See other bills
under the
same topic
PRIOR PRINTER'S NO. 2289
PRINTER'S NO. 4190
THE GENERAL ASSEMBLY OF PENNSYLVANIA
HOUSE BILL
No.
1704
Session of
2017
INTRODUCED BY GROVE, PHILLIPS-HILL, ORTITAY, CUTLER, BAKER,
SAYLOR, ENGLISH, MILLARD, BLOOM, WHEELAND, A. HARRIS, WATSON,
PICKETT, B. MILLER, COX, RYAN AND KEEFER, AUGUST 16, 2017
AS REPORTED FROM COMMITTEE ON STATE GOVERNMENT, HOUSE OF
REPRESENTATIVES, AS AMENDED, OCTOBER 9, 2018
AN ACT
Amending Title 71 (State Government) of the Pennsylvania
Consolidated Statutes, providing for information technology;
establishing the Office of Information Technology and the
Information Technology Fund; providing for administrative and
procurement procedures and for the Legislative JOINT
Cybersecurity Oversight Committee; and imposing penalties.
The General Assembly of the Commonwealth of Pennsylvania
hereby enacts as follows:
Section 1. Part V of Title 71 of the Pennsylvania
Consolidated Statutes is amended by adding a chapter to read:
CHAPTER 43
INFORMATION TECHNOLOGY
Subchapter
A. General Provisions
B. Office of Information Technology
C. Procurement and Business Operations
D. Security
E. Enforcement and Penalties
SUBCHAPTER A
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
GENERAL PROVISIONS
Sec.
4301. Scope of chapter.
4302. Findings and declarations.
4303. Definitions.
§ 4301. Scope of chapter.
This chapter relates to administrative procedures and
procurement regarding information technology.
§ 4302. Findings and declarations.
The General Assembly finds and declares the following:
(1) The Commonwealth has struggled to keep information
technology costs under control.
(2) M any of the Commonwealth's information technology
contracts extend well beyond their anticipated date of
completion.
(3) The Commonwealth can begin to reduce information
technology costs by the consolidation of information
technology functions and resources within the executive
branch.
(4) Consolidation of information technology services
will not only reduce costs but create more efficient
information technology operations.
(5) By reforming the Commonwealth's outdated approach to
information technology, the Commonwealth can improve data and
analytic capabilities and improve cybersecurity.
(6) The improvement of operations will enhance taxpayer
satisfaction and make it easier for residents to navigate.
(7) Consolidation of information technology services
must be designed to improve accountability and transparency
to taxpayers and enhance the Commonwealth's data and
20170HB1704PN4190 - 2 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
analytics capabilities.
§ 4303. Definitions.
The following words and phrases when used in this chapter
shall have the meanings given to them in this section unless the
context clearly indicates otherwise:
"Director." The administrative head of the office.
"Distributed information technology assets." Hardware,
software and communications equipment not classified as
traditional mainframe-based items, including, but not limited
to, personal computers, local area networks, servers, mobile
computers, peripheral equipment and other related hardware and
software items.
"Electronic bidding." The electronic solicitation and
receipt of offers to contract.
"Fund." The In formation Technology Fund established under
section 4316 (relating to Information Technology Fund).
"Independent agency." A board, commission, authority or
other agency of the Commonwealth that is not subject to the
policy supervision and control of the Governor. The term does
not include:
(1) a court or agency of the unified judicial system; or
(2) the General Assembly or an agency of the General
Assembly.
"Independent department." Any of the following:
(1) The Department of the Auditor General.
(2) The Treasury Department.
(3) The Office of Attorney General.
(4) A board or commission of an entity under paragraph
(1), (2) or (3).
"Information technology." Hardware, software and
20170HB1704PN4190 - 3 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
telecommunications equipment, including, but not limited to, the
following:
(1) Personal computers.
(2) Servers.
(3) Mainframes.
(4) Wired or wireless wide and local area networks.
(5) Broadband.
(6) Mobile or portable computers.
(7) Peripheral equipment.
(8) Telephones.
(9) Wireless communications.
(10) Handheld devices.
(11) Public safety radio services.
(12) Facsimile machines.
(13) Technology facilities, including, but not limited
to, data centers, dedicated training facilities or switching
facilities.
(13.1) ELECTRONIC PAYMENT PROCESSING SERVICES.
(14) Other relevant hardware and software items or
personnel tasked with the planning, implementation or support
of technology, including hosting or vendor-managed service
solutions.
"Information technology security incident." A computer-based
activity, network-based activity or paper-based activity which
results directly or indirectly in misuse, damage, denial of
service, compromise of integrity or loss of confidentiality of a
network, a computer, an application or data.
"Office." The Office of Information Technology established
under Subchapter B (relating to Office of Information
Technology).
20170HB1704PN4190 - 4 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
"Reverse auction." A real-time purchasing process in which
vendors compete to provide goods or services at the lowest
selling price in an open and interactive electronic environment.
"Secretary." The Secretary of Administration.
"State agency." Any of the following:
(1) The Governor's Office.
(2) A department, board, commission, authority or other
agency of the Commonwealth that is subject to the policy
supervision and control of the Governor.
(3) The office of Lieutenant Governor.
(4) An independent agency.
SUBCHAPTER B
OFFICE OF INFORMATION TECHNOLOGY
Sec.
4311. Establishment of office.
4312. Duties of office.
4313. Transfer of duties.
4314. Director.
4315. Planning and financing information technology resources.
4316. Information Technology Fund.
4317. Information technology reports.
4318 4317 . Financial reporting and accountability AND
INFORMATION TECHNOLOGY .
4319 4318 . Statewide electronic portal and annual report.
4320 4319 . Budget for information technology.
4321 4320 . Commonwealth portal.
4322 4321 . Information technology request.
4322. STATUS OF INFORMATION TECHNOLOGY PROJECTS AND CORRECTIVE
ACTION PLANS.
§ 4311. Establishment of office.
20170HB1704PN4190 - 5 -
<--
<--
<--
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
The Office of Information Technology is established within
the Governor's Office of Administration.
§ 4312. Duties of office.
(a) Duties generally.--The office shall:
(1) Consolidate information technology functions,
powers, duties, obligations infrastructure and support
services vested in State agencies.
(2) Direct the management and operations of information
technology services for each State agency, including, but not
limited to, the following:
(i) The development of priorities and strategic
plans.
(ii) The management of information technology
investments, procurement and policy.
(iii) Oversight of each State agency to ensure
compliance with the provisions of this chapter.
(3) Recommend any changes to staffing or operations
regarding information technology.
(b) Specific duties.--As part of the general duties under
subsection (a), the office shall:
(1) Assist in developing annual information technology
strategic plans for each State agency that include
priorities, coordination and monitoring of resource use and
expenditures, performance review measures, procurement and
other governance and planning measures.
(2) Review and approve the information technology plans
for each State agency.
(3) Consult with the Governor's Office of the Budget on
budgetary matters regarding information technology planning
and procurement.
20170HB1704PN4190 - 6 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(4) Create an advisory structure to advise on matters
involving overall technology and data governance.
(5) Establish and maintain an information technology
portfolio management process for overall monitoring of
information technology program objectives, alignment with
priorities, budgets and expenditures.
(6) Identify common information technology business
functions within each State agency.
(7) Make recommendations for consolidation, integration
and investment.
(8) Facilitate the use of common technology, as
appropriate.
(9) Expand the use of project management methodologies
and principles on information technology projects, including
measures to review project delivery and quality.
(10) Ensure compliance by each State agency with
required business process reviews.
(11) Maintain a central procurement organization.
(12) Procure or supervise the procurement of all
information technology.
(13) Oversee information technology contract issues,
monitoring and compliance.
(14) Serve as a liaison between State agencies and
contracted information technology vendors.
(15) Align the appropriate technology and procurement
methods with the service strategy.
(16) E stablish an information technology architecture
framework that governs information technology investments.
