HB 2884, Hse 2nd Rdg, Amnd #1

Amend CSHB 2884 by adding the following appropriately numbered SECTIONS to the bill and renumbering the SECTIONS of the bill accordingly:

SECTION ____. The heading to Subchapter L, Chapter 2054, Government Code, is amended to read as follows:

SUBCHAPTER L. STATEWIDE TECHNOLOGY CENTERS AND CLOUD COMPUTING SERVICES

SECTION ____. Section 2054.375, Government Code, is amended by amending Subdivision (1) and adding Subdivision (1-a) to read as follows:

(1) "Cloud computing service" has the meaning assigned by Section 2157.007.

(1-a) "Governmental entity" means a state agency or local government.

SECTION ____. Section 2054.378, Government Code, is amended to read as follows:

Sec. 2054.378. AUTHORIZATION FOR CLOUD COMPUTING SERVICES OR SELECTION FOR CENTER SERVICES; SCOPE OF OPERATION OF CENTERS. (a) The department shall allow a state agency at the agency's discretion to:

(1) contract with a cloud computing service provider for services described by Subsection (b); or

(2) use a statewide technology center for the services described by Subsection (b).

(b) The department may operate statewide technology centers to provide two or more governmental entities, on a cost-sharing basis, services relating to:

(1) information resources and information resources technology; and

(2) the deployment, development, and maintenance of software applications.

(c) [~~(b)~~] The department may operate a statewide technology center directly or contract with a cloud computing service provider [~~another person~~] to operate the center.

SECTION ____. Section 2054.382(a), Government Code, is amended to read as follows:

(a) The department, or a cloud computing service provider under contract with the department, may [~~shall~~] manage the operations of statewide technology centers that provide data center services or disaster recovery services for two or more state agencies, including management of the operations of the center on the campus of Angelo State University.

SECTION ____. Section 2054.384, Government Code, is amended to read as follows:

Sec. 2054.384. COST AND REQUIREMENTS ANALYSIS. (a) Each state agency the department considers for participation under this subchapter [~~The department~~] shall conduct a cost and requirements analysis to determine the agency's information resource technology needs and shall consider using a cloud computing service, including any security benefits and cost savings associated with purchasing the service from a cloud computing service provider, or [~~for each state agency that the department intends to select for participation in~~] a statewide technology center.

(b) A [~~selected~~] state agency shall identify the agency's [~~its~~] particular technology requirements, operations costs, and requested service levels for the department. The department may require a state agency to validate or resubmit data related to these factors. [~~The department shall fulfill the requirements and service levels of each state agency to the extent possible.~~]

SECTION ____. Section 2054.390, Government Code, is amended to read as follows:

Sec. 2054.390. PRIORITIZATION AND USE OF EXISTING CAPACITY REQUIRED [~~MIGRATION OF SERVICES~~]. If the [~~(a) The~~] department adopts a [shall prioritize the migration of services to the statewide technology center system established under this subchapter based on the size of the current technology center operational environment at a state agency, with the largest 25 ~~technology center environments ranking highest in priority.~~

[~~(c)~~ ~~A state agency shall comply with the department's request to migrate under this section.~~

[~~(d)~~ ~~Any~~] consolidation plan to migrate services to a statewide technology center established under this subchapter, the department shall [~~adopted by the department to execute this section must~~] prioritize and fully use the existing capacity of the State Data Center located on the campus of Angelo State University.

SECTION ____. Section 2054.392, Government Code, is amended to read as follows:

Sec. 2054.392. STATEWIDE TECHNOLOGY ACCOUNT. The comptroller shall establish in the state treasury the statewide technology account. The account is a revolving fund account for the administration of this subchapter. The account is the depository for all money received from entities served under this subchapter. Money in the account may be used only for a [~~the operation and management of a statewide technology center or for any other~~] purpose specified by the legislature.

SECTION ____. Subchapter L, Chapter 2054, Government Code, is amended by adding Section 2054.393 to read as follows:

Sec. 2054.393. CLOUD COMPUTING SERVICE POLICY; REPORT. (a) The department shall adopt a policy on state agency use of a cloud computing service that encourages state agencies to only contract with cloud computing service providers with internationally recognized accreditations validated by an independent assessor.

(b) The policy must require a state agency selecting a cloud computing service provider to:

(1) use to the extent possible the Federal Risk and Authorization Management Program (FedRAMP) authorizations and marketplace to maximize efficiency and alignment with national cloud computing standards and guidelines;

(2) examine the connectivity of state agency computing networks with the cloud computing service;

(3) examine the transparency of cloud computing service providers related to cloud computing performance and service;

(4) optimize cloud computing service costs;

(5) examine cloud computing service development practices; and

(6) evaluate cloud computing service security.

(c) The department may review a state agency's request for proposals for a cloud computing service to ensure compliance with the policy adopted under this section.

(d) A state agency may use a department-awarded statewide contract to purchase a cloud computing service.

(e) Not later than the 90th day after the date a state agency contracts with a provider for a cloud computing service, the agency shall submit to the department a report on the security of the cloud computing service and the cloud computing service provider's compliance with the policy adopted under this section.

(f) The department may select an accredited third-party assessment organization to review a cloud computing service provider's available documentation, including a system and organization controls report, to ensure that the provider has sufficient service controls to maintain the integrity, security, and confidentiality of state agency information. The department shall coordinate any review of a cloud computing service provider, including identifying and selecting an appropriate third-party assessment organization familiar with the cloud computing service provider to conduct the review.