S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   6227
 
                        2019-2020 Regular Sessions
 
                             I N  S E N A T E
 
                               May 24, 2019
                                ___________
 
 Introduced  by  Sen.  SAVINO -- read twice and ordered printed, and when
   printed to be committed to the Committee on Internet and Technology
 
 AN ACT to amend the state technology law, in relation to  cloud  service
   utilization and readiness of state agencies
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Legislative intent. The legislature  finds  that  New  York
 must  ensure  that  it continuously evaluates how information technology
 services are delivered to those who live and work in our state and  that
 the  services  provided  by  the state must keep pace with the technical
 solutions and offerings in the marketplace. A key part of achieving this
 goal is to ensure that the state of New York  aggressively  incorporates
 the  use of cloud technologies into state information technology service
 delivery models.
   The legislature further finds that,  as  with  any  technology,  cloud
 services  must  be  implemented in a manner that continues to ensure the
 availability, security, and privacy of  state  and  citizen  data.  This
 requires  ongoing oversight and management, as well as reworked internal
 governance processes to ensure flexibility for state employees to deploy
 on-demand best-in-class solutions.
   The legislature further finds that leveraging  cloud  services  models
 will  allow  the  state  to:    speed  up delivery of business solutions
 through faster paths to production; provide flexible  solutions  capable
 of quickly adapting to new and changing business solutions; reduce oper-
 ations  and  maintenance  costs  for  basic needs such as power and real
 estate; provide transparency so that customers are more  aware  of  what
 they  receive  for  their  money;  provide service elasticity to support
 increased citizen needs at peak times;  and  provide  a  structure  that
 allows  for  a  more  resilient environment in the case of a disaster or
 service outage.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD11999-01-9
              