This architecture framework shall include the following, as
appropriate:
20170HB1704PN4190 - 7 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(i) The development of standards, policies,
processes and strategic technology roadmaps.
(ii) The performance of technical reviews and
capability assessments of services, technologies and
State agency systems.
(iii) The evaluation of requests for information
technology policy exceptions.
(17) Develop and implement efforts to standardize data
elements and determine data ownership assignments.
(18) Develop and maintain a comprehensive information
technology inventory.
(19) Monitor compliance with information technology
policy and standards through an architectural review process.
(20) Maintain and strengthen the Commonwealth's
cybersecurity posture through security governance.
(21) Develop security solutions, services and programs
to protect data and infrastructure.
(22) Identify and remediate security risks and maintain
citizen trust in securing computerized personal information.
(23) Implement programs, processes and solutions to
maintain cybersecurity situational awareness and effectively
respond to cybersecurity attacks and information technology
security incidents.
(24) Foster a culture of situational and risk awareness.
(25) Conduct evaluations and compliance audits of State
agency security infrastructure.
(26) Recommend and conduct the consolidation of State
agency information technology services, including, but not
limited to, infrastructure, personnel, investments,
operations and support services.
20170HB1704PN4190 - 8 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(27) Establish and facilitate a process for the
identification, evaluation and optimization of information
technology shared services.
(28) Establish, maintain and communicate service level
agreements for shared services.
(29) Establish a process for:
(i) the development and implementation of
telecommunications policies, services and infrastructure;
and
(ii) reviewing and authorizing State agency requests
for enhanced services.
(30) Identify opportunities for convergence and
leveraging existing assets to reduce or eliminate duplicative
telecommunication networks.
(31) Establish and maintain an information technology
service management process library to govern the services
provided to each State agency.
(32) Establish a formal governance body to evaluate the
introduction of new information technology services and the
retiring of existing information technology services.
(33) Establish metrics to monitor the health of the
services provided and make appropriate corrections as
necessary.
(34) Establish information technology data management
and development policy frameworks for each State agency that
include policies, processes and standards that adhere to
commonly-accepted principles for, among other things, data
governance, data development and the quality, sourcing, use,
accessibility, content, ownership and licensing of open data.
(35) Create and maintain a comprehensive open data
20170HB1704PN4190 - 9 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
portal for public accessibility.
(36) Provide guidance regarding the procurement of
supplies and services related to the subject matter of this
chapter.
(37) Facilitate communication with the public by
publishing open data plans and policies and by soliciting or
allowing for public input on the subject matter of this
chapter.
(38) Ensure the internal examination of Commonwealth
data sets for business, confidentiality, privacy and security
issues and the reasonable mitigation of those issues, prior
to the data's release for open data purposes.
(39) Develop and facilitate the engagement with private
and other public stakeholders, including, but not limited to,
arranging for and expediting data-sharing agreements and
encouraging and facilitating cooperation and substantive and
administrative efficiencies.
(40) Develop and facilitate data sharing and data
analytics.
(41) Oversee and manage the information technology
contracts of each State agency. The following shall apply:
(i) The office shall obtain, review and maintain, on
an ongoing basis, records of the appropriations,
allotments, expenditures and revenues of each State
agency for information technology.
(ii) The office shall not manage but shall
coordinate efforts as necessary and appropriate regarding
the information technology contracts of an independent
department, the General Assembly and its agencies or the
agencies of the judicial branch.
20170HB1704PN4190 - 10 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
§ 4313. Transfer of duties.
Upon the effective date of this chapter, information
technology functions, powers, duties, obligations and services
shall be transferred to and vested in the office. The following
shall apply:
(1) The c hief information officer of each State agency
shall:
(i) Report directly to the director.
(ii) Work within the chief information officer's
respective State agency on behalf of the office as an
employee of the office.
(2) The salary and costs related to the chief
information officer of each State agency shall be paid by the
chief information officer's respective State agency from
funds appropriated for general government operations.
(3) The following shall apply for an employee of a State
agency who handles or otherwise has responsibility for the
State agency's information technology services:
(i) Except as provided in subparagraph (ii), the
employee shall be transferred to the office as an
employee of the State agency and operate in the physical
location of the State agency, but the employee shall
report matters to the office and be supervised by the
office.
(ii) Subparagraph (i) shall not apply to an employee
who handles proprietary information technology programs.
The employee shall remain an employee of the State agency
and shall coordinate with the office.
§ 4314. Director.
(a) Appointment and salary.--The secretary shall appoint the
20170HB1704PN4190 - 11 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
director and set the salary of the director.
(b) Qualifications.--The director shall be qualified by
education and experience for the office.
(c) Duties.--In addition to other duties specified under
this chapter, the director shall manage the operations of the
office and do all of the following:
(1) Develop and administer a comprehensive long-range
plan to ensure the proper management of the Commonwealth's
information technology resources.
(2) Set technical standards for information technology
and review and approve information technology projects and
budgets.
(3) Establish information technology security standards.
(4) Provide for the procurement of information
technology resources.
(5) Develop a schedule for the replacement or
modification of information technology systems.
(6) Require and review reports by each State agency
concerning information technology assets, systems, personnel
and projects and prescribe the form of the reports.
(7) Prescribe the manner in which information technology
assets, systems and personnel shall be provided and
distributed among State agencies.
(8) Prescribe the manner of inspecting or testing
information technology assets, systems or personnel to
determine compliance with information technology plans,
specifications and requirements.
(9) Hire personnel as necessary to perform the functions
of the office.
§ 4315. P lanning and financing information technology
20170HB1704PN4190 - 12 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
resources.
(a) Development of policies.--The director shall develop
necessary policies for State agency information technology
planning and financing to achieve the purposes of this chapter.
(b) Development of plan.--
(1) T he director shall analyze the information
technology systems and develop a plan to ascertain the needs,
costs and time frame required for State agencies to
efficiently use information technology systems, resources,
security and data management to achieve the purposes of this
chapter. The plan may include current applications and
infrastructure, migration from current environments and other
information necessary for fiscal or technology planning.
(2) The director shall develop strategic plans for
information technology as necessary.
(c) Consultation and cooperation.--
(1) In determining whether a strategic plan is necessary
for a State agency, the director shall consider the State
agency's operational needs, functions and performance
capabilities.
(2) The director shall consult with and assist State
agencies in the preparation of plans under this subsection.
(3) Each State agency shall actively participate in
preparing, testing and implementing an information technology
plan as determined by the director. A State agency shall
provide all financial information to the director necessary
to determine full costs and expenditures for information
technology assets, including resources provided by the State
agency or through contracts or grants.
(4) Each State agency shall prepare and submit plans as
20170HB1704PN4190 - 13 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
required by the director.
(5) A plan by a State agency shall be submitted to the
director no later than October 1 of each even-numbered year.
(d) Biennial plan.--
(1) The director shall develop a biennial State
Information Technology Plan, which shall be transmitted to
the General Assembly in conjunction with the Governor's
budget submission that year.
(2) The biennial plan shall include the following
elements:
(i) An inventory of current information technology
assets and major projects.
(ii) An inventory of significant unmet needs for
information technology resources over a five-year time
period, along with a ranking of the unmet needs in
priority order according to their urgency.
(iii) A statement of the financial requirements,
together with a recommended funding schedule for major
projects in progress or anticipated for approval during
the upcoming fiscal biennium.
(iv) An analysis of opportunities for Statewide
initiatives that would yield significant efficiencies or
improve effectiveness in State programs.
(3) As used in this subsection, the term "major project"
includes a project costing more than $500,000 to implement.
§ 4316. Information Technology Fund.
(a) Establishment.-- A restricted AN account is established
in the State Treasury GENERAL FUND to be known as the
Information Technology Fund.
(b) Receipt of money.--The fund may receive money for the
20170HB1704PN4190 - 14 -
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
operations of the office and to fulfill the duties of the office
under this chapter by the following methods:
(1) The transfer of encumbered funds from each State
agency which were designated for information technology
purposes prior to the effective date of this section.
