HF 3447

1st Engrossment - 90th Legislature (2017 - 2018) Posted on 03/26/2018 04:40pm

A bill for an act
relating to state government; requiring certain information and telecommunications
technology projects to be developed and completed by contract; changing
information technology and cyber security provisions; requiring a legislative report
before a project is deployed for live use; amending Minnesota Statutes 2016,
sections 16A.11, subdivision 1, by adding a subdivision; 16E.01, subdivision 1a;
16E.03, subdivisions 4, 7, by adding a subdivision; 16E.0465; Minnesota Statutes
2017 Supplement, section 16E.0466, subdivision 2.

BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

Section 1.

Minnesota Statutes 2016, section 16A.11, subdivision 1, is amended to read:

Subdivision 1.

When.

The governor shall submit a three-part budget to the legislature.
Parts one and two, the budget message and detailed operating budget, must be submitted
by the fourth Tuesday in January in each odd-numbered year. However, in a year following
the election of a governor who had not been governor the previous year, parts one and two
must be submitted by the third Tuesday in February. Part three, the detailed recommendations
as to capital expenditure, must be submitted as follows: agency capital budget requests by
July 15 of each odd-numbered year, and governor's recommendations by January 15 of each
even-numbered year. deleted text begin Detailed recommendations as to information technology expenditure
must be submitted as part of the detailed operating budget. Information technology
recommendations must include projects to be funded during the next biennium and planning
estimates for an additional two bienniums. Information technology recommendations must
specify purposes of the funding such as infrastructure, hardware, software, or training.
deleted text end

Sec. 2.

Minnesota Statutes 2016, section 16A.11, is amended by adding a subdivision to
read:

new text begin Subd. 6a. new text end

new text begin Information technology and cyber security. new text end

new text begin (a) Detailed recommendations
as to information and telecommunications technology systems and services expenditures
must be submitted as part of the detailed operating budget. These recommendations must
include projects to be funded during the next biennium and planning estimates for an
additional two bienniums, and must specify purposes of the funding, such as infrastructure,
hardware, software, or training. The detailed operating budget must also separately
recommend expenditures for the maintenance and enhancement of cyber security for the
state's information and telecommunications technology systems and services.
new text end

new text begin (b) The commissioner of management and budget, in consultation with the state chief
information officer, shall establish budget guidelines for the recommendations required by
this subdivision. Unless otherwise set by the commissioner at a higher amount, the amount
to be budgeted each fiscal year for maintenance and enhancement of cyber security must
be at least five percent of a department's or agency's total operating budget for information
and telecommunications technology systems and services in that year.
new text end

new text begin (c) As used in this subdivision:
new text end

new text begin (1) "information and telecommunications technology systems and services" has the
meaning given in section 16E.03, subdivision 1, paragraph (a); and
new text end

new text begin (2) "cyber security" has the meaning given in section 16E.03, subdivision 1, paragraph
(d).
new text end

Sec. 3.

Minnesota Statutes 2016, section 16E.01, subdivision 1a, is amended to read:

Subd. 1a.

Responsibilities.

new text begin (a) new text end The office shall provide oversight, leadership, and
direction for information and telecommunications technology policy and the management,
delivery, accessibility, and security of information and telecommunications technology
systems and services in Minnesota. The office shall manage strategic investments in
information and telecommunications technology systems and services to encourage the
development of a technically literate society, to ensure sufficient access to and efficient
delivery of accessible government services, and to maximize benefits for the state government
as an enterprise.

new text begin (b) In implementing the requirements of this chapter, the office must prioritize providing
centralized information technology support services to state agencies, developing policies,
standards, and strategic plans for the state's information technology systems and services,
and overseeing the information architecture required by section 16E.04, subdivision 2.
Developing, designing, or building specific information and telecommunications technology
projects is not a mission of the office, unless money related to a specific project is
appropriated for that express purpose.
new text end

Sec. 4.

Minnesota Statutes 2016, section 16E.03, subdivision 4, is amended to read:

Subd. 4.

Evaluation procedure.

The chief information officer shall establish and, as
necessary, update and modify procedures to evaluate information and communications
projects proposed by state agencies. The evaluation procedure must assess the necessity,
design and plan for development, ability to meet user requirements, accessibility, feasibility,
and flexibility of the proposed data processing device or system, its relationship to other
state new text begin or local new text end data processing devices or systems, and its costs and benefits when considered
by itself and when compared with other options. new text begin The evaluation procedure must also include
a process for consultation with affected local units of government, if implementation of the
proposed project requires the participation of both a state agency and a local government.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective July 1, 2018, and applies to the evaluation
procedure for information and telecommunications technology projects reviewed by the
state chief information officer on or after January 1, 2019.
new text end

Sec. 5.

Minnesota Statutes 2016, section 16E.03, subdivision 7, is amended to read:

Subd. 7.

Cyber security systems.