 S. 6227                             2
 
   § 2. Section 101 of the state technology law is amended  by  adding  a
 new subdivision 6 to read as follows:
   6.  "CLOUD  COMPUTING"  MEANS A MODEL FOR ENABLING UBIQUITOUS, CONVEN-
 IENT, ON-DEMAND NETWORK ACCESS TO A SHARED POOL OF CONFIGURABLE  COMPUT-
 ING  RESOURCES  (E.G.,  NETWORKS,  SERVERS,  STORAGE,  APPLICATIONS  AND
 SERVICES) THAT CAN BE RAPIDLY  PROVISIONED  AND  RELEASED  WITH  MINIMAL
 MANAGEMENT  EFFORT  OR  SERVICE  PROVIDER  INTERACTION AND WHICH HAS THE
 FOLLOWING CHARACTERISTICS: ON-DEMAND SELF-SERVICE, BROAD NETWORK ACCESS,
 RESOURCE POOLING, RAPID ELASTICITY OR EXPANSION, AND MEASURED SERVICE.
   § 3. The state technology law is amended by adding a new section 103-b
 to read as follows:
   § 103-B. CLOUD COMPUTING. 1. ALL STATE AGENCIES SHALL  UTILIZE  THIRD-
 PARTY,  COMMERCIAL  CLOUD  COMPUTING  SOLUTIONS  FOR ANY NEW INFORMATION
 TECHNOLOGY OR TELECOMMUNICATIONS INVESTMENTS ON OR BEFORE  JUNE  THIRTI-
 ETH,  TWO  THOUSAND  TWENTY, EXCEPT AS OTHERWISE PROVIDED IN SUBDIVISION
 TWO OF THIS SECTION. PRIOR TO SELECTING AND IMPLEMENTING A CLOUD COMPUT-
 ING SOLUTION, A STATE AGENCY SHALL EVALUATE:
   (A) THE ABILITY OF THE CLOUD COMPUTING SOLUTION TO MEET RELEVANT SECU-
 RITY AND COMPLIANCE REQUIREMENTS, LEVERAGING  DEFINED  FEDERAL  AUTHORI-
 ZATION OR ACCREDITATION PROGRAMS TO THE FULLEST EXTENT POSSIBLE; AND
   (B)  THE PORTABILITY OF DATA SHOULD THE STATE AGENCY CHOOSE TO DISCON-
 TINUE USE OF SUCH CLOUD SERVICE.
   2. (A) THE SECRETARY TO THE GOVERNOR, OR  HIS  OR  HER  DESIGNEE,  MAY
 GRANT  A WAIVER FROM THE REQUIREMENTS OF SUBDIVISION ONE OF THIS SECTION
 TO AN AGENCY IF THERE IS A  SERVICE  REQUIREMENT  OF  SUCH  AGENCY  THAT
 PROHIBITS THE ADOPTION OF A CLOUD COMPUTING SOLUTION.
   (B) AN APPLICATION FOR A WAIVER SUBMITTED BY AN AGENCY SHALL INCLUDE A
 WRITTEN  JUSTIFICATION  FOR  NOT  UTILIZING  A  CLOUD COMPUTING SOLUTION
 CITING SPECIFIC SERVICES OR PERFORMANCE REQUIREMENTS OF SUCH AGENCY.
   (C) THE SECRETARY TO THE GOVERNOR SHALL SUBMIT AN ANNUAL REPORT ON ALL
 WAIVER APPLICATIONS  RECEIVED,  INCLUDING  WHETHER  AN  APPLICATION  WAS
 GRANTED,  TO APPROPRIATE COMMITTEES OF THE LEGISLATURE, AS DETERMINED BY
 SUCH SECRETARY, BY DECEMBER THIRTIETH.
   3. STATE AGENCIES ARE PROHIBITED FROM  INSTALLING  AND  OPERATING  NEW
 SERVERS,  STORAGE,  NETWORKING,  AND RELATED HARDWARE IN AGENCY-OPERATED
 FACILITIES UNLESS A WAIVER IS GRANTED BY THE SECRETARY TO  THE  GOVERNOR
 OR HIS OR HER DESIGNEE, OR OTHERWISE PERMITTED BY LAW.
   4.  SUBJECT  TO  THE  AVAILABILITY  OF  AMOUNTS  APPROPRIATED FOR THIS
 SPECIFIC PURPOSE, THE DIRECTOR SHALL CONDUCT A STATEWIDE CLOUD COMPUTING
 READINESS ASSESSMENT TO PREPARE FOR THE MIGRATION OF  CORE  SERVICES  TO
 CLOUD SERVICES, INCLUDING WAYS IT CAN LEVERAGE CLOUD COMPUTING TO REDUCE
 COSTS. SUCH ASSESSMENT SHALL:
   (A)  INVENTORY  STATE AGENCY ASSETS, ASSOCIATED SERVICE CONTRACTS, AND
 OTHER RELEVANT INFORMATION;
   (B) IDENTIFY IMPACTS TO  STATE  AGENCY  STAFFING  RESULTING  FROM  THE
 MIGRATION TO CLOUD COMPUTING INCLUDING:
   (I) SKILL GAPS BETWEEN CURRENT ON-PREMISES COMPUTING PRACTICES AND HOW
 CLOUD  SERVICES  ARE  PROCURED,  SECURED,  ADMINISTERED,  MAINTAINED AND
 DEVELOPED; AND
   (II) NECESSARY RETRAINING AND  ONGOING  TRAINING  AND  DEVELOPMENT  TO
 ENSURE  STATE  AGENCY STAFF ACQUIRE AND MAINTAIN THE SKILLS NECESSARY TO
 EFFECTIVELY MAINTAIN INFORMATION  SECURITY  AND  UNDERSTAND  CHANGES  TO
 ENTERPRISE ARCHITECTURES; AND
   (C) IDENTIFY ADDITIONAL RESOURCES NEEDED BY THE OFFICE TO ENABLE CLOUD
 MIGRATION SUPPORT TO STATE AGENCIES.

 S. 6227                             3
 
   5.  ON  OR  BEFORE  JUNE  THIRTIETH, TWO THOUSAND TWENTY, THE DIRECTOR
 SHALL SUBMIT A REPORT TO THE GOVERNOR, THE TEMPORARY  PRESIDENT  OF  THE
 SENATE  AND  THE  SPEAKER  OF  THE  ASSEMBLY SUMMARIZING STATEWIDE CLOUD
 MIGRATION READINESS AND MAKING RECOMMENDATIONS FOR MIGRATION GOALS.
   6.  SUBJECT  TO  THE  AVAILABILITY  OF  AMOUNTS  APPROPRIATED FOR THIS
 PURPOSE, THE DIRECTOR SHALL OVERSEE AND PROVIDE TECHNICAL SPECIFICATIONS
 TO THE OFFICE OF GENERAL SERVICES, WHICH SHALL SELECT, THROUGH A COMPET-
 ITIVE BIDDING PROCESS, THREE CLOUD SERVICE PROVIDERS CAPABLE OF  PROVID-
 ING  STORAGE  AND  COMPUTER  SERVICES  AND  TO  PROVIDE SYSTEM MIGRATION
 SUPPORT.  THE  COMPETITIVE  BIDDING  PROCESS  SHALL  BE  RE-OPENED   AND
 CONTRACTS SHALL BE RENEGOTIATED NO LESS THAN EVERY FIVE YEARS.
   § 4. This act shall take effect January 1, 2020.