Rep. Norm Thurston — Voting Record

Bill

Number

H.B. 65 (2023GS)

Sponsor

Rep. Stenquist, J.

Final action

Governor Signed 3/13/2023

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• defines terms;
• modifies and clarifies duties of the Division of Technology Services in relation to procurement, contract management, and security assessment; and
• makes technical and conforming changes.

Every vote on this bill

Bill text

DIVISION OF TECHNOLOGY SERVICES AMENDMENTS
GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Jeffrey D. Stenquist
Senate Sponsor: 
Stephanie Pitcher
LONG TITLE
General Description:
This bill modifies provisions relating to the Division of Technology Services.
Highlighted Provisions:
This bill:
▸ defines terms;
▸ modifies and clarifies duties of the Division of Technology Services in relation to
procurement, contract management, and security assessment; and
▸ makes technical and conforming changes.
Money Appropriated in this Bill:
None
Other Special Clauses:
None
Utah Code Sections Affected:
AMENDS:
63A-16-104
, as last amended by Laws of Utah 2022, Chapter 169
63A-16-201
, as last amended by Laws of Utah 2022, Chapter 169
63A-16-205
, as last amended by Laws of Utah 2022, Chapter 169
63G-6a-303
, as last amended by Laws of Utah 2022, Chapter 421
RENUMBERS AND AMENDS:
63G-6a-109.5
, (Renumbered from 63A-16-204, as renumbered and amended by Laws
of Utah 2021, Chapter 344)
Be it enacted by the Legislature of the state of Utah:
Section 1. Section 
63A-16-104
 is amended to read:
63A-16-104.
Duties of division.
The division shall:
(1) lead state executive branch agency efforts to establish and reengineer the state's
information technology architecture with the goal of coordinating central and individual agency
information technology in a manner that:
(a) ensures compliance with the executive branch agency strategic plan; and
(b) ensures that cost-effective, efficient information and communication systems and
resources are being used by agencies to:
(i) reduce data, hardware, and software redundancy;
(ii) improve system interoperability and data accessibility between agencies; and
(iii) meet the agency's and user's business and service needs;
(2) coordinate an executive branch strategic plan for all agencies;
(3) develop and implement processes to replicate information technology best practices
and standards throughout the executive branch;
(4) [
at least once every odd-numbered year
] 
once every three years
:
(a) 
conduct an information technology security assessment via an independent third
party:
(i) to
 evaluate the adequacy of the division's and the executive branch agencies' data
and information technology system security standards [
through an independent third party
assessment
]; and
(ii) that will be completed over a period that does not exceed two years; and
(b) communicate the results of the [
independent third party
] assessment 
described in
Subsection (4)(a) 
to the appropriate executive branch agencies and to the president of the
Senate and the speaker of the House of Representatives;
(5) [
oversee the expanded use and implementation of
] 
subject to Subsection
63G-6a-109.5
(9):
(a) advise executive branch agencies on
 project and contract management principles as
they relate to information technology projects within the executive branch; 
and
(b) approve the acquisition of technology services and products by executive branch
agencies as required under Section 
63G-6a-109.5
;
[
(6) serve as general contractor between the state's information technology users and
private sector providers of information technology products and services;
]
[
(7)
] 
(6)
 work toward building stronger partnering relationships with providers;
[
(8)
] 
(7)
 develop service level agreements with executive branch departments and
agencies to ensure quality products and services are delivered on schedule and within budget;
[
(9)
] 
(8)
 develop standards for application development including a standard
methodology and cost-benefit analysis that all agencies shall utilize for application
development activities;
[
(10)
] 
(9)
 determine and implement statewide efforts to standardize data elements;
[
(11)
] 
(10)
 coordinate with executive branch agencies to provide basic website
standards for agencies that address common design standards and navigation standards,
including:
(a) accessibility for individuals with disabilities in accordance with:
(i) the standards of 29 U.S.C. Sec. 794d; and
(ii) Section 
63A-16-209
;
(b) consistency with standardized government security standards;
(c) designing around user needs with data-driven analysis influencing management and
development decisions, using qualitative and quantitative data to determine user goals, needs,
and behaviors, and continual testing of the website, web-based form, web-based application, or
