1.1 	A bill for an act
1.2 	relating to state government; requiring consideration of cloud computing service 
1.3 	options in state agency information technology projects; requiring technology 
1.4 	infrastructure inventories and security risk assessments; requiring completion of 
1.5 	the consolidation of information technology services and a strategic workplan; 
1.6 	requiring a consolidation surcharge for certain agencies; mandating reports;
1.7 	amending Minnesota Statutes 2018, sections 16E.03, subdivision 1, by adding a 
1.8 	subdivision; 16E.035.
1.9 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.10 	Section 1. Minnesota Statutes 2018, section 16E.03, subdivision 1, is amended to read:
1.11 		Subdivision 1.Definitions. (a) For the purposes of this chapter, the following terms 
1.12 	have the meanings given them.
1.13 	(b) "Information and telecommunications technology systems and services" means all 
1.14 	computing and telecommunications hardware and software, the activities undertaken to 
1.15 	secure that hardware and software, and the activities undertaken to acquire, transport, process, 
1.16 	analyze, store, and disseminate information electronically. "Information and 
1.17 	telecommunications technology systems and services" includes all proposed expenditures 
1.18 	for computing and telecommunications hardware and software, security for that hardware 
1.19 	and software, and related consulting or other professional services.
1.20 	(c) "Information and telecommunications technology project" means an effort to acquire 
1.21 	or produce information and telecommunications technology systems and services.
1.22 	(d) "Telecommunications" means voice, video, and data electronic transmissions 
1.23 	transported by wire, wireless, fiber-optic, radio, or other available transport technology.
2.1 	(e) "Cyber security" means the protection of data and systems in networks connected to 
2.2 	the Internet.
2.3 	(f) "State agency" means an agency in the executive branch of state government and 
2.4 	includes the Minnesota Office of Higher Education, but does not include the Minnesota 
2.5 	State Colleges and Universities unless specifically provided elsewhere in this chapter.
2.6 	(g) "Total expected project cost" includes direct staff costs, all supplemental contract 
2.7 	staff and vendor costs, and costs of hardware and software development or purchase. 
2.8 	Breaking a project into several phases does not affect the cost threshold, which must be 
2.9 	computed based on the full cost of all phases.
2.10 	(h) "Cloud computing" has the meaning described by the National Institute of Standards 
2.11 	and Technology of the United States Department of Commerce in special publication 
2.12 	800-145, September 2011.

2.13 	Sec. 2. Minnesota Statutes 2018, section 16E.03, is amended by adding a subdivision to 
2.14 	read:
2.15 		Subd. 4a.Cloud computing services. (a) The project evaluation procedure required by 
2.16 	subdivision 4 must include a review of cloud computing service options, including any 
2.17 	security benefits and costs savings associated with purchasing those service options from 
2.18 	a cloud computing service provider.
2.19 	(b) No later than October 1, 2019, and by October 1 of each even-numbered year 
2.20 	thereafter, the chief information officer must submit a report to the governor and to the 
2.21 	legislative committees with primary jurisdiction over state information technology issues 
2.22 	on the consideration of cloud computing service options in the information and 
2.23 	communications projects proposed by state agencies. The report must provide examples of 
2.24 	projects that produce cost savings and other benefits, including security enhancements, from 
2.25 	the use of cloud computing services.

2.26 	Sec. 3. Minnesota Statutes 2018, section 16E.035, is amended to read:
2.27 	16E.035 TECHNOLOGY INFRASTRUCTURE INVENTORY; SECURITY RISK 
2.28 	ASSESSMENT.
2.29 		Subdivision 1.Inventory required. (a) The chief information officer must prepare ~~a~~ 
2.30 	~~financial~~ an inventory of technology infrastructure owned or leased by MN.IT Services or 
2.31 	a state agency. The inventory must include:
2.32 	(1) each agency's information technology security program;
3.1 	(2) an inventory of servers, mainframes, cloud services, and other information technology 
3.2 	systems and services, itemized by agency;
3.3 	(3) identification of vendors that operate or manage information technology systems or 
3.4 	services within each agency;
3.5 	(4) information on how ~~the technology~~ each system or service fits into the state's 
3.6 	information technology architecture; and
3.7 	~~(2)~~ (5) a projected replacement schedule for each system or service.
3.8 	~~The chief information officer must report the inventory to the legislative committees~~ 
3.9 	~~with primary jurisdiction over state technology issues by July 1 of each even-numbered~~ 
3.10 	~~year.~~
3.11 		Subd. 2.Risk assessment. (a) The chief information officer must conduct a risk 
3.12 	assessment of the information technology systems and services contained in the inventory 
3.13 	required by subdivision 1. The risk assessment must include:
3.14 	(1) an analysis and assessment of each state agency's security and operational risks; and
3.15 	(2) for a state agency found to be at higher security and operational risks, a detailed 
3.16 	analysis of, and an estimate of the costs to implement:
3.17 	(i) the requirements for the agency to address the risks and related vulnerabilities; and
3.18 	(ii) agency efforts to address the risks through the modernization of information 
3.19 	technology systems and services, the use of cloud computing services, and use of a statewide 
3.20 	data center.
3.21 	(b) This section does not require disclosure of security information classified under 
3.22 	section 13.37.
3.23 		Subd. 3.Reports required. The chief information officer must submit a report containing 
3.24 	the inventory and risk assessments required by this section to the governor and the chairs 
3.25 	and ranking minority members of the legislative committees with primary jurisdiction over 
3.26 	state information technology issues no later than October 1, 2019, and by October 1 of each 
3.27 	even-numbered year thereafter.

