HB 1557

1
A bill to be entitled
2An act relating to state information technology; creating
3s. 14.204, F.S.; creating the Agency for Enterprise
4Information Technology within the Executive Office of the
5Governor; providing for the Governor and Cabinet to be the
6head of the agency; requiring that the agency be a
7separate budget entity that is not subject to the control
8of the Executive Office of the Governor; providing for an
9executive director of the agency to be subject to
10confirmation by the Senate; providing for the executive
11director to be the chief information officer of the state
12and the executive sponsor for all enterprise information
13technology projects; specifying the duties and
14responsibilities of the agency, which include defining
15architecture standards for information technology and
16developing a strategic information technology plan;
17requiring each state agency and the Agency Chief
18Information Officers Council to participate in the
19activities of the Agency for Enterprise Information
20Technology; amending s. 20.22, F.S.; removing the State
21Technology Office within the Department of Management
22Services; amending s. 216.0446, F.S.; revising the duties
23of the Technology Review Workgroup within the Legislature
24to conform to the transfer of duties concerning the
25management of information technology for state agencies;
26amending s. 282.0041, F.S.; revising and providing
27definitions; creating s. 282.0055, F.S.; providing for the
28Agency for Enterprise Information Technology to oversee
29information technology services that are common to all
30executive branch agencies and for agency information
31technology services to be responsible for information
32technology within an individual state agency; creating s.
33282.0056, F.S.; requiring the Agency for Enterprise
34Information Technology to develop a work plan; requiring
35that the work plan be approved by the Governor and Cabinet
36and submitted to the Legislature; requiring that certain
37specified policies be included in the initial work plan;
38requiring that the agency develop policy recommendations
39and strategies for consolidating computer rooms and data
40centers; requiring each state agency to provide assistance
41in the development of the work plan upon request; amending
42s. 282.20, F.S.; transferring management of the Technology
43Resource Center from the State Technology Office to the
44Department of Management Services; revising the duties of
45the center to conform to changes made by the act;
46requiring that the center submit its service rates and
47cost-allocation plan to the Agency for Enterprise
48Information Technology for review and approval; amending
49s. 282.3055, F.S.; revising the duties of state agencies
50with respect to providing assistance to the Agency for
51Enterprise Information Technology; revising the duties of
52the agency chief information officers; amending s.
53282.315, F.S.; revising the duties of the Agency Chief
54Information Officers Council; requiring that the council
55assist the Agency for Enterprise Information Technology in
56developing strategies for information technology services
57and projects and make policy recommendations and that the
58agency provide administrative support to the council;
59revising the membership of the council; providing for the
60appointment of a chair, vice chair, and secretary;
61amending s. 282.318, F.S.; providing duties of the Agency
62for Enterprise Information Technology with respect to the
63security of data and information technology resources;
64requiring state agencies to conduct a comprehensive risk
65analysis at specified intervals, develop and update
66internal policies and procedures, and ensure compliance
67with certain security requirements; requiring the Agency
68for Enterprise Information Technology to designate a chief
69information security officer, develop standards for risk
70analyses and security audits, and provide training for
71agency information security managers; deleting provisions
72specifying duties of the Department of Management Services
73to conform to changes made by the act; amending s.
74282.322, F.S.; requiring that the Agency for Enterprise
75Information Technology perform contract monitoring duties
76formerly performed by the Enterprise Project Management
77Office of the State Technology Office; amending s.
78216.023, F.S.; requiring that certain legislative budget
79requests include the statutory reference to the policy
80requiring a new information technology project; providing
81for the transfer of specified duties from the State
82Technology Office to the Department of Management
83Services; repealing ss. 186.022, 282.005, 282.101,
84282.102, 282.23, 282.3031, 282.3032, 282.3063, 282.310,
85287.057(24), 288.1092, and 288.1093, F.S., relating to
86information technology strategic plans, duties of the
87State Technology Office, the State Strategic Information
88Technology Alliance, information resources management
89responsibilities, guiding principles, the Agency Annual
90Enterprise Resource Planning and Management Report, the
91State Annual Report on Enterprise Resource Planning and
92Management, state strategic information technology
93alliances, and the One-Stop Permitting System Grant
94Program and the Quick Permitting County Designation
95Program within the State Technology Office; amending ss.
96215.95, 215.96, 282.103, 282.107, 288.0655, 339.155,
97381.90, 403.973, 408.05, 420.0003, 420.511, 943.08, and
981001.26, F.S., relating to the Financial Management
99Information Board and its coordination council, the SUNCOM
100Network, the Rural Infrastructure Fund, transportation
101planning, the Health Information Systems Council,
102expedited permitting, the Florida Center for Health
103Information and Policy Analysis, the state housing
104strategy and the Florida Housing Finance Corporation, the
105Criminal and Juvenile Justice Information System Council,
106and the public broadcasting program system; conforming
107cross-references and other references to provisions
108repealed by the act; providing appropriations and
109providing additional positions; authorizing the Agency for
110Enterprise Information Technology to provide training for
111agency chief information officers; providing an effective
112date.
113
114Be It Enacted by the Legislature of the State of Florida:
115
116     Section 1.  Section 14.204, Florida Statutes, is created to
117read:
118     14.204  Agency for Enterprise Information Technology.--The
119Agency for Enterprise Information Technology is created within
120the Executive Office of the Governor. The head of the agency
121shall be the Governor and Cabinet. The agency shall be a
122separate budget entity that is not subject to control,
123supervision, or direction by the Executive Office of the
124Governor in any manner, including, but not limited to,
125purchasing, transactions involving real or personal property,
126personnel, or budgetary matters.
127     (1)  The executive director of the agency shall be
128appointed by the Governor and Cabinet, is subject to
129confirmation by the Senate, and shall serve at the pleasure of
130the Governor and Cabinet. The executive director shall be the
131chief information officer of the state and the executive sponsor
132for all enterprise information technology projects.
