CS/HB 1557

1	A bill to be entitled
2	An act relating to state information technology; creating
3	s. 14.204, F.S.; creating the Agency for Enterprise
4	Information Technology within the Executive Office of the
5	Governor; providing for the Governor and Cabinet to be the
6	head of the agency; requiring that the agency be a
7	separate budget entity that is not subject to the control
8	of the Executive Office of the Governor; providing for an
9	executive director of the agency to be subject to
10	confirmation by the Senate; providing for the executive
11	director to be the chief information officer of the state
12	and the executive sponsor for all enterprise information
13	technology projects; specifying the duties and
14	responsibilities of the agency, which include defining
15	architecture standards for information technology and
16	developing a strategic enterprise information technology
17	plan; requiring each state agency and the Agency Chief
18	Information Officers Council to participate in the
19	activities of the Agency for Enterprise Information
20	Technology; amending s. 20.22, F.S.; removing the State
21	Technology Office within the Department of Management
22	Services; providing for a technology program within the
23	department; amending s. 216.0446, F.S.; revising the
24	duties of the Technology Review Workgroup within the
25	Legislature to conform to the transfer of duties
26	concerning the management of information technology for
27	state agencies; amending s. 282.0041, F.S.; revising and
28	providing definitions; creating s. 282.0055, F.S.;
29	providing for the Agency for Enterprise Information
30	Technology to oversee information technology services that
31	are common to all executive branch agencies and for agency
32	information technology services to be responsible for
33	information technology within an individual state agency;
34	creating s. 282.0056, F.S.; requiring the Agency for
35	Enterprise Information Technology to develop a work plan;
36	requiring that the work plan be approved by the Governor
37	and Cabinet and submitted to the Legislature; requiring
38	that certain specified policies be included in the initial
39	work plan; requiring that the agency develop policy
40	recommendations and strategies for consolidating computer
41	rooms and data centers; requiring each state agency to
42	provide assistance in the development of the work plan
43	upon request; amending s. 282.20, F.S.; transferring
44	management of the Technology Resource Center from the
45	State Technology Office to the Department of Management
46	Services; revising the duties of the center to conform to
47	changes made by the act; requiring that the center submit
48	its service rates and cost-allocation plan to the Agency
49	for Enterprise Information Technology for review; amending
50	s. 282.3055, F.S.; revising the duties of the agency chief
51	information officers; amending s. 282.315, F.S.; revising
52	the duties of the Agency Chief Information Officers
53	Council; requiring that the council assist the Agency for
54	Enterprise Information Technology in developing strategies
55	for information technology services and projects and make
56	policy recommendations; revising the membership of the
57	council; providing for the appointment of a chair, vice
58	chair, and secretary; amending s. 282.318, F.S.; providing
59	duties of the Agency for Enterprise Information Technology
60	with respect to the security of data and information
61	technology resources; requiring state agencies to conduct
62	a comprehensive risk analysis at specified intervals,
63	develop and update internal policies and procedures, and
64	ensure compliance with certain security requirements;
65	requiring the Agency for Enterprise Information Technology
66	to designate a chief information security officer, develop
67	standards for risk analyses and security audits, and
68	provide training for agency information security managers;
69	providing rulemaking authority; deleting provisions
70	specifying duties of the Department of Management Services
71	to conform to changes made by the act; amending s.
72	282.322, F.S.; requiring that the Agency for Enterprise
73	Information Technology perform contract monitoring duties
74	formerly performed by the Enterprise Project Management
75	Office of the State Technology Office; amending s.
76	216.023, F.S.; requiring that certain legislative budget
77	requests include the statutory reference to the policy
78	requiring a new information technology project; amending
79	s. 943.0313, F.S., relating to the Domestic Security
80	Oversight Council; conforming terminology to changes made
81	by the act; providing for the transfer of specified duties
82	from the State Technology Office to the Department of
83	Management Services; repealing ss. 186.022, 282.005,
84	282.101, 282.23, 282.3031, 282.3032, 282.3063, 282.310,
85	and 287.057(24), F.S., relating to information technology
86	strategic plans, duties of the State Technology Office,
87	the State Strategic Information Technology Alliance,
88	information resources management responsibilities, guiding
89	principles, the Agency Annual Enterprise Resource Planning
90	and Management Report, the State Annual Report on
91	Enterprise Resource Planning and Management, and state
92	strategic information technology alliances; amending ss.
93	215.95, 215.96, 282.103, 282.107, 339.155, 381.90,
94	403.973, 408.05, 420.0003, 420.511, 943.08, and 1001.26,
95	F.S., relating to the Financial Management Information
96	Board and its coordination council, the SUNCOM Network,
97	transportation planning, the Health Information Systems
98	Council, expedited permitting, the Florida Center for
99	Health Information and Policy Analysis, the state housing
100	strategy and the Florida Housing Finance Corporation, the
101	Criminal and Juvenile Justice Information System Council,
102	and the public broadcasting program system; conforming
103	cross-references and other references to provisions
104	repealed by the act; providing an effective date.
105
106	Be It Enacted by the Legislature of the State of Florida:
107
108	Section 1.  Section 14.204, Florida Statutes, is created to
109	read:
110	14.204  Agency for Enterprise Information Technology.--The
111	Agency for Enterprise Information Technology is created within
112	the Executive Office of the Governor. The head of the agency
113	shall be the Governor and Cabinet, which shall take action by
114	majority vote consisting of at least three affirmative votes
115	with the Governor on the prevailing side. The agency shall be a
116	separate budget entity that is not subject to control,
117	supervision, or direction by the Executive Office of the
118	Governor in any manner, including, but not limited to,
119	purchasing, transactions involving real or personal property,
120	personnel, or budgetary matters.
121	(1)  The executive director of the agency shall be
122	appointed by the Governor and Cabinet, is subject to
123	confirmation by the Senate, and shall serve at the pleasure of
124	the Governor and Cabinet. The executive director shall be the
125	chief information officer of the state and the executive sponsor
126	for all enterprise information technology projects. The
127	executive director must have a degree from an accredited
128	postsecondary institution, and at least 7 years of executive-
129	level experience in managing information technology
130	organizations.