4.1 	Sec. 4. COMPLETION OF INFORMATION TECHNOLOGY CONSOLIDATION; 
4.2 	SURCHARGE AND SUSPENSION OF SERVICES FOR NONCOMPLIANT 
4.3 	AGENCIES; STRATEGIC WORKPLAN.
 4.4 		Subdivision 1.Consolidation required; state agency surcharge. (a) No later than 
4.5 	December 31, 2020, the state chief information officer must complete the executive branch 
4.6 	information technology consolidation required by Laws 2011, First Special Session chapter 
4.7 	10, article 4, section 7, as amended by Laws 2013, chapter 134, section 29. The head of any 
4.8 	state agency subject to consolidation must assist the state chief information officer as 
4.9 	necessary to implement the requirements of this subdivision.
4.10 	(b) Beginning July 1, 2020, the state chief information officer must impose a technology 
4.11 	consolidation surcharge of ... percent on billings, and must suspend ongoing work on any 
4.12 	new projects or system upgrades, for an agency with information technology systems that 
4.13 	have not fully integrated into the statewide consolidated system despite the requirements 
4.14 	of law. Amounts received from the surcharge must be deposited into the general fund and 
4.15 	used to support information technology projects within agencies that have completed the 
4.16 	consolidation or for other purposes directed by law.
4.17 		Subd. 2.Strategic workplan. No later than August 1, 2019, the state chief information 
4.18 	officer must prepare a strategic workplan detailing the steps necessary to complete the 
4.19 	information technology consolidation required by subdivision 1. The plan must include 
4.20 	benchmark goals that can be reasonably measured and documented and have specific 
4.21 	deadlines to be met within each quarter. The benchmark goals must include but are not 
4.22 	limited to strategies for implementing the cloud computing services review required by 
4.23 	Minnesota Statutes, section 16E.03, subdivision 4a, and other tools to provide secure and 
4.24 	cost-effective services to executive branch agencies and other end-users.
4.25 		Subd. 3.Progress reports. (a) No later than September 1, 2019, the state chief 
4.26 	information officer must submit a copy of the workplan required by subdivision 2 to the 
4.27 	chairs and ranking minority members of the legislative committees with primary jurisdiction 
4.28 	over state government finance and state information technology services.
4.29 	(b) No later than October 1, 2019, and quarterly thereafter, the state chief information 
4.30 	officer must submit a progress report to the committees receiving the workplan required by 
4.31 	paragraph (a). At a minimum, the progress reports must include:
4.32 	(1) information sufficient to determine whether deadlines for each benchmark goal have 
4.33 	been met and an explanation of the circumstances for any deadline that has not been met;
4.34 	(2) details on the progress toward achieving each benchmark goal; and
5.1 	(3) information on any new or unexpected costs or other barriers that impact progress 
5.2 	toward achieving a benchmark goal, including a detailed explanation of efforts by the state 
5.3 	chief information officer to reduce or eliminate those costs or barriers to ensure achievement 
5.4 	of that goal.
5.5 	The report must also identify any agencies subject to the surcharge required under subdivision 
5.6 	1, paragraph (b).
5.7 	(c) The chairs of each committee in paragraph (a) must convene a public hearing within 
5.8 	30 days of receipt of each report to discuss its contents. The state chief information officer 
5.9 	must appear at each hearing and respond to questions from committee members regarding 
5.10 	the progress update.