
979	and local government and private sector entities.
980	2.  To develop a review process to ensure cooperative
981	planning among agencies that collect or maintain health-related
982	data.
983	3.  To create ad hoc issue-oriented technical workgroups on
984	an as-needed basis to make recommendations to the council.
985	Section 24.  Paragraph (b) of subsection (4) of section
986	420.0003, Florida Statutes, is amended to read:
987	420.0003  State housing strategy.--
988	(4)  IMPLEMENTATION.--The Department of Community Affairs
989	and the Florida Housing Finance Corporation in carrying out the
990	strategy articulated herein shall have the following duties:
991	(b)  The agency strategic plan of the Department of
992	Community Affairs, prepared pursuant to the provisions of ss.
993	186.021 and 186.022, shall include specific goals, objectives,
994	and strategies that implement the housing policies in this
995	section and shall include the strategic plan for housing
996	production prepared by the corporation pursuant to s. 420.511.
997	Section 25.  Subsection (2) of section 420.511, Florida
998	Statutes, is amended to read:
999	420.511  Business plan; strategic plan; annual report.--
1000	(2)  The corporation, in equal partnership with the
1001	department, shall develop annually a strategic plan for the
1002	provision of affordable housing in Florida as part of the
1003	department's agency strategic plan required pursuant to chapter
1004	186. In part, the plan shall include provisions that maximize
1005	the abilities of the corporation and the department to implement
1006	the state housing strategy established under s. 420.0003, to
1007	respond to federal housing initiatives, and to develop programs
1008	in a manner that is more responsive to the needs of public and
1009	private partners. The plan shall be developed on a schedule
1010	consistent with that established by s. ss. 186.021 and 186.022.
1011	For purposes of this act, the executive director or his or her
1012	designee shall serve as the corporation's representative to
1013	achieve a coordinated and integrated planning relationship with
1014	the department.
1015	Section 26.  Subsection (3) of section 943.08, Florida
1016	Statutes, is amended to read:
1017	943.08  Duties; Criminal and Juvenile Justice Information
1018	Systems Council.--
1019	(3)  The council shall develop and approve a long-range
1020	program strategic plan pursuant to the requirements set forth in
1021	s. 186.021 s. 186.022. Copies of the approved plan shall be
1022	transmitted, electronically or in writing, to the Executive
1023	Office of the Governor, the Speaker of the House of
1024	Representatives, the President of the Senate, and the council
1025	members.
1026	Section 27.  Paragraph (a) of subsection (2) of section
1027	1001.26, Florida Statutes, is amended to read:
1028	1001.26  Public broadcasting program system.--
1029	(2)(a)  The Department of Education is responsible for
1030	implementing the provisions of this section pursuant to s.
1031	282.102 and may employ personnel, acquire equipment and
1032	facilities, and perform all duties necessary for carrying out
1033	the purposes and objectives of this section.
1034	Section 28.  For the 2007-2008 fiscal year, the sum of
1035	$____ in recurring funds from the General Revenue Fund is
1036	appropriated and __ full-time equivalent positions are
1037	authorized to the Agency for Enterprise Information Technology
1038	to carry out the activities as provided in this act.
1039	Section 29.  For the 2007-2008 fiscal year, the sum of
1040	$____ in recurring funds from the General Revenue Fund is
1041	appropriated and __ full-time equivalent positions are
1042	authorized to the Agency for Enterprise Information Technology
1043	to carry out the duties of information security as provided in
1044	this act.
1045	Section 30.  The Agency for Enterprise Information
1046	Technology, in collaboration with the Agency Chief Information
1047	Officers Council, may implement a program to provide
1048	professional development and training opportunities for agency
1049	chief information officers. For the 2007-2008 fiscal year, the
1050	sum of $____ in recurring funds from the General Revenue Fund is
1051	appropriated to the Agency for Enterprise Information Technology
1052	to implement this program.
1053	Section 31.  This act shall take effect July 1, 2007.

CODING: Words stricken are deletions; words underlined are additions.