131	(2)  The agency shall have the following duties and
132	responsibilities:
133	(a)  Develop and implement strategies for the design,
134	delivery, and management of the enterprise information
135	technology services established in law.
136	(b)  Monitor the delivery and management of the enterprise
137	information technology services as established in law.
138	(c)  Make recommendations to the agency head and the
139	Legislature concerning other information technology services
140	that should be designed, delivered, and managed at the
141	enterprise level as defined in s. 282.0041(8).
142	(d)  Plan and establish policies for managing proposed
143	statutorily authorized enterprise information technology
144	services, which includes developing business cases that, when
145	applicable, include the components identified in s. 287.0574;
146	establishing and coordinating project-management teams;
147	establishing formal risk-assessment and mitigation processes;
148	and providing for independent monitoring of projects for
149	recommended corrective actions.
150	(e)  Not earlier than July 1, 2008, define the architecture
151	standards for enterprise information technology and develop
152	implementation approaches for statewide migration to those
153	standards.
154	(f)  Develop and publish a strategic enterprise information
155	technology plan that identifies and recommends strategies for
156	how enterprise information technology will deliver effective and
157	efficient government services to state residents and improve the
158	operations of state agencies.
159	(3)  The agency shall operate in such a manner as to ensure
160	participation and representation of state agencies and the
161	Agency Chief Information Officers Council established in s.
162	282.315.
163	Section 2.  Section 20.22, Florida Statutes, is amended to
164	read:
165	20.22  Department of Management Services.--There is created
166	a Department of Management Services.
167	(1)  The head of the Department of Management Services is
168	the Secretary of Management Services, who shall be appointed by
169	the Governor, subject to confirmation by the Senate, and shall
170	serve at the pleasure of the Governor.
171	(2)  The following divisions and programs within the
172	Department of Management Services are established:
173	(a)  Facilities Program.
174	(b)  Technology Program State Technology Office.
175	(c)  Workforce Program.
176	(d)1.  Support Program.
177	2.  Federal Property Assistance Program.
178	(e)  Administration Program.
179	(f)  Division of Administrative Hearings.
180	(g)  Division of Retirement.
181	(h)  Division of State Group Insurance.
182	(3)  The State Technology Office shall operate and manage
183	the Technology Resource Center.
184	(3)(4)  The duties of the Chief Labor Negotiator shall be
185	determined by the Secretary of Management Services, and must
186	include, but need not be limited to, the representation of the
187	Governor as the public employer in collective bargaining
188	negotiations pursuant to the provisions of chapter 447.
189	Section 3.  Section 216.0446, Florida Statutes, is amended
190	to read:
191	216.0446  Review of information technology resources
192	management needs.--
193	(1)  There is created within the Legislature the Technology
194	Review Workgroup. The workgroup and the State Technology Office
195	shall independently review and make recommendations with respect
196	to the portion of agencies' long-range program plans which
197	pertains to information technology resources management needs
198	and with respect to agencies' legislative budget requests for
199	information technology and related resources. The Technology
200	Review Workgroup shall report such recommendations, together
201	with the findings and conclusions on which such recommendations
202	are based, to the Legislative Budget Commission. The State
203	Technology Office shall report such recommendations, together
204	with the findings and conclusions on which such recommendations
205	are based, to the Executive Office of the Governor and to the
206	chairs of the legislative appropriations committees.
207	(2)  In addition to its primary duty specified in
208	subsection (1), the Technology Review Workgroup shall have
209	powers and duties that include, but are not limited to, the
210	following:
211	(a)  To evaluate the information technology resource
212	management needs identified in the agency long-range program
213	plans for consistency with the State Annual Report on Enterprise
214	Resource Planning and Management and statewide policies
215	recommended by the State Technology Office, and make
216	recommendations to the Legislative Budget Commission.
217	(b)  To review and make recommendations to the  Legislative
218	Budget Commission on proposed budget amendments and agency
219	transfers associated with information technology initiatives or
220	projects that involve more than one agency, that have an outcome
221	that impacts another agency, that exceed $500,000 in total cost
222	over a 1-year period, or that are requested by the Legislative
223	Budget Commission to be reviewed.
224	Section 4.  Section 282.0041, Florida Statutes, is amended
225	to read:
226	282.0041  Definitions.--For the purposes of this part, the
227	term:
228	(1)  "Agency" means those entities described in s.
229	216.011(1)(qq).
230	(2)  "Agency Annual Enterprise Resource Planning and
231	Management Report" means the report prepared by each Agency
232	Chief Information Officer as required by s. 282.3063.
233	(2)(3)  "Agency Chief Information Officer" means the person
234	appointed by the agency head State Technology Office to
235	coordinate and manage the information technology functions
236	policies and responsibilities activities applicable to that
237	agency and to participate and represent his or her agency in
238	developing strategies for implementing enterprise information
239	technology services identified in law and developing
240	recommendations for enterprise information technology policy.
241	(3)(4)  "Agency Chief Information Officers Council" means
242	the council created in s. 282.315 to facilitate the sharing and
243	coordination of information technology issues and initiatives
244	among the agencies.
245	(4)  "Agency for Enterprise Information Technology" means
246	the agency created in s. 14.204.
247	(5)  "Agency information technology service" means a
248	service that directly helps the agency fulfill its statutory or
249	constitutional responsibilities and policy objectives and is
250	usually associated with the agency's primary or core business
251	functions.
252	(6)  "Customer relationship management" or "C.R.M." means
253	the business processes, software, and Internet capabilities that
254	can help state agencies manage customer relationships of the
255	organization at the enterprise level.
256	(7)  "Enterprise level" means all executive branch agencies
257	created or authorized in statute to perform legislatively
258	delegated functions.
259	(8)  "Enterprise information technology service" means an
260	information technology service that is used in all agencies or a
261	subset of agencies and is established in law to be designed,
262	delivered, and managed at the enterprise level.