133     (2)  The agency shall have the following duties and
134responsibilities:
135     (a)  Develop and implement strategies for the design,
136delivery, and management of the enterprise information
137technology services established in law.
138     (b)  Manage the operation of the enterprise information
139technology services as identified in law, which includes
140executing service-level agreements, managing the procurement of
141enterprise information technology resources, and managing
142contracts with enterprise information technology service
143providers.
144     (c)  Make recommendations to the agency head and the
145Legislature concerning other information technology services
146that should be designed, delivered, and managed at the
147enterprise level as defined in s. 282.0041(6).
148     (d)  Plan and manage statutorily authorized enterprise
149information technology projects, which includes developing
150business cases that, when applicable, include the components
151identified in s. 287.0574; establishing and coordinating
152project-management teams; establishing formal risk-assessment
153and mitigation processes; and monitoring projects for
154recommending corrective actions.
155     (e)  Provide project-management resources and assistance to
156state agencies for information technology projects that are
157designated as high-risk pursuant to s. 282.322.
158     (f)  Define the architecture standards for enterprise
159information technology and develop implementation approaches for
160statewide migration to those standards.
161     (g)  Analyze the effect of new investments of enterprise
162information technology on existing information technology and
163complete assessments of the capability of the enterprise
164information technology.
165     (h)  Identify needs for professional development and
166training and provide opportunities for agency chief information
167officers which focus on aligning the operational activities of
168each state agency's information technology with best practices,
169standards, and project-management methodologies that promote
170sustainable and repeatable processes.
171     (i)  Develop and publish an enterprise strategic
172information technology plan that identifies and recommends
173strategies for how information technology will deliver effective
174and efficient government services to state residents and improve
175the operations of state agencies.
176     (3)  The agency shall operate in such a manner as to ensure
177participation and representation of state agencies and the
178Agency Chief Information Officers Council established in s.
179282.315.
180     Section 2.  Section 20.22, Florida Statutes, is amended to
181read:
182     20.22  Department of Management Services.--There is created
183a Department of Management Services.
184     (1)  The head of the Department of Management Services is
185the Secretary of Management Services, who shall be appointed by
186the Governor, subject to confirmation by the Senate, and shall
187serve at the pleasure of the Governor.
188     (2)  The following divisions and programs within the
189Department of Management Services are established:
190     (a)  Facilities Program.
191     (b)  State Technology Office.
192     (b)(c)  Workforce Program.
193     (c)(d)1.  Support Program.
194     2.  Federal Property Assistance Program.
195     (d)(e)  Administration Program.
196     (e)(f)  Division of Administrative Hearings.
197     (f)(g)  Division of Retirement.
198     (g)(h)  Division of State Group Insurance.
199     (3)  The State Technology Office shall operate and manage
200the Technology Resource Center.
201     (3)(4)  The duties of the Chief Labor Negotiator shall be
202determined by the Secretary of Management Services, and must
203include, but need not be limited to, the representation of the
204Governor as the public employer in collective bargaining
205negotiations pursuant to the provisions of chapter 447.
206     Section 3.  Section 216.0446, Florida Statutes, is amended
207to read:
208     216.0446  Review of information technology resources
209management needs.--
210     (1)  There is created within the Legislature the Technology
211Review Workgroup. The workgroup and the State Technology Office
212shall independently review and make recommendations with respect
213to the portion of agencies' long-range program plans which
214pertains to information technology resources management needs
215and with respect to agencies' legislative budget requests for
216information technology and related resources. The Technology
217Review Workgroup shall report such recommendations, together
218with the findings and conclusions on which such recommendations
219are based, to the Legislative Budget Commission. The State
220Technology Office shall report such recommendations, together
221with the findings and conclusions on which such recommendations
222are based, to the Executive Office of the Governor and to the
223chairs of the legislative appropriations committees.
224     (2)  In addition to its primary duty specified in
225subsection (1), the Technology Review Workgroup shall have
226powers and duties that include, but are not limited to, the
227following:
228     (a)  To evaluate the information technology resource
229management needs identified in the agency long-range program
230plans for consistency with the State Annual Report on Enterprise
231Resource Planning and Management and statewide policies
232recommended by the State Technology Office, and make
233recommendations to the Legislative Budget Commission.
234     (b)  To review and make recommendations to the  Legislative
235Budget Commission on proposed budget amendments and agency
236transfers associated with information technology initiatives or
237projects that involve more than one agency, that have an outcome
238that impacts another agency, that exceed $500,000 in total cost
239over a 1-year period, or that are requested by the Legislative
240Budget Commission to be reviewed.
241     Section 4.  Section 282.0041, Florida Statutes, is amended
242to read:
243     282.0041  Definitions.--For the purposes of this part, the
244term:
245     (1)  "Agency" means those entities described in s.
246216.011(1)(qq).
247     (2)  "Agency Annual Enterprise Resource Planning and
248Management Report" means the report prepared by each Agency
249Chief Information Officer as required by s. 282.3063.
250     (2)(3)  "Agency Chief Information Officer" means the person
251appointed by the agency head State Technology Office to
252coordinate and manage the information technology functions
253policies and responsibilities activities applicable to that
254agency and to participate and represent his or her agency in
255developing strategies for implementing enterprise information
256technology services identified in law and developing
257recommendations for enterprise information technology policy.
258     (3)(4)  "Agency Chief Information Officers Council" means
259the council created in s. 282.315 to facilitate the sharing and
260coordination of information technology issues and initiatives
261among the agencies.
262     (4)  "Agency for Enterprise Information Technology" means
263the agency created in s. 14.204.
264     (5)  "Agency information technology service" means a
265service that directly helps the agency fulfill its statutory or
266constitutional responsibilities and policy objectives and is
267usually associated with the agency's primary or core business
268functions.
269     (6)  "Enterprise level" means all executive branch agencies
270created or authorized in statute to perform legislatively
271delegated functions.
272     (7)  "Enterprise information technology service" means an
273information technology service that is common among agencies and
274is designed, delivered, and managed at the enterprise level.
