text:
(a) The administrative law judge of the Medical Quality Hearing Panel established pursuant to Section 11371 may issue an interim order suspending a license, imposing drug testing, continuing education, supervision of procedures, limitations on the authority to prescribe, furnish, administer, or dispense controlled substances, or other license restrictions. Interim orders may be issued only if the affidavits in support of the petition show that the licensee has engaged in, or is about to engage in, acts or omissions constituting a violation of the Medical Practice Act or the appropriate practice act governing each allied health profession, or is unable to practice safely due to a mental or physical condition, and that permitting the licensee to continue to engage in the profession for which the license was issued will endanger the public health, safety, or welfare. The failure to comply with an order issued pursuant to Section 820 of the Business and Professions Code may constitute grounds to issue an interim suspension order under this section.

(b) All orders authorized by this section shall be issued only after a hearing conducted pursuant to subdivision (d), unless it appears from the facts shown by affidavit that serious injury would result to the public before the matter can be heard on notice. Except as provided in subdivision (c), the licensee shall receive at least 15 days’ prior notice of the hearing, which notice shall include affidavits and all other information in support of the order.

(c) If an interim order is issued without notice, the administrative law judge who issued the order without notice shall cause the licensee to be notified of the order, including affidavits and all other information in support of the order by a 24-hour delivery service. That notice shall also include the date of the hearing on the order, which shall be conducted in accordance with the requirement of subdivision (d), not later than 20 days from the date of issuance. The order shall be dissolved unless the requirements of subdivision (a) are satisfied.

(d) For the purposes of the hearing conducted pursuant to this section, the licentiate shall, at a minimum, have the following rights:

(1) To be represented by counsel.

(2) To have a record made of the proceedings, copies of which may be obtained by the licentiate upon payment of any reasonable charges associated with the record.

(3) To present written evidence in the form of relevant declarations, affidavits, and documents.

The discretion of the administrative law judge to permit testimony at the hearing conducted pursuant to this section shall be identical to the discretion of a superior court judge to permit testimony at a hearing conducted pursuant to Section 527 of the Code of Civil Procedure.

(4) To present oral argument.

(e) Consistent with the burden and standards of proof applicable to a preliminary injunction entered under Section 527 of the Code of Civil Procedure, the administrative law judge shall grant the interim order if, in the exercise of discretion, the administrative law judge concludes that:

(1) There is a reasonable probability that the petitioner will prevail in the underlying action.

(2) The likelihood of injury to the public in not issuing the order outweighs the likelihood of injury to the licensee in issuing the order.

(f) In all cases in which an interim order is issued, and an accusation or petition to revoke probation is not filed and served pursuant to Sections 11503 and 11505 within 30 days of the date on which the parties to the hearing on the interim order have submitted the matter, the order shall be dissolved.

Upon service of the accusation or petition to revoke probation the licensee shall have, in addition to the rights granted by this section, all of the rights and privileges available as specified in this chapter. If the licensee requests a hearing on the accusation, the board shall provide the licensee with a hearing within 30 days of the request, unless the licensee stipulates to a later hearing, and a decision within 15 days of the date the decision is received from the administrative law judge, or the board shall nullify the interim order previously issued, unless good cause can be shown by the Division of Medical Quality for a delay.

(g) If an interim order is issued, a written decision shall be prepared within 15 days of the hearing, by the administrative law judge, including findings of fact and a conclusion articulating the connection between the evidence produced at the hearing and the decision reached.

(h) Notwithstanding the fact that interim orders issued pursuant to this section are not issued after a hearing as otherwise required by this chapter, interim orders so issued shall be subject to judicial review pursuant to Section 1094.5 of the Code of Civil Procedure. The relief that may be ordered shall be limited to a stay of the interim order. Interim orders issued pursuant to this section are final interim orders and, if not dissolved pursuant to subdivision (c) or (f), may only be challenged administratively at the hearing on the accusation.

(i) The interim order provided for by this section shall be:

(1) In addition to, and not a limitation on, the authority to seek injunctive relief provided for in the Business and Professions Code.

(2) A limitation on the emergency decision procedure provided in Article 13 (commencing with Section 11460.10) of Chapter 4.5.

history: (History: Amended by Stats. 2017, Ch. 775, Sec. 110. (SB 798) Effective January 1, 2018.)


kind: section

code: GOV

text: This chapter shall be known and may be cited as the Technology Act of 2005.

history: (History: Added by Stats. 2006, Ch. 533, Sec. 1. Effective January 1, 2007.)

division: 3. EXECUTIVE DEPARTMENT

chapter: 5.5. Technology

article: 1. General Provisions and Definitions

path: 2. GOVERNMENT OF THE STATE OF CALIFORNIA > 3. EXECUTIVE DEPARTMENT > 5.5. Technology > 1. General Provisions and Definitions


text:
For purposes of this chapter, the following terms shall have the following meanings, unless the context requires otherwise:

(a) “Chief” means the Chief of the Office of Technology Services.

(b) “Technology” includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, and business telecommunications systems and services.

(c) “Business telecommunications systems and services” includes, but is not limited to, wireless or wired systems for transport of voice, video, and data communications, network systems, requisite facilities, equipment, system controls, simulation, electronic commerce, and all related interactions between people and machines. Public safety communications are excluded from this definition.

(d) “Public agencies” include, but are not limited to, all state and local governmental agencies in the state, including cities, counties, other political subdivisions of the state, state departments, agencies, boards, and commissions, and departments, agencies, boards, and commissions of other states and federal agencies.

history: (History: Amended by Stats. 2013, Ch. 353, Sec. 70. (SB 820) Effective September 26, 2013. Operative July 1, 2013, by Sec. 129 of Ch. 353.)

title: 2. GOVERNMENT OF THE STATE OF CALIFORNIA

article: 1. General Provisions and Definitions


text:
(a) There is in the Government Operations Agency, in the Department of Technology, the Office of Technology Services.

