Amendment
Bill No. SB 2098

Amendment No. 781675

CHAMBER ACTION
Senate		House
.
.
.

---

---

1	Representative Grimsley offered the following:
2
3	Amendment (with title amendment)
4	Remove everything after the enacting clause and insert:
5
6	Section 1.  Paragraphs (a), (g), (h), (i), (j), and (k) of
7	subsection (4) and subsections (5) and (6) of section 14.204,
8	Florida Statutes, are amended to read:
9	14.204  Agency for Enterprise Information Technology.-The
10	Agency for Enterprise Information Technology is created within
11	the Executive Office of the Governor.
12	(4)  The agency shall have the following duties and
13	responsibilities:
14	(a)  Develop strategies for the planning, design, delivery,
15	implementation, and management of the enterprise information
16	technology services established in law, including the state data
17	center system services established pursuant to s. 282.201, the
18	information technology security service established in s.
19	282.318, and the statewide e-mail service established in s.
20	282.34.
21	(g)  Coordinate technology resource acquisition planning
22	and assist the Division of Purchasing of the Department of
23	Management Services in procurement negotiations for technology
24	hardware and software products and services in order to improve
25	the efficiency and reduce the cost of enterprise information
26	technology services.
27	(h)  In consultation with the Division of Purchasing in the
28	Department of Management Services, coordinate procurement
29	negotiations for information technology products as defined in
30	s. 282.0041 which will be used by multiple agencies.
31	(h)(i)  In coordination with, and through the services of,
32	the Division of Purchasing in the Department of Management
33	Services, establish best practices for the procurement of
34	information technology products as defined in s. 282.0041 in
35	order to achieve savings for the state.
36	(i)(j)  Develop information technology standards for
37	enterprise information technology services as defined in s.
38	282.0041.
39	(j)(k)  Provide annually, by December 31, recommendations
40	to the Legislature relating to techniques for consolidating the
41	purchase of information technology commodities and services,
42	which result in savings for the state, and for establishing a
43	process to achieve savings through consolidated purchases.
44	(5)  The Office of Information Security shall be created
45	within the agency. The agency shall designate a state Chief
46	Information Security Officer who shall oversee the office and
47	report directly to the executive director.
48	(6)  The agency shall operate in a manner that ensures the
49	participation and representation of state agencies and the
50	Agency Chief Information Officers Council established in s.
51	282.315.
52	Section 2.  Subsection (10) of section 20.315, Florida
53	Statutes, is amended to read:
54	20.315  Department of Corrections.-There is created a
55	Department of Corrections.
56	(10)  SINGLE INFORMATION AND RECORDS SYSTEM.-There shall be
57	only one offender-based information and records computer system
58	maintained by the Department of Corrections for the joint use of
59	the department and the Parole Commission. This data system shall
60	be managed through the department's Office of Information
61	Technology Justice Data Center. The department shall develop and
62	maintain, in consultation with the Criminal and Juvenile Justice
63	Information Systems Council under s. 943.08, such offender-based
64	information, including clemency administration information and
65	other computer services to serve the needs of both the
66	department and the Parole Commission. The department shall
67	notify the commission of all violations of parole and the
68	circumstances thereof.
69	Section 3.  Subsections (4) through (30) of section
70	282.0041, Florida Statutes, are renumbered as subsections (2)
71	through (28), respectively, and present subsections (2), (3),
72	and (19) of that section are amended to read:
73	282.0041  Definitions.-As used in this chapter, the term:
74	(2)  "Agency chief information officer" means the person
75	employed by the agency head to coordinate and manage the
76	information technology functions and responsibilities applicable
77	to that agency, to participate and represent the agency in
78	developing strategies for implementing enterprise information
79	technology services established pursuant to this part, and to
80	develop recommendations for enterprise information technology
81	policy.
82	(3)  "Agency Chief Information Officers Council" means the
83	council created in s. 282.315.
84	(17)(19)  "Primary data center" means a state or nonstate
85	agency data center that is a recipient entity for consolidation
86	of nonprimary data centers and computing facilities and is
87	established. A primary data center may be authorized in law or
88	designated by the Agency for Enterprise Information Technology
89	pursuant to s. 282.201.
90	Section 4.  Subsection (1) of section 282.0056, Florida
91	Statutes, is amended to read:
92	282.0056  Development of work plan; development of
93	implementation plans; and policy recommendations.-
94	(1)  For the purposes of carrying out its responsibilities
95	under s. 282.0055, the Agency for Enterprise Information
96	Technology shall develop an annual work plan within 60 days
97	after the beginning of the fiscal year describing the activities
98	that the agency intends to undertake for that year, including
99	proposed outcomes and completion timeframes for the planning and
100	implementation of all enterprise information technology
101	services. The work plan must be presented at a public hearing
102	and that includes the Agency Chief Information Officers Council,
103	which may review and comment on the plan. The work plan must
104	thereafter be approved by the Governor and Cabinet and submitted
105	to the President of the Senate and the Speaker of the House of
106	Representatives. The work plan may be amended as needed, subject
107	to approval by the Governor and Cabinet.
108	Section 5.  Subsections (2) through (5) of section 282.201,
109	Florida Statutes, are amended to read:
110	282.201  State data center system; agency duties and
111	limitations.-A state data center system that includes all
112	primary data centers, other nonprimary data centers, and
113	computing facilities, and that provides an enterprise
114	information technology service as defined in s. 282.0041, is
115	established.
116	(2)  AGENCY FOR ENTERPRISE INFORMATION TECHNOLOGY DUTIES.-
117	The Agency for Enterprise Information Technology shall:
118	(a)  Collect and maintain information necessary for
119	developing policies relating to the data center system,
120	including, but not limited to, an inventory of facilities.
121	(b)  Annually approve cost-recovery mechanisms and rate
122	structures for primary data centers which recover costs through
123	charges to customer entities.