275     (8)  "Data center service" means the enterprise information
276technology service that provides the centralized operation and
277management of data centers and server rooms.
278     (9)  "E-mail, messaging, and calendaring service" means the
279enterprise information technology service that enables users to
280send, receive, file, store, manage, and retrieve electronic
281messages, attachments, appointments, and addresses.
282     (5)  "Enterprise resources management infrastructure" means
283the hardware, software, networks, data, human resources,
284policies, standards, facilities, maintenance, and related
285materials and services that are required to support the business
286processes of an agency or state enterprise.
287     (6)  "Enterprise resource planning and management" means
288the planning, budgeting, acquiring, developing, organizing,
289directing, training, control, and related services associated
290with government information technology. The term encompasses
291information and related resources, as well as the controls
292associated with their acquisition, development, dissemination,
293and use.
294     (10)(7)  "Information technology" means equipment,
295hardware, software, firmware, programs, systems, networks,
296infrastructure, media, and related material used to
297automatically, electronically, and wirelessly collect, receive,
298access, transmit, display, store, record, retrieve, analyze,
299evaluate, process, classify, manipulate, manage, assimilate,
300control, communicate, exchange, convert, converge, interface,
301switch, or disseminate information of any kind or form.
302     (11)  "Information technology policy" means statements that
303describe clear choices for how information technology will
304deliver effective and efficient government services to residents
305and improve state agency operations. Such a policy may relate to
306investments, business applications, architecture, or
307infrastructure. A policy describes its rationale, implications
308of compliance or noncompliance, the timeline for implementation,
309metrics for determining compliance, and the accountable
310structure responsible for its implementation.
311     (12)(8)  "Project" means an undertaking directed at the
312accomplishment of a strategic objective relating to enterprise
313resources management or a specific appropriated program.
314     (9)  "State Annual Report on Enterprise Resource Planning
315and Management" means the report prepared by the State
316Technology Office as defined in s. 282.102.
317     (13)(10)  "Standards" means the use of current, open,
318nonproprietary, or non-vendor-specific technologies.
319     (11)  "State Technology Office" or "office" means the
320office created in s. 282.102.
321     (14)(12)  "Total cost" means all costs associated with
322information technology projects or initiatives, including, but
323not limited to, value of hardware, software, service,
324maintenance, incremental personnel, and facilities.  Total cost
325of a loan or gift of information technology resources to an
326agency includes the fair market value of the resources, except
327that the total cost of loans or gifts of information technology
328to state universities to be used in instruction or research does
329not include fair market value.
330     Section 5.  Section 282.0055, Florida Statutes, is created
331to read:
332     282.0055  Assignment of information technology.--In order
333to ensure the most effective and efficient use of the state's
334information technology and information technology resources and
335notwithstanding other provisions of law to the contrary, the
336design, delivery, and management of the enterprise information
337technology services defined in s. 282.0041(7) shall be the
338responsibility of the Agency for Enterprise Information
339Technology for executive branch agencies created or authorized
340in statute to perform legislatively delegated functions. The
341design, delivery, and management of the agency information
342technology services defined in s. 282.0041(5) shall be the
343responsibility of the individual state agency.
344     Section 6.  Section 282.0056, Florida Statutes, is created
345to read:
346     282.0056  Development of work plan.--
347     (1)  For purposes of carrying out its responsibilities set
348forth in s. 282.0055, the Agency for Enterprise Information
349Technology shall develop a work plan describing the activities
350that the agency intends to undertake and the proposed outcomes.
351The work plan must be approved by the agency head and submitted
352to the President of the Senate and the Speaker of the House of
353Representatives. The work plan may be amended as needed to
354ensure that the enterprise information technology services will
355be provided in an efficient, effective, and accountable manner.
356For the 2007-2008 fiscal year, the agency's work plan shall
357include the development of recommended information technology
358policies, as defined in s. 282.0041(11), and implementation
359plans for each of the following:
360     (a)  Consolidation of the deployment, management, and
361operation of state-owned or state-operated computer rooms and
362data centers.
363     (b)  A shared or consolidated enterprise information
364technology service delivery and support model for the e-mail,
365messaging, and calendaring service defined in s. 282.0041(9).
366     (c)  Information security.
367     (2)  In developing policy recommendations and
368implementation plans for current and proposed enterprise
369information technology services, the agency shall describe the
370scope of operation, conduct costs and requirements analyses,
371conduct an inventory of all existing information technology
372resources that are associated with each service, and develop
373strategies and timeframes for statewide migration. For purposes
374of consolidating state-owned or state-operated computer rooms
375and data centers, the Agency for Enterprise Information
376Technology shall develop a migration plan that ensures the
377migration of at least three computer rooms or data centers each
378fiscal year.
379     (3)  For the purpose of completing its work activities,
380each state agency shall provide to the Agency for Enterprise
381Information Technology all requested information, including, but
382not limited to, the agency's costs, service requirements, and
383equipment inventories.
384     Section 7.  Section 282.20, Florida Statutes, is amended to
385read:
386     282.20  Technology Resource Center.--
387     (1)(a)  The Department of Management Services State
388Technology Office shall operate and manage the Technology
389Resource Center.
390     (b)  For the purposes of this section, the term:
391     1.  "Information-system utility" means a full-service
392information-processing facility offering hardware, software,
393operations, integration, networking, and consulting services.
394     2.  "Customer" means a state agency or other entity which
395is authorized to utilize the SUNCOM Network pursuant to this
396part.
397     (2)  The Technology Resource Center shall:
398     (a)  Serve the office and other customers as an
399information-system utility.
400     (b)  Cooperate with customers to offer, develop, and
401support a wide range of services and applications needed by
402users of the Technology Resource Center.
403     (c)  Cooperate with the Florida Legal Resource Center of
404the Department of Legal Affairs and other state agencies to
405develop and provide access to repositories of legal information
406throughout the state.