263	(9)  "E-mail, messaging, and calendaring service" means the
264	enterprise information technology service that enables users to
265	send, receive, file, store, manage, and retrieve electronic
266	messages, attachments, appointments, and addresses.
267	(5)  "Enterprise resources management infrastructure" means
268	the hardware, software, networks, data, human resources,
269	policies, standards, facilities, maintenance, and related
270	materials and services that are required to support the business
271	processes of an agency or state enterprise.
272	(6)  "Enterprise resource planning and management" means
273	the planning, budgeting, acquiring, developing, organizing,
274	directing, training, control, and related services associated
275	with government information technology. The term encompasses
276	information and related resources, as well as the controls
277	associated with their acquisition, development, dissemination,
278	and use.
279	(10)(7)  "Information technology" means equipment,
280	hardware, software, firmware, programs, systems, networks,
281	infrastructure, media, and related material used to
282	automatically, electronically, and wirelessly collect, receive,
283	access, transmit, display, store, record, retrieve, analyze,
284	evaluate, process, classify, manipulate, manage, assimilate,
285	control, communicate, exchange, convert, converge, interface,
286	switch, or disseminate information of any kind or form.
287	(11)  "Information technology policy" means statements that
288	describe clear choices for how information technology will
289	deliver effective and efficient government services to residents
290	and improve state agency operations. Such a policy may relate to
291	investments, business applications, architecture, or
292	infrastructure. A policy describes its rationale, implications
293	of compliance or noncompliance, the timeline for implementation,
294	metrics for determining compliance, and the accountable
295	structure responsible for its implementation.
296	(12)(8)  "Project" means an endeavor that has a defined
297	start and end point; is undertaken to create or modify a unique
298	product, service, or result; and has specific objectives that,
299	when attained, signify completion undertaking directed at the
300	accomplishment of a strategic objective relating to enterprise
301	resources management or a specific appropriated program.
302	(9)  "State Annual Report on Enterprise Resource Planning
303	and Management" means the report prepared by the State
304	Technology Office as defined in s. 282.102.
305	(13)(10)  "Standards" means the use of current, open,
306	nonproprietary, or non-vendor-specific technologies.
307	(11)  "State Technology Office" or "office" means the
308	office created in s. 282.102.
309	(14)(12)  "Total cost" means all costs associated with
310	information technology projects or initiatives, including, but
311	not limited to, value of hardware, software, service,
312	maintenance, incremental personnel, and facilities.  Total cost
313	of a loan or gift of information technology resources to an
314	agency includes the fair market value of the resources, except
315	that the total cost of loans or gifts of information technology
316	to state universities to be used in instruction or research does
317	not include fair market value.
318	Section 5.  Section 282.0055, Florida Statutes, is created
319	to read:
320	282.0055  Assignment of information technology.--In order
321	to ensure the most effective and efficient use of the state's
322	information technology and information technology resources and
323	notwithstanding other provisions of law to the contrary, the
324	design, planning, project management, and implementation of the
325	enterprise information technology services defined in s.
326	282.0041(8) shall be the responsibility of the Agency for
327	Enterprise Information Technology for executive branch agencies
328	created or authorized in statute to perform legislatively
329	delegated functions. The design, delivery, and management of the
330	agency information technology services defined in s. 282.0041(5)
331	shall be the responsibility of the individual state agency.
332	Section 6.  Section 282.0056, Florida Statutes, is created
333	to read:
334	282.0056  Development of work plan; development of
335	implementation plans; and policy recommendations.--
336	(1)  For purposes of carrying out its responsibilities set
337	forth in s. 282.0055, the Agency for Enterprise Information
338	Technology shall develop a work plan describing the activities
339	that the agency intends to undertake and the proposed outcomes.
340	The work plan must be approved by the Governor and Cabinet and
341	submitted to the President of the Senate and the Speaker of the
342	House of Representatives. The work plan may be amended as needed
343	to ensure that the enterprise information technology services
344	will be provided in an efficient, effective, and accountable
345	manner. For the 2007-2008 fiscal year, the agency's work plan
346	shall include the development of recommended enterprise
347	information technology policies, as defined in s. 282.0041(11).
348	(2)  For the fiscal year beginning in 2008-2009, the agency
349	shall develop implementation plans for up to three of the
350	following proposed enterprise information technology services to
351	be established in law:
352	(a)  Consolidation of the deployment, management, and
353	operation of state-owned or state-operated computer rooms and
354	data centers.
355	(b)  A shared or consolidated enterprise information
356	technology service delivery and support model for the e-mail,
357	messaging, and calendaring service defined in s. 282.0041(9).
358	(c)  Information security.
359	(d)  A shared customer relationship management system that
360	consolidates agency requirements for receiving, managing,
361	responding to, tracking, and reporting on telephone, e-mail,
362	personnel, and other communications received from citizens.
363	(e)  Consideration of a planned replacement cycle for
364	computer equipment.
365	(3)  In developing policy recommendations and
366	implementation plans for established and proposed enterprise
367	information technology services, the agency shall describe the
368	scope of operation, conduct costs and requirements analyses,
369	conduct an inventory of all existing information technology
370	resources that are associated with each service, and develop
371	strategies and timeframes for statewide migration. For purposes
372	of consolidating state-owned or state-operated computer rooms
373	and data centers, the Agency for Enterprise Information
374	Technology shall develop a migration plan prior to initiating
375	any consolidation effort.
376	(4)  For the purpose of completing its work activities,
377	each state agency shall provide to the Agency for Enterprise
378	Information Technology all requested information, including, but
379	not limited to, the agency's costs, service requirements, and
380	equipment inventories.
381	Section 7.  Section 282.20, Florida Statutes, is amended to
382	read:
383	282.20  Technology Resource Center.--
384	(1)(a)  The Department of Management Services State
385	Technology Office shall operate and manage the Technology
386	Resource Center.
387	(b)  For the purposes of this section, the term:
388	1.  "Information-system utility" means a full-service
389	information-processing facility offering hardware, software,
390	operations, integration, networking, and consulting services.