124	(c)  By September December 31 of each year, submit to the
125	Legislature, the Executive Office of the Governor, and the
126	primary data centers recommendations to improve the efficiency
127	and cost-effectiveness effectiveness of computing services
128	provided by state data center system facilities. Such
129	recommendations may include, but need not be limited to:
130	1.  Policies for improving the cost-effectiveness and
131	efficiency of the state data center system and the projected
132	cost savings resulting from their implementation.
133	2.  Infrastructure improvements supporting the
134	consolidation of facilities or preempting the need to create
135	additional data centers or computing facilities.
136	3.  Standards for an objective, credible energy performance
137	rating system that data center boards of trustees can use to
138	measure state data center energy consumption and efficiency on a
139	biannual basis.
140	4.  Uniform disaster recovery standards.
141	5.  Standards for primary data centers to provide cost-
142	effective services and providing transparent financial data to
143	user agencies.
144	6.  Consolidation of contract practices or coordination of
145	software, hardware, or other technology-related procurements and
146	the projected cost savings.
147	7.  Improvements to data center governance structures.
148	(d)  By October 1 of each year beginning in 2011 2009,
149	provide recommendations recommend to the Governor and
150	Legislature regarding changes to the schedule for agency data
151	center consolidation established in subsection (4) at least two
152	nonprimary data centers for consolidation into a primary data
153	center or nonprimary data center facility.
154	1.  The consolidation proposal must provide a transition
155	plan that includes:
156	a.  Estimated transition costs for each data center or
157	computing facility recommended for consolidation;
158	b.  Detailed timeframes for the complete transition of each
159	data center or computing facility recommended for consolidation;
160	c.  Proposed recurring and nonrecurring fiscal impacts,
161	including increased or decreased costs and associated budget
162	impacts for affected budget entities;
163	d.  Substantive legislative changes necessary to implement
164	the transition; and
165	e.  Identification of computing resources to be transferred
166	and those that will remain in the agency. The transfer of
167	resources must include all hardware, software, staff, contracted
168	services, and facility resources performing data center
169	management and operations, security, backup and recovery,
170	disaster recovery, system administration, database
171	administration, system programming, job control, production
172	control, print, storage, technical support, help desk, and
173	managed services but excluding application development.
174	1.2.  Recommendations shall be based on the goal of
175	maximizing current and future cost savings by. The agency shall
176	consider the following criteria in selecting consolidations that
177	maximize efficiencies by providing the ability to:
178	a.  Consolidating Consolidate purchase decisions;
179	b.  Leveraging Leverage expertise and other resources to
180	gain economies of scale;
181	c.  Implementing Implement state information technology
182	policies more effectively; and
183	d.  Maintaining Maintain or improving improve the level of
184	service provision to customer entities; and
185	e.  Make progress towards the state's goal of consolidating
186	data centers and computing facilities into primary data centers.
187	2.3.  The agency shall establish workgroups as necessary to
188	ensure participation by affected agencies in the development of
189	recommendations related to consolidations.
190	(e)  By December 31, 2010, the agency shall develop and
191	submit to the Legislature an overall consolidation plan for
192	state data centers. The plan shall indicate a timeframe for the
193	consolidation of all remaining nonprimary data centers into
194	primary data centers, including existing and proposed primary
195	data centers, by 2019.
196	(e)(f)  Develop and establish rules relating to the
197	operation of the state data center system which comply with
198	applicable federal regulations, including 2 C.F.R. part 225 and
199	45 C.F.R. The agency shall provide notice of the development of
200	its proposed rules by publication of a notice of development in
201	the Florida Administrative Weekly no later than October 1, 2011.
202	The rules shall may address:
203	1.  Ensuring that financial information is captured and
204	reported consistently and accurately.
205	2.  Implementing standards for hardware, operations
206	software, including security, and network infrastructure for the
207	primary data centers Requiring the establishment of service-
208	level agreements executed between a data center and its customer
209	entities for services provided.
210	3.  Requiring annual full cost recovery on an equitable
211	rational basis. The cost-recovery methodology must ensure that
212	no service is subsidizing another service and may include
213	adjusting the subsequent year's rates as a means to recover
214	deficits or refund surpluses from a prior year.
215	4.  Requiring that any special assessment imposed to fund
216	expansion is based on a methodology that apportions the
217	assessment according to the proportional benefit to each
218	customer entity.
219	5.  Requiring that rebates be given when revenues have
220	exceeded costs, that rebates be applied to offset charges to
221	those customer entities that have subsidized the costs of other
222	customer entities, and that such rebates may be in the form of
223	credits against future billings.
224	6.  Requiring that all service-level agreements have a
225	contract term of up to 3 years, but may include an option to
226	renew for up to 3 additional years contingent on approval by the
227	board, and require at least a 180-day notice of termination.
228	7.  Designating any nonstate data center as a primary data
229	center if the center:
230	a.  Has an established governance structure that represents
231	customer entities proportionally.
232	b.  Maintains an appropriate cost-allocation methodology
233	that accurately bills a customer entity based on the actual
234	direct and indirect costs to the customer entity, and prohibits
235	the subsidization of one customer entity's costs by another
236	entity.
237	c.  Has sufficient raised floor space, cooling, and
238	redundant power capacity, including uninterruptible power supply
239	and backup power generation, to accommodate the computer
240	processing platforms and support necessary to host the computing
241	requirements of additional customer entities.
242	8.  Removing a nonstate data center from primary data
243	center designation if the nonstate data center fails to meet
244	standards necessary to ensure that the state's data is
245	maintained pursuant to subparagraph 7.
