Senate Bill S6453

                                
 
BILL NUMBER: S6453

SPONSOR: SAVINO
 
TITLE OF BILL:  An act to amend the general municipal law, in relation
to contracts pertaining to information technology cloud services

 
PURPOSE OR GENERAL IDEA OF BILL:

This legislation will provide risk management protocols for companies
looking to provide cloud service technologies to state agencies. Because
of the sensitive nature of the data stored in state databases, ensuring
contractors are held to the highest possible standards is of the utmost
importance.

 
SUMMARY OF PROVISIONS:

Amends the General Municipal Law so that new bidders for technology
cloud service contracts must be certified by the Federal Risk Authori-
zation Management Program (FedRAMP) or an equivalent process that will
be established by the state Office of General Services.

              

 
JUSTIFICATION:

As an increasing amount of state data makes its way onto remote, Inter-
net connected storage systems, also known as the "cloud", it is impor-
tant that agencies take seriously the threat of cyber attack, espionage,
and general mismanagement. With a number of cloud providers in the
market, procuring a secure platform is a daunting task without a certif-
ication process that ensures sensitive data remains private and avail-
able only to authorized users. Hackers including the "Red Apollo" group
based in China have recognized the value of cloud-based data caches in
an effort to spread malware and, in the process, revealed weaknesses in
the systems we rely upon on a daily basis (1). In the process of
collecting data in cloud storage, New York is creating a treasure trove
of data for hackers, cyber criminals, and foreign agents that requires
immediate action.

This legislation would require companies that want to host state data
become certified through the Federal Risk Authorization Management
Program (FedRAMP) or an equivalent process that will be established by
the Office of General Services. While OGS is already taking cybersecuri-
ty very seriously, this legislation will require active and granular
vetting of companies and their cybersecurity protocols before they are
entrusted with state data. The bill will ensure companies are entirely
responsible for funding the certification process to enable OGS to main-
tain adequate staffing.

(1) https://www.ft.com/content/4f990a78-537a-11e8-84f4-43d65af59d43

 
PRIOR LEGISLATIVE HISTORY:

2019: New Bill.

 
FISCAL IMPLICATIONS FOR STATE AND LOCAL GOVERNMENTS:

None. The cost of complying with this legislation will be borne entirely
by the bidding companies.

 
EFFECTIVE DATE:
365 days after it shall have become a law, however, effective immediate-
ly the state Office of General Services is authorized to begin the proc-
ess of established an equivalent state certification to the FedRAMP
program.