The Florida Senate

282.203  Primary data centers.--

(1)  DATA CENTER DUTIES.--Each primary data center shall:

(a)  Serve customer entities as an information-system utility.

(b)  Cooperate with customer entities to offer, develop, and support the services and applications as defined and provided by the center's board of trustees and customer entities.

(c)  Comply with rules adopted by the Agency for Enterprise Information Technology, pursuant to this section, and coordinate with the agency in the consolidation of data centers.

(d)  Provide transparent financial statements to customer entities and the Agency for Enterprise Information Technology.

(e)  Maintain the performance of the facility, which includes ensuring proper data backup, data backup recovery, an effective disaster recovery plan, and appropriate security, power, cooling and fire suppression, and capacity.

(f)  Develop a business continuity plan and conduct a live exercise of the plan at least annually. The plan must be approved by the board and the Agency for Enterprise Information Technology.

(g)  Enter into a service-level agreement with each customer entity to provide services as defined and approved by the board in compliance with rules of the Agency for Enterprise Information Technology. A service-level agreement may not have a term exceeding 3 years but may include an option to renew for up to 3 years contingent on approval by the board.

1.  A service-level agreement, at a minimum, must:

a.  Identify the parties and their roles, duties, and responsibilities under the agreement;

b.  Identify the legal authority under which the service-level agreement was negotiated and entered into by the parties;

c.  State the duration of the contractual term and specify the conditions for contract renewal;

d.  Prohibit the transfer of computing services between primary data center facilities without at least 180 days' notice of service cancellation;

e.  Identify the scope of work;

f.  Identify the products or services to be delivered with sufficient specificity to permit an external financial or performance audit;

g.  Establish the services to be provided, the business standards that must be met for each service, the cost of each service, and the process by which the business standards for each service are to be objectively measured and reported;

h.  Identify applicable funds and funding streams for the services or products under contract;

i.  Provide a timely billing methodology for recovering the cost of services provided to the customer entity;

j.  Provide a procedure for modifying the service-level agreement to address changes in projected costs of service;

k.  Provide that a service-level agreement may be terminated by either party for cause only after giving the other party and the Agency for Enterprise Information Technology notice in writing of the cause for termination and an opportunity for the other party to resolve the identified cause within a reasonable period; and

l.  Provide for mediation of disputes by the Division of Administrative Hearings pursuant to s. 120.573

2.  A service-level agreement may include:

a.  A dispute resolution mechanism, including alternatives to administrative or judicial proceedings;

b.  The setting of a surety or performance bond for service-level agreements entered into with nonstate agency primary data centers, which may be designated by the Agency for Enterprise Information Technology; or

c.  Additional terms and conditions as determined advisable by the parties if such additional terms and conditions do not conflict with the requirements of this section or rules adopted by the Agency for Enterprise Information Technology.

3.  The failure to execute a service-level agreement within 60 days after service commencement shall, in the case of an existing customer entity, result in a continuation of the terms of the service-level agreement from the prior fiscal year, including any amendments that were formally proposed to the customer entity by the primary data center within the 3 months before service commencement, and a revised cost-of-service estimate. If a new customer entity fails to execute an agreement within 60 days after service commencement, the data center may cease services.

(h)  Plan, design, establish pilot projects for, and conduct experiments with information technology resources, and implement enhancements in services if such implementation is cost-effective and approved by the board.

(i)  Enter into a memorandum of understanding with the agency where the data center is administratively located which establishes the services to be provided by that agency to the data center and the cost of such services.

(2)  BOARD OF TRUSTEES.--Each primary data center shall be headed by a board of trustees as defined in s. 20.03

(a)  The members of the board shall be appointed by the agency head or chief executive officer of the representative customer entities of the primary data center and shall serve at the pleasure of the appointing customer entity. The initial appointments of members shall be made as soon as practicable, but not later than July 1, 2008.

1.  For each of the first 2 fiscal years that a center is in operation, membership shall be apportioned as provided in subparagraph 3. based on projected customer entity usage rates for the fiscal operating year of the primary data center. However, at a minimum:

a.  During the Southwood Shared Resource Center's first 2 operating years, the Department of Transportation, the Department of Highway Safety and Motor Vehicles, the Department of Health, and the Department of Revenue must each have at least one trustee.

b.  During the Northwood Shared Resource Center's first operating year, the Department of State and the Department of Education must each have at least one trustee.

2.  After the second full year of operation, membership shall be apportioned as provided in subparagraph 3. based on the most recent estimate of customer entity usage rates for the prior year and a projection of usage rates for the first 9 months of the next fiscal year. Such calculation must be completed before the annual budget meeting held before the beginning of the next fiscal year so that any decision to add or remove board members can be voted on at the budget meeting and become effective on July 1 of the subsequent fiscal year.