digital service to ensure that user needs are addressed;
(d) providing users of the website, web-based form, web-based application, or digital
service with the option for a more customized digital experience that allows users to complete
digital transactions in an efficient and accurate manner; and
(e) full functionality and usability on common mobile devices;
[
(12)
] 
(11)
 consider, when making a purchase for an information system, cloud
computing options, including any security benefits, privacy, data retention risks, and cost
savings associated with cloud computing options;
[
(13)
] 
(12)
 develop systems and methodologies to review, evaluate, and prioritize
existing information technology projects within the executive branch and report to the governor
and the Government Operations Interim Committee in accordance with Section 
63A-16-201
 on
a semiannual basis regarding the status of information technology projects;
[
(14)
] 
(13)
 assist the Governor's Office of Planning and Budget with the development
of information technology budgets for agencies;
[
(15)
] 
(14)
 ensure that any training or certification required of a public official or
public employee, as those terms are defined in Section 
63G-22-102
, complies with Title 63G,
Chapter 22, State Training and Certification Requirements, if the training or certification is
required:
(a) under this chapter;
(b) by the department; or
(c) by the division;
[
(16)
] 
(15)
 provide support to executive branch agencies for the information
technology assets and functions that are unique to the agency and are mission critical functions
of the agency;
[
(17)
] 
(16)
 provide in-house information technology staff support to executive branch
agencies;
[
(18)
] 
(17)
 establish a committee composed of agency user groups to coordinate
division services with agency needs;
[
(19)
] 
(18)
 assist executive branch agencies in complying with the requirements of any
rule made by the chief information officer;
[
(20)
] 
(19)
 develop and implement an effective enterprise architecture governance
model for the executive branch;
[
(21)
] 
(20)
 provide oversight of information technology projects that impact statewide
information technology services, assets, or functions of state government to:
(a) control costs;
(b) ensure business value to a project;
(c) maximize resources;
(d) ensure the uniform application of best practices; and
(e) avoid duplication of resources;
[
(22)
] 
(21)
 develop a method of accountability to agencies for services provided by the
department through service agreements with the agencies;
[
(23)
] 
(22)
 serve as a project manager for enterprise architecture, including
management of applications, standards, and procurement of enterprise architecture;
[
(24)
] 
(23)
 coordinate the development and implementation of advanced state
telecommunication systems;
[
(25)
] 
(24)
 provide services, including technical assistance:
(a) to executive branch agencies and subscribers to the services; and
(b) related to information technology or telecommunications;
[
(26)
] 
(25)
 establish telecommunication system specifications and standards for use by:
(a) one or more executive branch agencies; or
(b) one or more entities that subscribe to the telecommunication systems in accordance
with Section 
63A-16-302
;
[
(27)
] 
(26)
 coordinate state telecommunication planning, in cooperation with:
(a) state telecommunication users;
(b) executive branch agencies; and
(c) other subscribers to the state's telecommunication systems;
[
(28)
] 
(27)
 cooperate with the federal government, other state entities, counties, and
municipalities in the development, implementation, and maintenance of:
(a) (i) governmental information technology; or
(ii) governmental telecommunication systems; and
(b) (i) as part of a cooperative organization; or
(ii) through means other than a cooperative organization;
[
(29)
] 
(28)
 establish, operate, manage, and maintain:
(a) one or more state data centers; and
(b) one or more regional computer centers;
[
(30)
] 
(29)
 design, implement, and manage all state-owned, leased, or rented land,
mobile, or radio telecommunication systems that are used in the delivery of services for state
government or the state's political subdivisions;
[
(31)
] 
(30)
 in accordance with the executive branch strategic plan, implement
minimum standards to be used by the division for purposes of compatibility of procedures,
programming languages, codes, and media that facilitate the exchange of information within
and among telecommunication systems;
[
(32)
] 
(31)
 establish standards for the information technology needs of a collection of
executive branch agencies or programs that share common characteristics relative to the types
of stakeholders the agencies or programs serve, including:
(a) project management;