391	2.  "Customer" means a state agency or other entity which
392	is authorized to utilize the SUNCOM Network pursuant to this
393	part.
394	(2)  The Technology Resource Center shall:
395	(a)  Serve the office and other customers as an
396	information-system utility.
397	(b)  Cooperate with customers to offer, develop, and
398	support a wide range of services and applications needed by
399	users of the Technology Resource Center.
400	(c)  Cooperate with the Florida Legal Resource Center of
401	the Department of Legal Affairs and other state agencies to
402	develop and provide access to repositories of legal information
403	throughout the state.
404	(c)(d)  Cooperate with the Agency for Enterprise
405	Information Technology office to identify and facilitate
406	interdepartmental networking and integration of network services
407	for its customers.
408	(d)(e)  Assist customers in testing and evaluating new and
409	emerging technologies that could be used to meet the needs of
410	the state.
411	(3)  The department office may contract with customers to
412	provide any combination of services necessary for agencies to
413	fulfill their responsibilities and to serve their users.
414	(4)  The Technology Resource Center may plan, design,
415	establish pilot projects for, and conduct experiments with
416	information technology resources, and may implement enhancements
417	in services when such implementation is cost-effective. Funding
418	for experiments and pilot projects shall be derived from service
419	revenues and may not exceed 5 percent of the service revenues
420	for the Technology Resource Center for any single fiscal year.
421	Any experiment, pilot project, plan, or design must be approved
422	by the Agency for Enterprise Information Technology Chief
423	Information Officer.
424	(5)  Beginning in the 2007-2008 fiscal year and annually
425	thereafter, the Technology Resource Center shall submit to the
426	Agency for Enterprise Information Technology for its review a
427	copy of its current and proposed services and service rates and
428	cost-allocation plan. When appropriate, the Agency for
429	Enterprise Information Technology shall request review and
430	comment from the customers and Agency Chief Information Officers
431	Council concerning the center's current and proposed rate and
432	services structure.
433	(5)  Notwithstanding the provisions of s. 216.272, the
434	Technology Resource Center may spend funds in the reserve
435	account of the Technology Enterprise Operating Trust Fund for
436	enhancements to center operations or for information technology
437	resources. Any expenditure of reserve account funds must be
438	approved by the Chief Information Officer. Any funds remaining
439	in the reserve account at the end of the fiscal year may be
440	carried forward and spent as approved by the Chief Information
441	Officer, provided that such approval conforms to any applicable
442	provisions of chapter 216.
443	Section 8.  Section 282.3055, Florida Statutes, is amended
444	to read:
445	282.3055  Agency chief information officer; appointment;
446	duties.--
447	(1)(a)  Each agency head shall To assist the State
448	Technology Officer in carrying out the enterprise resource
449	planning and management responsibilities, the Chief Information
450	Officer may appoint or contract for an agency chief information
451	officer. This position may be full time or part time.
452	(b)  The agency chief information officer must, at a
453	minimum, have knowledge and experience in both management and
454	information technology resources.
455	(2)  The duties of the agency chief information officer
456	include, but are not limited to:
457	(a)  Coordinating and facilitating the agency enterprise
458	resource planning and management of agency information
459	technology services projects and initiatives.
460	(b)  Preparing an agency annual report on enterprise
461	resource planning and management pursuant to s. 282.3063.
462	(b)(c)  Developing and Implementing agency information
463	technology enterprise resource planning and management policies,
464	procedures, guidelines, and standards that are consistent with
465	the procedures and standards adopted by the Agency for
466	Enterprise Information Technology, including specific policies
467	and procedures for review and approval of the agency's purchases
468	of information technology resources in accordance with the
469	office's policies and procedures.
470	(c)(d)  Advising agency senior management as to the
471	information technology enterprise resource planning and
472	management needs of the agency for inclusion in planning
473	documents required by law.
474	(d)(e)  Assisting in the development and prioritization of
475	the information technology enterprise resource needs for
476	planning and management schedule of the agency's legislative
477	budget request.
478	(e)  Assisting the Agency for Enterprise Information
479	Technology in the development of strategies for implementing the
480	enterprise information technology services established in law
481	and developing recommendations for enterprise information
482	technology policy.
483	Section 9.  Section 282.315, Florida Statutes, is amended
484	to read:
485	282.315  Agency Chief Information Officers Council;
486	creation.--The Legislature finds that enhancing communication,
487	consensus building, coordination, and facilitation with respect
488	to issues concerning of statewide enterprise information
489	technology resources are resource planning and management issues
490	is essential to improving the state management of such
491	resources.
492	(1)  There is created an Agency Chief Information Officers
493	Council to:
494	(a)  Enhance communication and collaboration among the
495	Agency Chief Information Officers and the Agency for Enterprise
496	Information Technology by sharing enterprise resource planning
497	and management experiences and exchanging ideas.
498	(b)  Identify and recommend Facilitate the sharing of best
499	practices that are characteristic of highly successful
500	technology organizations, as well as exemplary information
501	technology applications for use by of state agencies, and assist
502	the Agency for Enterprise Information Technology in developing
503	strategies for implementing the enterprise information
504	technology services established in law and developing
505	recommendations for enterprise information technology policy.
506	(c)  Identify efficiency opportunities among state agencies
507	and make recommendations for action to the Agency for Enterprise
508	Information Technology.
509	(d)  Serve as an educational forum for enterprise resource
510	planning and management issues.
511	(d)(e)  Assist the Agency for Enterprise Information
512	Technology State Technology Office in identifying critical
513	enterprise information technology statewide issues and, when
514	appropriate, make recommendations for solving enterprise
515	resource planning and management deficiencies.
516	(2)  Members of the council shall include the Agency Chief
517	Information Officers, including the Chief Information Officers
518	of the agencies and governmental entities enumerated in s.
