1.1 	A bill for an act
1.2 	relating to state government; requiring certain information and telecommunications 
1.3 	technology projects to be developed and completed by contract; changing 
1.4 	information technology and cyber security provisions; requiring a legislative report 
1.5 	before a project is deployed for live use; amending Minnesota Statutes 2016, 
1.6 	sections 16A.11, subdivision 1, by adding a subdivision; 16E.01, subdivision 1a; 
1.7 	16E.03, subdivisions 4, 7, by adding a subdivision; 16E.0465; Minnesota Statutes 
1.8 	2017 Supplement, section 16E.0466, subdivision 2.
1.9 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.10 	Section 1. Minnesota Statutes 2016, section 16A.11, subdivision 1, is amended to read:
1.11 		Subdivision 1.When. The governor shall submit a three-part budget to the legislature. 
1.12 	Parts one and two, the budget message and detailed operating budget, must be submitted 
1.13 	by the fourth Tuesday in January in each odd-numbered year. However, in a year following 
1.14 	the election of a governor who had not been governor the previous year, parts one and two 
1.15 	must be submitted by the third Tuesday in February. Part three, the detailed recommendations 
1.16 	as to capital expenditure, must be submitted as follows: agency capital budget requests by 
1.17 	July 15 of each odd-numbered year, and governor's recommendations by January 15 of each 
1.18 	even-numbered year. Detailed recommendations as to information technology expenditure 
1.19 	must be submitted as part of the detailed operating budget. Information technology 
1.20 	recommendations must include projects to be funded during the next biennium and planning 
1.21 	estimates for an additional two bienniums. Information technology recommendations must 
1.22 	specify purposes of the funding such as infrastructure, hardware, software, or training.

2.1 	Sec. 2. Minnesota Statutes 2016, section 16A.11, is amended by adding a subdivision to 
2.2 	read:
2.3 		Subd. 6a.Information technology and cyber security. (a) Detailed recommendations 
2.4 	as to information and telecommunications technology systems and services expenditures 
2.5 	must be submitted as part of the detailed operating budget. These recommendations must 
2.6 	include projects to be funded during the next biennium and planning estimates for an 
2.7 	additional two bienniums, and must specify purposes of the funding, such as infrastructure, 
2.8 	hardware, software, or training. The detailed operating budget must also separately 
2.9 	recommend expenditures for the maintenance and enhancement of cyber security for the 
2.10 	state's information and telecommunications technology systems and services.
2.11 	(b) The commissioner of management and budget, in consultation with the state chief 
2.12 	information officer, shall establish budget guidelines for the recommendations required by 
2.13 	this subdivision. Unless otherwise set by the commissioner at a higher amount, the amount 
2.14 	to be budgeted each fiscal year for maintenance and enhancement of cyber security must 
2.15 	be at least five percent of a department's or agency's total operating budget for information 
2.16 	and telecommunications technology systems and services in that year.
2.17 	(c) As used in this subdivision:
2.18 	(1) "information and telecommunications technology systems and services" has the 
2.19 	meaning given in section 16E.03, subdivision 1, paragraph (a); and
2.20 	(2) "cyber security" has the meaning given in section 16E.03, subdivision 1, paragraph 
2.21 	(d).

2.22 	Sec. 3. Minnesota Statutes 2016, section 16E.01, subdivision 1a, is amended to read:
2.23 		Subd. 1a.Responsibilities. (a) The office shall provide oversight, leadership, and 
2.24 	direction for information and telecommunications technology policy and the management, 
2.25 	delivery, accessibility, and security of information and telecommunications technology 
2.26 	systems and services in Minnesota. The office shall manage strategic investments in 
2.27 	information and telecommunications technology systems and services to encourage the 
2.28 	development of a technically literate society, to ensure sufficient access to and efficient 
2.29 	delivery of accessible government services, and to maximize benefits for the state government 
2.30 	as an enterprise.
2.31 	(b) In implementing the requirements of this chapter, the office must prioritize providing 
2.32 	centralized information technology support services to state agencies, developing policies, 
2.33 	standards, and strategic plans for the state's information technology systems and services, 
3.1 	and overseeing the information architecture required by section 16E.04, subdivision 2. 
3.2 	Developing, designing, or building specific information and telecommunications technology 
3.3 	projects is not a mission of the office, unless money related to a specific project is 
3.4 	appropriated for that express purpose.

3.5 	Sec. 4. Minnesota Statutes 2016, section 16E.03, subdivision 4, is amended to read:
3.6 		Subd. 4.Evaluation procedure. The chief information officer shall establish and, as 
3.7 	necessary, update and modify procedures to evaluate information and communications 
3.8 	projects proposed by state agencies. The evaluation procedure must assess the necessity, 
3.9 	design and plan for development, ability to meet user requirements, accessibility, feasibility, 
3.10 	and flexibility of the proposed data processing device or system, its relationship to other 
3.11 	state or local data processing devices or systems, and its costs and benefits when considered 
3.12 	by itself and when compared with other options. The evaluation procedure must also include 
3.13 	a process for consultation with affected local units of government, if implementation of the 
3.14 	proposed project requires the participation of both a state agency and a local government.

3.15 	EFFECTIVE DATE. This section is effective July 1, 2018, and applies to the evaluation 
3.16 	procedure for information and telecommunications technology projects reviewed by the 
3.17 	state chief information officer on or after January 1, 2019.