(b) application development; and
(c) 
subject to Subsections (5) and 
63G-6a-109.5
(9), 
procurement;
[
(33)
] 
(32)
 provide oversight of information technology standards that impact multiple
executive branch agency information technology services, assets, or functions to:
(a) control costs;
(b) ensure business value to a project;
(c) maximize resources;
(d) ensure the uniform application of best practices; and
(e) avoid duplication of resources; and
[
(34)
] 
(33)
 establish a system of accountability to user agencies through the use of
service agreements.
Section 2. Section 
63A-16-201
 is amended to read:
63A-16-201.
Chief information officer -- Appointment -- Powers -- Reporting.
(1) The director of the division shall serve as the state's chief information officer.
(2) The chief information officer shall:
(a) advise the governor on information technology policy; and
(b) perform those duties given the chief information officer by statute.
(3) (a) The chief information officer shall report annually to:
(i) the governor; and
(ii) the Government Operations Interim Committee.
(b) The report required under Subsection (3)(a) shall:
(i) summarize the state's current and projected use of information technology;
(ii) summarize the executive branch strategic plan including a description of major
changes in the executive branch strategic plan;
(iii) provide a brief description of each state agency's information technology plan;
(iv) include the status of information technology projects described in Subsection
[
63A-16-104
(11)
] 
63A-16-104
(10)
;
(v) include the performance report described in Section 
63A-16-211
; and
(vi) include the expenditure of the funds provided for electronic technology,
equipment, and hardware.
Section 3. Section 
63A-16-205
 is amended to read:
63A-16-205.
Rulemaking -- Policies.
(1) (a) Except as provided in Subsection (2), the chief information officer shall, by rule
made in accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act:
(i) [
provide
] 
establish
 standards that impose requirements on executive branch
agencies [
that:(A) are
] related to the security of the statewide area network; [
and
]
[
(B)
] 
(ii)
 establish standards for when an agency must obtain approval before obtaining
items [
listed
] 
described
 in Subsection [
63A-16-204
(1)
] 
63G-6a-109.5
(2)
;
[
(ii)
] 
(iii)
 specify the detail and format required in an agency information technology
plan submitted in accordance with Section 
63A-16-203
;
[
(iii)
] 
(iv)
 [
provide for
] 
establish
 standards related to the privacy policies of websites
operated by or on behalf of an executive branch agency;
[
(iv)
] 
(v)
 [
provide
] 
subject to Subsection 
63G-6a-109.5
(9), establish standards
 for the
acquisition, licensing, and sale of computer software;
[
(v)
] 
(vi)
 specify the requirements for the project plan and business case analysis
required [
by Section 
63A-16-204
] 
under Section 
63G-6a-109.5
;
[
(vi)
] 
(vii)
 provide for project oversight of agency technology projects when required
[
by Section 
63A-16-204
] 
under Section 
63G-6a-109.5
;
[
(vii)
] 
(viii)
 establish, in accordance with Subsection [
63A-16-204
(2)
]
63G-6a-109.5
(3)
, the implementation of the needs assessment for information technology
purchases;
[
(viii)
] 
(ix)
 establish telecommunications standards and specifications in accordance
with Subsection [
63A-16-104
(26)
] 
63G-6a-109.5
(25)
; and
[
(ix)
] 
(x)
 establish standards for accessibility of information technology by individuals
with disabilities in accordance with Section 
63A-16-209
.
(b) The rulemaking authority granted by [
this
] Subsection (1)
(a)
 is in addition to any
other rulemaking authority granted under this chapter.
(2) (a) Notwithstanding Title 63G, Chapter 3, Utah Administrative Rulemaking Act,
and subject to Subsection (2)(b), the chief information officer may adopt a policy that outlines
procedures to be followed by the chief information officer in facilitating the implementation of
this title by executive branch agencies if the policy:
(i) is consistent with the executive branch strategic plan; and
(ii) is not required to be made by rule under Subsection (1) or Section 
63G-3-201
.
(b) (i) A policy adopted by the chief information officer under Subsection (2)(a) may
not take effect until 30 days after the day on which the chief information officer submits the
policy to:
(A) the governor; and
(B) all cabinet level officials.
(ii) During the 30-day period described in Subsection (2)(b)(i), cabinet level officials
may review and comment on a policy submitted under Subsection (2)(b)(i).
(3) (a) Notwithstanding Subsection (1) or (2) or Title 63G, Chapter 3, Utah
Administrative Rulemaking Act, without following the procedures of Subsection (1) or (2), the
chief information officer may adopt a security procedure to be followed by executive branch