519	282.3031, except that there shall be one Chief Information
520	Officer selected by the state attorneys and one Chief
521	Information Officer selected by the public defenders. The
522	council shall appoint a chair, vice chair, and secretary from
523	among its members to a 1-year term each. The council shall
524	establish procedures governing council business. The chairs, or
525	their designees, of the Florida Financial Management Information
526	System Coordinating Council, the Criminal and Juvenile Justice
527	Information Systems Council, and the Health Information Systems
528	Council shall represent their respective organizations on the
529	Chief Information Officers Council as voting members.
530	(3)  The Agency for Enterprise Information Technology State
531	Technology Office shall provide administrative support to the
532	council.
533	Section 10.  Section 282.318, Florida Statutes, is amended
534	to read:
535	282.318  Security of data and information technology
536	resources.--
537	(1)  This section may be cited as the "Security of Data and
538	Information Technology Infrastructure Resources Act."
539	(2)(a)  The Agency for Enterprise Information Technology
540	State Technology Office, in consultation with each agency head,
541	is responsible and accountable for assessing and recommending
542	minimum operating procedures for ensuring assuring an adequate
543	level of security for all data and information technology
544	resources for executive branch agencies created or authorized in
545	statute to perform legislatively delegated functions. To assist
546	the agency in carrying out this responsibility, of each agency
547	head and, to carry out this responsibility, shall, at a minimum:
548	1.  Designate an information security manager who shall
549	administer the security program of the each agency for its data
550	and information technology resources.
551	2.  Conduct, and periodically update every 3 years, a
552	comprehensive risk analysis to determine the security threats to
553	the data, information, and information technology resources of
554	the each agency. The risk analysis information is confidential
555	and exempt from the provisions of s. 119.07(1), except that such
556	information shall be available to the Auditor General and the
557	Agency for Enterprise Information Technology in performing his
558	or her postauditing duties.
559	3.  Develop, and periodically update, written internal
560	policies and procedures, which shall include procedures for
561	notifying the Agency for Enterprise Information Technology when
562	an information security incident occurs or data is compromised.
563	Such policies and procedures must be consistent with the
564	standard operating procedures adopted by the Agency for
565	Enterprise Information Technology in order to ensure to assure
566	the security of the data, information, and information
567	technology resources of the each agency. The internal policies
568	and procedures that which, if disclosed, could facilitate the
569	unauthorized modification, disclosure, or destruction of data or
570	information technology resources are confidential information
571	and exempt from the provisions of s. 119.07(1), except that such
572	information shall be available to the Auditor General and the
573	Agency for Enterprise Information Technology in performing his
574	or her postauditing duties.
575	4.  Implement appropriate cost-effective safeguards to
576	reduce, eliminate, or recover from the identified risks to the
577	data, information, and information technology resources of the
578	each agency.
579	5.  Ensure that periodic internal audits and evaluations of
580	the agency's each security program for the data, information,
581	and information technology resources of the agency are
582	conducted. The results of such internal audits and evaluations
583	are confidential information and exempt from the provisions of
584	s. 119.07(1), except that such information shall be available to
585	the Auditor General and the Agency for Enterprise Information
586	Technology in performing his or her postauditing duties.
587	6.  Include appropriate security requirements, as
588	determined by the State Technology Office, in consultation with
589	each agency head, in the written specifications for the
590	solicitation of information technology and information
591	technology resources which are consistent with the standard
592	security operating procedures adopted by the Agency for
593	Enterprise Information Technology.
594	(b)  In those instances under this subsection in which the
595	state agency or department State Technology Office develops
596	state contracts for use by state agencies, the state agency or
597	department office shall include appropriate security
598	requirements in the specifications for the solicitation for
599	state contracts for procuring information technology or
600	information technology resources.
601	(3)  The Agency for Enterprise Information Technology shall
602	designate a chief information security officer.
603	(4)  The Agency for Enterprise Information Technology shall
604	develop standards and templates for conducting comprehensive
605	risk analyses and information security audits by state agencies,
606	assist agencies in their compliance with the provisions of this
607	section, pursue appropriate funding provided for the purpose of
608	enhancing domestic security, establish minimum guidelines and
609	procedures for the recovery of information technology following
610	a disaster, and provide training for agency information security
611	managers. Standards, templates, guidelines, and procedures shall
612	be published annually, no later than September 30 each year, to
613	enable agencies to incorporate them in their planning for the
614	following fiscal year.
615	(5)  The Agency for Enterprise Information Technology may
616	adopt rules pursuant to ss. 120.536(1) and 120.54 relating to
617	information security and to administer the provisions of this
618	section.
619	(3)  Notwithstanding subsection (2), the Department of
620	Management Services, hereafter referred to as the "department,"
621	in consultation with each agency head, is responsible for
622	coordinating, assessing, and recommending minimum operating
623	procedures for ensuring an adequate level of security for data
624	and information technology resources. To assist the department
625	in carrying out this responsibility, each agency shall, at a
626	minimum:
627	(a)  Designate an information security manager who shall
628	administer the security program of the agency for its data and
629	information technology resources.
630	(b)  Conduct, and update every 3 years, a comprehensive
631	risk analysis to determine the security threats to the data,
632	information, and information technology resources of the agency.
633	The risk analysis information made confidential and exempt under
634	subparagraph (2)(a)2. shall be available to the Auditor General
635	in performing his or her postauditing duties.
636	(c)  Develop, and periodically update, written internal
637	policies and procedures that are consistent with the standard
638	operating procedures recommended by the department to ensure the
639	security of the data and information technology resources of the
640	agency. The internal policies and procedures that, if disclosed,
641	could facilitate the unauthorized modification, disclosure, or
642	destruction of data or information technology resources made
643	confidential and exempt under subparagraph (2)(a)3. shall be
644	available to the Auditor General in performing his or her
645	postauditing duties.
646	(d)  Implement appropriate cost-effective safeguards to
647	reduce, eliminate, or recover from the identified risks to the
648	data and information technology resources of the agency.
649	(e)  Ensure that periodic internal audits and evaluations
650	of the security program for the data, information, and
651	information technology resources of the agency are conducted.