(b) The purpose of this article is to establish a general purpose technology services provider to serve the common technology needs of executive branch entities with accountability to customers for providing secure services that are responsive to client needs at a cost representing best value to the state.

(c) The purpose of this chapter is to improve and coordinate the use of technology and to coordinate and cooperate with all public agencies in the state in order to eliminate duplications and to bring about economies that could not otherwise be obtained.

(d) Unless the context clearly requires otherwise, whenever the term “Department of Technology Services” appears in any statute, regulation, or contract, it shall be deemed to refer to the Office of Technology Services, and whenever the term “Director of Technology Services” appears in statute, regulation, or contract, it shall be deemed to refer to the Chief of the Office of Technology Services.

(e) Unless the context clearly requires otherwise, the Office of Technology Services and the Director of Technology succeed to and are vested with all the duties, powers, purposes, responsibilities, and jurisdiction vested in the former Department of Technology Services and the former Director of Technology Services, or Secretary of California Technology, respectively.

(f) All employees serving in state civil service, other than temporary employees, who are engaged in the performance of functions transferred to the Office of Technology Services, are transferred to the Office of Technology Services. The status, positions, and rights of those persons shall not be affected by their transfer and shall continue to be retained by them pursuant to the State Civil Service Act (Part 2 (commencing with Section 18500) of Division 5), except as to positions the duties of which are vested in a position exempt from civil service. The personnel records of all transferred employees shall be transferred to the Office of Technology Services.

(g) The property of any office, agency, or department related to functions transferred to the Office of Technology Services is transferred to the Office of Technology Services. If any doubt arises as to where that property is transferred, the Department of General Services shall determine where the property is transferred.

(h) All unexpended balances of appropriations and other funds available for use in connection with any function or the administration of any law transferred to the Office of Technology Services shall be transferred to the Office of Technology Services for the use and for the purpose for which the appropriation was originally made or the funds were originally available. If there is any doubt as to where those balances and funds are transferred, the Department of Finance shall determine where the balances and funds are transferred.

history: (History: Amended by Stats. 2013, Ch. 353, Sec. 71. (SB 820) Effective September 26, 2013. Operative July 1, 2013, by Sec. 129 of Ch. 353.)

article: 2. Office of Technology Services

path: 2. GOVERNMENT OF THE STATE OF CALIFORNIA > 3. EXECUTIVE DEPARTMENT > 5.5. Technology > 2. Office of Technology Services


text: The Chief of the Office of Technology Services shall be appointed by, and serve at the pleasure of, the Governor, subject to Senate confirmation. The chief shall report to the Director of Technology.

history: (History: Amended by Stats. 2013, Ch. 353, Sec. 72. (SB 820) Effective September 26, 2013. Operative July 1, 2013, by Sec. 129 of Ch. 353.)

article: 2. Office of Technology Services


text: The chief shall be responsible for managing the affairs of the Office of Technology Services and shall perform all duties, exercise all powers and jurisdiction, and assume and discharge all responsibilities necessary to carry out the purposes of this chapter. The Office of Technology Services shall employ professional, clerical, technical, and administrative personnel as necessary to carry out this chapter.

history: (History: Amended by Stats. 2013, Ch. 353, Sec. 73. (SB 820) Effective September 26, 2013. Operative July 1, 2013, by Sec. 129 of Ch. 353.)

article: 2. Office of Technology Services


text: The Director of Technology shall propose to the Director of Finance rates for Office of Technology Services’ services based on a formal rate methodology. The Director of Finance shall approve the proposal based on the reasonableness of the rates, any significant impact on departmental budgets, and all other requirements of the rate reassessment required under Section 11540.5. The Director of Technology and the Director of Finance shall coordinate to develop policies and procedures to implement this section, including, but not limited to, the format and timeframe of the rate proposal and any changes recommended as part of the rate reassessment pursuant to subdivision (e) of Section 11540.5.

history: (History: Amended by Stats. 2022, Ch. 48, Sec. 24. (SB 189) Effective June 30, 2022.)

article: 2. Office of Technology Services


text:
(a) The department, in consultation with the Department of Finance, shall reassess the formal rate methodology and relevant policies and procedures for state data center services.

(b) Upon appropriation by the Legislature, moneys to support the administrative costs or revenue losses sustained by the department during the rate reassessment shall be allocated to the department from the General Fund.

(c) The department shall conduct the rate reassessment commencing July 1, 2022, and shall complete the rate reassessment no later than June 30, 2025.

(d) Upon completion of the rate reassessment, any remaining funds transferred from the General Fund for the purposes of administrative costs or revenue losses sustained by the department shall be transferred to the Technology Services Revolving Fund created by Section 11544 no later than June 30, 2025.

(e) To complete the rate reassessment, the department, in consultation with the Department of Finance, shall do all of the following:

(1) Develop a rate structure that would allow a state entity or other customer of a state data center to compare services offered by state data centers with comparable services offered by major private vendors, including, but not limited to, features, levels of service, rates, and service options for all offered services.

(2) Determine and designate which state data center services are either cost inefficient or mandatory.

(3) Evaluate the potential elimination of both cost-inefficient state data center services and nonmandatory state data center services.

(4) (A) Recommend revision of policies, procedures, and strategies for the provision of state data center services, including, but not limited to, all of the following:

(i) Creating centralized contracts for shared information technology services to replace state data center services, including, but not limited to, contracts pursuant to subdivision (b) of Section 11546.45.

(ii) Requiring state entities to use specific state data center services needed to maintain a certain level of service for critical programs.

(iii) Instating term agreements for state data center services to improve revenue and expenditure forecasting.