407     (c)(d)  Cooperate with the Agency for Enterprise
408Information Technology office to identify and facilitate
409interdepartmental networking and integration of network services
410for its customers.
411     (d)(e)  Assist customers in testing and evaluating new and
412emerging technologies that could be used to meet the needs of
413the state.
414     (3)  The department office may contract with customers to
415provide any combination of services necessary for agencies to
416fulfill their responsibilities and to serve their users.
417     (4)  The Technology Resource Center may plan, design,
418establish pilot projects for, and conduct experiments with
419information technology resources, and may implement enhancements
420in services when such implementation is cost-effective. Funding
421for experiments and pilot projects shall be derived from service
422revenues and may not exceed 5 percent of the service revenues
423for the Technology Resource Center for any single fiscal year.
424Any experiment, pilot project, plan, or design must be approved
425by the Agency for Enterprise Information Technology Chief
426Information Officer.
427     (5)  Beginning in the 2007-2008 fiscal year and annually
428thereafter, the Technology Resource Center shall submit to the
429Agency for Enterprise Information Technology for its review and
430approval a copy of its service rates and cost-allocation plan.
431When appropriate, the Agency for Enterprise Information
432Technology shall request review and comment from the customers
433and Agency Chief Information Officers Council concerning the
434center's proposed rate structure.
435     (5)  Notwithstanding the provisions of s. 216.272, the
436Technology Resource Center may spend funds in the reserve
437account of the Technology Enterprise Operating Trust Fund for
438enhancements to center operations or for information technology
439resources. Any expenditure of reserve account funds must be
440approved by the Chief Information Officer. Any funds remaining
441in the reserve account at the end of the fiscal year may be
442carried forward and spent as approved by the Chief Information
443Officer, provided that such approval conforms to any applicable
444provisions of chapter 216.
445     Section 8.  Section 282.3055, Florida Statutes, is amended
446to read:
447     282.3055  Agency chief information officer; appointment;
448duties.--
449     (1)(a)  In order to assist the State Technology Officer in
450carrying out agency information technology the enterprise
451resource planning and management responsibilities and assist the
452Agency for Enterprise Information Technology in developing
453strategies for implementing the enterprise information
454technology services established by law, each agency head shall,
455the Chief Information Officer may appoint or contract for an
456agency chief information officer. This position may be full time
457or part time.
458     (b)  The agency chief information officer must, at a
459minimum, have knowledge and experience in both management and
460information technology resources.
461     (2)  The duties of the agency chief information officer
462include, but are not limited to:
463     (a)  Coordinating and facilitating the agency enterprise
464resource planning and management of agency information
465technology services projects and initiatives.
466     (b)  Preparing an agency annual report on enterprise
467resource planning and management pursuant to s. 282.3063.
468     (b)(c)  Developing and Implementing agency information
469technology enterprise resource planning and management policies,
470procedures, guidelines, and standards that are consistent with
471the procedures and standards adopted by the Agency for
472Enterprise Information Technology, including specific policies
473and procedures for review and approval of the agency's purchases
474of information technology resources in accordance with the
475office's policies and procedures.
476     (c)(d)  Advising agency senior management as to the
477information technology enterprise resource planning and
478management needs of the agency for inclusion in planning
479documents required by law.
480     (d)(e)  Assisting in the development and prioritization of
481the information technology enterprise resource needs for
482planning and management schedule of the agency's legislative
483budget request.
484     (e)  Assisting the Agency for Enterprise Information
485Technology in the development of strategies for implementing the
486utility information technology services established in law and
487developing recommendations for enterprise information technology
488policy.
489     Section 9.  Section 282.315, Florida Statutes, is amended
490to read:
491     282.315  Agency Chief Information Officers Council;
492creation.--The Legislature finds that enhancing communication,
493consensus building, coordination, and facilitation with respect
494to issues concerning of statewide enterprise information
495technology resources resource planning and management issues is
496essential to improving the state management of such resources.
497     (1)  There is created an Agency Chief Information Officers
498Council to:
499     (a)  Enhance communication and collaboration among the
500Agency Chief Information Officers and the Agency for Enterprise
501Information Technology by sharing enterprise resource planning
502and management experiences and exchanging ideas.
503     (b)  Identify and recommend Facilitate the sharing of best
504practices that are characteristic of highly successful
505technology organizations, as well as exemplary information
506technology applications for use by of state agencies, and assist
507the Agency for Enterprise Information Technology in developing
508strategies for implementing the utility information technology
509services and enterprise information technology projects
510established in law and developing recommendations for enterprise
511information technology policy.
512     (c)  Identify efficiency opportunities among state agencies
513and make recommendations for action to the Agency for Enterprise
514Information Technology.
515     (d)  Serve as an educational forum for enterprise resource
516planning and management issues.
517     (d)(e)  Assist the Agency for Enterprise Information
518Technology State Technology Office in identifying critical
519enterprise information technology statewide issues and, when
520appropriate, make recommendations for solving enterprise
521resource planning and management deficiencies.
522     (2)  Members of the council shall include the Agency Chief
523Information Officers, including the Chief Information Officers
524of the agencies and governmental entities enumerated in s.
525282.0055 s. 282.3031, except that there shall be one Chief
526Information Officer selected by the state attorneys and one
527Chief Information Officer selected by the public defenders. The
528council shall appoint a chair, vice chair, and secretary from
529among its members to a 1-year term each. The council shall
530establish procedures governing council business. The chairs, or
531their designees, of the Florida Financial Management Information
532System Coordinating Council, the Criminal and Juvenile Justice
533Information Systems Council, and the Health Information Systems
534Council shall represent their respective organizations on the
535Chief Information Officers Council as voting members.
536     (3)  The Agency for Enterprise Information Technology State
537Technology Office shall provide administrative support to the
538council.
539     Section 10.  Section 282.318, Florida Statutes, is amended
540to read:
541     282.318  Security of data and information technology
542resources.--
543     (1)  This section may be cited as the "Security of Data and
544Information Technology Infrastructure Resources Act."