3.18 	Sec. 5. Minnesota Statutes 2016, section 16E.03, subdivision 7, is amended to read:
3.19 		Subd. 7.Cyber security systems. In consultation with the attorney general and 
3.20 	appropriate agency heads, the chief information officer shall develop cyber security policies, 
3.21 	guidelines, and standards, and shall install and administer state data security systems on the 
3.22 	state's computer facilities consistent with these policies, guidelines, standards, and state law 
3.23 	to ensure the integrity of computer-based and other data and to ensure applicable limitations 
3.24 	on access to data, consistent with the public's right to know as defined in chapter 13. The 
3.25 	chief information officer is responsible for overall security of state agency networks 
3.26 	connected to the Internet. Each department or agency head is responsible for the security 
3.27 	of the department's or agency's data within the guidelines of established enterprise policy.
3.28 	Unless otherwise expressly provided by law, at least five percent of each department's or 
3.29 	agency's expenditures in a fiscal year for information and telecommunications technology 
3.30 	systems and services must be directed to the maintenance and enhancement of cyber security.

3.31 	EFFECTIVE DATE. This section is effective July 1, 2018, and applies to expenditures 
3.32 	in fiscal years beginning on or after that date.

4.1 	Sec. 6. Minnesota Statutes 2016, section 16E.03, is amended by adding a subdivision to 
4.2 	read:
4.3 		Subd. 11.Systems impacting local government. An information and telecommunications 
4.4 	technology project that includes the participation of both a state agency and a local unit of 
4.5 	government may not be approved for full release or deployment until the project has been 
4.6 	field tested by at least one local unit of government, and the results of the field test 
4.7 	successfully demonstrate the integrity, security, and quality of the technology, and that the 
4.8 	functionality and usability of the overall project meet the expectations described in the 
4.9 	project's proposal. Standards for field testing that meet the requirements of this subdivision 
4.10 	must be incorporated into the project's development plan before it may be approved by the 
4.11 	chief information officer under subdivision 3.

4.12 	EFFECTIVE DATE. This section is effective July 1, 2018, and applies to information 
4.13 	and telecommunications technology projects approved by the state chief information officer 
4.14 	on or after that date.

4.15 	Sec. 7. Minnesota Statutes 2016, section 16E.0465, is amended to read:
4.16 	16E.0465 TECHNOLOGY APPROVAL.
4.17 		Subdivision 1.Application. This section applies to an appropriation of more than 
4.18 	$1,000,000 of state or federal funds to a state agency for any information and 
4.19 	telecommunications technology project or for any phase of such a project, device, or system. 
4.20 	For purposes of this section, an appropriation of state or federal funds to a state agency 
4.21 	includes an appropriation:
4.22 	(1) to a constitutional officer;
4.23 	(2) for a project that includes both a state agency and units of local government; and
4.24 	(3) to a state agency for grants to be made to other entities.
4.25 		Subd. 2.Required review and approval. (a) A state agency receiving an appropriation 
4.26 	of more than $1,000,000 for an information and telecommunications technology project 
4.27 	subject to this section must divide the project into phases.
4.28 	(b) The commissioner of management and budget may not authorize the encumbrance 
4.29 	or expenditure of an appropriation of state funds to a state agency for any phase of a project, 
4.30 	device, or system subject to this section unless the Office of MN.IT Services has reviewed 
4.31 	each phase of the project, device, or system, and based on this review, the chief information 
4.32 	officer has determined for each phase that:
5.1 	(1) the project is compatible with the state information architecture and other policies 
5.2 	and standards established by the chief information officer;
5.3 	(2) the agency is able to accomplish the goals of the phase of the project with the funds 
5.4 	appropriated; and
5.5 	(3) the project supports the enterprise information technology strategy.
5.6 		Subd. 4.Projects of more than $100,000 must be subject to contract. A state agency 
5.7 	receiving an appropriation of more than $100,000 for an information and telecommunications 
5.8 	technology project must enter into a contract with one or more vendors for the project's 
5.9 	development and completion. The contract must be solicited, awarded, and executed 
5.10 	according to the requirements of chapter 16C. Notwithstanding section 16C.08, subdivision 
5.11 	2, a competitive proposal process must be used for professional and technical services related 
5.12 	to a project subject to this subdivision, regardless of whether a current state agency employee 
5.13 	is able and available to perform the services called for by the contract.

5.14 	Sec. 8. Minnesota Statutes 2017 Supplement, section 16E.0466, subdivision 2, is amended 
5.15 	to read:
5.16 		Subd. 2.Legislative report. (a) No later than October 1, 2017, and annually thereafter, 
5.17 	the state chief information officer must submit a comprehensive project portfolio report to 
5.18 	the chairs and ranking minority members of the house of representatives and senate 
5.19 	committees with jurisdiction over state government finance on projects requiring consultation 
5.20 	under subdivision 1. The report must itemize:
5.21 	(1) each project presented to the office for consultation in the time since the last report;
5.22 	(2) the information technology cost associated with the project, including the information 
5.23 	technology cost as a percentage of the project's complete budget;
5.24 	(3) whether a solicitation was required under section 16E.0465, subdivision 4, and, if 
5.25 	so, the status of the solicitation;
5.26 	(3) (4) the status of the information technology components of the project's development;
5.27 	(4) (5) the date the information technology components of the project are expected to 
5.28 	be completed; and
5.29 	(5) (6) the projected costs for ongoing support and maintenance of the information 
5.30 	technology components after the project is complete; and
5.31 	(7) the date the project is expected to be deployed for live use within the affected agency.
6.1 	(b) No fewer than 30 days prior to a project being deployed for live use within an affected 
6.2 	agency, the state chief information officer must submit a notice of the project's status and 
6.3 	expected deployment date to the chairs and ranking minority members of the legislative 
6.4 	committees with jurisdiction over any agency affected by the project.

6.5 	Sec. 9. EFFECTIVE DATE.
 6.6 	Sections 1 to 8 are effective July 1, 2018, and apply to information and 
6.7 	telecommunications projects for which an appropriation is provided on or after that date.