246	(3)  STATE AGENCY DUTIES.-
247	(a)  For the purpose of completing its work activities as
248	described in subsection (1), each state agency shall provide to
249	the Agency for Enterprise Information Technology all requested
250	information and any other information relevant to the agency's
251	ability to effectively transition its computer services into a
252	primary data center. The agency shall also participate as
253	required in workgroups relating to specific consolidation
254	planning and implementation tasks as assigned by the Agency for
255	Enterprise Information Technology and determined necessary to
256	accomplish consolidation goals.
257	(b)  Each state agency shall submit to the Agency for
258	Enterprise Information Technology information relating to its
259	data centers and computing facilities as required in
260	instructions issued by July 1 of each year by the Agency for
261	Enterprise Information Technology. The information required may
262	include:
263	1.  Amount of floor space used and available.
264	2.  Numbers and capacities of mainframes and servers.
265	3.  Storage and network capacity.
266	4.  Amount of power used and the available capacity.
267	5.  Estimated expenditures by service area, including
268	hardware and software, numbers of full-time equivalent
269	positions, personnel turnover, and position reclassifications.
270	6.  A list of contracts in effect for the fiscal year,
271	including, but not limited to, contracts for hardware, software
272	and maintenance, including the expiration date, the contract
273	parties, and the cost of the contract.
274	7.  Service-level agreements by customer entity.
275	(c)  The chief information officer of each state agency
276	shall assist the Agency for Enterprise Information Technology at
277	the request of the Agency for Enterprise Information Technology.
278	(c)(d)  Each state agency customer of a primary data center
279	shall notify the data center, by May 31 and November 30 of each
280	year, of any significant changes in anticipated utilization of
281	data center services pursuant to requirements established by the
282	boards of trustees of each primary data center.
283	(4)  SCHEDULE FOR AGENCY DATA CENTER CONSOLIDATION.-
284	(a)  State agency data center consolidations shall be made
285	in accordance with budget adjustments contained in the General
286	Appropriations Act no later than the date provided and to the
287	specified primary data center as provided in this subsection.
288	(b)  For consolidation during fiscal year 2011-2012 into
289	the Northwest Regional Data Center:
290	1.  College Center for Library Automation (CCLA) no later
291	than December 31, 2011.
292	2.  Florida Center for Library Automation (FCLA) no later
293	than December 31, 2011.
294	3.  Department of Education no later than December 31,
295	2011, including the computing services and resources of:
296	a.  The Knott Data Center located in the Turlington
297	Building.
298	b.  The Division of Blind Services.
299	c.  The Division of Vocational Rehabilitation.
300	d.  FCAT Explorer.
301	e.  FACTS.org.
302
303	Such consolidations are contingent upon the Agency for
304	Enterprise Information Technology's completion of a cost-benefit
305	analysis to determine whether additional savings can be
306	achieved. The cost-benefit analysis shall compare the costs and
307	savings estimates provided by the Northwest Regional Data
308	Center, the Northwood Shared Resource Center, and the Southwood
309	Shared Resource Center for the consolidation of the College
310	Center for Library Automation, the Florida Center for Library
311	Automation, and the Department of Education to their respective
312	data centers. The cost-benefit analysis shall be submitted no
313	later than August 1, 2011, to the Executive Office of the
314	Governor and the chairs of the House Appropriations Committee
315	and the Senate Budget Committee. Any actions recommended as a
316	result of the cost-benefit analysis are subject to the notice,
317	review, and objection requirements of s. 216.177.
318	(c)  For consolidation during fiscal year 2011-2012 into
319	the Southwood Shared Resource Center:
320	1.  The Department of Corrections no later than September
321	30, 2011.
322	2.  The Department of Transportation Survey and Mapping
323	Office no later than March 31, 2012.
324	3.  The Department of Transportation Burns Office Building
325	no later than March 31, 2012.
326	(d)  For consolidation during fiscal year 2011-2012 into
327	the Northwood Shared Resource Center:
328	1.  The Department of Transportation Motor Carrier
329	Compliance Office no later than July 1, 2011.
330	2.  The Department of Highway Safety and Motor Vehicles no
331	later than March 31, 2012.
332	(e)  For consolidation during fiscal year 2012-2013 into
333	the Southwood Shared Resource Center:
334	1.  The Department of Community Affairs, including the
335	Division of Emergency Management, no later than September 30,
336	2012.
337	2.  The Department of Revenue Carlton Building and Taxworld
338	Building L locations no later than September 30, 2012.
339	3.  The Department of Health Test and Development Lab and
340	all remaining data center resources no later than December 31,
341	2012.
342	(f)  For consolidation during fiscal year 2012-2013 into
343	the Northwood Shared Resource Center:
344	1.  The Agency for Health Care Administration no later than
345	July 1, 2012.
346	2.  The Department of Environmental Protection no later
347	than December 31, 2012.
348	3.  The Department of Law Enforcement no later than March
349	30, 2013.
350	(g)  The following agencies shall work with the Agency for
351	Enterprise Information Technology to begin preliminary planning
352	for consolidation of their data centers into a primary data
353	center during fiscal year 2013-2014:
354	1.  The Department of the Lottery.
355	2.  The Department of Legal Affairs.
356	3.  The Fish and Wildlife Conservation Commission.
357	4.  The Executive Office of the Governor, excluding all
358	resources, equipment, and applications supported within the
359	Legislative Appropriations System/Planning and Budget Subsystem.
360	5.  The Department of Veterans' Affairs.
361	6.  The Department of Elderly Affairs.
362	7.  The Department of Financial Services Hartman, Larson,
363	and Fletcher Buildings data centers.
364	8.  The Department of Agriculture and Consumer Services
365	Agriculture Management Information Center in the Mayo Building
366	and the Division of Licensing.
367	(h)  The following agencies shall work with the Agency for
368	Enterprise Information Technology to begin preliminary planning
369	for consolidation of their data centers into a primary data
370	center during fiscal year 2014-2015:
371	1.  The Department of Health Jacksonville Lab Data Center.