652	The results of such internal audits and evaluations made
653	confidential and exempt under subparagraph (2)(a)5. shall be
654	available to the Auditor General in performing his or her
655	postauditing duties.
656	(f)  Include appropriate security requirements in the
657	written specifications for the solicitation of information
658	technology resources that are consistent with the standard
659	security operating procedures as recommended by the department.
660	(g)  This subsection expires July 1, 2007.
661
662	In those instances under this subsection in which the department
663	develops state contracts for use by state agencies, the
664	department shall include appropriate security requirements in
665	the specifications for the solicitation for state contracts for
666	procuring information technology resources.
667	(4)  In order to ensure the security of data, information,
668	and information technology resources, the department shall
669	establish the Office of Information Security and shall designate
670	a Chief Information Security Officer as the head of the office.
671	The office shall coordinate its activities with the Agency Chief
672	Information Officers Council as established in s. 282.315. The
673	office is responsible for developing a strategic plan for
674	information technology security which shall be submitted by
675	March 1, 2007, to the Executive Office of the Governor, the
676	President of the Senate, and the Speaker of the House of
677	Representatives; developing standards and templates for
678	conducting comprehensive risk analyses and information security
679	audits by state agencies; assisting agencies in their compliance
680	with the provisions of this section; establishing minimum
681	standards for the recovery of information technology following a
682	disaster; and conducting training for agency information
683	security managers. This subsection expires July 1, 2007.
684	Section 11.  Subsection (2) of section 282.322, Florida
685	Statutes, is amended to read:
686	282.322  Special monitoring process for designated
687	information resources management projects.--
688	(2)  The Agency for Enterprise Information Technology
689	Project Management Office of the State Technology Office shall
690	report on any information technology project that the
691	Legislature projects the office identifies as high-risk to the
692	Executive Office of the Governor, the President of the Senate,
693	the Speaker of the House of Representatives, and the chairs of
694	the appropriations committees. Within the limits of current
695	appropriations, the Agency for Enterprise Information Technology
696	Project Management Office shall monitor and report on such high-
697	risk information technology projects, and assess the levels of
698	risks associated with proceeding to the next stage of the
699	project.
700	Section 12.  Paragraph (a) of subsection (4) of section
701	216.023, Florida Statutes, is amended to read:
702	216.023  Legislative budget requests to be furnished to
703	Legislature by agencies.--
704	(4)(a)  The legislative budget request must contain for
705	each program:
706	1.  The constitutional or statutory authority for a
707	program, a brief purpose statement, and approved program
708	components.
709	2.  Information on expenditures for 3 fiscal years (actual
710	prior-year expenditures, current-year estimated expenditures,
711	and agency budget requested expenditures for the next fiscal
712	year) by appropriation category.
713	3.  Details on trust funds and fees.
714	4.  The total number of positions (authorized, fixed, and
715	requested).
716	5.  An issue narrative describing and justifying changes in
717	amounts and positions requested for current and proposed
718	programs for the next fiscal year.
719	6.  Information resource requests.
720	7.  Supporting information, including applicable cost-
721	benefit analyses, business case analyses, performance
722	contracting procedures, service comparisons, and impacts on
723	performance standards for any request to outsource or privatize
724	agency functions. The cost-benefit and business case analyses
725	must include an assessment of the impact on each affected
726	activity from those identified in accordance with paragraph (b).
727	Performance standards must include standards for each affected
728	activity and be expressed in terms of the associated unit of
729	activity.
730	8.  An evaluation of any major outsourcing and
731	privatization initiatives undertaken during the last 5 fiscal
732	years having aggregate expenditures exceeding $10 million during
733	the term of the contract. The evaluation shall include an
734	assessment of contractor performance, a comparison of
735	anticipated service levels to actual service levels, and a
736	comparison of estimated savings to actual savings achieved.
737	Consolidated reports issued by the Department of Management
738	Services may be used to satisfy this requirement.
739	9.  Supporting information for any proposed consolidated
740	financing of deferred-payment commodity contracts including
741	guaranteed energy performance savings contracts.  Supporting
742	information must also include narrative describing and
743	justifying the need, baseline for current costs, estimated cost
744	savings, projected equipment purchases, estimated contract
745	costs, and return on investment calculation.
746	10.  For projects that exceed $10 million in total cost,
747	the statutory reference of the existing policy or the proposed
748	substantive policy that establishes and defines the project's
749	governance structure, scope, main business objectives that must
750	be achieved, and completion timeframes. Information technology
751	budget requests for the continuance of existing hardware and
752	software maintenance agreements, renewal of existing software
753	licensing agreements, or the replacement of desktop units with
754	new technology that is similar to the technology currently in
755	use are exempt from this requirement.
756	Section 13.  Paragraph (a) of subsection (1) of section
757	943.0313, Florida Statutes, is amended to read:
758	943.0313  Domestic Security Oversight Council.--The
759	Legislature finds that there exists a need to provide executive
760	direction and leadership with respect to terrorism prevention,
761	preparation, protection, response, and recovery efforts by state
762	and local agencies in this state. In recognition of this need,
763	the Domestic Security Oversight Council is hereby created. The
764	council shall serve as an advisory council pursuant to s.
765	20.03(7) to provide guidance to the state's regional domestic
766	security task forces and other domestic security working groups
767	and to make recommendations to the Governor and the Legislature
768	regarding the expenditure of funds and allocation of resources
769	related to counter-terrorism and domestic security efforts.
770	(1)  MEMBERSHIP.--
771	(a)  The Domestic Security Oversight Council shall consist
772	of the following voting members:
773	1.  The executive director of the Department of Law
774	Enforcement.
775	2.  The director of the Division of Emergency Management
776	within the Department of Community Affairs.
777	3.  The Attorney General.
778	4.  The Commissioner of Agriculture.
779	5.  The Secretary of Health.
780	6.  The Commissioner of Education.
781	7.  The State Fire Marshal.
782	8.  The adjutant general of the Florida National Guard.
