Senate Bill S6515

                            
 
                     S T A T E   O F   N E W   Y O R K
 ________________________________________________________________________
 
                                   6515
 
                        2021-2022 Regular Sessions
 
                             I N  S E N A T E
 
                                May 4, 2021
                                ___________
 
 Introduced  by  Sen.  SAVINO -- read twice and ordered printed, and when
   printed to be committed to the Committee on Internet and Technology
 
 AN ACT to amend the state technology law, in relation to  cloud  service
   utilization and readiness of state agencies
 
   THE  PEOPLE OF THE STATE OF NEW YORK, REPRESENTED IN SENATE AND ASSEM-
 BLY, DO ENACT AS FOLLOWS:
 
   Section 1. Legislative intent. The legislature  finds  that  New  York
 must  ensure  that  it continuously evaluates how information technology
 services are delivered to those who live and work in our state and  that
 the  services  provided  by  the state must keep pace with the technical
 solutions and offerings in the marketplace. A key part of achieving this
 goal is to ensure that the state of New York  aggressively  incorporates
 the  use of cloud technologies into state information technology service
 delivery models.
   The legislature further finds that,  as  with  any  technology,  cloud
 services  must  be  implemented in a manner that continues to ensure the
 availability, security, and privacy of  state  and  citizen  data.  This
 requires  ongoing oversight and management, as well as reworked internal
 governance processes to ensure flexibility for state employees to deploy
 on-demand best-in-class solutions.
   The legislature further finds that leveraging  cloud  services  models
 will  allow  the  state  to:    speed  up delivery of business solutions
 through faster paths to production; provide flexible  solutions  capable
 of quickly adapting to new and changing business solutions; reduce oper-
 ations  and  maintenance  costs  for  basic needs such as power and real
 estate; provide transparency so that customers are more  aware  of  what
 they  receive  for  their  money;  provide service elasticity to support
 increased citizen needs at peak times;  and  provide  a  structure  that
 allows  for  a  more  resilient environment in the case of a disaster or
 service outage.
 
  EXPLANATION--Matter in ITALICS (underscored) is new; matter in brackets
                       [ ] is old law to be omitted.
                                                            LBD08513-01-1
              