372	2.  The Department of Transportation District, Toll,
373	Materials Office.
374	3.  The Department of Military Affairs Camp Blanding Joint
375	Training Center, Starke.
376	4.  The Department of Community Affairs Camp Blanding
377	Emergency Operations Center, Starke.
378	5.  The Department of Education Division of Blind Services,
379	Disaster Recovery site, Daytona Beach.
380	6.  The Department of Education Disaster Recovery site,
381	Sante Fe College.
382	7.  The Department of the Lottery Disaster Recovery Backup
383	Data Center, Orlando.
384	8.  The Fish and Wildlife Conservation Commission Research
385	Institute, St. Petersburg.
386	9.  The Department of Children and Family Services Suncoast
387	Data Center, Tampa.
388	10.  The Department of Children and Family Services Florida
389	State Hospital, Chattahoochee.
390	(i)  All computing facilities as defined in s. 282.0041 or
391	groups of servers remaining in an agency shall be transferred to
392	a primary data center for consolidation during fiscal year 2015-
393	2016 unless required to remain in the agency for specific
394	business reasons.
395	(j)  All agencies consolidating data centers into a primary
396	data center shall execute a new or update an existing service-
397	level agreement no later than 60 days after the identified
398	consolidation date, as required by s. 282.203, that specifies
399	the services and levels of services the agency is to receive
400	from the primary data center as a result of the consolidation.
401	Any agency that is unable to execute the service-level agreement
402	by the required date must submit a report to the Executive
403	Office of the Governor and to the chairs of the House
404	Appropriations Committee and the Senate Budget Committee within
405	5 working days after such date that explains the specific issues
406	preventing execution and describing the agency's plan and
407	schedule for resolving the issues.
408	(k)  Beginning September 1, 2011, and every 6 months
409	thereafter, until all data center consolidations are complete,
410	the Agency for Enterprise Information Technology shall provide a
411	status report on the implementation of consolidation required to
412	be completed during the fiscal year. The report shall be
413	submitted to the Executive Office of the Governor and the chairs
414	of the House Appropriations Committee and the Senate Budget
415	Committee. The status report shall describe:
416	1.  Whether the consolidation is on schedule, including the
417	progress on achieving milestones necessary for successful and
418	timely consolidation of scheduled agency data centers and
419	computing facilities; and
420	2.  Risks that may affect the progress or outcomes of the
421	consolidation and how such risks are being addressed, mitigated,
422	or managed.
423	(l)  Each agency identified in this subsection for
424	consolidation into a primary data center must submit a
425	transition plan to the Agency for Enterprise Information
426	Technology not later than September 1 of the fiscal year prior
427	to its scheduled consolidation. Transition plans shall be
428	developed in consultation with the appropriate primary data
429	center and the Agency for Enterprise Information Technology and
430	must include:
431	1.  An inventory of all resources of the agency data center
432	being consolidated, including all hardware, software, staff,
433	contracted services, and facility resources performing data
434	center management and operations, security, backup and recovery,
435	disaster recovery, system administration, database
436	administration, system programming, job control, production
437	control, print, storage, technical support, help desk, and
438	managed services, excluding application development.
439	2.  A description of the level of services needed to meet
440	the technical and operational requirements of the platforms
441	being consolidated and a cost estimate for the primary data
442	center's provision of such services.
443	3.  A description of resources for computing services
444	proposed to remain in the department.
445	4.  A timetable with significant milestones for the
446	completion of the consolidation.
447	5.  The fiscal year adjustments to budget categories
448	currently supporting agency costs to accomplish the transfer of
449	sufficient budget resources into the appropriate data processing
450	category pursuant to the legislative budget request instructions
451	provided in s. 216.023.
452	(m)  Each primary data center shall develop a transition
453	plan for absorbing the transfer of agency data center resources
454	based upon the timetables for transition as provided in this
455	subsection. The plan shall be submitted to the Agency for
456	Enterprise Information Technology no later than September 30 of
457	the fiscal year prior to the scheduled consolidation. Each plan
458	shall include:
459	1.  An estimate of the cost of providing data center
460	services for each agency scheduled for consolidation.
461	2.  A staffing plan that identifies the projected staffing
462	needs and requirements based on the estimated workload
463	identified in the agency transition plans.
464	3.  An analysis of the cost impacts to existing agency
465	customers resulting from the planned consolidations.
466	4.  The fiscal year adjustments to budget categories to
467	absorb the transfer of agency data center resources pursuant to
468	the legislative budget request instructions provided in s.
469	216.023.
470	5.  A description of any issues that must be resolved to
471	accomplish all consolidations required during the fiscal year as
472	efficiently and effectively as possible.
473	(n)  The Agency for Enterprise Information Technology shall
474	develop a comprehensive transition plan, which shall be
475	submitted no later than October 15 of the fiscal year prior to
476	the scheduled consolidations to the Executive Office of the
477	Governor and the chairs of the House Appropriations Committee
478	and the Senate Budget Committee. The comprehensive transition
479	plan shall be developed in consultation with the agencies
480	submitting their agency transition plans and the affected
481	primary data center. The comprehensive transition plan shall
482	include:
483	1.  Recommendations for accomplishing the proposed
484	consolidations as efficiently and effectively as possible with
485	minimal disruption to the agency's business processes.
486	2.  Strategies to minimize risks associated with any of the
487	proposed consolidations.
488	3.  A compilation of the agency transition plans scheduled
489	for consolidation in the following fiscal year.
490	4.  Revisions to any budget adjustments provided in the
491	agency or primary data center transition plans pursuant to the
492	legislative budget request instructions provided in s. 216.023.