783	9.  The state chief information officer of the State
784	Technology Office within the Department of Management Services.
785	10.  Each sheriff or chief of police who serves as a co-
786	chair of a regional domestic security task force pursuant to s.
787	943.0312(1)(b).
788	11.  Each of the department's special agents in charge who
789	serve as a co-chair of a regional domestic security task force.
790	12.  Two representatives of the Florida Fire Chiefs
791	Association.
792	13.  One representative of the Florida Police Chiefs
793	Association.
794	14.  One representative of the Florida Prosecuting
795	Attorneys Association.
796	15.  The chair of the Statewide Domestic Security
797	Intelligence Committee.
798	16.  One representative of the Florida Hospital
799	Association.
800	17.  One representative of the Emergency Medical Services
801	Advisory Council.
802	18.  One representative of the Florida Emergency
803	Preparedness Association.
804	19.  One representative of the Florida Seaport
805	Transportation and Economic Development Council.
806	Section 14.  Unless otherwise specified in this act, the
807	Department of Management Services, established in s. 20.22,
808	Florida Statutes, shall assume the duties and responsibilities
809	of the State Technology Office as set forth in ss. 215.322(2),
810	282.102, 282.103, 282.104, 282.105, 282.106, 282.107, 282.1095,
811	282.111, 282.21, 282.22, 288.1092, 288.1093, 365.171, 365.172,
812	and 365.173, Florida Statutes.
813	Section 15.  Sections 186.022, 282.005, 282.101, 282.23,
814	282.3031, 282.3032, 282.3063, and 282.310, Florida Statutes, and
815	subsection (24) of section 287.057, Florida Statutes, are
816	repealed.
817	Section 16.  Paragraph (d) of subsection (2) of section
818	215.95, Florida Statutes, is amended to read:
819	215.95  Financial Management Information Board.--
820	(2)  To carry out its duties and responsibilities, the
821	board shall by majority vote:
822	(d)  By March 1 of each year, approve a strategic plan
823	pursuant to the requirements set forth in s. 186.022(9).
824	Section 17.  Paragraph (a) of subsection (3) of section
825	215.96, Florida Statutes, is amended to read:
826	215.96  Coordinating council and design and coordination
827	staff.--
828	(3)  The coordinating council, assisted by the design and
829	coordination staff, shall have the following duties, powers, and
830	responsibilities pertaining to the Florida Financial Management
831	Information System:
832	(a)  To conduct such studies and to establish committees,
833	workgroups, and teams to develop recommendations for rules,
834	policies, procedures, principles, and standards to the board as
835	necessary to assist the board in its efforts to design,
836	implement, and perpetuate a financial management information
837	system, including, but not limited to, the establishment of
838	common data codes, and the development of integrated financial
839	management policies that address the information and management
840	needs of the functional owner subsystems, and the development of
841	a strategic plan pursuant to the requirements set forth in s.
842	186.022. The coordinating council shall make available a copy of
843	the approved plan in writing or through electronic means to each
844	of the coordinating council members, the fiscal committees of
845	the Legislature, and any interested person.
846	Section 18.  Subsection (1) of section 282.103, Florida
847	Statutes, is amended to read:
848	282.103  SUNCOM Network; exemptions from the required
849	use.--
850	(1)  There is created within the Department of Management
851	Services State Technology Office the SUNCOM Network which shall
852	be developed to serve as the state communications system for
853	providing local and long-distance communications services to
854	state agencies, political subdivisions of the state,
855	municipalities, state universities, and nonprofit corporations
856	pursuant to ss. 282.102-282.111 ss. 282.101-282.111. The SUNCOM
857	Network shall be developed to transmit all types of
858	communications signals, including, but not limited to, voice,
859	data, video, image, and radio. State agencies shall cooperate
860	and assist in the development and joint use of communications
861	systems and services.
862	Section 19.  Subsections (1) and (2) of section 282.107,
863	Florida Statutes, are amended to read:
864	282.107  SUNCOM Network; criteria for usage.--
865	(1)  The Department of Management Services State Technology
866	Office shall periodically review the qualifications of
867	subscribers using the state SUNCOM Network and shall terminate
868	services provided to any facility not qualified pursuant to ss.
869	282.102-282.111 ss. 282.101-282.111 or rules adopted hereunder.
870	In the event of nonpayment of invoices by subscribers whose
871	SUNCOM Network invoices are paid from sources other than
872	legislative appropriations, such nonpayment represents good and
873	sufficient reason to terminate service.
874	(2)  The Department of Management Services State Technology
875	Office shall adopt rules for implementing and operating the
876	state SUNCOM Network, which shall include setting forth its
877	procedures for withdrawing and restoring authorization to use
878	the state SUNCOM Network. Such rules shall provide a minimum of
879	30 days' notice to affected parties prior to termination of
880	voice communications service.
881	Section 20.  Paragraph (b) of subsection (3) and subsection
882	(4) of section 339.155, Florida Statutes, are amended to read:
883	339.155  Transportation planning.--
884	(3)  FORMAT, SCHEDULE, AND REVIEW.--The Florida
885	Transportation Plan shall be a unified, concise planning
886	document that clearly defines the state's long-range
887	transportation goals and objectives and documents the
888	department's short-range objectives developed to further such
889	goals and objectives. The plan shall include a glossary that
890	clearly and succinctly defines any and all phrases, words, or
891	terms of art included in the plan, with which the general public
892	may be unfamiliar and shall consist of, at a minimum, the
893	following components:
894	(b)  A short-range component documenting the short-term
895	objectives and strategies necessary to implement the goals and
896	long-term objectives contained in the long-range component. The
897	short-range component must define the relationship between the
898	long-range goals and the short-range objectives, specify those
899	objectives against which the department's achievement of such
900	goals will be measured, and identify transportation strategies
901	necessary to efficiently achieve the goals and objectives in the
902	plan. It must provide a policy framework within which the
903	department's legislative budget request, the strategic
904	information resource management plan, and the work program are
905	developed. The short-range component shall serve as the
906	department's annual agency strategic plan pursuant to s.