(B) The recommendations shall consider how to revise the policies, procedures, and strategies, including, but not limited to, those in subparagraph (A), to provide state data center services in a cost-effective, efficient, and strategic manner.

(f) Commencing April 1, 2023, and every twelve months thereafter until August 1, 2025, the department shall submit a written report to relevant budget subcommittees of both houses and to the Joint Legislative Budget Committee on progress toward the state data center rate reassessment requirements in subdivision (e); its consideration of changes to current policies, procedures, and strategies pursuant to paragraph (4) of subdivision (e); and on all of the following outcome metrics:

(1) The total number of services offered by state data centers.

(2) The total number of services identified for elimination from state data centers.

(3) An explanation and timeline for the elimination of services identified in paragraph (2).

(4) The amount and percentage change in rates, if any, for state data center services.

(5) An explanation for the change in rates, if any, calculated pursuant to paragraph (4).

(6) The estimated difference in rates by service between state data centers and major private vendors based on the total cost of ownership, which include, but are not limited to, migration costs, managed service support, comparable features, levels of service, and service options.

(7) An explanation for the difference in service rates calculated pursuant to paragraph (6).

(8) The forecasted change in state data center service subscriptions over the current fiscal year and next two fiscal years.

(9) The forecasted change in state data center revenues and expenditures over the current fiscal year and next two fiscal years based on the change in subscriptions forecasted in paragraph (8).

(g) For purposes of this section, the following definitions have the following meanings:

(1) “Cost-inefficient services” means services for which state data center service rates are higher than major private vendor service rates once the state data center service rates are reduced to cover only direct costs.

(2) “Department,” unless otherwise stated, refers to the Department of Technology.

(3) “Major private vendors” shall be designated pursuant to specific criteria.

(4) “Mandatory services” means state data center services that must be used by all state entities to achieve greater cost efficiency, improved security, or other comparable reasons identified by the department.

(5) “State data center” means a Tier III or equivalent data center, as designated by the department.

history: (History: Added by Stats. 2022, Ch. 48, Sec. 25. (SB 189) Effective June 30, 2022.)

article: 2. Office of Technology Services


text:
(a) The Office of Technology Services may acquire, install, equip, maintain, and operate new or existing business telecommunications systems and services. Acquisitions for information technology goods and services shall be made pursuant to Chapter 3 (commencing with Section 12100) of Part 2 of Division 2 of the Public Contract Code. To accomplish that purpose, the Office of Technology Services may enter into contracts, obtain licenses, acquire personal property, install necessary equipment and facilities, and do other acts that will provide adequate and efficient business telecommunications systems and services. Any system established shall be made available to all public agencies in the state on terms that may be agreed upon by the agency and the Office of Technology Services.

(b) With respect to business telecommunications systems and services, the Office of Technology Services may do all of the following:

(1) Provide representation of public agencies before the Federal Communications Commission in matters affecting the state and other public agencies regarding business telecommunications systems and services issues.

(2) Provide, upon request, advice to public agencies concerning existing or proposed business telecommunications systems and services between any and all public agencies.

(3) Recommend to public agencies rules, regulations, procedures, and methods of operation that it deems necessary to effectuate the most efficient and economical use of business telecommunications systems and services within the state.

(4) Carry out the policies of this chapter.

(c) The Office of Technology Services has responsibilities with respect to business telecommunications systems, services, policy, and planning, which include, but are not limited to, all of the following:

(1) Assessing the overall long-range business telecommunications needs and requirements of the state considering both routine and emergency operations for business telecommunications systems and services, performance, cost, state-of-the-art technology, multiuser availability, security, reliability, and other factors deemed to be important to state needs and requirements.

(2) Developing strategic and tactical policies and plans for business telecommunications with consideration for the systems and requirements of public agencies.

(3) Recommending industry standards, service level agreements, and solutions regarding business telecommunications systems and services to ensure multiuser availability and compatibility.

(4) Providing advice and assistance in the selection of business telecommunications equipment to ensure all of the following:

(A) Ensuring that the business telecommunications needs of state agencies are met.

(B) Ensuring that procurement is compatible throughout state agencies and is consistent with the state’s strategic and tactical plans for telecommunications.

(C) Ensuring that procurement is designed to leverage the buying power of the state and encourage economies of scale.

(5) Providing management oversight of statewide business telecommunications systems and services developments.

(6) Providing for coordination of, and comment on, plans and policies and operational requirements from departments that utilize business telecommunications systems and services as determined by the Office of Technology Services.

(7) Monitoring and participating, on behalf of the state, in the proceedings of federal and state regulatory agencies and in congressional and state legislative deliberations that have an impact on state governmental business telecommunications activities.

(d) The Office of Technology Services shall develop and describe statewide policy on the use of business telecommunications systems and services by state agencies. In the development of that policy, the Office of Technology Services shall ensure that access to state business information and services is improved, and that the policy is cost effective for the state and its residents. The Office of Technology Services shall develop guidelines that do all of the following:

(1) Describe what types of state business information and services may be accessed using business telecommunications systems and services.

(2) Characterize the conditions under which a state agency may utilize business telecommunications systems and services.

(3) Characterize the conditions under which a state agency may charge for information and services.

(4) Specify pricing policies.

(5) Provide other guidance as may be appropriate at the discretion of the Office of Technology Services.

history: (History: Amended by Stats. 2013, Ch. 353, Sec. 75. (SB 820) Effective September 26, 2013. Operative July 1, 2013, by Sec. 129 of Ch. 353.)

article: 2. Office of Technology Services


text:
(a) The Office of Technology Services shall create a link to state agency Internet Web sites at the State of California Internet portal specifically for the use of small businesses, designed to assist entrepreneurs and small business owners in accessing information regarding startup requirements and regulatory compliance applicable to the particular business.

