Existing law requires the Department of Technology, on or before July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency, as specified. Existing law authorizes a local entity that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, to submit a Technology Recovery Plan, upon request of the Department of Technology.

This bill would create the Office of Local Cloud Migration and Digital Innovation in the Department of Technology. The bill would require the office to promote the use of technologies including, but not limited to, cloud-based computing and data storage that will assist local agencies in their efforts to further transparency, efficiency, disaster preparedness and response, as well as general accessibility to the public. The bill would require the office to operate in partnership with private industry and the nonprofit community to maximize the assistance provided to local agencies. The bill would create the Local Cloud Migration and Digital Innovation Local Assistance Fund for the purpose of receipt of donations from private industry and the nonprofit community, and funds directly allocated by the Legislature, and would make money in the fund available to the office, upon appropriation by the Legislature, for the above-described purposes.

Existing law requires the Department of Technology, on or before July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency, as specified. Existing law authorizes a local entity that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, to submit a Technology Recovery Plan, upon request of the Department of Technology.

This bill would create the Office of Local Cloud Migration and Digital Innovation in the Department of Technology, contingent upon the appropriation of the necessary funds by the Legislature. Technology. The bill would require the office to promote cloud-based data storage as an efficient and cost-effective means of data storage and protection for local agencies and to assist local agencies in integrating cloud-based storage into their information technology systems and their technology recovery plans, as specified. the use of technologies including, but not limited to, cloud-based computing and data storage that will assist local agencies in their efforts to further transparency, efficiency, disaster preparedness and response, as well as general accessibility to the public. The bill would require the office to operate in partnership with private industry and the nonprofit community to maximize the assistance provided to local agencies. The bill would create the Cloud Local Cloud Migration and Digital Innovation Local Assistance Fund for the purpose of receipt of donations from private industry and the nonprofit community, and funds directly allocated by the Legislature, and would make money in the fund available to the office, upon appropriation by the Legislature, for the above-described purposes.

Existing law requires the Department of Technology, on or before July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency, as specified. Existing law authorizes a local entity that receives state funds for the purposes of storing, sharing, or transmitting data, or in support of an information technology project with a state entity, to submit a Technology Recovery Plan, upon request of the Department of Technology.

This bill would state the intent of the Legislature to enact legislation that encourages local agencies to adopt state data protection standards set forth in the State Administrative Manual, as well as federal standards set forth by the National Institute of Standards and Technology, by creating incentives for local agencies to embrace state and federal standards. create the Office of Cloud Migration in the Department of Technology, contingent upon the appropriation of the necessary funds by the Legislature. The bill would require the office to promote cloud-based data storage as an efficient and cost-effective means of data storage and protection for local agencies and to assist local agencies in integrating cloud-based storage into their information technology systems and their technology recovery plans, as specified. The bill would require the office to operate in partnership with private industry and the nonprofit community to maximize the assistance provided to local agencies. The bill would create the Cloud Migration Local Assistance Fund for the purpose of receipt of donations from private industry and the nonprofit community, and would make money in the fund available to the office, upon appropriation by the Legislature, for the above-described purposes.

Existing law requires the Department of Technology, on or before July 1, 2018, to update the Technology Recovery Plan element of the State Administrative Manual to ensure the inclusion of cybersecurity strategy incident response standards for each state agency, as specified.

This bill would state the intent of the Legislature to enact legislation that encourages local agencies to adopt state data protection standards set forth in the State Administrative Manual, as well as federal standards set forth by the National Institute of Standards and Technology, by creating incentives for local agencies to embrace state and federal standards.

Date of Hearing: May 16, 2018

ASSEMBLY COMMITTEE ON APPROPRIATIONS

Lorena Gonzalez Fletcher, Chair

ABPCA Bill Id:AB 2812

Author:(Limón) – As Amended Ver:May 9, 2018

Urgency: No State Mandated Local Program: No Reimbursable: No

SUMMARY:

This bill requires the California Department of Technology (CDT) to create the Office of Local Cloud Migration and Digital Innovation (Office) to assist local agencies. Specifically, this bill:

1. Requires the Office to assist local agencies by providing direction on the most cost effective ways to integrate all applicable technologies that advance specified goals. Such technologies shall include, but are not limited to, cloud-based computing and data storage and the integration of such technology into local agency information technology systems.
2. Creates a Cloud Migration and Digital Innovation Local Assistance Fund, for the purpose of funding the Office. This fund is authorized to receive private donations and state funds allocated by the Legislature.

FISCAL EFFECT:

GF costs for CDT to create the Office of about $1 million in the first year and $900,000 ongoing.