493	(5)(4)  AGENCY LIMITATIONS.-
494	(a)  Unless authorized by the Legislature or as provided in
495	paragraphs (b) and (c), a state agency may not:
496	1.  Create a new computing facility or data center, or
497	expand the capability to support additional computer equipment
498	in an existing computing facility or nonprimary data center, or
499	purchase equipment or other resources necessary to expand the
500	capabilities of the agency data center;
501	2.  Expend funds prior to the agency's scheduled
502	consolidation into a primary data center for the purchase or
503	modification of hardware or operations software that do not
504	comply with the standards established for efficient
505	consolidation and without consultation with the primary data
506	center;
507	3.2.  Transfer existing computer services to a nonprimary
508	data center or computing facility, including outsourced computer
509	service providers;
510	4.3.  Terminate services with a primary data center or
511	transfer services between primary data centers without giving
512	written notice of intent to terminate or transfer services 180
513	days before such termination or transfer and completing a cost-
514	benefit analysis that documents that the requested transfer will
515	not increase the agency's data center costs; or
516	5.4.  Initiate a new computer service if it does not
517	currently have an internal data center except with a primary
518	data center.
519	(b)  Exceptions to the limitations in subparagraphs (a)1.,
520	2., 3., and 5. 4. may be granted by the Agency for Enterprise
521	Information Technology if there is insufficient capacity in a
522	primary data center to absorb the workload associated with
523	agency computing services.
524	1.  A request for an exception must be submitted in writing
525	to the Agency for Enterprise Information Technology. The agency
526	must accept, accept with conditions, or deny the request within
527	60 days after receipt of the written request. The agency's
528	decision is not subject to chapter 120.
529	2.  At a minimum, the agency may not approve a request
530	unless it includes:
531	a.  Documentation approved by the primary data center's
532	board of trustees which confirms that the center cannot meet the
533	capacity requirements of the agency requesting the exception
534	within the current fiscal year.
535	b.  A description of the capacity requirements of the
536	agency requesting the exception.
537	c.  Documentation from the agency demonstrating why it is
538	critical to the agency's mission that the expansion or transfer
539	must be completed within the fiscal year rather than when
540	capacity is established at a primary data center.
541	(c)  Exceptions to subparagraph (a)4.3. may be granted by
542	the board of trustees of the primary data center if the
543	termination or transfer of services can be absorbed within the
544	current cost-allocation plan.
545	(d)  Upon the termination of or transfer of agency
546	computing services from the primary data center, the primary
547	data center shall require information sufficient to determine
548	compliance with this section. If a primary data center
549	determines that an agency is in violation of this section, it
550	shall report the violation to the Agency for Enterprise
551	Information Technology.
552	(6)(5)  RULES.-The Agency for Enterprise Information
553	Technology is authorized to adopt rules pursuant to ss.
554	120.536(1) and 120.54 to administer the provisions of this part
555	relating to the state data center system including the primary
556	data centers.
557	Section 6.  Subsection (1) and paragraph (a) of subsection
558	(2) of section 282.203, Florida Statutes, are amended to read:
559	282.203  Primary data centers.-
560	(1)  DATA CENTER DUTIES.-Each primary data center shall:
561	(a)  Serve customer entities as an information-system
562	utility.
563	(b)  Cooperate with customer entities to offer, develop,
564	and support the services and applications as defined and
565	provided by the center's board of trustees and customer
566	entities.
567	(c)  Comply with standards and rules adopted by the Agency
568	for Enterprise Information Technology, pursuant to this section,
569	and coordinate with the agency in the consolidation of data
570	centers.
571	(d)  Provide transparent financial statements to customer
572	entities, the center's board of trustees, and the Agency for
573	Enterprise Information Technology. The financial statements
574	shall be provided as follows:
575	1.  Annually, by July 30 for the current fiscal year and by
576	December 1 for the subsequent fiscal year, the data center must
577	provide the total annual budgeted costs by major expenditure
578	category, including, but not limited to, salaries, expense,
579	operating capital outlay, contracted services, or other
580	personnel services, which directly relate to the provision of
581	each service and which separately indicate the administrative
582	overhead allocated to each service.
583	2.  Annually, by July 30 for the current fiscal year and by
584	December 1 for the subsequent fiscal year, the data center must
585	provide total projected billings for each customer entity which
586	are required to recover the costs of the data center.
587	3.  Annually, by January 31, the data center must provide
588	updates of the financial statements required under subparagraphs
589	1. and 2. for the current fiscal year.
590	4.  By February 15, for proposed legislative budget
591	increases, the data center must provide updates of the financial
592	statements required under subparagraphs 1. and 2. for the
593	subsequent fiscal year.
594
595	The financial information required under subparagraphs 1., 2.,
596	and 3. must be based on current law and current appropriations.
597	(e)  Annually, by October 1, submit to the board of
598	trustees cost-reduction proposals, including strategies and
599	timetables for lowering customer entities' costs without
600	reducing the level of services.
601	(f)  By December 31, 2010, submit organizational plans that
602	minimize the annual recurring cost of center operations and
603	eliminate the need for state agency customers to maintain data
604	center skills and staff within their agency. The plans shall:
605	1.  Establish an efficient organizational structure
606	describing the roles and responsibilities of all positions and
607	business units in the centers;
608	2.  Define a human resources planning and management
609	process that shall be used to make required center staffing
610	decisions; and
611	3.  Develop a process for projecting staffing requirements
612	based on estimated workload identified in customer agency
613	service level agreements.
614	(f)(g)  Maintain the performance of the facility, which
615	includes ensuring proper data backup, data backup recovery, an
616	effective disaster recovery plan, and appropriate security,
617	power, cooling and fire suppression, and capacity.
618	(g)(h)  Develop a business continuity plan and conduct a
619	live exercise of the plan at least annually. The plan must be
620	approved by the board and the Agency for Enterprise Information
621	Technology.
622	(h)(i)  Enter into a service-level agreement with each
623	customer entity to provide services as defined and approved by
624	the board in compliance with rules of the Agency for Enterprise
625	Information Technology. A service-level agreement may not have a
626	term exceeding 3 years but may include an option to renew for up
627	to 3 years contingent on approval by the board.