545     (2)(a)  The Agency for Enterprise Information Technology
546State Technology Office, in consultation with each agency head,
547is responsible and accountable for assessing and recommending
548minimum operating procedures for ensuring assuring an adequate
549level of security for all data and information technology
550resources for executive branch agencies created or authorized in
551statute to perform legislatively delegated functions. To assist
552the agency in carrying out this responsibility, of each agency
553head and, to carry out this responsibility, shall, at a minimum:
554     1.  Designate an information security manager who shall
555administer the security program of the each agency for its data
556and information technology resources.
557     2.  Conduct, and periodically update every 3 years, a
558comprehensive risk analysis to determine the security threats to
559the data, information, and information technology resources of
560the each agency. The risk analysis information is confidential
561and exempt from the provisions of s. 119.07(1), except that such
562information shall be available to the Auditor General and the
563Agency for Enterprise Information Technology in performing his
564or her postauditing duties.
565     3.  Develop, and periodically update, written internal
566policies and procedures that are consistent with the standard
567operating procedures adopted by the Agency for Enterprise
568Information Technology in order to ensure to assure the security
569of the data, information, and information technology resources
570of the each agency. The internal policies and procedures that
571which, if disclosed, could facilitate the unauthorized
572modification, disclosure, or destruction of data or information
573technology resources are confidential information and exempt
574from the provisions of s. 119.07(1), except that such
575information shall be available to the Auditor General and the
576Agency for Enterprise Information Technology in performing his
577or her postauditing duties.
578     4.  Implement appropriate cost-effective safeguards to
579reduce, eliminate, or recover from the identified risks to the
580data, information, and information technology resources of the
581each agency.
582     5.  Ensure that periodic internal audits and evaluations of
583the agency's each security program for the data, information,
584and information technology resources of the agency are
585conducted. The results of such internal audits and evaluations
586are confidential information and exempt from the provisions of
587s. 119.07(1), except that such information shall be available to
588the Auditor General and the Agency for Enterprise Information
589Technology in performing his or her postauditing duties.
590     6.  Include appropriate security requirements, as
591determined by the State Technology Office, in consultation with
592each agency head, in the written specifications for the
593solicitation of information technology and information
594technology resources which are consistent with the standard
595security operating procedures adopted by the Agency for
596Enterprise Information Technology.
597     (b)  In those instances under this subsection in which the
598state agency or department State Technology Office develops
599state contracts for use by state agencies, the state agency or
600department office shall include appropriate security
601requirements in the specifications for the solicitation for
602state contracts for procuring information technology or
603information technology resources.
604     (3)  The Agency for Enterprise Information Technology shall
605designate a chief information security officer.
606     (4)  The Agency for Enterprise Information Technology shall
607develop standards and templates for conducting comprehensive
608risk analyses and information security audits by state agencies,
609assist agencies in their compliance with the provisions of this
610section, pursue appropriate funding provided for the purpose of
611enhancing domestic security, establish minimum guidelines and
612procedures for the recovery of information technology following
613a disaster, and provide training for agency information security
614managers.
615     (3)  Notwithstanding subsection (2), the Department of
616Management Services, hereafter referred to as the "department,"
617in consultation with each agency head, is responsible for
618coordinating, assessing, and recommending minimum operating
619procedures for ensuring an adequate level of security for data
620and information technology resources. To assist the department
621in carrying out this responsibility, each agency shall, at a
622minimum:
623     (a)  Designate an information security manager who shall
624administer the security program of the agency for its data and
625information technology resources.
626     (b)  Conduct, and update every 3 years, a comprehensive
627risk analysis to determine the security threats to the data,
628information, and information technology resources of the agency.
629The risk analysis information made confidential and exempt under
630subparagraph (2)(a)2. shall be available to the Auditor General
631in performing his or her postauditing duties.
632     (c)  Develop, and periodically update, written internal
633policies and procedures that are consistent with the standard
634operating procedures recommended by the department to ensure the
635security of the data and information technology resources of the
636agency. The internal policies and procedures that, if disclosed,
637could facilitate the unauthorized modification, disclosure, or
638destruction of data or information technology resources made
639confidential and exempt under subparagraph (2)(a)3. shall be
640available to the Auditor General in performing his or her
641postauditing duties.
642     (d)  Implement appropriate cost-effective safeguards to
643reduce, eliminate, or recover from the identified risks to the
644data and information technology resources of the agency.
645     (e)  Ensure that periodic internal audits and evaluations
646of the security program for the data, information, and
647information technology resources of the agency are conducted.
648The results of such internal audits and evaluations made
649confidential and exempt under subparagraph (2)(a)5. shall be
650available to the Auditor General in performing his or her
651postauditing duties.
652     (f)  Include appropriate security requirements in the
653written specifications for the solicitation of information
654technology resources that are consistent with the standard
655security operating procedures as recommended by the department.
656     (g)  This subsection expires July 1, 2007.
657
658In those instances under this subsection in which the department
659develops state contracts for use by state agencies, the
660department shall include appropriate security requirements in
661the specifications for the solicitation for state contracts for
662procuring information technology resources.
663     (4)  In order to ensure the security of data, information,
664and information technology resources, the department shall
665establish the Office of Information Security and shall designate
666a Chief Information Security Officer as the head of the office.
667The office shall coordinate its activities with the Agency Chief
668Information Officers Council as established in s. 282.315. The
669office is responsible for developing a strategic plan for
670information technology security which shall be submitted by
671March 1, 2007, to the Executive Office of the Governor, the
672President of the Senate, and the Speaker of the House of
673Representatives; developing standards and templates for
674conducting comprehensive risk analyses and information security
675audits by state agencies; assisting agencies in their compliance
676with the provisions of this section; establishing minimum
677standards for the recovery of information technology following a
678disaster; and conducting training for agency information
679security managers. This subsection expires July 1, 2007.
