BILL ANALYSIS
AB 1266
Page 1
Date of Hearing: April 28, 2009
ASSEMBLY COMMITTEE ON BUSINESS AND PROFESSIONS
Mary Hayashi, Chair
AB 1266 (Huber) - As Amended: April 2, 2009
SUBJECT : State government information technology.
SUMMARY : Codifies the Governor's Reorganization Plan (GRP 1)
into statute. Specifically, this bill :
1)Transfers all the duties, functions, employees, property, and
related funding of the Division of Telecommunications from the
Department of General Services (DGS) to the Office of the
Chief Information Officer (OCIO).
2)Renames the Department of Technology Services (DTS) to the
Office of Technology Services, and transfers it from the State
and Consumer Services Agency (SCSA) to the OCIO.
3)Renames the Department of Technology Services Revolving Fund
the Technology Services Revolving Fund, and makes conforming
changes.
4)Eliminates the Office of Information Security and Privacy
Protection (OISPP), and instead creates the Office of
Information Security within the OCIO, and the Office of
Privacy Protection within the SCSA.
5)Transfers to the OCIO all employees serving in state civil
service, other than temporary employees, who are engaged in
the performance of functions transferred to the OCIO and
maintains the status position and rights of those employees.
6)Transfers certain responsibilities relating to creating the
state's IT procurement policies from the Department of Finance
(DOF), DGS, and the Department of IT, to the OCIO.
EXISTING LAW :
1)Permits the Legislature to enact statutes that allow the
Governor to assign and reorganize functions among executive
officers and agencies and their employees, except for other
elected executive branch offices.
AB 1266
Page 2
2)Authorizes Governor's Reorganization Plans that "transfer,"
"abolish," "consolidate," or "coordinate" executive branch
agencies or their functions and that establish new agencies to
replace ones abolished.
3)Mandates that such plans become law unless either House of the
Legislature enacts a resolution disapproving such a plan
within 60 days.
4)Creates the OCIO within the Governor's cabinet, with a State
Chief Information Officer (State CIO) having specified duties
in creating and maintaining the technology policy of the
state.
5)Creates the Division of Telecommunications within DGS, and
requires that division to perform numerous duties with regard
to public safety, and emergency and non-emergency
communications policies and facilities.
6)Establishes DTS within SCSA, specifies the duties of the
department's director, and establishes the Department of
Technology Services Revolving Fund within the State Treasury.
7)Establishes OISPP within SCSA and the Office of Privacy
Protection within OISPP with duties to ensure the
confidentiality, integrity, and availability of state systems
and applications, and to promote and protect consumer privacy.
8)Authorizes the DOF, DGS, and the Department of IT to create
certain polices for the state's procurement of information
technology.
9)Requires the introduction of a bill not later than the next
regular legislative session after a Governor's reorganization
plan has taken effect, as specified, as may be necessary to
reflect the changes made by the reorganization plan. The
purpose of this bill is to insure that statutory law is
amended to conform to the changes made by the reorganization
plan, but failure to enact such a bill shall not affect the
validity of the plan.
FISCAL EFFECT : Unknown
COMMENTS :
AB 1266
Page 3
Purpose of the bill . According to the author's office, "The
Governor announced his plan (GRP 1) to consolidate statewide
information technology (IT) functions under the Office of the
Chief Information Officer (OCIO). By creating a central IT
organization, the state will leverage California's IT program
for greater coordination and efficiency while reducing costs and
saving the state approximately $1.5 billion over the next five
years.
"The GRP is based on a recent Little Hoover Commission report
that proposed realigning IT resources to enhance efficiency and
bolster performance. It is expected that the reorganization
will create more accountability and provide a framework to
enhance the IT workforce that supports our computer systems.
"AB 1266 seeks to codify GRP 1 into statute."
Background . The Legislature must either permit GRP 1 to take
effect or reject it in its current form. AB 1266 may be used as
a vehicle to codify GRP 1 should the Legislature approve of its
implementation, or to make any desired changes to the GRP.