(b) For purposes of this section, “small business” has the same meaning as set forth in Section 14837.

history: (History: Amended by Stats. 2010, Ch. 404, Sec. 12. (AB 2408) Effective January 1, 2011.)

article: 2. Office of Technology Services


text:
(a) The Stephen P. Teale Data Center and the California Health and Human Services Agency Data Center are consolidated within, and their functions are transferred to, the Office of Technology Services.

(b) Except as expressly provided otherwise in this chapter, the Office of Technology Services is the successor to, and is vested with, all of the duties, powers, purposes, responsibilities, and jurisdiction of the Stephen P. Teale Data Center, and the California Health and Human Services Agency Data Center. Any reference in statutes, regulations, or contracts to those entities with respect to the transferred functions shall be construed to refer to the Office of Technology Services unless the context clearly requires otherwise.

(c) A lease, license, or any other agreement to which either the Stephen P. Teale Data Center or the California Health and Human Services Agency Data Center is a party shall not be void or voidable by reason of this chapter, but shall continue in full force and effect, with the Office of Technology Services assuming all of the rights, obligations, and duties of the Stephen P. Teale Data Center or the California Health and Human Services Agency Data Center, respectively.

(d) Notwithstanding subdivision (e) of Section 11793 and subdivision (e) of Section 11797, on and after the effective date of this chapter, the balance of any funds available for expenditure by the Stephen P. Teale Data Center and the California Health and Human Services Agency Data Center, with respect to business telecommunications systems and services functions in carrying out any functions transferred to the Office of Technology Services by this chapter, shall be transferred to the Technology Services Revolving Fund created by Section 11544, and shall be made available for the support and maintenance of the Office of Technology Services.

(e) Any reference in statute regulation, or contract to the former Stephen P. Teale Data Center Fund or the California Health and Human Services Data Center Revolving Fund shall be construed to refer to the Technology Services Revolving Fund unless the context clearly requires otherwise.

(f) All books, documents, records, and property of the Stephen P. Teale Data Center and the California Health and Human Services Agency Data Center, excluding the Systems Integration Division, shall be transferred to the Office of Technology Services.

(g) (1) All officers and employees of the former Stephen P. Teale Data Center and the California Health and Human Services Agency Data Center, are transferred to the Office of Technology Services.

(2) The status, position, and rights of any officer or employee of the Stephen P. Teale Data Center and the California Health and Human Services Agency Data Center, shall not be affected by the transfer and consolidation of the functions of that officer or employee to the Office of Technology Services.

history: (History: Amended by Stats. 2013, Ch. 28, Sec. 10. (SB 71) Effective June 27, 2013. Operative July 1, 2013, by Sec. 93 of Ch. 28.)

article: 2. Office of Technology Services


text: If the Legislature directs or authorizes the Department of Technology to maintain, develop, or prescribe processes, procedures, or policies in connection with the administration of its duties under this chapter, Chapter 5.6 (commencing with Section 11545), Part 6.5 (commencing with Section 15250), Section 6611 of the Public Contract Code, or Chapter 3 (commencing with Section 12100) or Chapter 3.5 (commencing with Section 12120) of Part 2 of Division 2 of the Public Contract Code, the action by the department shall be exempt from the rulemaking provisions of the Administrative Procedure Act (Chapter 3.5 (commencing with Section 11340) of Part 1). This section shall apply to actions taken by the department with respect to the State Administrative Manual and the State Contracting Manual.

history: (History: Added by Stats. 2013, Ch. 28, Sec. 11. (SB 71) Effective June 27, 2013. Operative July 1, 2013, by Sec. 93 of Ch. 28.)

article: 2. Office of Technology Services


text:
(a) The Technology Services Revolving Fund, hereafter known as the fund, is hereby created within the State Treasury. The fund shall be administered by the Director of Technology to receive all revenues from the sale of technology or technology services provided for in this chapter, for other services rendered by the Department of Technology, and all other moneys properly credited to the Department of Technology from any other source, to pay, upon appropriation by the Legislature, all costs arising from this chapter and rendering of services to state and other public agencies, including, but not limited to, employment and compensation of necessary personnel and expenses, such as operating and other expenses of the Department of Technology, and costs associated with approved information technology projects, and to establish reserves. At the discretion of the Director of Technology, segregated, dedicated accounts within the fund may be established. The amendments made to this section by the act adding this sentence shall apply to all revenues earned on or after July 1, 2010.

(b) The fund shall consist of all of the following:

(1) Moneys appropriated and made available by the Legislature for the purposes of this chapter.

(2) Any other moneys that may be made available to the Department of Technology from any other source, including the return from investments of moneys by the Treasurer.

(c) The Department of Technology may collect payments from public agencies for providing services to client agencies. The Department of Technology may require monthly payments by client agencies for the services provided. Pursuant to Section 11255, the Controller shall transfer any amounts so authorized by the Department of Technology, consistent with the annual budget of each department, to the fund. The Department of Technology shall notify each affected state agency upon requesting the Controller to make the transfer.

(d) At the end of any fiscal year, if the balance remaining in the fund at the end of that fiscal year exceeds 25 percent of the portion of the Department of Technology’s current fiscal year budget used for support of data center and other client services, the excess amount shall be used to reduce the billing rates for services rendered during the following fiscal year.

history: (History: Amended by Stats. 2014, Ch. 28, Sec. 7. (SB 854) Effective June 20, 2014.)

article: 3. Technology Services Revolving Fund

path: 2. GOVERNMENT OF THE STATE OF CALIFORNIA > 3. EXECUTIVE DEPARTMENT > 5.5. Technology > 3. Technology Services Revolving Fund


text:
(a) (1) There is in state government the Department of Technology within the Government Operations Agency. The Director of Technology shall be appointed by, and serve at the pleasure of, the Governor, subject to Senate confirmation. The Director of Technology shall supervise the Department of Technology and report directly to the Governor on issues relating to information technology.