680     Section 11.  Subsection (2) of section 282.322, Florida
681Statutes, is amended to read:
682     282.322  Special monitoring process for designated
683information resources management projects.--
684     (2)  The Agency for Enterprise Information Technology
685Project Management Office of the State Technology Office shall
686report on any information technology project that the
687Legislature projects the office identifies as high-risk to the
688Executive Office of the Governor, the President of the Senate,
689the Speaker of the House of Representatives, and the chairs of
690the appropriations committees. Within the limits of current
691appropriations, the Agency for Enterprise Information Technology
692Project Management Office shall monitor and report on such high-
693risk information technology projects, and assess the levels of
694risks associated with proceeding to the next stage of the
695project.
696     Section 12.  Paragraph (a) of subsection (4) of section
697216.023, Florida Statutes, is amended to read:
698     216.023  Legislative budget requests to be furnished to
699Legislature by agencies.--
700     (4)(a)  The legislative budget request must contain for
701each program:
702     1.  The constitutional or statutory authority for a
703program, a brief purpose statement, and approved program
704components.
705     2.  Information on expenditures for 3 fiscal years (actual
706prior-year expenditures, current-year estimated expenditures,
707and agency budget requested expenditures for the next fiscal
708year) by appropriation category.
709     3.  Details on trust funds and fees.
710     4.  The total number of positions (authorized, fixed, and
711requested).
712     5.  An issue narrative describing and justifying changes in
713amounts and positions requested for current and proposed
714programs for the next fiscal year.
715     6.  Information resource requests.
716     7.  Supporting information, including applicable cost-
717benefit analyses, business case analyses, performance
718contracting procedures, service comparisons, and impacts on
719performance standards for any request to outsource or privatize
720agency functions. The cost-benefit and business case analyses
721must include an assessment of the impact on each affected
722activity from those identified in accordance with paragraph (b).
723Performance standards must include standards for each affected
724activity and be expressed in terms of the associated unit of
725activity.
726     8.  An evaluation of any major outsourcing and
727privatization initiatives undertaken during the last 5 fiscal
728years having aggregate expenditures exceeding $10 million during
729the term of the contract. The evaluation shall include an
730assessment of contractor performance, a comparison of
731anticipated service levels to actual service levels, and a
732comparison of estimated savings to actual savings achieved.
733Consolidated reports issued by the Department of Management
734Services may be used to satisfy this requirement.
735     9.  Supporting information for any proposed consolidated
736financing of deferred-payment commodity contracts including
737guaranteed energy performance savings contracts.  Supporting
738information must also include narrative describing and
739justifying the need, baseline for current costs, estimated cost
740savings, projected equipment purchases, estimated contract
741costs, and return on investment calculation.
742     10.  In accordance with the instructions for legislative
743budget requests for new information technology projects that
744exceed $5 million in total cost, the statutory reference of the
745existing or proposed substantive policy that establishes and
746defines the project's governance structure, scope, main business
747objectives that must be achieved, and completion timeframes.
748Information technology budget requests for the continuance of
749existing hardware and software maintenance agreements, renewal
750of existing software licensing agreements, or the replacement of
751desktop units with new technology that is similar to the
752technology currently in use are exempt from this requirement.
753     Section 13.  Unless otherwise specified in this act, the
754Department of Management Services, established in s. 20.22,
755Florida Statutes, shall assume the duties and responsibilities
756of the State Technology Office as set forth in ss. 215.322(2),
757282.103, 282.104, 282.105, 282.106, 282.107, 282.1095, 282.111,
758282.21, 282.22, 288.1092, 288.1093, 365.171, 365.172, 365.173,
759and 943.0313, Florida Statutes.
760     Section 14.  Sections 186.022, 282.005, 282.101, 282.102,
761282.23, 282.3031, 282.3032, 282.3063, and 282.310, Florida
762Statutes, subsection (24) of section 287.057, Florida Statutes,
763and sections 288.1092 and 288.1093, Florida Statutes, are
764repealed.
765     Section 15.  Paragraph (d) of subsection (2) of section
766215.95, Florida Statutes, is amended to read:
767     215.95  Financial Management Information Board.--
768     (2)  To carry out its duties and responsibilities, the
769board shall by majority vote:
770     (d)  By March 1 of each year, approve a strategic plan
771pursuant to the requirements set forth in s. 186.022(9).
772     Section 16.  Paragraph (a) of subsection (3) of section
773215.96, Florida Statutes, is amended to read:
774     215.96  Coordinating council and design and coordination
775staff.--
776     (3)  The coordinating council, assisted by the design and
777coordination staff, shall have the following duties, powers, and
778responsibilities pertaining to the Florida Financial Management
779Information System:
780     (a)  To conduct such studies and to establish committees,
781workgroups, and teams to develop recommendations for rules,
782policies, procedures, principles, and standards to the board as
783necessary to assist the board in its efforts to design,
784implement, and perpetuate a financial management information
785system, including, but not limited to, the establishment of
786common data codes, and the development of integrated financial
787management policies that address the information and management
788needs of the functional owner subsystems, and the development of
789a strategic plan pursuant to the requirements set forth in s.
790186.022. The coordinating council shall make available a copy of
791the approved plan in writing or through electronic means to each
792of the coordinating council members, the fiscal committees of
793the Legislature, and any interested person.
794     Section 17.  Subsection (1) of section 282.103, Florida
795Statutes, is amended to read:
796     282.103  SUNCOM Network; exemptions from the required
797use.--
798     (1)  There is created within the State Technology Office
799the SUNCOM Network which shall be developed to serve as the
800state communications system for providing local and long-
801distance communications services to state agencies, political
802subdivisions of the state, municipalities, state universities,
803and nonprofit corporations pursuant to ss. 282.103-282.111 ss.
804282.101-282.111. The SUNCOM Network shall be developed to
805transmit all types of communications signals, including, but not
806limited to, voice, data, video, image, and radio. State agencies
807shall cooperate and assist in the development and joint use of
808communications systems and services.