Purpose of GRP 1 . According to the Governor's February, 2009
report submitted to the Little Hoover Commission (Commission),
"Since the early 1980's the state tried several models for
governing the way it manages information technology investments
and operations. Nearly all of these models were shown to be
insufficient for the management and oversight of complex
technology infrastructures and large IT projects. Accordingly,
in 2006 the Legislature enacted and Governor Arnold
Schwarzenegger signed SB 834 (Chapter 533, Statutes of 2006) to
establish the Office of the State Chief Information Officer
(OCIO).
"With the creation of the OCIO, the Governor and the Legislature
have established the structure on which a strong information
technology program can be built. Greater expectations and new
challenges require a new, more coordinated approach to the
governance and management of information technology. This
Reorganization Plan provides that approach - a federated
governance model for information technology in California. This
governance framework consolidates enterprise information
technology functions under the Office of the State Chief
Information Officer to improve coordination and realize
AB 1266
Page 4
significant efficiencies in procurement and technology
implementation.
"In the federated governance model, responsibilities will be
divided as follows:
The Enterprise Tier (OCIO) will provide robust IT
infrastructure for the entire government, offer shared
technology services across government, provide oversight to
reduce risk in IT project management, and enhance security
and stakeholder privacy.
The Agency Tier will provide program policy and
direction, prioritize Agency IT investments, and
consolidate IT resources to reduce operational costs.
The Department Tier will provide local desktop/LAN
support, manage business specific applications and purchase
IT resources necessary for department activities.
"Ultimately this Reorganization Plan proposes to transform the
existing IT governance framework from one that is focused on the
needs of individual agencies to one that provides affordable,
consistent and reliable technology services to all state
agencies, while supporting the diverse needs of individual
agencies. The plan introduces the concept of California's state
government as a single enterprise in its use of information
technology.
"This approach flows from business strategies and drivers and
uses enterprise architecture to ensure the wise investment of
limited resources. The federated governance framework enables
operational improvements by defining common or shared technology
(enterprise architecture) standards across diverse program
areas, providing interoperability and supporting the diverse
programmatic missions of state agencies. This approach also
establishes a common platform and standards for operations and
growth, improves the speed of implementations and provides an
optimal return on investment.
"The GRP, which is informed in part by the [Little Hoover]
Commission's recent recommendations on IT, proposes to realign
state IT resources in order to:
Integrate four agencies - the OCIO, Office of
Information Security and Privacy Protection (Office of
Information Security), Department of Technology Services
AB 1266
Page 5
and the Department of General Services - Telecommunications
Division -into an expanded OCIO.
Provide the State Chief Information Officer with
authority for IT procurement policy and enterprise IT
management.
Achieve consolidation of software contracts, office
automation tools, data centers/computer rooms, servers,
storage and networks to realize estimated cost savings and
cost avoidance of $1.5 billion over the next five years.
Preserve program-specific IT systems and budgets at the
agency level."
Entities Involved in the IT Reorganization . AB 1266 codifies
GRP 1 which consolidates the following existing entities:
1) Office of the State Chief Information Officer (OCIO) .
SB 834 (Figueroa) Chapter 533, Statutes of 2006 establishes
the State CIO as a member of the Governor's cabinet, and
codifies the responsibilities of the State CIO as generally
providing oversight, advice, and management regarding
information technology to the Governor and various agencies
within the state. The Budget Act of 2007 and related
legislation (SB 90 (Senate Committee) Chapter 183, Statutes
of 2007) established the OCIO, and provided the State CIO
and the OCIO with responsibility and authority for
statewide technology vision, strategic planning and
coordination, technology policy and standards (enterprise
architecture), data management policy and standards, and
the review and approval of technology projects. In the
Budget Act of 2008, the Legislature provided the OCIO with
32 positions and a budget of approximately $6.7 million.
2) The Department of Technology Services (DTS) . SB 834
also codified the Governor's Reorganization Plan No. 2 (GRP
2), effective July 9, 2005, which established the
Department of Technology Services (DTS) in state
government, and authorized the department to acquire,
install, equip, maintain, and operate new or existing
business telecommunications systems and services and
requires it to coordinate all matters affecting statewide
business telecommunications policy and planning. In the
Budget Act of 2008, the Legislature provided DTS with
approximately 800 positions and a budget of $278 million.