628	1.  A service-level agreement, at a minimum, must:
629	a.  Identify the parties and their roles, duties, and
630	responsibilities under the agreement;
631	b.  Identify the legal authority under which the service-
632	level agreement was negotiated and entered into by the parties;
633	c.  State the duration of the contractual term and specify
634	the conditions for contract renewal;
635	d.  Prohibit the transfer of computing services between
636	primary data center facilities without at least 180 days' notice
637	of service cancellation;
638	e.  Identify the scope of work;
639	f.  Identify the products or services to be delivered with
640	sufficient specificity to permit an external financial or
641	performance audit;
642	g.  Establish the services to be provided, the business
643	standards that must be met for each service, the cost of each
644	service, and the process by which the business standards for
645	each service are to be objectively measured and reported;
646	h.  Identify applicable funds and funding streams for the
647	services or products under contract;
648	i.  Provide a timely billing methodology for recovering the
649	cost of services provided to the customer entity;
650	j.  Provide a procedure for modifying the service-level
651	agreement to address changes in projected costs of service;
652	k.  Provide that a service-level agreement may be
653	terminated by either party for cause only after giving the other
654	party and the Agency for Enterprise Information Technology
655	notice in writing of the cause for termination and an
656	opportunity for the other party to resolve the identified cause
657	within a reasonable period; and
658	l.  Provide for mediation of disputes by the Division of
659	Administrative Hearings pursuant to s. 120.573.
660	2.  A service-level agreement may include:
661	a.  A dispute resolution mechanism, including alternatives
662	to administrative or judicial proceedings; or
663	b.  The setting of a surety or performance bond for
664	service-level agreements entered into with nonstate agency
665	primary data centers, which may be designated by the Agency for
666	Enterprise Information Technology; or
667	b.c.  Additional terms and conditions as determined
668	advisable by the parties if such additional terms and conditions
669	do not conflict with the requirements of this section or rules
670	adopted by the Agency for Enterprise Information Technology.
671	3.  The failure to execute a service-level agreement within
672	60 days after service commencement shall, in the case of an
673	existing customer entity, result in a continuation of the terms
674	of the service-level agreement from the prior fiscal year,
675	including any amendments that were formally proposed to the
676	customer entity by the primary data center within the 3 months
677	before service commencement, and a revised cost-of-service
678	estimate. If a new customer entity fails to execute an agreement
679	within 60 days after service commencement, the data center may
680	cease services.
681	(i)(j)  Plan, design, establish pilot projects for, and
682	conduct experiments with information technology resources, and
683	implement enhancements in services if such implementation is
684	cost-effective and approved by the board.
685	(j)(k)  Enter into a memorandum of understanding with the
686	agency where the primary data center is administratively located
687	which establishes the services to be provided by that agency to
688	the primary data center and the cost of such services.
689	(k)(l)  Be the custodian of resources and equipment that
690	are located, operated, supported, and managed by the center for
691	the purposes of chapter 273, except resources and equipment
692	located, operated, supported, and managed by Northwest Regional
693	Data Center.
694	(l)  Assume administrative access rights to the resources
695	and equipment, such as servers, network components, and other
696	devices, that are consolidated into the primary data center.
697	Upon the date of each consolidation specified in s. 282.201 or
698	as provided in the General Appropriations Act, each agency shall
699	relinquish all administrative access rights. Each primary data
700	center shall provide its customer agencies with the appropriate
701	level of access to applications, servers, network components,
702	and other devices necessary for the agency to perform core
703	business activities and functions.
704	(2)  BOARD OF TRUSTEES.-Each primary data center shall be
705	headed by a board of trustees as defined in s. 20.03.
706	(a)  The members of the board shall be appointed by the
707	agency head or chief executive officer of the representative
708	customer entities of the primary data center and shall serve at
709	the pleasure of the appointing customer entity.
710	1.  During the fiscal year prior to its consolidation into
711	a primary data center and for the following full fiscal year, an
712	agency shall have a single trustee having one vote on the board
713	of the primary data center into which it is to consolidate,
714	unless in the second year it is entitled to a greater number of
715	votes as provided in subparagraphs 3. and 4. For each of the
716	first 2 fiscal years that a center is in operation, membership
717	shall be as provided in subparagraph 3. based on projected
718	customer entity usage rates for the fiscal operating year of the
719	primary data center. However, at a minimum:
720	a.  During the Southwood Shared Resource Center's first 2
721	operating years, the Department of Transportation, the
722	Department of Highway Safety and Motor Vehicles, the Department
723	of Health, and the Department of Revenue must each have at least
724	one trustee.
725	b.  During the Northwood Shared Resource Center's first
726	operating year, the Department of State and the Department of
727	Education must each have at least one trustee.
728	2.  Board After the second full year of operation,
729	membership shall be as provided in subparagraph 3. based on the
730	most recent estimate of customer entity usage rates for the
731	prior year and a projection of usage rates for the first 9
732	months of the next fiscal year. Such calculation must be
733	completed before the annual budget meeting held before the
734	beginning of the next fiscal year so that any decision to add or
735	remove board members can be voted on at the budget meeting and
736	become effective on July 1 of the subsequent fiscal year.
737	3.  Each customer entity that has a projected usage rate of
738	4 percent or greater during the fiscal operating year of the
739	primary data center shall have one trustee on the board.
740	4.  The total number of votes for each trustee shall be
741	apportioned as follows:
742	a.  Customer entities of a primary data center whose usage
743	rate represents 4 but less than 15 percent of total usage shall
744	have one vote.
745	b.  Customer entities of a primary data center whose usage
746	rate represents 15 but less than 30 percent of total usage shall
747	have two votes.
748	c.  Customer entities of a primary data center whose usage
749	rate represents 30 but less than 50 percent of total usage shall
750	have three votes.