COMMENTS:

Background and purpose. At the state level, CDT has enacted a statewide Cloud Computing Policy (or “cloud first” policy). This policy requires state entities to shift toward using cloud computing technologies first in the delivery of information technology services in any new information technology projects and build and evaluate for cloud solutions to meet their business needs whenever feasible. The author contends CDT has developed significant expertise that would benefit local agencies if shared. According to the author:

AB 2812 will create the Office of Cloud Migration and Digital Innovation (OCMDI) within the CDT. This newly created office shall provide expertise and resources to local agencies in need of upgraded information technology systems and technologies, included but not limited to cloud-based computing and data storage, for the purposes of building more cost effective, transparent and disaster resistant systems, such a data storage.

Analysis Prepared by: Jessica Peters / APPR. / (916) 319-2081

Date of Hearing: April 17, 2018

ASSEMBLY COMMITTEE ON PRIVACY AND CONSUMER PROTECTION

Ed Chau, Chair

ABPCA Bill Id:AB 2812 (

Author:Limón) – As Amended Ver:April 9, 2018

SUBJECT: Data storage and protection standards: local agencies

SUMMARY: This bill would create within the California Department of Technology (CDT) an Office of Local Cloud Migration and Digital Innovation (Office) to promote the use of technologies including, but not limited to, cloud-based computing and data storage that will assist local agencies in their efforts to further transparency, efficiency, disaster preparedness and response, as well as general accessibility to the public, as specified. Specifically, this bill would:

1. Require the Office to assist local agencies in providing direction on the most cost effective ways to integrate all applicable technologies that advance specified goals. Such technologies shall include, but are not limited to, cloud-based computing and data storage and the integration of such technology into local agency information technology systems and technology recovery plans.
2. Require the Office to prioritize providing assistance to local agencies seeking to improve their information technology systems to migrate to more accessible and cost-effective cloud-based or other applicable technology solutions.
3. Require the Office to operate, in partnership with private industry and the nonprofit community, to maximize the assistance provided to local agencies.
4. Create a Cloud Migration and Digital Innovation Local Assistance Fund, for the purpose of receipt of donations from private industry and the nonprofit community, and funds directly allocated by the Legislature. Moneys in the fund, upon appropriation by the Legislature, would be made available to support these purposes.
5. Set forth various findings and declarations, including, among other things, that:
   • CDT has established statewide contract vehicles for cloud computing and storage that may be utilized by local government agencies. Further, CDT’s fee-for-service component in these contract vehicles will support the creation and maintenance of the Office.
   • The agility and elasticity of the cloud can decrease local government agencies’ information technology costs surrounding disaster recovery, as specified.
   • It is the intent of the Legislature to: (1) leverage private sector expertise to ensure that local agencies find innovative ways to provide essential services and improve the quality of life for all California residents; and (2) assist local agencies in their efforts to improve governmental transparency, efficiency, disaster preparedness and response, as well as general accessibility through readily available and cost-efficient technologies.

EXISTING LAW:

1. Establishes CDT within the Government Operations Agency, under the supervision of the Director of Technology, also known as the State Chief Information Officer. (Gov. Code Sec. 11545(a).)
2. Requires the Director of CDT to, among other things, advise the Governor on the strategic management and direction of the state’s information technology resources and provide technology direction to agency and department chief information officers to ensure the integration of statewide technology initiatives. (Gov. Code Sec. 11545(b).) Among other things, the duties of the Director include minimizing overlap, redundancy, and cost in state information technology operations by promoting the efficient and effective use of information technology. (Gov. Code Sec. 11545(b)(3).)
3. Requires CDT to improve the governance and implementation of information technology by standardizing reporting relationships, roles, and responsibilities for setting information technology priorities. (Gov. Code Sec. 11546.1.)
4. Establishes within CDT the Office of Technology Services (OTech) to serve the common technology needs of executive branch entities with accountability to customers for providing secure services that are responsive to client needs at a cost representing best value to the state. The stated purpose of having a technology office within state government is to improve and coordinate the use of technology and to coordinate and cooperate with all public agencies in the state in order to eliminate duplications and to bring about economies that could not otherwise be obtained. (Gov. Code Sec. 11534.)
5. Sets forth the State’s Cloud Computing Policy in the California State Administrative Manual (SAM), which is intended to accelerate the pace at which agencies/state entities will realize the benefits of cloud computing while adequately addressing relevant statutory and policy requirements associated with State IT systems, including information security and risk management, privacy, legal issues, and other applicable requirements. This policy recognizes that cloud computing is an effective method for the secure, agile and reliable delivery of government services in the State of California and enables business programs to enhance service delivery while ensuring the underlying technologies are transparent, ubiquitous, and interchangeable. (SAM Sec. 4983.)
6. Provides under this Cloud Computing Policy that each agency/state entity must, among other things:
   • Evaluate, in consultation with their information technology organization, secure cloud computing alternatives for all information technology projects and infrastructure initiatives (e.g., storage, servers, and Wide Area Network equipment).
   • Use a cloud service model, i.e., Software as a Service (SaaS), Platform as a Service (PaaS), or Infrastructure as a Service (IaaS), whenever a feasible and cost effective solution is available, consistent with specified factors, and use IaaS and PaaS solutions provided through CDT. If an agency/state entity determines that the use of a cloud service solution is not feasible, or the required solution is not provided through CDT, they shall submit an exemption request to CDT for approval.
   • Ensure that all confidential, sensitive or personal information is encrypted, as specified.
   • Maintain an effective incident response and mitigation capability for security and privacy incidents, as specified. (SAM Sec. 4983.1; see SAM Sec. 4819.2 for corresponding definitions of terms such as “cloud computing,” “cloud SaaS,” “cloud PaaS,” and “cloud IaaS.”)