agencies to protect the statewide area network if:
(i) broad communication of the security procedure would create a significant potential
for increasing the vulnerability of the statewide area network to breach or attack; and
(ii) after consultation with the chief information officer, the governor agrees that broad
communication of the security procedure would create a significant potential increase in the
vulnerability of the statewide area network to breach or attack.
(b) A security procedure described in Subsection (3)(a) is classified as a protected
record under Title 63G, Chapter 2, Government Records Access and Management Act.
(c) The chief information officer shall provide a copy of the security procedure as a
protected record to:
(i) the chief justice of the Utah Supreme Court for the judicial branch;
(ii) the speaker of the House of Representatives and the president of the Senate for the
legislative branch;
(iii) the chair of the Utah Board of Higher Education; and
(iv) the chair of the State Board of Education.
Section 4. Section 
63G-6a-109.5
, which is renumbered from Section 63A-16-204 is
renumbered and amended to read:
[
63A-16-204
].
 63G-6a-109.5.
Approval of acquisitions of information
technology.
(1) As used in this section:
(a) "Chief information officer" means the director of the Division of Technology
Services, created in Section 
63A-16-103
.
(b) "Department" means the Department of Government Operations, created in Section
63A-1-104
.
[
(1)
] 
(2)
 (a) In accordance with Subsection [
(2)
] 
(3)
, the chief information officer shall
approve the acquisition by an executive branch agency of:
(i) information technology equipment;
(ii) telecommunications equipment;
(iii) software;
(iv) services related to the items [
listed
] 
described
 in Subsections [
(1)(a)(i)
] 
(2)(a)(i)
through (iii); and
(v) data acquisition.
(b) The chief information officer may negotiate the purchase, lease, or rental of private
or public information technology or telecommunication services or facilities in accordance with
this section.
(c) Where practical, efficient, and economically beneficial, the chief information
officer shall use existing private and public information technology or telecommunication
resources.
(d) In accordance with Section 
63A-16-206
, the chief information officer may
recommend coordination of acquisitions between two or more executive branch agencies if the
coordination is in the best interests of the state.
[
(d)
] 
(e)
 [
Notwithstanding another provision of this section, an
] 
An
 acquisition
[
authorized by
] 
approved under
 this section shall comply with rules made by the applicable
rulemaking authority under [
Title 63G,
] Chapter 6a, Utah Procurement Code.
[
(2)
] 
(3)
 Before [
negotiating
] 
a conducting procurement unit negotiates
 a purchase,
lease, or rental under Subsection [
(1)
] 
(2)
 for an amount that exceeds the value established by
the chief information officer by rule
 made
 in accordance with Section 
63A-16-205
, the chief
information officer shall:
(a) conduct an analysis of the needs of executive branch agencies and subscribers of
services and the ability of the proposed information technology or telecommunications services
or supplies to meet those needs; and
(b) for purchases, leases, or rentals not covered by an existing statewide contract,
certify in writing to the chief procurement officer in the Division of Purchasing and General
Services that:
(i) the analysis required in Subsection [
(2)(a)
] 
(3)(a)
 was completed; and
(ii) based on the analysis, the proposed purchase, lease, rental, or master contract of
services, products, or supplies is practical, efficient, and economically beneficial to the state
and the executive branch agency or subscriber of services.
[
(3)
] 
(4)
 [
In approving an acquisition described in Subsections (1) and (2), the
] 
The
chief information officer shall
 approve an acquisition described in Subsection (2) or (3) if the
acquisition complies with
:
[
(a) establish by administrative rule, in accordance with Section 
63A-16-205
, standards
under which an agency must obtain approval from the chief information officer before
acquiring the items listed in Subsections (1) and (2);
]
[
(b) for those acquisitions requiring approval, determine whether the acquisition is in
compliance with:
]
(a) the applicable rules and policies described in Section 
63A-16-205
;
[
(i)
] 
(b)
 the executive branch strategic plan;
[
(ii)
] 
(c)
 the applicable agency information technology plan;
[
(iii)
] 
(d)
 the budget for the executive branch agency or department as adopted by the
Legislature;
[
(iv)
] 
(e)
 [
Title 63G,
] Chapter 6a, Utah Procurement Code; and
[
(v)
] 
(f)
 the information technology accessibility standards described in Section
63A-16-209