809     Section 18.  Subsection (1) of section 282.107, Florida
810Statutes, is amended to read:
811     282.107  SUNCOM Network; criteria for usage.--
812     (1)  The State Technology Office shall periodically review
813the qualifications of subscribers using the state SUNCOM Network
814and shall terminate services provided to any facility not
815qualified pursuant to ss. 282.103-282.111 ss. 282.101-282.111 or
816rules adopted hereunder.  In the event of nonpayment of invoices
817by subscribers whose SUNCOM Network invoices are paid from
818sources other than legislative appropriations, such nonpayment
819represents good and sufficient reason to terminate service.
820     Section 19.  Paragraph (e) of subsection (2) of section
821288.0655, Florida Statutes, is amended to read:
822     288.0655  Rural Infrastructure Fund.--
823     (2)
824     (e)  To enable local governments to access the resources
825available pursuant to s. 403.973(18)(19), the office may award
826grants for surveys, feasibility studies, and other activities
827related to the identification and preclearance review of land
828which is suitable for preclearance review. Authorized grants
829under this paragraph shall not exceed $75,000 each, except in
830the case of a project in a rural area of critical economic
831concern, in which case the grant shall not exceed $300,000. Any
832funds awarded under this paragraph must be matched at a level of
83350 percent with local funds, except that any funds awarded for a
834project in a rural area of critical economic concern must be
835matched at a level of 33 percent with local funds. In evaluating
836applications under this paragraph, the office shall consider the
837extent to which the application seeks to minimize administrative
838and consultant expenses.
839     Section 20.  Paragraph (b) of subsection (3) and subsection
840(4) of section 339.155, Florida Statutes, are amended to read:
841     339.155  Transportation planning.--
842     (3)  FORMAT, SCHEDULE, AND REVIEW.--The Florida
843Transportation Plan shall be a unified, concise planning
844document that clearly defines the state's long-range
845transportation goals and objectives and documents the
846department's short-range objectives developed to further such
847goals and objectives. The plan shall include a glossary that
848clearly and succinctly defines any and all phrases, words, or
849terms of art included in the plan, with which the general public
850may be unfamiliar and shall consist of, at a minimum, the
851following components:
852     (b)  A short-range component documenting the short-term
853objectives and strategies necessary to implement the goals and
854long-term objectives contained in the long-range component. The
855short-range component must define the relationship between the
856long-range goals and the short-range objectives, specify those
857objectives against which the department's achievement of such
858goals will be measured, and identify transportation strategies
859necessary to efficiently achieve the goals and objectives in the
860plan. It must provide a policy framework within which the
861department's legislative budget request, the strategic
862information resource management plan, and the work program are
863developed. The short-range component shall serve as the
864department's annual agency strategic plan pursuant to s.
865186.021. The short-range component shall be developed consistent
866with the requirements of s. 186.022 and consistent with
867available and forecasted state and federal funds. In addition to
868those entities listed in s. 186.022, The short-range component
869shall also be submitted to the Florida Transportation
870Commission.
871     (4)  ANNUAL PERFORMANCE REPORT.--The department shall
872develop an annual performance report evaluating the operation of
873the department for the preceding fiscal year. The report, which
874shall meet the requirements of s. 186.022, shall also include a
875summary of the financial operations of the department and shall
876annually evaluate how well the adopted work program meets the
877short-term objectives contained in the short-range component of
878the Florida Transportation Plan. In addition to the entities
879listed in s. 186.022, This performance report shall also be
880submitted to the Florida Transportation Commission and the
881legislative appropriations and transportation committees.
882     Section 21.  Subsection (7) of section 381.90, Florida
883Statutes, is amended to read:
884     381.90  Health Information Systems Council; legislative
885intent; creation, appointment, duties.--
886     (7)  The council's duties and responsibilities include, but
887are not limited to, the following:
888     (a)  By June 1 of each year, to develop and approve a
889strategic plan pursuant to the requirements set forth in s.
890186.022.
891     (a)(b)  To develop a mission statement, goals, and plan of
892action, based on the guiding principles specified in s.
893282.3032, for the identification, collection, standardization,
894sharing, and coordination of health-related data across federal,
895state, and local government and private-sector entities.
896     (b)(c)  To develop a review process to ensure cooperative
897planning among agencies that collect or maintain health-related
898data.
899     (c)(d)  To create ad hoc issue-oriented technical
900workgroups, on an as-needed basis, to make recommendations to
901the council.
902     Section 22.  Subsections (5) through (20) of section
903403.973, Florida Statutes, are renumbered as subsections (4)
904through (19), respectively, and current subsections (4), (7),
905(8), (13), and (14) of that section are amended to read:
906     403.973  Expedited permitting; comprehensive plan
907amendments.--
908     (4)  The office may delegate to a Quick Permitting County
909designated under s. 288.1093 the responsibility for convening
910regional permit teams and, in consultation with the office, for
911certifying as eligible for expedited review projects that meet
912the criteria of subsection (3) and that are consistent with the
913economic goals of the county. In order to receive such a
914delegation, the Quick Permitting County must hold the public
915hearing required under subsection (7) and agree to execute a
916memorandum of agreement for each qualified project.
917     (6)(7)  The local government shall hold a duly noticed
918public hearing to execute a memorandum of agreement for each
919qualified project. Notwithstanding any other provision of law,
920and at the option of the local government, the workshop provided
921for in subsection (5) (6) may be conducted on the same date as
922the public hearing held under this subsection. The memorandum of
923agreement that a local government signs shall include a
924provision identifying necessary local government procedures and
925time limits that will be modified to allow for the local
926government decision on the project within 90 days. The
927memorandum of agreement applies to projects, on a case-by-case
928basis, that qualify for special review and approval as specified
929in this section. The memorandum of agreement must make it clear
930that this expedited permitting and review process does not
931modify, qualify, or otherwise alter existing local government
932nonprocedural standards for permit applications, unless
933expressly authorized by law.