(2) Transfers as authorized by the General Assembly that
are not already provided for under this section.
(3) Appropriations from the General Fund.
(4) (3) The transfer of a portion of a State agency's
funds regarding general government operations for information
technology employees.
(c) Use of fund money.--
(1) Subject to paragraph (2), the director shall approve
the disbursement of money from the fund, which shall be used
for the following purposes and other legitimate purposes:
(i) P roject management.
(ii) Security.
(iii) E-mail operations.
(iv) State portal operations.
(2) Expenditures made from the fund which involve money
appropriated from the General Fund shall be approved by the
director.
§ 4317. I nformation technology reports.
(a) Report on office operations.--By February 1 of each
year, the director shall issue an annual report regarding the
office, which shall, at a minimum, include the following:
(1) Current cash balances.
(2) Line-item details on expenditures which occurred
following the previous biennial report.
(3) Anticipated expenditures and revenues.
20170HB1704PN4190 - 15 -
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(4) The financial activities of the fund, including fund
expenditures, during the immediately prior fiscal year.
(b) Issuance.--A report under subsection (a) shall be
submitted to the following:
(1) The Secretary of the Budget.
(2) The Independent Fiscal Office.
(3) The chairperson and minority chairperson of the
Appropriations Committee of the Senate.
(4) The chairperson and minority chairperson of the
Appropriations Committee of the House of Representatives.
§ 4318 4317 . Financial reporting and accountability AND
INFORMATION TECHNOLOGY .
(a) Development of processes.--The office, along with the
Secretary of the Budget and the State Treasurer, shall develop
processes for budgeting and accounting of expenditures for
information technology operations, services, projects,
infrastructure and assets across all State agencies.
(b) Included information.--T he budgeting and accounting
processes under subsection (a) may include information regarding
the following:
(1) Hardware.
(2) S oftware.
(3) Personnel.
(4) Training.
(5) Contractual services.
(6) Other items relevant to information technology.
(c) Reports.--By February 1 of each year, the director shall
also report to the General Assembly the following information:
(1) Services currently provided and associated
transaction volumes or other relevant indicators of
20170HB1704PN4190 - 16 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
utilization by user type.
(2) New services added during the previous year.
(3) Services added that are currently available in other
states.
(4) The total amount collected for each service.
(5) The total amount remitted to the State for each
service.
(3) THE TOTAL APPROPRIATION FOR EACH SERVICE.
(6) (4) The total amount remitted to the vendor for each
service.
(7) (5) Any other use of State data by the vendor and
the total amount of revenue collected per use and in total.
(8) (6) User satisfaction with each service.
(9) (7) Any other issues associated with the provision
of each service.
(D) FINANCIAL INFORMATION.--THE DIRECTOR SHALL, AT A
MINIMUM, INCLUDE IN THE REPORT UNDER SUBSECTION (C) THE
FOLLOWING FINANCIAL INFORMATION:
(1) CURRENT BUDGETARY BALANCES FOR THE FUND AND EACH
INFORMATION TECHNOLOGY PROJECT.
(2) LINE-ITEM DETAILS ON EXPENDITURES.
(3) ANTICIPATED EXPENDITURES FOR THE NEXT THREE YEARS.
(4) THE FINANCIAL ACTIVITIES OF THE FUND, INCLUDING FUND
EXPENDITURES, DURING THE IMMEDIATELY PRIOR FISCAL YEAR.
(E) ISSUANCE.--IN ADDITION TO THE GENERAL ASSEMBLY, A REPORT
UNDER SUBSECTION (C) SHALL BE SUBMITTED TO THE FOLLOWING:
(1) THE SECRETARY OF THE BUDGET.
(2) THE INDEPENDENT FISCAL OFFICE.
(3) THE GENERAL ASSEMBLY.
§ 4319 4318 . Statewide electronic portal and annual report.
20170HB1704PN4190 - 17 -
<--
<--
<--
<--
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
The office shall develop and operate a Statewide electronic
portal to increase the convenience of the public in conducting
online transactions with and obtaining information from State
government. The portal shall be designed to facilitate and
improve public interactions along with communications between
State agencies.
§ 4320 4319 . B udget for information technology.
The office, along with the Secretary of the Budget, shall
develop and implement a plan to manage all information
technology funding, including State and other receipts, as soon
as practicable. As part of the plan and implementation, the
following shall apply:
(1) F unding for information technology resources,
projects and contracts shall be appropriated to and managed
by the office.
(2) Funding for the office's information technology
shared services and approved contracts shall remain with the
State agencies.
(3) Information technology budget codes and fund codes
shall be created as required.
§ 4321 4320 . Commonwealth portal.
Each State agency shall functionally link its Internet or
electronic services to a centralized web portal system
established under this chapter.
§ 4322 4321 . Information technology request.
A State agency may request significant resources, as defined
by the director, for the purpose of acquiring, operating or
maintaining information technology for the State agency. In
addition to other information that may be required by the
director, the State agency shall submit the following to
20170HB1704PN4190 - 18 -
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
accompany the request:
(1) A s tatement setting forth the following:
(i) The needs of the State agency for information
technology and related resources, including expected
improvements to programmatic or business operations.
(ii) The requirements for State resources, together
with an evaluation of those requirements by the chief
information officer assigned to the State agency which
takes into consideration the following:
(A) The State's current technology.
(B) The opportunities for technology sharing.
(C) Any other factors relevant to the analysis
by the director.
(2) A review and evaluation of the statement under
paragraph (1) which is prepared by the chief information
officer assigned to the State agency.
(3) In cases of an acquisition, an explanation of the
method by which the acquisition is to be financed.
(4) A statement by the chief information officer
assigned to the State agency which sets forth viable
alternatives, if any, for meeting the State agency needs in
an economical and efficient manner.
§ 4322. STATUS OF INFORMATION TECHNOLOGY PROJECTS AND
CORRECTIVE ACTION PLANS.
(A) PORTAL.--WITHIN ONE YEAR OF THE EFFECTIVE DATE OF THIS
ACT, THE DIRECTOR SHALL DEVELOP A WEB-BASED PORTAL DETAILING THE
STATUS OF EACH OF THE COMMONWEALTH'S INFORMATION TECHNOLOGY
PROJECTS. THE PORTAL SHALL INCLUDE THE FOLLOWING:
(1) A BRIEF SUMMARY OF EACH INFORMATION TECHNOLOGY
PROJECT.
20170HB1704PN4190 - 19 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(2) THE APPROVED BUDGET OF EACH PROJECT.
(3) THE TOTAL AND PERCENT OF THE PROJECT'S APPROVED
BUDGET WHICH HAS BEEN EXPENDED BY THE AGENCY BASED ON THE END
BALANCE FROM THE PRIOR BUSINESS DAY, ALONG WITH A COLOR
DESIGNATION AS FOLLOWS:
(I) IF AN INFORMATION TECHNOLOGY PROJECT IS UNDER
THE PROJECT'S APPROVED BUDGET, THE PROJECT SHALL BE
DESIGNATED AS THE COLOR GREEN.
(II) IF AN INFORMATION TECHNOLOGY PROJECT IS OVER
THE PROJECT'S APPROVED BUDGET, THE PROJECT SHALL BE
DESIGNATED AS THE COLOR RED.
(4) THE COMPLETION DATE IN THE ORIGINAL CONTRACT ALONG
WITH THE TOTAL PERCENT OF WORK FOR THE PROJECT THAT HAS BEEN
COMPLETED, ALONG WITH A COLOR DESIGNATION AS FOLLOWS:
(I) IF AN INFORMATION TECHNOLOGY PROJECT HAS NOT
EXCEEDED THE COMPLETION DATE IN THE ORIGINAL CONTRACT,
THE PROJECT SHALL BE DESIGNATED AS GREEN.