3.  Membership shall be apportioned using the following criteria:

a.  Customer entities of a primary data center whose usage rate represents 4 to 14 percent of total usage shall have one trustee.

b.  Customer entities of a primary data center whose usage rate represents 15 to 29 percent of total usage shall have two trustees.

c.  Customer entities of a primary data center whose usage rate represents 30 to 49 percent of total usage shall have three trustees.

d.  A customer entity of a primary data center whose usage rate represents 50 percent or more of total usage shall have four trustees.

e.  A single trustee shall represent those customer entities that represent less than 4 percent of the total usage. The trustee shall be selected by a process determined by the board.

f.  The executive director of the Agency for Enterprise Information Technology shall serve as a voting member of the board.

(b)  Before July 1 of each year, each board of trustees of a primary data center shall elect a chair and a vice chair to a term of 1 year or until a successor is elected. The vice chair shall serve in the absence of the chair. The vice chair may not be from the same customer entity as the chair. The chair may be elected to serve one additional successive term.

(c)  Members of the board representing customer entities who fail to timely pay for data center services do not have voting rights.

(d)  The board shall take action by majority vote. If there is a tie, the chair shall be on the prevailing side.

(3)  BOARD DUTIES.--Each board of trustees of a primary data center shall:

(a)  Employ an executive director, pursuant to s. 20.05, who serves at the pleasure of the board. The executive director is responsible for the daily operation of the primary data center, ensuring compliance with all laws and rules regulating the primary data center, managing primary data center employees, and the performance of the primary data center.

(b)  Establish procedures for the primary data center to ensure that budgeting and accounting procedures, cost-recovery methodologies, and operating procedures are in compliance with laws governing the state data center system, rules adopted by the Agency for Enterprise Information Technology, and applicable federal regulations, including 2 C.F.R. part 225 and 45 C.F.R.

(c)  Monitor the operation of the primary data center to ensure compliance by the executive director and employees with laws and rules governing the primary data center, and ensure that staff members are accountable for the performance of the primary data center.

(d)  Provide each customer entity with full disclosure concerning plans for new, additional, or reduced service requirements, including expected achievable service levels and performance metrics.

(e)  Ensure the sufficiency and transparency of the primary data center financial information by:

1.  Establishing policies that ensure that cost-recovery methodologies, billings, receivables, expenditure, budgeting, and accounting data are captured and reported timely, consistently, accurately, and transparently and, upon adoption of rules by the Agency for Enterprise Information Technology, are in compliance with such rules.

2.  Requiring execution of service-level agreements by the data center and each customer entity for services provided by the data center to the customer entity.

3.  Requiring cost recovery for the full cost of services, including direct and indirect costs. The cost-recovery methodology must ensure that no service is subsidizing another service without an affirmative vote of approval by the customer entity providing the subsidy.

4.  Establishing special assessments to fund expansions based on a methodology that apportions the assessment according to the proportional benefit to each customer entity.

5.  Providing rebates to customer entities when revenues exceed costs and offsetting charges to those who have subsidized other customer entity costs based on actual prior year final expenditures. Rebates may be credited against future billings.

6.  Approving all expenditures committing over $50,000 in a fiscal year.

7.  Projecting costs and revenues at the beginning of the third quarter of each fiscal year through the end of the fiscal year. If in any given fiscal year the primary data center is projected to earn revenues that are below costs for that fiscal year after first reducing operating costs where possible, the board shall implement any combination of the following remedies to cover the shortfall:

a.  The board may direct the primary data center to adjust current year chargeback rates through the end of the fiscal year to cover the shortfall. The rate adjustments shall be implemented using actual usage rate and billing data from the first three quarters of the fiscal year and the same principles used to set rates for the fiscal year.

b.  The board may direct the primary data center to levy one-time charges on all customer entities to cover the shortfall. The one-time charges shall be implemented using actual usage rate and billing data from the first three quarters of the fiscal year and the same principles used to set rates for the fiscal year.

c.  The customer entities represented by each board member may provide payments to cover the shortfall in proportion to the amounts each entity paid in the prior fiscal year.

(f)  Meet as often as necessary, but not less than once per quarter, and hold the annual budget meeting between April 1 and June 30 of each year.

(g)  Approve the portfolio of services offered by the data center.

(h)  By July 1 of each year, submit to the Agency for Enterprise Information Technology proposed cost-recovery mechanisms and rate structures for all customer entities for the fiscal year including the cost-allocation methodology for administrative expenditures and the calculation of administrative expenditures as a percent of total costs.

(i)  Consider energy-efficient products and their total cost of ownership when replacing, upgrading, or expanding:

1.  Data center facilities, including, but not limited to, environmental, power, and control systems; and

2.  Data center network, storage, and computer equipment. If the total cost of ownership, including initial acquisition cost, is estimated to be equal to or lower than existing infrastructure, technical specifications for energy-efficient products should be incorporated into the replacement, upgrade, or expansion planning and acquisition process.

History.--s. 9, ch. 2008-116.