(2) Unless the context clearly requires otherwise, whenever the term “office of the State Chief Information Officer” or “California Technology Agency” appears in any statute, regulation, or contract, or any other code, it shall be construed to refer to the Department of Technology, and whenever the term “State Chief Information Officer” or “Secretary of California Technology” appears in any statute, regulation, or contract, or any other code, it shall be construed to refer to the Director of Technology.

(3) The Director of Technology shall be the State Chief Information Officer.

(b) The duties of the Director of Technology shall include, but are not limited to, all of the following:

(1) Advising the Governor on the strategic management and direction of the state’s information technology resources.

(2) Establishing and enforcing state information technology strategic plans, policies, standards, and enterprise architecture. This shall include the periodic review and maintenance of the information technology sections of the State Administrative Manual and procurement procedures related to information technology projects, except for sections on information technology fiscal policy. The Director of Technology shall consult with the Director of General Services, the Director of Finance, and other relevant agencies concerning policies and standards these agencies are responsible to issue that relate to information technology.

(3) Minimizing overlap, redundancy, and cost in state information technology operations by promoting the efficient and effective use of information technology.

(4) Providing technology direction to agency and department chief information officers to ensure the integration of statewide technology initiatives, compliance with information technology policies and standards, and the promotion of the alignment and effective management of information technology services. This paragraph does not limit the authority of a constitutional officer, cabinet agency secretary, or department director to establish programmatic priorities and business direction to the respective agency or department chief information officer.

(5) Working to improve organizational maturity and capacity in the effective management of information technology.

(6) Establishing performance management and improvement processes to ensure state information technology systems and services are efficient and effective.

(7) Approving, suspending, terminating, and reinstating information technology projects.

(8) Performing enterprise information technology functions and services, including, but not limited to, implementing Geographic Information Systems (GIS), shared services, applications, and program and project management activities in partnership with the owning agency or department.

(c) (1) The department may provide GIS data to a regional notification center, as defined in subdivision (q) of Section 4216, as provided to a state agency in accordance with this chapter, for the purposes of a regional notification center carrying out its duties pursuant to Article 2 (commencing with Section 4216) of Chapter 3.1 of Division 5 of Title 1.

(2) The department shall collect payment from a regional notification center to cover its reasonable costs for providing GIS data pursuant to this subdivision. Funds collected pursuant to this subdivision shall be deposited into the Technology Services Revolving Fund created pursuant to Section 11544.

(3) A state agency shall not be liable to a regional notification center or other third party for providing GIS data pursuant to this subdivision.

(d) The Director of Technology shall produce an annual information technology strategic plan that shall guide the acquisition, management, and use of information technology. State agencies shall cooperate with the department in the development of this plan, as required by the Director of Technology.

(1) Upon establishment of the information technology strategic plan, the Director of Technology shall take all appropriate and necessary steps to implement the plan, subject to any modifications and adjustments deemed necessary and reasonable.

(2) The information technology strategic plan shall be submitted to the Joint Legislative Budget Committee by January 15 of every year.

(e) The Director of Technology shall produce an annual information technology performance report that shall assess and measure the state’s progress toward enhancing its information technology program for human capital management; reducing and avoiding costs and risks associated with the acquisition, development, implementation, management, and operation of information technology assets, infrastructure, and systems; improving energy efficiency in the use of information technology assets; enhancing the security, reliability, and quality of information technology networks, services, and systems; and improving the information technology procurement process. This report shall also include cost savings and avoidances achieved through improvements to the way the state acquires, develops, implements, manages, and operates state technology assets, infrastructure, and systems. The department shall establish those policies and procedures required to improve the performance of the state’s information technology program.

(1) The department shall maintain an information technology performance management framework that includes the performance measures and targets that the department will utilize to assess the performance of, and measure the costs and risks avoided by, the state’s information technology program.

(2) State agencies shall take all necessary steps to achieve the targets set forth by the department and shall report their progress to the department on a quarterly basis.

(3) Notwithstanding Section 10231.5, the information technology performance report shall be submitted to the Joint Legislative Budget Committee, including any changes, by January 15 of every year. To enhance transparency, the department shall post performance targets and progress toward these targets on its public internet website.

(f) If the Governor’s Reorganization Plan No. 2 of 2012 becomes effective, this section shall prevail over Section 186 of the Governor’s Reorganization Plan No. 2 of 2012, regardless of the dates on which this section and that plan take effect, and this section shall become operative on July 1, 2013.

history: (History: Amended by Stats. 2019, Ch. 494, Sec. 1. (AB 754) Effective January 1, 2020.)

chapter: 5.6. Department of Technology

path: 2. GOVERNMENT OF THE STATE OF CALIFORNIA > 3. EXECUTIVE DEPARTMENT > 5.6. Department of Technology


text:
(a) The Department of Technology shall be responsible for the approval and oversight of information technology projects, which shall include, but are not limited to, all of the following:

(1) Establishing and maintaining a framework of policies, procedures, and requirements for the initiation, approval, implementation, management, oversight, and continuation of information technology projects. Unless otherwise required by law, a state department shall not procure oversight services of information technology projects without the approval of the Department of Technology.

(2) Evaluating information technology projects based on the business case justification, resources requirements, proposed technical solution, project management, oversight and risk mitigation approach, and compliance with statewide strategies, policies, and procedures. Projects shall continue to be funded through the established Budget Act process.

(3) Consulting with agencies during initial project planning to ensure that project proposals are based on well-defined programmatic needs, clearly identify programmatic benefits, and consider feasible alternatives to address the identified needs and benefits consistent with statewide strategies, policies, and procedures.

(4) Consulting with agencies prior to project initiation to review the project governance and management framework to ensure that it is best designed for success and will serve as a resource for agencies throughout the project implementation.