 S. 6515                             2
 
   § 2. Section 101 of the state technology law is amended  by  adding  a
 new subdivision 6 to read as follows:
   6.  "CLOUD  COMPUTING"  MEANS A MODEL FOR ENABLING UBIQUITOUS, CONVEN-
 IENT, ON-DEMAND NETWORK ACCESS TO A SHARED POOL OF CONFIGURABLE  COMPUT-
 ING  RESOURCES  (E.G.,  NETWORKS,  SERVERS,  STORAGE,  APPLICATIONS  AND
 SERVICES) THAT CAN BE RAPIDLY  PROVISIONED  AND  RELEASED  WITH  MINIMAL
 MANAGEMENT  EFFORT  OR  SERVICE  PROVIDER  INTERACTION AND WHICH HAS THE
 FOLLOWING CHARACTERISTICS: ON-DEMAND SELF-SERVICE, BROAD NETWORK ACCESS,
 RESOURCE POOLING, RAPID ELASTICITY OR EXPANSION, AND MEASURED SERVICE.
   § 3. The state technology law is amended by adding a new section 103-b
 to read as follows:
   § 103-B. CLOUD COMPUTING. 1. ALL STATE AGENCIES SHALL  UTILIZE  THIRD-
 PARTY,  COMMERCIAL  CLOUD  COMPUTING  SOLUTIONS  FOR ANY NEW INFORMATION
 TECHNOLOGY OR TELECOMMUNICATIONS INVESTMENTS ON OR BEFORE  JUNE  THIRTI-
 ETH,  TWO  THOUSAND TWENTY-TWO, EXCEPT AS OTHERWISE PROVIDED IN SUBDIVI-
 SION TWO OF THIS SECTION. PRIOR TO SELECTING AND  IMPLEMENTING  A  CLOUD
 COMPUTING SOLUTION, A STATE AGENCY SHALL EVALUATE:
   (A) THE ABILITY OF THE CLOUD COMPUTING SOLUTION TO MEET RELEVANT SECU-
 RITY  AND  COMPLIANCE  REQUIREMENTS, LEVERAGING DEFINED FEDERAL AUTHORI-
 ZATION OR ACCREDITATION PROGRAMS TO THE FULLEST EXTENT POSSIBLE; AND
   (B) THE PORTABILITY OF DATA SHOULD THE STATE AGENCY CHOOSE TO  DISCON-
 TINUE USE OF SUCH CLOUD SERVICE.
   2.  (A)  THE  SECRETARY  TO  THE GOVERNOR, OR HIS OR HER DESIGNEE, MAY
 GRANT A WAIVER FROM THE REQUIREMENTS OF SUBDIVISION ONE OF THIS  SECTION
 TO  AN  AGENCY  IF  THERE  IS  A SERVICE REQUIREMENT OF SUCH AGENCY THAT
 PROHIBITS THE ADOPTION OF A CLOUD COMPUTING SOLUTION.
   (B) AN APPLICATION FOR A WAIVER SUBMITTED BY AN AGENCY SHALL INCLUDE A
 WRITTEN JUSTIFICATION FOR  NOT  UTILIZING  A  CLOUD  COMPUTING  SOLUTION
 CITING SPECIFIC SERVICES OR PERFORMANCE REQUIREMENTS OF SUCH AGENCY.
   (C) THE SECRETARY TO THE GOVERNOR SHALL SUBMIT AN ANNUAL REPORT ON ALL
 WAIVER  APPLICATIONS  RECEIVED,  INCLUDING  WHETHER  AN  APPLICATION WAS
 GRANTED, TO APPROPRIATE COMMITTEES OF THE LEGISLATURE, AS DETERMINED  BY
 SUCH SECRETARY, BY DECEMBER THIRTIETH.
   3.  STATE  AGENCIES  ARE  PROHIBITED FROM INSTALLING AND OPERATING NEW
 SERVERS, STORAGE, NETWORKING, AND RELATED  HARDWARE  IN  AGENCY-OPERATED
 FACILITIES  UNLESS  A WAIVER IS GRANTED BY THE SECRETARY TO THE GOVERNOR
 OR HIS OR HER DESIGNEE, OR OTHERWISE PERMITTED BY LAW.
   4. SUBJECT TO  THE  AVAILABILITY  OF  AMOUNTS  APPROPRIATED  FOR  THIS
 SPECIFIC PURPOSE, THE DIRECTOR SHALL CONDUCT A STATEWIDE CLOUD COMPUTING
 READINESS  ASSESSMENT  TO  PREPARE FOR THE MIGRATION OF CORE SERVICES TO
 CLOUD SERVICES, INCLUDING WAYS IT CAN LEVERAGE CLOUD COMPUTING TO REDUCE
 COSTS. SUCH ASSESSMENT SHALL:
   (A) INVENTORY STATE AGENCY ASSETS, ASSOCIATED SERVICE  CONTRACTS,  AND
 OTHER RELEVANT INFORMATION;
   (B)  IDENTIFY  IMPACTS  TO  STATE  AGENCY  STAFFING RESULTING FROM THE
 MIGRATION TO CLOUD COMPUTING INCLUDING:
   (I) SKILL GAPS BETWEEN CURRENT ON-PREMISES COMPUTING PRACTICES AND HOW
 CLOUD SERVICES  ARE  PROCURED,  SECURED,  ADMINISTERED,  MAINTAINED  AND
 DEVELOPED; AND
   (II)  NECESSARY  RETRAINING  AND  ONGOING  TRAINING AND DEVELOPMENT TO
 ENSURE STATE AGENCY STAFF ACQUIRE AND MAINTAIN THE SKILLS  NECESSARY  TO
 EFFECTIVELY  MAINTAIN  INFORMATION  SECURITY  AND  UNDERSTAND CHANGES TO
 ENTERPRISE ARCHITECTURES; AND
   (C) IDENTIFY ADDITIONAL RESOURCES NEEDED BY THE OFFICE TO ENABLE CLOUD
 MIGRATION SUPPORT TO STATE AGENCIES.

 S. 6515                             3
 
   5. ON OR BEFORE JUNE THIRTIETH, TWO THOUSAND TWENTY-TWO, THE  DIRECTOR
 SHALL  SUBMIT  A  REPORT TO THE GOVERNOR, THE TEMPORARY PRESIDENT OF THE
 SENATE AND THE SPEAKER  OF  THE  ASSEMBLY  SUMMARIZING  STATEWIDE  CLOUD
 MIGRATION READINESS AND MAKING RECOMMENDATIONS FOR MIGRATION GOALS.
   6.  SUBJECT  TO  THE  AVAILABILITY  OF  AMOUNTS  APPROPRIATED FOR THIS
 PURPOSE, THE DIRECTOR SHALL OVERSEE AND PROVIDE TECHNICAL SPECIFICATIONS
 TO THE OFFICE OF GENERAL SERVICES, WHICH SHALL SELECT, THROUGH A COMPET-
 ITIVE BIDDING PROCESS, THREE CLOUD SERVICE PROVIDERS CAPABLE OF  PROVID-
 ING  STORAGE  AND  COMPUTER  SERVICES  AND  TO  PROVIDE SYSTEM MIGRATION
 SUPPORT.  THE  COMPETITIVE  BIDDING  PROCESS  SHALL  BE  RE-OPENED   AND
 CONTRACTS SHALL BE RENEGOTIATED NO LESS THAN EVERY FIVE YEARS.
   § 4. This act shall take effect January 1, 2022.