[
; and
]
.
[
(c) in accordance with Section 
63A-16-206
, require coordination of acquisitions
between two or more executive branch agencies if it is in the best interests of the state.
]
[
(4)
] 
(5)
 Each executive branch agency shall provide the chief information officer with
complete access to all information technology records, documents, and reports:
(a) at the request of the chief information officer; and
(b) related to the executive branch agency's acquisition of [
any item listed
] 
an item
described
 in Subsection [
(1)
] 
(2)
.
[
(5)
] 
(6)
 (a) In accordance with administrative rules established by the [
department
]
chief information officer
 under Section 
63A-16-205
, an executive branch agency and the
department may not initiate a new technology project unless the technology project is described
in a formal project plan and a business case analysis is approved by the chief information
officer and the highest ranking executive branch agency official.
(b) The project plan and business case analysis required [
by
] 
under
 this Subsection
[
(5)
] 
(6)
 shall include:
(i) a statement of work to be done and existing work to be modified or displaced;
(ii) 
the
 total cost of 
the
 system development and conversion effort, including system
analysis and programming costs, establishment of master files, testing, documentation, special
equipment cost
,
 and all other costs, including overhead;
(iii) 
the
 savings or added operating costs that will result after conversion;
(iv) 
a description of the
 other advantages or reasons that justify the work;
(v) 
the
 source of funding of the work, including ongoing costs;
(vi) 
a description of the project's
 consistency with budget submissions and planning
components of budgets; and
(vii) 
a statement regarding
 whether the work is within the scope of projects or
initiatives envisioned when the current fiscal year budget was approved.
(c) The chief information officer shall determine the required form of the project plan
and business case analysis described in this Subsection [
(5)
] 
(6)
.
[
(6)
] 
(7)
 [
The
] 
Subject to Subsection (9), the
 chief information officer and the Division
of Purchasing and General Services within the department shall work cooperatively to establish
procedures under which the chief information officer shall monitor and approve acquisitions
[
as provided in
] 
under
 this section.
(8) In addition to the requirement that the chief information officer approve the
acquisitions described in Subsections (2) and (3), the Division of Technology Services shall,
subject to Subsection (9), assist and support executive branch agencies in the acquisition of all
technology services and products.
(9) In relation to the acquisition of technology services or products:
(a) the requirement of approval by the chief information officer, as described in this
section, and the assistance and support of the Division of Technology Services described in
Subsection (8), do not make the chief information officer, the department, or the Division of
Technology Services responsible to manage the contract or fund the procurement;
(b) contract management is the responsibility of the conducting procurement unit; and
(c) funding of the procurement is the responsibility of the executive branch agency
acquiring the technology services or products.
Section 5. Section 
63G-6a-303
 is amended to read:
63G-6a-303.
Role, duties, and authority of chief procurement officer.
(1) The chief procurement officer:
(a) is the director of the division;
(b) serves as the central procurement officer of the state;
(c) serves as a voting member of the board; and
(d) serves as the protest officer for a protest relating to a procurement of an executive
branch procurement, except an executive branch procurement unit designated under Subsection
63G-6a-103
(38)(b), (c), (d), or (e) as an independent procurement unit, or a state cooperative
contract procurement, unless the chief procurement officer designates another to serve as
protest officer, as authorized in this chapter.
(2) Except as otherwise provided in this chapter, the chief procurement officer shall:
(a) develop procurement policies and procedures supporting ethical procurement
practices, fair and open competition among vendors, and transparency within the state's
procurement process;
(b) administer the state's cooperative purchasing program, including state cooperative
contracts and associated administrative fees;
(c) enter into an agreement with a public entity for services provided by the division, if
the agreement is in the best interest of the state;
(d) ensure the division's compliance with any applicable law, rule, or policy, including
a law, rule, or policy applicable to the division's role as an issuing procurement unit or