(II) IF AN INFORMATION TECHNOLOGY PROJECT HAS
EXCEEDED THE COMPLETION DATE IN THE ORIGINAL CONTRACT,
THE PROJECT SHALL BE DESIGNATED AS RED.
(5) A SUMMARY OF THE SCOPE OF WORK, ALONG WITH A COLOR
DESIGNATION AS FOLLOWS:
(I) IF AN INFORMATION TECHNOLOGY PROJECT IS MEETING
THE SCOPE OF WORK IN THE ORIGINAL CONTRACT, THE PROJECT
SHALL BE DESIGNATED AS THE COLOR GREEN.
(II) IF AN INFORMATION TECHNOLOGY PROJECT IS NOT
MEETING THE SCOPE OF WORK IN THE ORIGINAL CONTRACT, THE
PROJECT SHALL BE DESIGNATED AS THE COLOR RED.
(6) A SUMMARY OF THE PERFORMANCE REQUIREMENTS OF THE
CONTRACT, ALONG WITH A COLOR DESIGNATION AS FOLLOWS:
20170HB1704PN4190 - 20 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(I) IF AN INFORMATION TECHNOLOGY PROJECT IS MEETING
THE PERFORMANCE REQUIREMENTS IN THE ORIGINAL CONTRACT,
THE PROJECT SHALL BE DESIGNATED AS THE COLOR GREEN.
(II) IF AN INFORMATION TECHNOLOGY PROJECT IS NOT
MEETING THE PERFORMANCE MEASURES IN THE ORIGINAL
CONTRACT, THE PROJECT SHALL BE DESIGNATED AS THE COLOR
RED.
(B) NOTIFICATION.--THE FOLLOWING SHALL APPLY:
(1) UPON DETERMINING THAT AN INFORMATION TECHNOLOGY
PROJECT WILL BE DESIGNATED RED, THE DIRECTOR SHALL NOTIFY THE
GOVERNOR'S OFFICE, THE INDEPENDENT FISCAL OFFICE AND THE
GENERAL ASSEMBLY.
(2) UPON BEING NOTIFIED THAT THE INFORMATION TECHNOLOGY
PROJECT IS DESIGNATED AS RED, THE DIRECTOR SHALL DEVELOP A
CORRECTIVE ACTION PLAN TO ENSURE THAT THE INFORMATION
TECHNOLOGY PROJECT MOVES BACK TO GREEN STATUS.
(3) THE CORRECTIVE ACTION PLAN SHALL BE FINALIZED WITHIN
20 DAYS FROM THE NOTIFICATION. THE FINALIZED CORRECTIVE
ACTION PLAN SHALL BE SENT TO THE GENERAL ASSEMBLY, THE
INDEPENDENT FISCAL OFFICE AND THE AUDITOR GENERAL.
SUBCHAPTER C
PROCUREMENT AND BUSINESS OPERATIONS
Sec.
4331. Reporting requirements regarding procurement.
4332. Business continuity planning.
4333. Information technology operations.
4334. Communications services.
4335. Project approval standards.
4336. Project management standards.
4337. Dispute resolution.
20170HB1704PN4190 - 21 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
4338. Procurement of information technology.
4339. CONTRACTOR VERIFICATION.
4339 4340 . Review and approval of contracts.
4340 4341 . Purchase of certain equipment prohibited.
4341 4342 . Refurbished computer equipment purchasing program.
4342 4343 . Data on reliability and other matters.
§ 4331. Reporting requirements regarding procurement.
(a) Bids.--A vendor submitting a bid OR PROPOSAL shall
disclose in a statement, provided contemporaneously with the bid
OR PROPOSAL , where services will be performed under the contract
sought, including any subcontracts, and whether any services
under that contract, including any subcontracts, are anticipated
to be performed outside the United States.
(b) Retention and reports.--The di rector shall:
(1) retain the statements required by this section
regardless of the State agency that awards the contract; and
(2) report annually to the secretary on the number of
contracts.
(c) Records of purchases.--Each State agency which makes a
direct purchase of information technology through the office
shall report directly to the director, who shall keep annual
records of information technology purchases.
(d) Effect of section.--Nothing in this section is intended
to contravene any existing treaty, law, agreement or regulation
of the United States.
§ 4332. B usiness continuity planning.
(a) Oversight.--The director shall oversee the manner and
means by which information technology business and disaster
recovery plans for State agencies are created, reviewed and
updated.
20170HB1704PN4190 - 22 -
<--
<--
<--
<--
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(b) Disaster recovery planning team.--Each State agency
shall establish a disaster recovery planning team to work with
the office to develop the disaster recovery plan and administer
and implement the plan.
(c) Components of plan.--In developing a disaster recovery
plan, all of the following shall be completed:
(1) Consideration of the organizational, managerial and
technical environments in which the plan must be implemented.
(2) An assessment of the types and likely parameters of
disasters most likely to occur and the resultant impacts on
the State agency's ability to perform its mission.
(3) The listing of the protective measures to be
implemented in anticipation of a natural or manmade disaster.
(4) A determination whether the plan is adequate to
address information technology security incidents.
(d) Submittal.--Each State agency shall submit its disaster
recovery plan to the director on an annual basis and as
otherwise requested by the director.
§ 4333. I nformation technology operations.
(a) Functions.--In addition to other functions authorized or
required by this chapter, the office shall do the following:
(1) S ubmit all rates and fees for common, shared and
Statewide information technology services provided by the
office to the Budget Office for approval.
(2) (1) Establish and operate centers of expertise for
specific information technologies and services to serve two
or more State agencies on a cost-sharing basis, if the
director, after consultation with the Budget Office, decides
it is advisable from the standpoint of efficiency and
economy to establish these centers and services.
20170HB1704PN4190 - 23 -
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(3) Charge each State agency for which services are
performed its proportionate part of the cost of maintaining
and operating the shared centers and services, subject to
approval by the Budget Office.
(4) (2) Require a State agency served to transfer to the
department ownership, custody or control of information
processing equipment, supplies and positions required by the
shared centers and services.
(5) (3) Adopt plans, policies and procedures for the
acquisition, management and use of information technology
resources in State agencies to facilitate more efficient and
economic use of information technology in the State agencies.
(6) (4) Develop and promote training programs to
efficiently implement, use and manage information technology
resources throughout State government.
(b) Confidentiality.--No data of a confidential nature shall
be entered into or processed through an information technology
system or network established under this chapter until
appropriate safeguards and other security measures are approved
by the director and installed and fully operational.
(c) Cost sharing.--Notwithstanding any other provision of
law, the office shall provide information technology services on
a cost-sharing basis to:
(1) An independent department as requested by the head
of the independent department.
(2) The General Assembly and its agencies as requested
by the President pro tempore of the Senate and the Speaker of
the House of Representatives.
(3) The judicial branch as requested by the Chief
Justice.
20170HB1704PN4190 - 24 -
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(d) Estimates and actual expenditures.--Each State agency
shall furnish to the director upon request and on forms
prescribed:
(1) estimates of all information technology goods and
services needed and required by the State agency; and
(2) actual expenditures for all information technology
goods and services needed and required by the State agency
for the periods after the expenditures have been made.
§ 4334. Communications services.
The director shall exercise authority for telecommunications
and other communications included in information technology
relating to the internal management and operations of a State
agency. In discharging this responsibility, the director shall
do the following:
(1) Provide for the establishment, management and
operation, through State ownership, by contract or through
commercial leasing, of the following systems and services as
they affect the internal management and operation of State
agencies:
(i) C entral telephone systems and telephone
networks, including Voice over Internet Protocol and
commercial mobile radio systems.
(ii) Satellite services.
(iii) Closed-circuit television systems.
(iv) Two-way radio systems.
(v) Microwave systems.
(vi) Related systems based on telecommunication
technologies.
(vii) Broadband.
(2) Coordinate the development of cost-sharing systems
20170HB1704PN4190 - 25 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
for respective State agencies for their proportionate parts
of the cost of maintenance and operation of the systems and
services listed in this section.