FISCAL EFFECT: Unknown

COMMENTS:

1. Purpose of this bill: This bill seeks to create a new office within the state’s technology department that would be dedicated to assisting local agencies in becoming more efficient and effective in their use of cloud and other technology resources to address various needs, California Public Records Act (CPRA) responses, and disaster recovery. This bill is sponsored by the League of California Cities.
2. Author’s statement: According to the author, “AB 2812 will create the Office of Cloud Migration and Digital Innovation (OCMDI) within the [CDT]. This newly created office shall provide expertise and resources to local agencies in need of upgraded information technology systems and technologies, included but not limited to cloud-based computing and data storage, for the purposes of building more cost effective, transparent and disaster resistant systems, such a data storage.

In addition to facilitating the shift to cloud computing and storage, the [OCMDI] shall assist local agencies in integrating all applicable technologies that advance cost effective, efficient and transparent data storage, as well as efficient disaster preparedness and response.

By enabling enhanced access to cloud based services among other technological resources at the local level, this bill will enable local agencies to access quantifiable benefits of:

• • Cost effectiveness/budgetary relief: Cloud-based storage costs are minimal compared to current preservation methods.
  • Easier administration of California Public Record Act requests: Cloud based services enable improved responsiveness, access and transparency.
  • Improved disaster recovery: Cloud based storage enables access to faster disaster recovery of information technology systems without additional infrastructure expenses.

The [OCMDI] will provide assistance to local agencies most seeking to improve their information technology systems, and will operate in partnership with the private industry and nonprofit community to maximize the assistance provided to local agencies.”

1. Outdated information technology systems create inefficiencies in both CPRA responsiveness and disaster recovery: To underscore the need for this bill, the author points out that the “[i]nformation technology systems commonly used by resource limited local agencies are outdated, expensive to maintain, and difficult to access. Creating an [o]ffice within the California Department of Technology to help such agencies shift to more cost effective and advanced information technology systems, will save local agencies money, increase transparency and improve disaster recovery.” The author contends that deficiencies in local agency information technology systems are “exemplified by an uptake in for profit data mining, characterized by requests for large amounts of data from local agencies by means of the California Public Records Act.” To accommodate such requests, the author writes, “local administrators commonly must to travel to offsite storage facilities to locate microfilm, a time consuming and inefficient process.”

In support, the author references an article by sponsor, League of California Cities, citing 4,002 processed CPRA requests by the city of Sacramento in 2016—compared to 1,800 in 2013. This increased volume of requests has reportedly forced many agencies to hire additional staff dedicated solely to reviewing documents in association with CPRA requests. Ultimately, “[r]eliance upon the retrieval of offsite microfilm, is not only costly, but hinders efficient emergency response.” To this end, the author cites a May 2017 Assembly Budget Committee No. 3 Agenda, where a California Highway Patrol budget request reflected that moving CHP’s disaster recovery environment to the cloud could enable them to restore mission critical systems in 24 hours, as opposed to 3 months to procure new equipment, retrieve tapes from an offsite location and then restore those mission critical systems and data. (See Asm. Budget Com. No. 3 Agenda (May 3, 2017) <http://abgt.assembly.ca.gov/ sites/abgt.assembly.ca.gov/files/May%203%20-%20Trans%20Agenda%20open%20issues %20and%20SFL%20%28Part%20A%29.pdf> [as of Apr. 5, 2018].)