conducting procurement unit, or as the state's central procurement organization;
(e) manage the division's electronic procurement system;
(f) oversee the recruitment, training, career development, certification requirements,
and performance evaluation of the division's procurement personnel;
(g) make procurement training available to procurement units and persons who do
business with procurement units;
(h) provide exemplary customer service and continually improve the division's
procurement operations;
(i) exercise all other authority, fulfill all other duties and responsibilities, and perform
all other functions authorized under this chapter; and
(j) ensure that any training described in this Subsection (2) complies with [
Title 63G,
]
Chapter 22, State Training and Certification Requirements. 
(3) With respect to a procurement or contract over which the chief procurement officer
has authority under this chapter, the chief procurement officer, except as otherwise provided in
this chapter:
(a) shall:
(i) manage and supervise a procurement to ensure to the extent practicable that
taxpayers receive the best value;
(ii) prepare and issue standard specifications for procurement items;
(iii) review contracts, coordinate contract compliance, conduct contract audits, and
approve change orders;
(iv) in accordance with Section [
63A-16-204
] 
63G-6a-109.5
, coordinate with the
Division of Technology Services, created in Section 
63A-16-103
, with respect to the
procurement of information technology services by an executive branch procurement unit;
(v) correct, amend, or cancel a procurement at any stage of the procurement process if
the procurement is out of compliance with this chapter or a board rule;
(vi) after consultation with the attorney general's office, correct, amend, or cancel a
contract at any time during the term of the contract if:
(A) the contract is out of compliance with this chapter or a board rule; and
(B) the chief procurement officer determines that correcting, amending, or canceling
the contract is in the best interest of the state; and
(vii) make a reasonable attempt to resolve a contract dispute, in coordination with the
attorney general's office; and
(b) may:
(i) delegate limited purchasing authority to a state agency, with appropriate oversight
and control to ensure compliance with this chapter;
(ii) delegate duties and authority to an employee of the division, as the chief
procurement officer considers appropriate;
(iii) negotiate and settle contract overcharges, undercharges, and claims, in accordance
with the law and after consultation with the attorney general's office;
(iv) authorize a procurement unit to make a procurement pursuant to a regional
solicitation, as defined in Subsection 
63G-6a-2105
(7), even if the procurement item is also
offered under a state cooperative contract, if the chief procurement officer determines that the
procurement pursuant to a regional solicitation is in the best interest of the acquiring
procurement unit; and
(v) remove an individual from the procurement process or contract administration for:
(A) having a conflict of interest or the appearance of a conflict of interest with a person
responding to a solicitation or with a contractor;
(B) having a bias or the appearance of bias for or against a person responding to a
solicitation or for or against a contractor;
(C) making an inconsistent or unexplainable score for a solicitation response;
(D) having inappropriate contact or communication with a person responding to a
solicitation;
(E) socializing inappropriately with a person responding to a solicitation or with a
contractor;
(F) engaging in any other action or having any other association that causes the chief
procurement officer to conclude that the individual cannot fairly evaluate a solicitation
response or administer a contract; or
(G) any other violation of a law, rule, or policy.
(4) The chief procurement officer may not delegate to an individual outside the
division the chief procurement officer's authority over a procurement described in Subsection
(3)(a)(iv).
(5) The chief procurement officer has final authority to determine whether an executive
branch procurement unit's anticipated expenditure of public funds, anticipated agreement to
expend public funds, or provision of a benefit constitutes a procurement that is subject to this
chapter.
(6) Except as otherwise provided in this chapter, the chief procurement officer shall
review, monitor, and audit the procurement activities and delegated procurement authority of
an executive branch procurement unit, except to the extent that an executive branch
procurement unit is designated under Subsection 
63G-6a-103
(38)(b), (c), (d), or (e) as an
independent procurement unit, to ensure compliance with this chapter, rules made by the
applicable rulemaking authority, and division policies.