(5) Requiring agencies to provide information on information technology projects including, but not limited to, all of the following:

(A) The degree to which the project is within approved scope, cost, and schedule.

(B) Project issues, risks, and corresponding mitigation efforts.

(C) The current estimated schedule and costs for project completion.

(6) Requiring agencies to perform remedial measures to achieve compliance with approved project objectives. These remedial measures may include, but are not limited to, any of the following:

(A) Independent assessments of project activities, the cost of which shall be funded by the agency administering the project.

(B) Establishing remediation plans.

(C) Securing appropriate expertise, the cost of which shall be funded by the agency administering the project.

(D) Requiring additional project reporting.

(E) Requiring approval to initiate any action identified in the approved project schedule.

(7) Suspending, reinstating, or terminating information technology projects. The Department of Technology shall notify the Joint Legislative Budget Committee of any project suspension, reinstatement, and termination within 30 days of that suspension, reinstatement, or termination.

(8) Establishing restrictions or other controls to mitigate nonperformance by agencies, including, but not limited to, any of the following:

(A) The restriction of future project approvals pending demonstration of successful correction of the identified performance failure.

(B) The revocation or reduction of authority for state agencies to initiate information technology projects or acquire information technology or telecommunications goods or services.

(b) The Department of Technology shall have the authority to delegate to another agency any authority granted under this section based on its assessment of the agency’s project management, project oversight, and project performance.

history: (History: Amended by Stats. 2013, Ch. 353, Sec. 77. (SB 820) Effective September 26, 2013. Operative July 1, 2013, by Sec. 129 of Ch. 353.)


text:
The Department of Technology shall improve the governance and implementation of information technology by standardizing reporting relationships, roles, and responsibilities for setting information technology priorities.

(a) (1) Each state agency shall have a chief information officer who is appointed by the head of the state agency, or by the head’s designee, subject to the approval of the Department of Technology.

(2) A chief information officer appointed under this subdivision shall do all of the following:

(A) Oversee the information technology portfolio and information technology services within their state agency through the operational oversight of information technology budgets of departments, boards, bureaus, and offices within the state agency.

(B) Develop the enterprise architecture for their state agency, subject to the review and approval of the Department of Technology, to rationalize, standardize, and consolidate information technology applications, assets, infrastructure, data, and procedures for all departments, boards, bureaus, and offices within the state agency.

(C) Ensure that all departments, boards, bureaus, and offices within the state agency are in compliance with the state information technology policy.

(b) (1) Each state entity shall have a chief information officer who is appointed by the head of the state entity.

(2) A chief information officer appointed under this subdivision shall do all of the following:

(A) Supervise all information technology and telecommunications activities within their state entity, including, but not limited to, information technology, information security, and telecommunications personnel, contractors, systems, assets, projects, purchases, and contracts.

(B) Ensure the entity conforms with state information technology and telecommunications policy and enterprise architecture.

(c) Each state agency shall have an information security officer appointed by the head of the state agency, or the head’s designee, subject to the approval by the Department of Technology. The state agency’s information security officer appointed under this subdivision shall report to the state agency’s chief information officer.

(d) Each state entity shall have an information security officer who is appointed by the head of the state entity. An information security officer shall report to the chief information officer of their state entity. The Department of Technology shall develop specific qualification criteria for an information security officer. If a state entity cannot fund a position for an information security officer, the entity’s chief information officer shall perform the duties assigned to the information security officer. The chief information officer shall coordinate with the Department of Technology for any necessary support.

(e) (1) For purposes of this section, “state agency” means the Transportation Agency, Department of Corrections and Rehabilitation, Department of Veterans Affairs, Business, Consumer Services, and Housing Agency, Natural Resources Agency, California Health and Human Services Agency, California Environmental Protection Agency, Labor and Workforce Development Agency, and Department of Food and Agriculture.

(2) For purposes of this section, “state entity” means an entity within the executive branch that is under the direct authority of the Governor, including, but not limited to, all departments, boards, bureaus, commissions, councils, and offices that are not defined as a “state agency” pursuant to paragraph (1).

(f) A state entity that is not defined under subdivision (e) may voluntarily comply with any of the requirements of Sections 11546.2 and 11546.3 and may request assistance from the Department of Technology to do so.

(g) This section shall become inoperative on July 1, 2026, and, as of January 1, 2027, is repealed.

history: (History: Amended by Stats. 2026, Ch. 28, Sec. 26. (SB 170) Effective June 29, 2026. Inoperative July 1, 2026, by its own provisions. Repealed as of January 1, 2027, by its own provisions. See later operative version added by Sec. 27 of Stats. 2026, Ch. 28.)


text:
The Department of Technology shall improve the governance and implementation of information technology by standardizing reporting relationships, roles, and responsibilities for setting information technology priorities.

(a) (1) Each state agency shall have a chief information officer who is appointed by the head of the state agency, or by the head’s designee, subject to the approval of the Department of Technology.

(2) A chief information officer appointed under this subdivision shall do all of the following:

(A) Oversee the information technology portfolio and information technology services within their state agency through the operational oversight of information technology budgets of departments, boards, bureaus, and offices within the state agency.

(B) Develop the enterprise architecture for their state agency, subject to the review and approval of the Department of Technology, to rationalize, standardize, and consolidate information technology applications, assets, infrastructure, data, and procedures for all departments, boards, bureaus, and offices within the state agency.

(C) Ensure that all departments, boards, bureaus, and offices within the state agency are in compliance with the state information technology policy.

(b) (1) Each state entity shall have a chief information officer who is appointed by the head of the state entity.

(2) A chief information officer appointed under this subdivision shall do all of the following:

(A) Supervise all information technology and telecommunications activities within their state entity, including, but not limited to, information technology, information security, and telecommunications personnel, contractors, systems, assets, projects, purchases, and contracts.