3) The Technology Services Board (TSB) . The TSB, which was
AB 1266
Page 6
also established on July 9, 2005 via GRP 2, provides
governance and guidance to the DTS, helps set policy on
services provided, reviews and approves DTS' annual budget
and rates, and ensures appropriate oversight and customer
orientation. The TSB was designed to ensure that the DTS
is governed by its major customers from a business
perspective. Chaired by the State CIO, the TSB membership
consists of top executives from all cabinet agencies and
the State Controller's Office.
4) Office of Information Security and Privacy Protection
(OISPP) . SB 90 also created the OISPP in the SCSA to
ensure the confidentiality, integrity, and availability of
state systems and applications, and to promote and protect
consumer privacy to ensure the trust of the residents of
the state. The OISPP is made up of two offices: The Office
of Information Security is responsible for ensuring the
confidentiality, integrity, and availability of state
systems and computer applications and for protecting state
information. The Office of Privacy Protection promotes and
protects consumers' privacy rights.
5) Department of General Services - Telecommunications
Division (DGS-TD) . The DGS-TD was first established in
1947 and has existed in its current incarnation since the
business telecommunications functions were transferred to
DTS on July 9, 2005 via GRP 2. DGS-TD is made up of two
distinct offices, the Office of Public Safety
Communications Services (OPSCS) and the State of California
9-1-1 Emergency Communications Office (9-1-1 Office). The
OPSCS provides engineering and technical support services
for public safety related communications systems, including
design, installation, and maintenance services. The 9-1-1
Office provides oversight of the 9-1-1 network and
approximately 500 police, fire, and paramedic dispatch
centers, also known as Public Safety Answering Points
(PSAPs) and assists PSAPs in the administration and funding
of 9-1-1 services. In the Budget Act of 2008, the
Legislature provided approximately 368 positions and over
$220 million to the DGS -TD.
6) IT Procurement Policy . The Legislature granted the
Department of Information Technology (DOIT) authority for
IT procurement policy and DGS authority for IT procurement
procedures. When DOIT sunset on July 1, 2002, their
AB 1266
Page 7
authority over IT procurement policy was transferred to the
Department of Finance (DOF) and Management Memo 02-20
clarified the delineation of responsibilities in the area
of IT procurement. However, several references in the
Public Contract Code still state that DOIT and DGS are
jointly responsible to create and coordinate policies and
procedures for the acquisition of information technology
goods and services.
Proposed IT Governance Structure . The Legislative Analyst's
Office (LAO) described GRP 1's IT structure as follows: "The new
organizational structure would transfer DOF's authority over
procurement policy for IT goods and services to the OCIO. It
would also transfer all the functions from DTS, the
Telecommunications Division of DGS, and the information security
functions of OISPP. The CIO would keep her current
responsibilities. All transferred employees affected by this
reorganization would report to the OCIO, though physically they
would remain at their current locations. The total number of
positions transferred would be about 1,180, with 800 from DTS,
368 from DGS's Telecommunications Division, and 6 from OISPP.
All unexpended balances of appropriations, and other funds
available for functions affected by this reorganization would be
transferred to the OCIO and would have to be used for their
original purposes.
"The administration indicates this GRP is a first step toward
greater centralization of state IT functions. The
administration believes this first phase of reorganization would
permit the state to avoid $185 million in costs (all funds) in
2009-10 and $1.5 billion in costs (all funds) over five years.
This would be achieved through such means as consolidating
software contracts, data centers, computer rooms, servers,
storage, and networks."
The Legislative Analyst Office's Recommendation . In a March 9,
2009 letter to the Commission, the LAO characterized the
administration's plan to consolidate more IT functions under the
OCIO as "ha[ving] merit and offers potential statewide cost
avoidance - more so in the long term, when IT policies have been
firmly established and state entities are working from a more
standardized IT framework. However, we are concerned that this
GRP lacks detail regarding implementation and has not completely
addressed potential challenges to the existing OCIO staff and
newly transferred offices. The legislature may want to consider
AB 1266
Page 8
other means of achieving some of the same goals stated in this
GRP."