(3) A ssist in the development of coordinated
telecommunications services or systems within and among all
State agencies and recommend, where appropriate, cooperative
utilization of telecommunication facilities by aggregating
users.
(4) Perform traffic analysis and engineering for all
telecommunications services and systems listed in this
section.
(5) Establish telecommunications specifications and
designs so as to promote and support compatibility of the
systems within State agencies.
(6) Provide every three years an inventory of
telecommunications costs, facilities, systems and personnel
within State agencies.
(7) Promote, coordinate and assist in the design and
engineering of emergency telecommunications systems,
including, but not limited to, the 911 emergency telephone
number program, emergency medical services, and other
emergency telecommunications services.
(8) Perform frequency coordination and management for
State agencies and municipalities, including all public
safety radio service frequencies, in accordance with the
rules and regulations of the Federal Communications
Commission or any successor Federal agency.
(9) Advise all State agencies on telecommunications
management planning and related matters and provide
opportunities for training to users within State agencies in
20170HB1704PN4190 - 26 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
telecommunications technology and systems.
(10) Assist and coordinate the development of policies
and long-range plans, consistent with the protection of
residents' rights to privacy and access to information, for
the acquisition and use of telecommunications systems. All
policies and plans shall be based on current information
about the Commonwealth's telecommunications activities in
relation to the full range of emerging technologies.
§ 4335. Project approval standards.
(a) Review and approval.--The director shall review all
PROPOSED information technology projects for each State agency.
Project approval may be granted upon the director's
determination that:
(1) the project conforms to project management
procedures and policies and to procurement rules and
policies; and
(2) sufficient funds are available for implementation.
(b) Implementation.--Unless expressly exempt within this
chapter, no State agency shall proceed with an information
technology project until the director approves the project.
(c) Disapproval.--If a project is not approved, the director
shall specify in writing the grounds for the disapproval no
later than 15 business days after making the determination. The
director shall provide notice of the disapproval, along with the
grounds for the disapproval, to all of the following:
(1) The State agency.
(2) The Secretary of the Budget.
(3) The Independent Fiscal Office.
(4) The chairperson and minority chairperson of the
Appropriations Committee of the Senate.
20170HB1704PN4190 - 27 -
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(5) The chairperson and minority chairperson of the
Appropriations Committee of the House of Representatives.
(4) THE GENERAL ASSEMBLY.
(d) Suspension.--
(1) The director may suspend an information technology
project if the project:
(i) does not continue to meet the applicable quality
assurance standards;
(ii) has exceeded its projected costs; or
(iii) has failed to meet its projected completion
date.
(2) If the director suspends a project for a reason
under paragraph (1), the director shall specify in writing
the grounds for suspending the project no later than five
business days after making the determination. The director
shall provide notice of the suspension, along with the
grounds for suspension, to all of the following:
(i) The State agency.
(ii) The Secretary of the Budget.
(iii) The Independent Fiscal Office.
(iv) The chairperson and minority chairperson of the
Appropriations Committee of the Senate.
(v) The chairperson and minority chairperson of the
Appropriations Committee of the House of Representatives.
(II) THE INDEPENDENT FISCAL OFFICE.
(III) THE AUDITOR GENERAL.
(IV) THE SECRETARY OF THE BUDGET.
(V) THE STATE TREASURER.
(VI) THE GENERAL ASSEMBLY.
(3) After a project has been suspended, the State
20170HB1704PN4190 - 28 -
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Treasurer may not allow the transfer of money from the State
agency to further implement the project unless the director
approves an amended version of the plan for the project.
(4) If a State agency attempts to continue to implement
a project that is no longer approved by the director and
expend additional money for the project, the State Treasurer
shall prevent the transfer of funds and remit the intended
expenditures into the fund. After remitting the unauthorized
expenditure, the State Treasurer shall immediately notify the
following:
(i) The director.
(ii) The Secretary of the Budget.
(iii) The chairperson and minority chairperson of
the Appropriations Committee of the Senate.
(iv) The chairperson and minority chairperson of the
Appropriations Committee of the House of Representatives.
(II) THE GOVERNOR.
(III) THE SECRETARY OF THE BUDGET.
(IV) THE GENERAL ASSEMBLY.
(e) Quality assurance.--Information technology projects
authorized under this chapter shall meet all project standards
and requirements established under this chapter.
(f) Performance contracting.--All contracts between a State
agency and a private party for information technology projects
shall include provisions for vendor performance review and
accountability, contract suspension or termination and
termination of funding.
(g) Contract provisions.--
(1) The director may require the following contract
provisions:
20170HB1704PN4190 - 29 -
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(i) A performance bond.
(ii) Monetary penalties.
(iii) Other performance assurance measures for
projects that are not completed within the specified time
period or that involve costs in excess of those specified
in the contract.
(2) Notwithstanding the provisions under paragraph (1)
which are included in the contract, the director shall have
the authority to suspend the project that is the basis of the
contract.
(h) Cost savings.--The director may utilize cost savings
realized on government vendor partnerships as performance
incentives for an information technology vendor.
(i) Use of experts.--
(1) Notwithstanding any other provision of this chapter
to the contrary, the director may require a State agency to
engage the services of private counsel or other experts with
information technology and intellectual property expertise on
a particular subject matter if the State agency is developing
and implementing an information technology project with a
total cost of ownership in excess of $5,000,000.
(2) At the director's discretion, the private counsel or
other expert under paragraph (1) may:
(i) Review requests for proposals OR INVITATION FOR
BIDS .
(ii) Review and provide advice and assistance during
the evaluation of proposals OR BIDS and selection of
vendors CONTRACTORS .
(iii) Review and negotiate contracts associated with
the development, implementation, operation and
20170HB1704PN4190 - 30 -
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
maintenance of the project.
(3) At the director's discretion, the requirement under
paragraph (1) may also apply to information technology
programs that are separated into individual projects, if the
total cost of ownership for the overall program exceeds
$5,000,000.
§ 4336. Project management standards.
(a) Personnel.-- Each State agency shall provide personnel if
necessary to participate in project management, implementation,
testing and other activities for an information technology
project.
(b) Policies.--The director shall develop office policies
for implementing an approved project, whether the project is
undertaken in single or multiple phases or components.
(c) Project management assistant.--
(1) The director may designate a project management
assistant to implement an information technology project of a
State agency.
(2) A project management assistant for a State agency
shall:
(i) Advise the State agency regarding the initial
planning of an information technology project, the
content and design of a request for proposals, contract
development, procurement and architectural and other
technical reviews.
(ii) Monitor progress in the development and
implementation of an information technology project.
(iii) Provide status reports to the State agency and
the director, including recommendations regarding
continued approval of an information technology project.
20170HB1704PN4190 - 31 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(3) Personnel of the State agency to which a project
management assistant is designated shall provide periodic
reports to the project management assistant regarding an
information technology project. Each report shall include
information regarding the following:
(i) The State agency's business requirements.
(ii) Applicable laws and regulations.
(iii) Project costs.
(iv) Issues related to hardware, software or
training.
(v) Projected and actual completion dates for the
project.
(vi) Any other information related to the
implementation of the project.
§ 4337. D ispute resolution.
(a) Right to request for review.--If the director has
disapproved or suspended an information technology project or
has disapproved a State agency's request for an amended version
of the plan for the project, the affected State agency may
request the director to revisit the determination about the
project. The request for review shall be submitted in writing to
the director within 15 business days following the State
agency's receipt of the disapproval or suspension.
(b) Contents of request for review.--A request for review
under subsection (a) shall specify the grounds for the State
agency's disagreement with the director's determination. The
State agency shall include with its request a plan to modify the
project to meet the director's concerns.
(c) Notification.--
(1) Within 30 days after initial receipt of a State
20170HB1704PN4190 - 32 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
agency's request for review, the director shall notify the
State agency whether or not the project, as modified, may be
implemented.