751	d.  A customer entity of a primary data center whose usage
752	rate represents 50 percent or more of total usage shall have
753	four votes.
754	e.  A single trustee having one vote shall represent those
755	customer entities that represent less than 4 percent of the
756	total usage. The trustee shall be selected by a process
757	determined by the board.
758	Section 7.  Section 282.206, Florida Statutes, is created
759	to read:
760	282.206  Northwest Regional Data Center.-Northwest Regional
761	Data Center is designated as a primary data center as defined in
762	s. 282.0041. The center shall be managed by a board of trustees
763	as provided in s. 282.203, who shall comply with all
764	requirements of that section related to the operation of the
765	center and with the rules of the Agency for Enterprise
766	Information Technology relating to primary data centers.
767	Section 8.  Sections 282.3055 and 282.315, Florida
768	Statutes, are repealed.
769	Section 9.  Subsections (3) through (7) of section 282.318,
770	Florida Statutes, are amended to read:
771	282.318  Enterprise security of data and information
772	technology.-
773	(3)  The Office of Information Security within the Agency
774	for Enterprise Information Technology is responsible for
775	establishing rules and publishing guidelines for ensuring an
776	appropriate level of security for all data and information
777	technology resources for executive branch agencies. The Agency
778	for Enterprise Information Technology office shall also perform
779	the following duties and responsibilities:
780	(a)  Develop, and annually update by February 1, an
781	enterprise information security strategic plan that includes
782	security goals and objectives for the strategic issues of
783	information security policy, risk management, training, incident
784	management, and survivability planning.
785	(b)  Develop enterprise security rules and published
786	guidelines for:
787	1.  Comprehensive risk analyses and information security
788	audits conducted by state agencies.
789	2.  Responding to suspected or confirmed information
790	security incidents, including suspected or confirmed breaches of
791	personal information or exempt data.
792	3.  Agency security plans, including strategic security
793	plans and security program plans.
794	4.  The recovery of information technology and data
795	following a disaster.
796	5.  The managerial, operational, and technical safeguards
797	for protecting state government data and information technology
798	resources.
799	(c)  Assist agencies in complying with the provisions of
800	this section.
801	(d)  Pursue appropriate funding for the purpose of
802	enhancing domestic security.
803	(e)  Provide training for agency information security
804	managers.
805	(f)  Annually review the strategic and operational
806	information security plans of executive branch agencies.
807	(4)  To assist the Agency for Enterprise Information
808	Technology Office of Information Security in carrying out its
809	responsibilities, each agency head shall, at a minimum:
810	(a)  Designate an information security manager to
811	administer the security program of the agency for its data and
812	information technology resources. This designation must be
813	provided annually in writing to the Agency for Enterprise
814	Information Technology office by January 1.
815	(b)  Submit to the Agency for Enterprise Information
816	Technology, office annually by July 31, the agency's strategic
817	and operational information security plans developed pursuant to
818	the rules and guidelines established by the Agency for
819	Enterprise Information Technology office.
820	1.  The agency strategic information security plan must
821	cover a 3-year period and define security goals, intermediate
822	objectives, and projected agency costs for the strategic issues
823	of agency information security policy, risk management, security
824	training, security incident response, and survivability. The
825	plan must be based on the enterprise strategic information
826	security plan created by the Agency for Enterprise Information
827	Technology office. Additional issues may be included.
828	2.  The agency operational information security plan must
829	include a progress report for the prior operational information
830	security plan and a project plan that includes activities,
831	timelines, and deliverables for security objectives that,
832	subject to current resources, the agency will implement during
833	the current fiscal year. The cost of implementing the portions
834	of the plan which cannot be funded from current resources must
835	be identified in the plan.
836	(c)  Conduct, and update every 3 years, a comprehensive
837	risk analysis to determine the security threats to the data,
838	information, and information technology resources of the agency.
839	The risk analysis information is confidential and exempt from
840	the provisions of s. 119.07(1), except that such information
841	shall be available to the Auditor General and the Agency for
842	Enterprise Information Technology for performing postauditing
843	duties.
844	(d)  Develop, and periodically update, written internal
845	policies and procedures, which include procedures for notifying
846	the Agency for Enterprise Information Technology office when a
847	suspected or confirmed breach, or an information security
848	incident, occurs. Such policies and procedures must be
849	consistent with the rules and guidelines established by the
850	Agency for Enterprise Information Technology office to ensure
851	the security of the data, information, and information
852	technology resources of the agency. The internal policies and
853	procedures that, if disclosed, could facilitate the unauthorized
854	modification, disclosure, or destruction of data or information
855	technology resources are confidential information and exempt
856	from s. 119.07(1), except that such information shall be
857	available to the Auditor General and the Agency for Enterprise
858	Information Technology for performing postauditing duties.
859	(e)  Implement appropriate cost-effective safeguards to
860	address identified risks to the data, information, and
861	information technology resources of the agency.
862	(f)  Ensure that periodic internal audits and evaluations
863	of the agency's security program for the data, information, and
864	information technology resources of the agency are conducted.
865	The results of such audits and evaluations are confidential
866	information and exempt from s. 119.07(1), except that such
867	information shall be available to the Auditor General and the
868	Agency for Enterprise Information Technology for performing
869	postauditing duties.
870	(g)  Include appropriate security requirements in the
871	written specifications for the solicitation of information
872	technology and information technology resources and services,
873	which are consistent with the rules and guidelines established
874	by the Agency for Enterprise Information Technology office.
875	(h)  Provide security awareness training to employees and
876	users of the agency's communication and information resources
877	concerning information security risks and the responsibility of
878	employees and users to comply with policies, standards,
879	guidelines, and operating procedures adopted by the agency to
880	reduce those risks.