934     (7)(8)  At the option of the participating local
935government, appeals of its final approval for a project may be
936pursuant to the summary hearing provisions of s. 120.574,
937pursuant to subsection (14) (15), or pursuant to other appellate
938processes available to the local government. The local
939government's decision to enter into a summary hearing must be
940made as provided in s. 120.574 or in the memorandum of
941agreement.
942     (12)(13)  The applicant, the regional permit action team,
943and participating local governments may agree to incorporate
944into a single document the permits, licenses, and approvals that
945are obtained through the expedited permit process. This
946consolidated permit is subject to the summary hearing provisions
947set forth in subsection (14) (15).
948     (13)(14)  Notwithstanding any other provisions of law:
949     (a)  Local comprehensive plan amendments for projects
950qualified under this section are exempt from the twice-a-year
951limits provision in s. 163.3187; and
952     (b)  Projects qualified under this section are not subject
953to interstate highway level-of-service standards adopted by the
954Department of Transportation for concurrency purposes. The
955memorandum of agreement specified in subsection (5) (6) must
956include a process by which the applicant will be assessed a fair
957share of the cost of mitigating the project's significant
958traffic impacts, as defined in chapter 380 and related rules.
959The agreement must also specify whether the significant traffic
960impacts on the interstate system will be mitigated through the
961implementation of a project or payment of funds to the
962Department of Transportation. Where funds are paid, the
963Department of Transportation must include in the 5-year work
964program transportation projects or project phases, in an amount
965equal to the funds received, to mitigate the traffic impacts
966associated with the proposed project.
967     Section 23.  Paragraph (h) of subsection (8) of section
968408.05, Florida Statutes, is amended to read:
969     408.05  Florida Center for Health Information and Policy
970Analysis.--
971     (8)  STATE CONSUMER HEALTH INFORMATION AND POLICY ADVISORY
972COUNCIL.--
973     (h)  The council's duties and responsibilities include, but
974are not limited to, the following:
975     1.  To develop a mission statement, goals, and a plan of
976action based on the guiding principles specified in s. 282.3032
977for the identification, collection, standardization, sharing,
978and coordination of health-related data across federal, state,
979and local government and private sector entities.
980     2.  To develop a review process to ensure cooperative
981planning among agencies that collect or maintain health-related
982data.
983     3.  To create ad hoc issue-oriented technical workgroups on
984an as-needed basis to make recommendations to the council.
985     Section 24.  Paragraph (b) of subsection (4) of section
986420.0003, Florida Statutes, is amended to read:
987     420.0003  State housing strategy.--
988     (4)  IMPLEMENTATION.--The Department of Community Affairs
989and the Florida Housing Finance Corporation in carrying out the
990strategy articulated herein shall have the following duties:
991     (b)  The agency strategic plan of the Department of
992Community Affairs, prepared pursuant to the provisions of ss.
993186.021 and 186.022, shall include specific goals, objectives,
994and strategies that implement the housing policies in this
995section and shall include the strategic plan for housing
996production prepared by the corporation pursuant to s. 420.511.
997     Section 25.  Subsection (2) of section 420.511, Florida
998Statutes, is amended to read:
999     420.511  Business plan; strategic plan; annual report.--
1000     (2)  The corporation, in equal partnership with the
1001department, shall develop annually a strategic plan for the
1002provision of affordable housing in Florida as part of the
1003department's agency strategic plan required pursuant to chapter
1004186. In part, the plan shall include provisions that maximize
1005the abilities of the corporation and the department to implement
1006the state housing strategy established under s. 420.0003, to
1007respond to federal housing initiatives, and to develop programs
1008in a manner that is more responsive to the needs of public and
1009private partners. The plan shall be developed on a schedule
1010consistent with that established by s. ss. 186.021 and 186.022.
1011For purposes of this act, the executive director or his or her
1012designee shall serve as the corporation's representative to
1013achieve a coordinated and integrated planning relationship with
1014the department.
1015     Section 26.  Subsection (3) of section 943.08, Florida
1016Statutes, is amended to read:
1017     943.08  Duties; Criminal and Juvenile Justice Information
1018Systems Council.--
1019     (3)  The council shall develop and approve a long-range
1020program strategic plan pursuant to the requirements set forth in
1021s. 186.021 s. 186.022. Copies of the approved plan shall be
1022transmitted, electronically or in writing, to the Executive
1023Office of the Governor, the Speaker of the House of
1024Representatives, the President of the Senate, and the council
1025members.
1026     Section 27.  Paragraph (a) of subsection (2) of section
10271001.26, Florida Statutes, is amended to read:
1028     1001.26  Public broadcasting program system.--
1029     (2)(a)  The Department of Education is responsible for
1030implementing the provisions of this section pursuant to s.
1031282.102 and may employ personnel, acquire equipment and
1032facilities, and perform all duties necessary for carrying out
1033the purposes and objectives of this section.
1034     Section 28.  For the 2007-2008 fiscal year, the sum of
1035$____ in recurring funds from the General Revenue Fund is
1036appropriated and __ full-time equivalent positions are
1037authorized to the Agency for Enterprise Information Technology
1038to carry out the activities as provided in this act.
1039     Section 29.  For the 2007-2008 fiscal year, the sum of
1040$____ in recurring funds from the General Revenue Fund is
1041appropriated and __ full-time equivalent positions are
1042authorized to the Agency for Enterprise Information Technology
1043to carry out the duties of information security as provided in
1044this act.
1045     Section 30.  The Agency for Enterprise Information
1046Technology, in collaboration with the Agency Chief Information
1047Officers Council, may implement a program to provide
1048professional development and training opportunities for agency
1049chief information officers. For the 2007-2008 fiscal year, the
1050sum of $____ in recurring funds from the General Revenue Fund is
1051appropriated to the Agency for Enterprise Information Technology
1052to implement this program.
1053     Section 31.  This act shall take effect July 1, 2007.


CODING: Words stricken are deletions; words underlined are additions.