(2) If the director approves the implementation of a
modified project by a State agency, the director shall notify
the State Treasurer and the Secretary of the Budget
immediately.
§ 4338. Procurement of information technology.
(a) General duty of office.--Notwithstanding any other
provision of law, the office shall procure all information
technology for State agencies UTILIZING THE PROCESSES UNDER 62
PA.C.S. CH. 5 (RELATING TO SOURCE SELECTION AND CONTRACT
FORMATION) . The office shall integrate technological review,
cost analysis and procurement for all information technology
needs of State agencies to make procurement and implementation
of technology more responsive, efficient and cost-effective.
(b) Specific duties of office.--Subject to the provisions of
this chapter AND CONSISTENT WITH THE PROCESSES ENACTED UNDER 62
PA.C.S. CH. 5 , the office shall have the authority and
responsibility to do the following:
(1) Purchase or contract for all information technology
for State agencies.
(2) Establish processes, specifications and standards
which shall apply to all information technology to be
purchased, licensed or leased by State agencies.
(3) Establish processes, specifications and standards
relating to information technology personal services contract
requirements for State agencies.
(4) Utilize the purchasing benchmarks established by the
director.
20170HB1704PN4190 - 33 -
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(5) Provide strategic sourcing resources and planning to
compile and consolidate all estimates of information
technology goods and services needed and required by State
agencies.
(6) Reduce the size of information technology projects
to ensure that the projects are manageable and meet initial
estimates for project costs and completion dates.
(7) Ensure that projects utilize problem-based
procurement. As used in this paragraph, the term "problem-
based procurement" means a request for bids by a State agency
for an information technology project which details the
information technology needs of the State agency and solicits
proposals by bidders regarding how to best meet those needs.
( c) Confidentiality.--
(1) Subject to paragraph (2), contract information
compiled by the office shall be made a matter of public
record after the award of contract.
(2) Trade secrets, test data and similar proprietary
information and security information protected from
disclosure under Federal or State law shall remain
confidential.
(d) Electronic procurement.--The office may authorize the
use of an electronic procurement system to conduct a reverse
auction and electronic bidding. The following apply:
(1) The vendor's price may be revealed during the
reverse auction.
(2) The office may contract with a third-party vendor to
conduct the reverse auction.
(3) Offers OR BIDS may be accepted and contracts may be
entered by use of electronic bidding.
20170HB1704PN4190 - 34 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(4) All requirements relating to formal and competitive
bids, including advertisement, seal and signature, are
satisfied when a procurement is conducted or a contract is
entered in compliance with the reverse auction or electronic
bidding requirements established by the office.
(e) Bulk purchasing.--
(1) The director shall establish procedures for the
procurement of information technology through bulk purchases.
The procedures may include the following:
(i) The aggregation of hardware purchases.
(ii) The use of formal bid procedures.
(iii) Restrictions on supplemental staffing.
(iv) Enterprise software licensing, hosting and
multiyear maintenance agreements.
(2) The director may require State agencies to submit
information technology procurement requests to the department
on October 1, January 1 and June 1, or another regularly
occurring schedule, of each fiscal year in order to allow for
bulk purchasing.
(f) Most advantageous offer.--All BIDS OR offers to
contract, whether through competitive SEALED bidding or other
procurement method UNDER 62 PA.C.S. CH. 5 , shall be subject to
evaluation and selection by acceptance of the most advantageous
offer to the Commonwealth.
(g) Considerations.--E valuation of an information technology
purchase shall take into consideration the following factors:
(1) The best value of the purchase.
(2) Compliance with information technology project
management policies.
(3) Compliance with information technology security
20170HB1704PN4190 - 35 -
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
standards and policies.
(4) Substantial conformity with the specifications and
other conditions set forth in the solicitation.
(h) Exceptions.--In addition to permitted waivers of
competition, the requirements of competitive bidding shall not
apply to information technology contracts and procurements:
(1) in the case of a pressing need or an emergency
arising from an information technology security incident; or
(2) in the use of master licensing or purchasing
agreements governing the office's acquisition of proprietary
intellectual property.
(i) Award by director.--The director may award a cost plus
percentage of cost contract for information technology projects.
As needed, the director shall report the cost plus percentage of
cost contract to the following:
(1) The Secretary of the Budget.
(2) The Auditor General.
(3) The chairperson and minority chairperson of the
Appropriations Committee of the Senate.
(4) The chairperson and minority chairperson of the
Appropriations Committee of the House of Representatives.
(3) THE GENERAL ASSEMBLY.
§ 4339. CONTRACTOR VERIFICATION.
(A) GENERAL RULE.--A CONTRACT FOR PROFESSIONAL OR TECHNICAL
SERVICES IN WHICH THE COST TO THE COMMONWEALTH EXCEEDS $100,000
SHALL REQUIRE A CONTRACTOR WORKING WITH A STATE AGENCY ON A
PROJECT TO USE SOFTWARE THAT VERIFIES THAT THE HOURS BILLED ON A
CONTRACT WITH THE STATE AGENCY ARE VALID AND FULFILL THE PURPOSE
OF THE CONTRACT.
(B) CONTRACT SPECIFICATIONS.--A CONTRACT SHALL SPECIFY THAT
20170HB1704PN4190 - 36 -
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
A STATE AGENCY MAY NOT PAY FOR HOURS WORKED ON A PROJECT THAT
ARE PERFORMED ON A COMPUTER UNLESS THE HOURS CAN BE VERIFIED
THROUGH THE USE OF THE SOFTWARE OR DATA COLLECTED BY THE
SOFTWARE.
(C) SOFTWARE REQUIREMENTS.--THE SOFTWARE INCORPORATED BY A
CONTRACTOR TO MEET THE REQUIREMENTS OF THIS SECTION SHALL DO THE
FOLLOWING:
(1) PERMIT THE STATE AGENCY OR AN AUDITOR OF THE STATE
AGENCY TO HAVE REAL-TIME OR RETROACTIVE ACCESS TO DATA
COLLECTED BY THE SOFTWARE.
(2) AUTOMATICALLY CAPTURE A SCREENSHOT OF ACTIVITY AS
FOLLOWS:
(I) THE SOFTWARE SHALL CAPTURE A SCREENSHOT AT LEAST
ONCE EVERY THREE MINUTES.
(II) A SCREENSHOT SHALL BE MADE AVAILABLE FOR REVIEW
BY THE STATE AGENCY OR AN AUDITOR OF THE STATE AGENCY IN
REAL-TIME AND RETROACTIVELY.
(III) TRACK TOTAL KEYSTROKE AND MOUSE EVENT
FREQUENCY.
(IV) BE PROCURED BY THE CONTRACTOR FROM AN
INDEPENDENT ENTITY.
(3) PROVIDE THE STATE AGENCY OR AN AUDITOR OF THE STATE
AGENCY AN AUTOMATED REAL-TIME COST STATUS OF EACH TASK
RELATING TO THE CONTRACT.
(4) PROVIDE THE STATE AGENCY PROFESSIONAL BIOGRAPHICAL
INFORMATION THAT IS NOT PRIVATE OR CONFIDENTIAL ON
INDIVIDUALS PERFORMING TASKS UNDER THE CONTRACT.
(5) PROTECT ALL DATA THAT IS PRIVATE OR CONFIDENTIAL ON
INDIVIDUALS CONSISTENT WITH PENNSYLVANIA LAW.
(6) PERMIT THE STATE AGENCY TO PROVIDE IMMEDIATE
20170HB1704PN4190 - 37 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
FEEDBACK TO THE CONTRACTOR ON WORK IN PROGRESS UNDER THE
CONTRACT.
(D) DATA STORAGE.--THE CONTRACTOR SHALL STORE, OR CONTRACT
TO STORE, THE DATA COLLECTED BY THE SOFTWARE REQUIRED UNDER THIS
SECTION FOR A PERIOD OF NO LESS THAN SEVEN YEARS AFTER THE STATE
AGENCY HAS REMITTED PAYMENT TO THE CONTRACTOR FOR WORK UNDER THE
CONTRACT.