907	186.021. The short-range component shall be developed consistent
908	with the requirements of s. 186.022 and consistent with
909	available and forecasted state and federal funds. In addition to
910	those entities listed in s. 186.022, The short-range component
911	shall also be submitted to the Florida Transportation
912	Commission.
913	(4)  ANNUAL PERFORMANCE REPORT.--The department shall
914	develop an annual performance report evaluating the operation of
915	the department for the preceding fiscal year. The report, which
916	shall meet the requirements of s. 186.022, shall also include a
917	summary of the financial operations of the department and shall
918	annually evaluate how well the adopted work program meets the
919	short-term objectives contained in the short-range component of
920	the Florida Transportation Plan. In addition to the entities
921	listed in s. 186.022, This performance report shall also be
922	submitted to the Florida Transportation Commission and the
923	legislative appropriations and transportation committees.
924	Section 21.  Subsection (7) of section 381.90, Florida
925	Statutes, is amended to read:
926	381.90  Health Information Systems Council; legislative
927	intent; creation, appointment, duties.--
928	(7)  The council's duties and responsibilities include, but
929	are not limited to, the following:
930	(a)  By June 1 of each year, to develop and approve a
931	strategic plan pursuant to the requirements set forth in s.
932	186.022.
933	(a)(b)  To develop a mission statement, goals, and plan of
934	action, based on the guiding principles specified in s.
935	282.3032, for the identification, collection, standardization,
936	sharing, and coordination of health-related data across federal,
937	state, and local government and private-sector entities.
938	(b)(c)  To develop a review process to ensure cooperative
939	planning among agencies that collect or maintain health-related
940	data.
941	(c)(d)  To create ad hoc issue-oriented technical
942	workgroups, on an as-needed basis, to make recommendations to
943	the council.
944	Section 22.  Subsection (4) of section 403.973, Florida
945	Statutes, is amended to read:
946	403.973  Expedited permitting; comprehensive plan
947	amendments.--
948	(4)  The office may delegate to a Quick Permitting County
949	designated under s. 288.1093 the responsibility for convening
950	regional permit teams and, in consultation with the office, for
951	certifying as eligible for expedited review projects that meet
952	the criteria of subsection (3) and that are consistent with the
953	economic goals of the county. In order to receive such a
954	delegation, the Quick Permitting County must hold the public
955	hearing required under subsection (7) and agree to execute a
956	memorandum of agreement for each qualified project.
957	Section 23.  Paragraph (h) of subsection (8) of section
958	408.05, Florida Statutes, is amended to read:
959	408.05  Florida Center for Health Information and Policy
960	Analysis.--
961	(8)  STATE CONSUMER HEALTH INFORMATION AND POLICY ADVISORY
962	COUNCIL.--
963	(h)  The council's duties and responsibilities include, but
964	are not limited to, the following:
965	1.  To develop a mission statement, goals, and a plan of
966	action based on the guiding principles specified in s. 282.3032
967	for the identification, collection, standardization, sharing,
968	and coordination of health-related data across federal, state,
969	and local government and private sector entities.
970	2.  To develop a review process to ensure cooperative
971	planning among agencies that collect or maintain health-related
972	data.
973	3.  To create ad hoc issue-oriented technical workgroups on
974	an as-needed basis to make recommendations to the council.
975	Section 24.  Paragraph (b) of subsection (4) of section
976	420.0003, Florida Statutes, is amended to read:
977	420.0003  State housing strategy.--
978	(4)  IMPLEMENTATION.--The Department of Community Affairs
979	and the Florida Housing Finance Corporation in carrying out the
980	strategy articulated herein shall have the following duties:
981	(b)  The agency strategic plan of the Department of
982	Community Affairs, prepared pursuant to the provisions of ss.
983	186.021 and 186.022, shall include specific goals, objectives,
984	and strategies that implement the housing policies in this
985	section and shall include the strategic plan for housing
986	production prepared by the corporation pursuant to s. 420.511.
987	Section 25.  Subsection (2) of section 420.511, Florida
988	Statutes, is amended to read:
989	420.511  Business plan; strategic plan; annual report.--
990	(2)  The corporation, in equal partnership with the
991	department, shall develop annually a strategic plan for the
992	provision of affordable housing in Florida as part of the
993	department's agency strategic plan required pursuant to chapter
994	186. In part, the plan shall include provisions that maximize
995	the abilities of the corporation and the department to implement
996	the state housing strategy established under s. 420.0003, to
997	respond to federal housing initiatives, and to develop programs
998	in a manner that is more responsive to the needs of public and
999	private partners. The plan shall be developed on a schedule
1000	consistent with that established by s. ss. 186.021 and 186.022.
1001	For purposes of this act, the executive director or his or her
1002	designee shall serve as the corporation's representative to
1003	achieve a coordinated and integrated planning relationship with
1004	the department.
1005	Section 26.  Subsection (3) of section 943.08, Florida
1006	Statutes, is amended to read:
1007	943.08  Duties; Criminal and Juvenile Justice Information
1008	Systems Council.--
1009	(3)  The council shall develop and approve a long-range
1010	program strategic plan pursuant to the requirements set forth in
1011	s. 186.021 s. 186.022. Copies of the approved plan shall be
1012	transmitted, electronically or in writing, to the Executive
1013	Office of the Governor, the Speaker of the House of
1014	Representatives, the President of the Senate, and the council
1015	members.
1016	Section 27.  Paragraph (a) of subsection (2) of section
1017	1001.26, Florida Statutes, is amended to read:
1018	1001.26  Public broadcasting program system.--
1019	(2)(a)  The Department of Education is responsible for
1020	implementing the provisions of this section pursuant to s.
1021	282.102 and may employ personnel, acquire equipment and
1022	facilities, and perform all duties necessary for carrying out
1023	the purposes and objectives of this section.
1024	Section 28.  This act shall take effect July 1, 2007.

CODING: Words stricken are deletions; words underlined are additions.