1. Statewide public policy promoting use of cloud services: This bill seeks to capitalize upon and leverage the expertise of this state’s technology department, CDT, to create an office in CDT that is solely dedicated to cloud migration and digital innovation issues for local agencies. Already, at the state level, CDT provides similar functions for state agencies and entities and, as of August 2014, has enacted a statewide Cloud Computing Policy (or “cloud first” policy) that requires state entities to shift toward using cloud computing technologies first in the delivery of information technology services in any new information technology projects and build and evaluate for cloud solutions to meet their business needs whenever feasible. This policy sets forth that doing so enables government “to place greater emphasis on delivering the highest quality business value to the people of California, while keeping the underlying technologies transparent, ubiquitous and interchangeable.” As stated in a 2017 CDT Technology Letter update regarding this policy:

In an increasingly digital era, state government and consumers of Information Technology (IT) services expect greater agility and increasing returns on their technology investments. They want modern, reliable, secure and innovative solutions for the people and organizations they serve. Cloud computing continues to be the technology of choice for meeting these growing demands through on-demand, self-service computing, in a pay-as-you-use model. [ . . . ]

To further realize the benefits of cloud, CDT has updated the Cloud Computing policy to enable rapid acquisition of cloud infrastructure technologies through pre-existing contracts and moving the responsibility and cost of uptime, infrastructure and/or platform upgrades and security to commercial cloud service providers. These changes will establish a channel between IT service providers and business partners, providing greater flexibility and more opportunities to meet program needs than currently possible. (CDT TL-17-06 (Aug. 2017).)

While it is important not to prematurely over-expand the portfolio of a state entity that is still maturing, this bill appears to promote public policy that encourages the use of cloud IT services among local agencies, consistent with that already seen at state agency level. It further seeks to encourage local agencies to leverage contracts negotiated by CDT using the buying power of the state to obtain the best value available instead of conducting their own individual procurements for the same services which would arguably benefit not only the local agencies in terms of cost efficiencies and the quality of the products (due to security standards that must be met by those that wish to be awarded cloud computing contracts by CDT), but also the State, due to the percentage that goes back to either CDT or the Department of General Services, depending on the contract vehicle.

1. Prioritization of assistance mandated by bill: This bill requires that the new Office of Local Cloud Migration and Digital Innovation “prioritize providing assistance to local agencies seeking to improve their information technology systems to migrate to more accessible and cost-effective cloud-based or other applicable technology solutions.” While Committee staff understands that this language was intended to require CDT to prioritize among the local agencies seeking to migrate to cloud-based or other applicable solutions, it does not state how that prioritization must happen. Without additional details, this could inadvertently suggest that the prioritization is to be given over other CDT cloud activities for state entities or that the office must internally prioritize assistance to those local agencies seeking to migrate to cloud-based or other applicable technology solutions over other local agencies seeking assistance from CDT for other purposes. Furthermore, even if the underlying intent here appears to in fact be to help prioritize smaller counties with fewer resources over larger counties with greater resources, one could argue that helping some of the larger counties could make some of the biggest immediate impact for Californians and the State, alike. Moreover, CDT should retain flexibility in determining how to prioritize these requests within their larger role and responsibilities to the State. Accordingly, the author may wish to consider amending the bill to clarify this “prioritization” language to ensure that locals’ resource needs are considered within the handling of requests in the new Office of Local Cloud Migration and Digital Innovation, but to also sufficiently provide CDT flexibility in making prioritization determinations, so that this prioritization language does not have any broader affect than absolutely necessary.
2. Technical amendments: The author may also wish to consider the following technical amendments at the next opportunity to amend the bill to correct drafting errors in the bill’s findings and declarations:

Technical amendments:

On page 3, line 3, strike “and”

On page 3, line 4-6, strike “It the intent of the Legislature that leveraging this private sector expertise is vital” and insert “It is the intent of the Legislature to leverage this vital private sector expertise”

1. Arguments in Support: Several cities and the California Special Districts Association write in support, noting that for the local agencies and special districts, “lack of available resources is the primary factor in the inability to modernize their technology. AB 2812 falls in line with CDT’s 2017 strategic plan to foster collaboration with local governments, while bridging the gap between local agency ‘haves and have-nots’ by encouraging the utilization of public-private partnerships. Ensuring that California technology leaders assist local agencies in their goal to implore the most cost efficient, secure and accessible technologies ultimately will result in a more responsive and effective government.” They further support the bill because “CDT has established statewide contract vehicles for the procurement of cloud services available to cities, allowing [their local agencies and special districts] to easily acquire cloud services at competitively bid pricing. These contract vehicles enable rapid and cost-effective procurement of cloud services, while supporting CDT for their expertise and management of the contracts.”

REGISTERED SUPPORT / OPPOSITION:

Support

League of California Cities (sponsor)

California State Association of Counties

California Special Districts Association

City of Belmont

City of Chino Hills

City of Citrus Heights

City of Fillmore

City of Dublin

City of Goleta

City of Grand Terrace

City of Highland

City of Oxnard

Opposition

None on file

Analysis Prepared by: Ronak Daylami / P. & C.P. / (916) 319-2200