(E) REQUESTS FOR DATA.--DATA COLLECTED BY THE SOFTWARE
DURING THE CONTRACT PERIOD SHALL NOT BE CONSIDERED GOVERNMENT
DATA AND THE CONTRACTOR SHALL RETRIEVE THE DATA UPON REQUEST OF
THE STATE AGENCY, IN THE FORMAT REQUESTED BY THE STATE AGENCY,
AT ANY TIME DURING THE SEVEN-YEAR PERIOD.
(F) CHARGE PROHIBITED.--THE CONTRACTOR MAY NOT CHARGE THE
STATE AGENCY OR AN AUDITOR OF THE STATE AGENCY FOR ACCESS TO OR
USE OF THE SOFTWARE OR FOR ACCESS TO OR RETRIEVALS OF DATA
COLLECTED BY THE SOFTWARE.
§ 4339 4340 . R eview and approval of contracts.
(a) Submittal to director.--When the dollar value of a
proposed contract for the procurement of information technology
equipment, materials or supplies exceeds the benchmark
established under this chapter or by the director, a State
agency shall submit the proposed contract to the director for
review and approval or other action deemed appropriate by the
director.
(b) Considerations.--T he director shall determine whether
the proposed contract under subsection (a) ensures compliance
with the established processes, specifications and standards
applicable to the information technology purchased, licensed or
leased in this Commonwealth, including established procurement
processes.
20170HB1704PN4190 - 38 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(c) Determination.--T he director shall promptly notify the
State agency of the determination regarding the proposed
contract under subsection (a).
(d) Notification.--For contract awards greater than $25,000
$100,000 , the director shall provide updates on a quarterly AN
ANNUAL basis to the following:
(1) The chairperson and minority chairperson of the
Appropriations Committee of the Senate.
(2) The chairperson and minority chairperson of the
Appropriations Committee of the House of Representatives.
(3) The chairperson and minority chairperson of each of
the standing committees of the Senate and House of
Representatives with jurisdiction over the State agency which
is a party to the contract. GENERAL ASSEMBLY.
§ 4340 4341 . Purchase of certain equipment prohibited.
(a) Determination.--A State agency may not purchase computer
INFORMATION TECHNOLOGY equipment or televisions, or enter into a
contract with any manufacturer, unless the director determines
that the purchase or contract is in compliance with the
requirements under this chapter . AND EXISTING STATE LAW
REGARDING THE PROCUREMENT OF INFORMATION TECHNOLOGY EQUIPMENT
AND TELEVISIONS.
(b) Findings.--If the director determines that a purchase or
contract is not in compliance with the requirements under this
chapter OR EXISTING STATE LAW REGARDING THE PROCUREMENT OF
INFORMATION TECHNOLOGY EQUIPMENT AND TELEVISIONS , the director
shall issue written findings regarding the noncompliance to the
State agency.
§ 4341 4342 . Refurbished computer equipment purchasing program.
(a) Option.--The office shall offer a State agency the
20170HB1704PN4190 - 39 -
<--
<--
<--
<--
<--
<--
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
option of purchasing refurbished computer equipment from
registered computer equipment refurbishers whenever most
appropriate to meet the respective needs of the State agency.
(b) Savings.--A State agency shall document any savings
resulting from the purchase of refurbished computer equipment,
including, but not limited to, the initial acquisition cost and
operations and maintenance costs. The savings shall be reported
quarterly ANNUALLY to:
(1) The director.
(2) The chairperson and minority chairperson of the
Appropriations Committee of the Senate.
(3) The chairperson and minority chairperson of the
Appropriations Committee of the House of Representatives.
(2) THE GENERAL ASSEMBLY.
(c) Requirements.--Participating computer equipment
refurbishers shall meet all EXISTING procurement requirements
established by the office.
§ 4342 4343 . D ata on reliability and other matters.
(a) Maintenance of data.--The office shall maintain data on
equipment reliability, potential cost savings and matters
associated with the refurbished computer equipment purchasing
program.
(b) Report.--The office shall transmit a report regarding
the matters under subsection (a) by February 1, 2018, and
quarterly thereafter to the following:
(1) The General Assembly.
(2) The Independent Fiscal Office.
(3) The Secretary of the Budget.
SUBCHAPTER D
SECURITY
20170HB1704PN4190 - 40 -
<--
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
Sec.
4351. Statewide security standards.
4352. Security standards and risk assessments.
4353. Assessment of compliance with security standards.
4354. Legislative JOINT Cybersecurity Oversight Committee.
§ 4351. Statewide security standards.
(a) Establishment.--
(1) The director shall establish a Statewide set of
standards for information technology security to maximize the
functionality, security and interoperability of the
Commonwealth's distributed information technology assets,
including the following:
(i) D ata classification.
(ii) Management.
(iii) Communications.
(iv) Encryption technologies.
(2) The standards under this subsection shall conform to
the industry's best practices and standards regarding
information technology security.
(b) Review and revision.--The director shall review and
revise the security standards annually as necessary. As part of
this function, the director shall review periodically existing
security standards and practices in place among the various
State agencies to determine whether those standards and
practices meet Statewide security and encryption requirements.
(c) Assumption of responsibilities.--The director may assume
the direct responsibility of providing for the information
technology security of a State agency that fails to adhere to
security standards adopted under this chapter.
§ 4352. Security standards and risk assessments.
20170HB1704PN4190 - 41 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(a) Standards.--Notwithstanding any other provision of law
and except as otherwise provided by this chapter, all
information technology security goods, software or services
purchased using taxpayer money, or for use by a State agency or
in a public facility, shall be subject to approval by the
director in accordance with security standards under this
chapter.
(b) Assessments.-- The director shall conduct risk
assessments to identify compliance and operational and strategic
risks to the information technology network. The following
apply:
(1) The assessments may include methods such as
penetration testing or similar assessment methodologies.
(2) The director may contract with another party to
perform the assessments.
(3) Detailed reports of the risk and security issues
identified in the assessments shall be kept confidential.
(c) Security audit.--The director shall contract with a
FEDERAL GOVERNMENT ENTITY OR A third party that is nationally
recognized to perform a security audit of a State agency's
information technology system. The following shall apply:
(1) The director shall determine a schedule for State
agency security audits.
(2) The audit of a State agency shall be paid from
encumbered funds of the State agency.
(d) Notification and approval.--Before a State agency may
enter into a contract with another party for an assessment of
network vulnerability, the State agency shall notify the
director and obtain approval of the request. The following
apply:
20170HB1704PN4190 - 42 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(1) The party conducting the assessment shall provide
the State agency with a detailed report of the security
issues identified, which shall not be publicly disclosed.
(2) The State agency shall provide the director with
copies of the detailed report under paragraph (1), which
shall not be publicly disclosed.
(3) The State agency shall issue a public report on the
general results of the assessment.
(e) Effect of section.--Nothing in this section shall be
construed to preclude the Auditor General OR THE GENERAL
ASSEMBLY from assessing the security practices of State
information technology systems as part of its statutory duties
and responsibilities.
§ 4353. A ssessment of compliance with security standards.
(a) Frequency.--The director shall biannually assess the
ability of each State agency and each State agency's contracted
vendors to comply with the current security standards
established under this chapter.
(b) Contents.--T he assessment under this section shall
include, at a minimum, the following:
(1) The rate of compliance with the current security
standards.
(2) An assessment of security organization, security
practices, security information standards, network security
architecture and current expenditures of State funds for
information technology security.
(3) An estimate of the cost to implement the security
measures needed for State agencies to fully comply with the
established standards.
(c) Submittal of information.--Each State agency shall
20170HB1704PN4190 - 43 -
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
submit information required by the director for the assessments
under this section.