The Little Hoover Commission's Recommendation . In its March 26,
2009 "Recommendation to the Legislature," the Commission
concluded, "IT often is cited as a driver of government
efficiency, but it goes beyond processing licenses online or
automating an outdated system. The GRP helps reframe the state's
approach to governance by moving away from a collection of
agencies with unique, mutually exclusively needs and toward a
practice of operating the state as a single enterprise.
"The OCIO is the appropriate office to herald in this change
through the building of a technology infrastructure that cuts
across agencies to align policy goals and priorities.
"The Governor's Reorganization Plan represents an evolutionary
step more than a revolutionary one, but one that is urgently
needed. It will move California forward."
Potential Issues of Concern:
Implementation . The LAO raises concerns that the office may be
taking on too many duties at one time, and points out that
previous attempts at IT reorganization have been plagued by
trying to do too much at once. The LAO suggests several options
including a phased implementation approach to moderate this
risk. Other interested parties have also expressed concern
regarding the GRP's implementation. For example, the Service
Employees International Union Local 1000 (SEIU) has expressed
concern that the GRP is "ambitious in scope but is more of an
overview than a step-by-step 'how to' plan. Teresa Takai, the
State CIO, has responded to these criticisms by stating that
significant IT consolidation has already taken place over the
last 15 months, and the proposed reorganization is the next
logical step. The OCIO recently published an IT strategic plan,
and Ms. Takai has stated that all organization and state IT
functions were engaged in that plan's development. The OCIO
also recently developed a report of specific strategies and
milestones for the implementation of the GRP. This report was
provided to the Committee at the April 14, 2009 hearing of GRP
1.
Cost Savings . The LAO and others have expressed skepticism over
whether the GRP, if implemented, would actually produce the
AB 1266
Page 9
proposed $1.5 billion in savings over the next five years. The
OCIO has responded to these concerns by producing a more
detailed account of the proposed avoidance/savings by fiscal
year in their "Cost Avoidance and Savings Strategies &
Milestones" report that was provided to the Committee at the
April 14, 2009 hearing of GRP 1.
The Commission has also noted, "Economies of scale and cost
savings will be gained from empowering the OCIO to consolidate
contracts and reduce overlap and redundancy. Arguably more
important than the financial impact, The GRP represents another
critical step toward providing the state CIO with real authority
to align technology across state agencies and coordinate IT
activity and data sharing."
Project Management . Both the LAO and Commission note that there
is a lack of project management reform under the Governor's
proposal. The Commission recommended in its November 2008 study
to transfer a successful 200-person project-management office in
the Health and Human Services Agency HHS) to the OCIO. This
unit - the Office of Systems Integration (OSI) - has worked
directly under the agency secretary since 2005 and is charged,
under statute, with managing the development and implementation
of $1.3 billion in large-scale IT systems, including case
management, payroll and eligibility projects for health care and
social services. The Commission recommended that the OCIO
should have the authority to deploy expert project managers from
OSI to troubled projects in other departments and agencies.
The LAO, noting the state's lack of project management
experience for large IT projects, suggested that the OCIO
leverage the expertise of OSI's project management staff by
absorbing them as they rotate off completed projects. "This
would give the OCIO a small cadre of professional state staff
that could be "loaned" to different state IT projects,"
according to LA Mac Taylor. Such an arrangement would require
legislation due to restrictions on the OSI's scope of work.
The OSI was not included in the GRP. Joe Munso, undersecretary
of the HHS, told the Commission the OSI projects are at critical
stages and administrative changes could jeopardize their
success. Teresa Takai, State CIO, agreed that moving the OSI
currently poses too many risks. In testimony to the Commission,
Ms Takai said the OCIO is planning a complementary strategy to
build OSI-type offices within each agency, as well as a small,
AB 1266
Page 10
five-person central project-management office inside the OCIO.
Related legislation . GRP 1 (Governor's Administration) of 2009,
the Governor's plan to consolidate statewide IT functions under
the OCIO, which is identical to this bill, was heard in the
Assembly Business and Professions Committee on April 14, 2009.
The Committee recommended that GRP 1 be permitted to take effect
by a vote of eight to one.
REGISTERED SUPPORT / OPPOSITION :
Support
None on file.
Opposition
None on file.
Analysis Prepared by : Whitney Clark / B. & P. / (916)
319-3301