(B) Ensure the entity conforms with state information technology and telecommunications policy and enterprise architecture.

(c) Each state agency shall have an information security officer appointed by the head of the state agency, or the head’s designee, subject to the approval by the Department of Technology. The state agency’s information security officer appointed under this subdivision shall report to the state agency’s chief information officer.

(d) Each state entity shall have an information security officer who is appointed by the head of the state entity. An information security officer shall report to the chief information officer of their state entity. The Department of Technology shall develop specific qualification criteria for an information security officer. If a state entity cannot fund a position for an information security officer, the entity’s chief information officer shall perform the duties assigned to the information security officer. The chief information officer shall coordinate with the Department of Technology for any necessary support.

(e) (1) For purposes of this section, “state agency” means the Transportation Agency, Department of Corrections and Rehabilitation, Department of Veterans Affairs, Business and Consumer Services Agency, California Housing and Homelessness Agency, Natural Resources Agency, California Health and Human Services Agency, California Environmental Protection Agency, Labor and Workforce Development Agency, and Department of Food and Agriculture.

(2) For purposes of this section, “state entity” means an entity within the executive branch that is under the direct authority of the Governor, including, but not limited to, all departments, boards, bureaus, commissions, councils, and offices that are not defined as a “state agency” pursuant to paragraph (1).

(f) A state entity that is not defined under subdivision (e) may voluntarily comply with any of the requirements of Sections 11546.2 and 11546.3 and may request assistance from the Department of Technology to do so.

(g) This section shall become operative on July 1, 2026.

history: (History: Repealed (in Sec. 26) and added by Stats. 2026, Ch. 28, Sec. 27. (SB 170) Effective June 29, 2026. Operative July 1, 2026, by its own provisions.)


text:
(a) On or before February 1 of every year, each state agency and state entity subject to Section 11546.1, shall submit, as instructed by the Department of Technology, a summary of its actual and projected information technology and telecommunications costs, including, but not limited to, personnel, for the immediately preceding fiscal year and current fiscal year, showing current expenses and projected expenses for the current fiscal year, in a format prescribed by the Department of Technology in order to capture statewide information technology expenditures.

(b) On or before February 1 of every year, each state agency and state entity subject to Section 11546.1 shall submit, as instructed and in a format prescribed by the Department of Technology, a summary of its actual and projected information security costs, including, but not limited to, personnel, for the immediately preceding fiscal year and current fiscal year, showing current expenses and projected expenses for the current fiscal year, in order to capture statewide information security expenditures, including the expenditure of federal grant funds for information security purposes.

history: (History: Amended by Stats. 2017, Ch. 193, Sec. 2. (AB 475) Effective January 1, 2018.)


text:
(a) (1) A chief information officer appointed under Section 11546.1 shall develop a plan to leverage cost-effective strategies to reduce the total amount of energy utilized by information technology and telecommunications equipment of the officer’s agency or entity, as the case may be, in support of the statewide effort to reduce energy consumption by 20 percent below the 2009 baseline by July 1, 2011, and by 30 percent below the 2009 baseline by July 1, 2012.

(2) A chief information officer appointed under Section 11546.1 shall report the progress toward the energy reduction targets in paragraph (1) to the Department of Technology on a quarterly basis beginning in January 2011. The Department of Technology shall include the quarterly reports on its Internet Web site.

(b) (1) A state agency or entity subject to Section 11546.1 shall do all of the following:

(A) Comply with the policies of the Department of Technology to reduce the total amount of office square footage currently utilized for data centers by the agency or entity, as the case may be, in support of the statewide effort to reduce energy consumption by 50 percent below the 2009 baseline by July 2011.

(B) Host all mission critical and public-facing applications and server refreshes in a Tier III or equivalent data center, as designated by the Department of Technology.

(C) Close any existing data centers or server rooms that house nonnetwork equipment by June 2013. On or before July 2011, transition plans, in accordance with guidance provided by the Department of Technology, shall be submitted to the Department of Technology.

(D) Be in migration from its existing network services to the California Government Network by no later than July 2011.

(E) Report to the Department of Technology on the progress toward the targets listed in this subdivision on a quarterly basis, beginning in January 2011.

(2) The Department of Technology shall include the quarterly reports required by subparagraph (E) of paragraph (1) on its Internet Web site.

(c) (1) A state agency or entity subject to Section 11546.1 shall do both of the following:

(A) Be in migration to the state shared email solution by no later than June 2011.

(B) Report to the Department of Technology on the progress toward the target listed in subparagraph (A) on a quarterly basis, beginning in April 2011.

(2) The Department of Technology shall include the quarterly reports required by subparagraph (B) of paragraph (1) on its Internet Web site.

history: (History: Amended by Stats. 2013, Ch. 352, Sec. 237. (AB 1317) Effective September 26, 2013. Operative July 1, 2013, by Sec. 543 of Ch. 352.)


text: Notwithstanding any other law, any service contract proposed to be entered into by an agency that would not otherwise be subject to review, approval, or oversight by the Department of Technology but that contains an information technology component that would be subject to oversight by the Department of Technology if it was a separate information technology project, shall be subject to review, approval, and oversight by the Department of Technology as set forth in Section 11546.

history: (History: Amended by Stats. 2013, Ch. 352, Sec. 238. (AB 1317) Effective September 26, 2013. Operative July 1, 2013, by Sec. 543 of Ch. 352.)


text: Notwithstanding any other law, all employees of the Department of Technology shall be designated as excluded from collective bargaining pursuant to subdivision (b) of Section 3527, except for employees of the Office of Technology Services and employees of the Public Safety Communications Division who are not otherwise excluded from collective bargaining.

history: (History: Amended by Stats. 2013, Ch. 352, Sec. 239. (AB 1317) Effective September 26, 2013. Operative July 1, 2013, by Sec. 543 of Ch. 352.)


text:
(a) The Director of Technology shall require fingerprint images and associated information from an employee, prospective employee, contractor, subcontractor, volunteer, or vendor whose duties include, or would include, working on data center, telecommunications, or network operations, engineering, or security with access to confidential or sensitive information and data on the network or computing infrastructure.