In consultation with the attorney general and
appropriate agency heads, the chief information officer shall develop cyber security policies,
guidelines, and standards, and shall install and administer state data security systems on the
state's computer facilities consistent with these policies, guidelines, standards, and state law
to ensure the integrity of computer-based and other data and to ensure applicable limitations
on access to data, consistent with the public's right to know as defined in chapter 13. The
chief information officer is responsible for overall security of state agency networks
connected to the Internet. Each department or agency head is responsible for the security
of the department's or agency's data within the guidelines of established enterprise policy. new text begin
Unless otherwise expressly provided by law, at least five percent of each department's or
agency's expenditures in a fiscal year for information and telecommunications technology
systems and services must be directed to the maintenance and enhancement of cyber security.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective July 1, 2018, and applies to expenditures
in fiscal years beginning on or after that date.
new text end

Sec. 6.

Minnesota Statutes 2016, section 16E.03, is amended by adding a subdivision to
read:

new text begin Subd. 11. new text end

new text begin Systems impacting local government. new text end

new text begin An information and telecommunications
technology project that includes the participation of both a state agency and a local unit of
government may not be approved for full release or deployment until the project has been
field tested by at least one local unit of government, and the results of the field test
successfully demonstrate the integrity, security, and quality of the technology, and that the
functionality and usability of the overall project meet the expectations described in the
project's proposal. Standards for field testing that meet the requirements of this subdivision
must be incorporated into the project's development plan before it may be approved by the
chief information officer under subdivision 3.
new text end

new text begin EFFECTIVE DATE. new text end

new text begin This section is effective July 1, 2018, and applies to information
and telecommunications technology projects approved by the state chief information officer
on or after that date.
new text end

Sec. 7.

Minnesota Statutes 2016, section 16E.0465, is amended to read:

16E.0465 TECHNOLOGY APPROVAL.

Subdivision 1.

Application.

This section applies to an appropriation of deleted text begin more than
$1,000,000 of deleted text end state or federal funds to a state agency for any information and
telecommunications technology project or for any phase of such a project, device, or system.
For purposes of this section, an appropriation of state or federal funds to a state agency
includes an appropriation:

(1) to a constitutional officer;

(2) for a project that includes both a state agency and units of local government; and

(3) to a state agency for grants to be made to other entities.

Subd. 2.

Required review and approval.

(a) A state agency receiving an appropriation
new text begin of more than $1,000,000 new text end for an information and telecommunications technology project
subject to this section must divide the project into phases.

(b) The commissioner of management and budget may not authorize the encumbrance
or expenditure of an appropriation of state funds to a state agency for any phase of a project,
device, or system subject to this section unless the Office of MN.IT Services has reviewed
each phase of the project, device, or system, and based on this review, the chief information
officer has determined for each phase that:

(1) the project is compatible with the state information architecture and other policies
and standards established by the chief information officer;

(2) the agency is able to accomplish the goals of the phase of the project with the funds
appropriated; and

(3) the project supports the enterprise information technology strategy.

new text begin Subd. 4. new text end

new text begin Projects of more than $100,000 must be subject to contract. new text end

new text begin A state agency
receiving an appropriation of more than $100,000 for an information and telecommunications
technology project must enter into a contract with one or more vendors for the project's
development and completion. The contract must be solicited, awarded, and executed
according to the requirements of chapter 16C. Notwithstanding section 16C.08, subdivision
2, a competitive proposal process must be used for professional and technical services related
to a project subject to this subdivision, regardless of whether a current state agency employee
is able and available to perform the services called for by the contract.
new text end

Sec. 8.

Minnesota Statutes 2017 Supplement, section 16E.0466, subdivision 2, is amended
to read:

Subd. 2.

Legislative report.

new text begin (a) new text end No later than October 1, 2017, and annually thereafter,
the state chief information officer must submit a comprehensive project portfolio report to
the chairs and ranking minority members of the house of representatives and senate
committees with jurisdiction over state government finance on projects requiring consultation
under subdivision 1. The report must itemize:

(1) each project presented to the office for consultation in the time since the last report;

(2) the information technology cost associated with the project, including the information
technology cost as a percentage of the project's complete budget;

new text begin (3) whether a solicitation was required under section 16E.0465, subdivision 4, and, if
so, the status of the solicitation;
new text end

deleted text begin (3) deleted text end new text begin (4) new text end the status of the information technology components of the project's development;

deleted text begin (4) deleted text end new text begin (5) new text end the date the information technology components of the project are expected to
be completed; and

deleted text begin (5) deleted text end new text begin (6) new text end the projected costs for ongoing support and maintenance of the information
technology components after the project is complete new text begin ; and
new text end

new text begin (7) the date the project is expected to be deployed for live use within the affected agency new text end .

new text begin (b) No fewer than 30 days prior to a project being deployed for live use within an affected
agency, the state chief information officer must submit a notice of the project's status and
expected deployment date to the chairs and ranking minority members of the legislative
committees with jurisdiction over any agency affected by the project.
new text end

Sec. 9. new text begin EFFECTIVE DATE.
new text end

new text begin Sections 1 to 8 are effective July 1, 2018, and apply to information and
telecommunications projects for which an appropriation is provided on or after that date.
new text end