881	(i)  Develop a process for detecting, reporting, and
882	responding to suspected or confirmed security incidents,
883	including suspected or confirmed breaches consistent with the
884	security rules and guidelines established by the Agency for
885	Enterprise Information Technology office.
886	1.  Suspected or confirmed information security incidents
887	and breaches must be immediately reported to the Agency for
888	Enterprise Information Technology office.
889	2.  For incidents involving breaches, agencies shall
890	provide notice in accordance with s. 817.5681 and to the Agency
891	for Enterprise Information Technology office in accordance with
892	this subsection.
893	(5)  Each state agency shall include appropriate security
894	requirements in the specifications for the solicitation of
895	contracts for procuring information technology or information
896	technology resources or services which are consistent with the
897	rules and guidelines established by the Agency for Enterprise
898	Information Technology Office of Information Security.
899	(6)  The Agency for Enterprise Information Technology may
900	adopt rules relating to information security and to administer
901	the provisions of this section.
902	(7)  By December 31, 2010, the Agency for Enterprise
903	Information Technology shall develop, and submit to the
904	Governor, the President of the Senate, and the Speaker of the
905	House of Representatives a proposed implementation plan for
906	information technology security. The agency shall describe the
907	scope of operation, conduct costs and requirements analyses,
908	conduct an inventory of all existing security information
909	technology resources, and develop strategies, timeframes, and
910	resources necessary for statewide migration.
911	Section 10.  Subsection (5) of section 282.34, Florida
912	Statutes, is amended to read:
913	282.34  Statewide e-mail service.-A state e-mail system
914	that includes the delivery and support of e-mail, messaging, and
915	calendaring capabilities is established as an enterprise
916	information technology service as defined in s. 282.0041. The
917	service shall be designed to meet the needs of all executive
918	branch agencies. The primary goals of the service are to
919	minimize the state investment required to establish, operate,
920	and support the statewide service; reduce the cost of current e-
921	mail operations and the number of duplicative e-mail systems;
922	and eliminate the need for each state agency to maintain its own
923	e-mail staff.
924	(5)  In order to develop the implementation plan for the
925	statewide e-mail service, the Agency for Enterprise Information
926	Technology shall establish and coordinate a statewide e-mail
927	project team. The agency shall also consult with and, as
928	necessary, form workgroups consisting of agency e-mail
929	management staff, agency chief information officers, agency
930	budget directors, and other administrative staff. The statewide
931	e-mail implementation plan must be submitted to the Governor,
932	the President of the Senate, and the Speaker of the House of
933	Representatives by July 1, 2011.
934	Section 11.  Paragraph (h) of subsection (3) and paragraph
935	(b) of subsection (4) of section 287.042, Florida Statutes, are
936	amended to read:
937	287.042  Powers, duties, and functions.-The department
938	shall have the following powers, duties, and functions:
939	(3)  To establish a system of coordinated, uniform
940	procurement policies, procedures, and practices to be used by
941	agencies in acquiring commodities and contractual services,
942	which shall include, but not be limited to:
943	(h)  Development, in consultation with the Agency Chief
944	Information Officers Council, of procedures to be used by state
945	agencies when procuring information technology commodities and
946	contractual services to ensure compliance with public records
947	requirements and records retention and archiving requirements.
948	(4)
949	(b)  To prescribe, in consultation with the Agency Chief
950	Information Officers Council, procedures for procuring
951	information technology and information technology consultant
952	services which provide for public announcement and
953	qualification, competitive solicitations, contract award, and
954	prohibition against contingent fees. Such procedures shall be
955	limited to information technology consultant contracts for which
956	the total project costs, or planning or study activities, are
957	estimated to exceed the threshold amount provided for in s.
958	287.017, for CATEGORY TWO.
959	Section 12.  This act shall take effect July 1, 2011.
960
961
962	-----------------------------------------------------
963	T I T L E  A M E N D M E N T
964	Remove the entire title and insert:
965	A bill to be entitled
966	An act relating to the Agency for Enterprise Information
967	Technology; amending s. 14.204, F.S.; revising duties and
968	responsibilities of the agency; removing provisions for
969	the Office of Information Security and the Agency Chief
970	Information Officers Council; amending s. 20.315, F.S.,
971	relating to the Department of Corrections; providing for
972	the department's data system to be managed through the
973	department's Office of Information Technology; removing
974	reference to the Justice Data Center; amending s.
975	282.0041, F.S.; removing the definitions of the terms
976	"agency chief information officer" and "Agency Chief
977	Information Officers Council"; revising the definition of
978	the term "primary data center"; amending s. 282.0056,
979	F.S.; revising requirements for development of an annual
980	work plan by the agency; amending s. 282.201, F.S.;
981	revising duties of the agency; providing for submission of
982	certain recommendations to the Executive Office of the
983	Governor, the Legislature, and primary data centers;
984	removing a provision for an overall consolidation plan;
985	revising provisions for adoption of rules by the agency;
986	requiring publication of notice; revising duties of state
987	agencies; providing a schedule for state agency data
988	center consolidation; providing conditions for
989	consolidations; requiring the agency to make certain
990	reports; requiring development of transition plans;
991	amending s. 282.203, F.S.; revising duties of primary data
992	centers; revising provisions for service-level agreements;
993	revising provisions for membership of boards of trustees
994	of primary data centers; creating s. 282.206, F.S.;
995	designating the Northwest Regional Data Center as a
996	primary data center; repealing s. 282.3055, F.S., relating
997	to agency chief information officers; repealing s.
998	282.315, F.S., relating to the Agency Chief Information
999	Officers Council; amending s. 282.318, F.S., relating to
1000	enterprise security of data and information technology;
1001	conforming to changes made by the act; deleting an
1002	obsolete provision; amending ss. 282.34 and 287.042, F.S.,
1003	relating to statewide e-mail service and powers, duties,
1004	and functions of the Department of Management Services,
1005	respectively; conforming provisions to changes made by the
1006	act; providing an effective date.

CODING: Words stricken are deletions; words underlined are additions.