§ 4354. Legislative JOINT Cybersecurity Oversight Committee.
(a) Establishment and membership.--The Legi slative JOINT
Cybersecurity Oversight Committee is established and shall
consist of the following members:
(1) The director.
(2) The following individuals appointed by the President
pro tempore of the Senate:
(i) Three members of the Senate.
(ii) A representative from the information
technology office of the majority caucus of the Senate.
(3) The following individuals appointed by the Minority
Leader of the Senate:
(i) Two members of the Senate.
(ii) A representative from the information
technology office of the minority caucus of the Senate.
(4) The following individuals appointed by the Speaker
of the House of Representatives:
(i) Three members of the House of Representatives.
(ii) A representative from the information
technology office of the majority caucus of the House of
Representatives.
(5) The following individuals appointed by the Minority
Leader of the House of Representatives:
(i) Two members of the House of Representatives.
(ii) A representative from the information
technology office of the minority caucus of the House of
Representatives.
(6) The Attorney General or a designee of the Attorney
20170HB1704PN4190 - 44 -
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
General.
(7) The chief information officer of:
(i) The Department of the Auditor General.
(ii) The Treasury Department.
(iii) The Office of Attorney General.
(iv) The Administrative Office of Pennsylvania
Courts.
(V) THE PENNSYLVANIA PUBLIC UTILITY COMMISSION.
(8) FOUR PRIVATE CITIZENS APPOINTED BY THE GOVERNOR WITH
PROFESSIONAL CYBER SECURITY EXPERIENCE.
(8) (9) The Commissioner of the Pennsylvania State
Police or a designee of the commissioner.
(b) Chairperson and vice chairperson.--The chairperson and
vice chairperson of the committee shall be appointed by the
President pro tempore of the Senate and the Speaker of the House
of Representatives as follows:
(1) Beginning on the effective date of this section and
until the following January 1:
(i) The chairperson of the committee shall be one of
the members of the Senate appointed to the committee.
(ii) The vice chairperson of the committee shall be
one of the members of the House of Representatives
appointed to the committee.
(2) Except as provided in paragraph (1), a chairperson
and vice chairperson shall serve for a period of two years.
(3) At the end of each two-year period, the chairperson
and vice chairperson of the committee shall rotate between a
member of the Senate appointed to the committee and a member
of the House of Representatives appointed to the committee.
(4) A vacancy in the position of chairperson or vice
20170HB1704PN4190 - 45 -
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
chairperson of the committee shall be filled by the
appointing authority in the same manner as the original
appointment. GOVERNOR AND THE VICE CHAIRPERSON OF THE
COMMITTEE SHALL BE APPOINTED BY THE CHAIRPERSON.
(C) STAFFING.--THE COMMITTEE SHALL BE STAFFED BY THE OFFICE,
WHICH SHALL SUPPORT AND ASSIST THE COMMITTEE.
(c) (D) Service of members.--Each member of the committee
shall serve at the pleasure of the individual who appointed the
member.
(d) (E) Vacancies.--A vacancy in the membership of the
committee shall be filled by the appointing authority in the
same manner as the original appointment.
(e) (F) Meetings.--
(1) The committee shall meet at least on a quarterly
basis and no later than the first Thursday of each quarter.
(2) The chairperson of the committee, with the consent
of the vice chairperson of the committee, may schedule
additional meetings of the committee.
(3) The chairperson of the committee shall provide the
members of the committee with notice of the time and location
of each meeting of the committee no later than one week prior
to the meeting. Notice shall also be provided to the
Governor, the President pro tempore of the Senate and the
Speaker of the House of Representatives.
(4) Notice of the meetings of the committee shall be
provided by regular mail and e-mail.
(5) A member of the committee may participate in a
meeting of the committee in person, by teleconference, by
video conference or by other means as agreed to by the
chairperson and vice chairperson of the committee.
20170HB1704PN4190 - 46 -
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(6) A meeting of the committee shall not be subject to
65 Pa.C.S. Ch. 7 (relating to open meetings).
(f) Quorum.--
(1) For the purposes of adopting a report under this
section or conducting committee business that requires a
vote of the committee, at least a majority of the members of
the committee must be present during the meeting or otherwise
participating in the meeting as described in subsection (e)
(5).
(2) For the purposes of receiving testimony from an
individual invited by the chairperson of the committee to
testify before the committee, at least three members of the
committee shall be present during the meeting.
(g) Testimony.--
(1) Rules regarding testimony before the standing
committees of the General Assembly shall govern testimony
given to the committee.
(2) Written testimony shall be made available to the
members of the committee, regardless of whether the member
was present during the meeting at which the testimony was
given.
(h) Compensation.--A member of the committee shall not be
entitled to compensation as a member of the committee but may be
reimbursed for actual and reasonable expenses incurred in the
performance of duties as a member of the committee.
(i) (G) Duties.--The committee shall r eview AND COORDINATE
cybersecurity policies and issue an annual report on DISCUSS
emerging cybersecurity threats, recommended policy changes and
an assessment of ASSESS current cybersecurity within this
Commonwealth. The report shall be transmitted to:
20170HB1704PN4190 - 47 -
<--
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
(1) The Governor.
(2) The President pro tempore of the Senate.
(3) The Speaker of the House of Representatives.
(4) The Majority Leader and the Minority Leader of the
Senate.
(5) The Majority Leader and the Minority Leader of the
House of Representatives.
(6) The Court Administrator of Pennsylvania.
(j) (H) Definitions.--As used in this section, the following
words and phrases shall have the meanings given to them in this
subsection unless the context clearly indicates otherwise:
"Committee." The Legislative JOINT Cybersecurity Oversight
Committee established under this section.
SUBCHAPTER E
ENFORCEMENT AND PENALTIES
Sec.
4361. Administrative and judicial review.
4362. Unauthorized use for private benefit prohibited.
4363. Financial interests.
4364. Certification of submittal without collusion.
§ 4361. Administrative and judicial review.
Actions taken by the director under this chapter shall be
subject to review in accordance with 2 Pa.C.S. Chs. 5 (relating
to practice and procedure) and 7 (relating to judicial review).
§ 4362. Unauthorized use for private benefit prohibited.
(a) Offense.--It is unlawful for any person, by the use of
the powers, policies or procedures under this chapter , to
purchase, attempt to purchase, procure or attempt to procure any
property or services for private use or benefit.
(b) Criminal penalties and fines.--A person that violates
20170HB1704PN4190 - 48 -
<--
<--
<--
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
subsection (a) commits a misdemeanor of the first degree. Upon
conviction, the person shall be liable to the Commonwealth to
repay any amount expended in violation of this chapter, together
with any court costs.
§ 4363. F inancial interests.
(a) Offense.--
(1) The director and any other policymaking employee of
the office shall not have a financial interest or personal
beneficial interest, either directly or indirectly, in the
purchase of or contract for information technology. The
financial interest or personal interest shall extend to a
c orporation, partnership, company, trust, association or
other entity furnishing information technology to the
Commonwealth or any of its State agencies.
(2) Consistent with paragraph (1), the director or other
policymaking employee may not accept or receive, directly or
indirectly, any of the following:
(i) Anything of monetary or other value, whether by
rebate, gift or otherwise.
(ii) A promise, obligation or contract for future
reward or compensation, regardless of the business or
nonbusiness nature of the promise, obligation or
contract.
(b) Criminal penalties.--A person that violates subsection
(a) commits a felony of the third degree. Upon conviction, the
person shall be removed from office or State employment.
§ 4364. Certification of submittal without collusion.
(a) Duty.--The director shall require bidders under this
chapter to certify that each bid on information technology
contracts overseen by the office is submitted competitively and
20170HB1704PN4190 - 49 -
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
without collusion.
(b) Grading.--A person that provides a false certification
under this section commits a misdemeanor of the first degree.
Section 2. This act shall take effect immediately.
20170HB1704PN4190 - 50 -
1
2
3
4