(b) The fingerprint images and associated information described in subdivision (a) shall be furnished to the Department of Justice for the purpose of obtaining information as to the existence and nature of any of the following:

(1) A record of state or federal convictions and the existence and nature of state or federal arrests for which the person is free on bail or on his or her own recognizance pending trial or appeal.

(2) Being convicted of, or pleading nolo contendere to, a crime, or having committed an act involving dishonesty, fraud, or deceit, if the crime or act is substantially related to the qualifications, functions, or duties of a person employed by the state in accordance with this provision.

(3) Any conviction or arrest, for which the person is free on bail or on his or her own recognizance pending trial or appeal, with a reasonable nexus to the information or data to which the employee shall have access.

(c) Requests for federal criminal offender record information received by the Department of Justice pursuant to this section shall be forwarded to the Federal Bureau of Investigation by the Department of Justice.

(d) The Department of Justice shall respond to the Director of Technology with information as provided under subdivision (p) of Section 11105 of the Penal Code.

(e) The Director of Technology shall request subsequent arrest notifications from the Department of Justice as provided under Section 11105.2 of the Penal Code.

(f) The Department of Justice may assess a fee sufficient to cover the processing costs required under this section, as authorized pursuant to subdivision (e) of Section 11105 of the Penal Code.

(g) If an individual described in subdivision (a) is rejected as a result of information contained in the Department of Justice or Federal Bureau of Investigation criminal offender record information response, the individual shall receive a copy of the response record from the Director of Technology.

(h) The Director of Technology shall develop a written appeal process for an individual described in subdivision (a) who is determined ineligible for employment because of his or her Department of Justice or Federal Bureau of Investigation criminal offender record. Individuals shall not be found to be ineligible for employment pursuant to this section until the appeal process is in place.

(i) When considering the background information received pursuant to this section, the Director of Technology shall take under consideration any evidence of rehabilitation, including participation in treatment programs, as well as the age and specifics of the offense.

history: (History: Amended by Stats. 2013, Ch. 352, Sec. 240. (AB 1317) Effective September 26, 2013. Operative July 1, 2013, by Sec. 543 of Ch. 352.)


text:
(a) Before July 1, 2019, and before July 1 biennially thereafter, the director of each state agency or state entity, as defined in subdivision (e) of Section 11546.1, and each chief information officer appointed under Section 11546.1, shall post on the home page of the state agency’s or state entity’s Internet Web site a signed certification from the state agency’s or state entity’s director and chief information officer that they have determined that the Internet Web site is in compliance with Sections 7405 and 11135, and the Web Content Accessibility Guidelines 2.0, or a subsequent version, published by the Web Accessibility Initiative of the World Wide Web Consortium at a minimum Level AA success criteria.

(b) The Director of Technology shall create a standard form that each state agency’s or state entity’s chief information officer shall use to determine whether the state agency’s or state entity’s Internet Web site is in compliance with the accessibility standards specified in subdivision (a).

history: (History: Added by Stats. 2017, Ch. 780, Sec. 1. (AB 434) Effective January 1, 2018.)


text:
(a) There is hereby established within the Government Operations Agency a consortium that shall develop, pursuant to this section, a framework for the creation of a public cloud computing cluster to be known as “CalCompute.”

(b) The consortium shall develop a framework for the creation of CalCompute that advances the development and deployment of artificial intelligence that is safe, ethical, equitable, and sustainable by doing, at a minimum, both of the following:

(1) Fostering research and innovation that benefits the public.

(2) Enabling equitable innovation by expanding access to computational resources.

(c) The consortium shall make reasonable efforts to ensure that CalCompute is established within the University of California to the extent possible.

(d) CalCompute shall include, but not be limited to, all of the following:

(1) A fully owned and hosted cloud platform.

(2) Necessary human expertise to operate and maintain the platform.

(3) Necessary human expertise to support, train, and facilitate the use of CalCompute.

(e) The consortium shall operate in accordance with all relevant labor and workforce laws and standards.

(f) (1) On or before January 1, 2027, the Government Operations Agency shall submit, pursuant to Section 9795, a report from the consortium to the Legislature with the framework developed pursuant to subdivision (b) for the creation and operation of CalCompute.

(2) The report required by this subdivision shall include all of the following elements:

(A) A landscape analysis of California’s current public, private, and nonprofit cloud computing platform infrastructure.

(B) An analysis of the cost to the state to build and maintain CalCompute and recommendations for potential funding sources.

(C) Recommendations for the governance structure and ongoing operation of CalCompute.

(D) Recommendations for the parameters for use of CalCompute, including, but not limited to, a process for determining which users and projects will be supported by CalCompute.

(E) An analysis of the state’s technology workforce and recommendations for equitable pathways to strengthen the workforce, including the role of CalCompute.

(F) A detailed description of any proposed partnerships, contracts, or licensing agreements with nongovernmental entities, including, but not limited to, technology-based companies, that demonstrates compliance with the requirements of subdivisions (c) and (d).

(G) Recommendations regarding how the creation and ongoing management of CalCompute can prioritize the use of the current public sector workforce.

(g) The consortium shall, consistent with state constitutional law, consist of 14 members as follows:

(1) Four representatives of the University of California and other public and private academic research institutions and national laboratories appointed by the Secretary of Government Operations.

(2) Three representatives of impacted workforce labor organizations appointed by the Speaker of the Assembly.

(3) Three representatives of stakeholder groups with relevant expertise and experience, including, but not limited to, ethicists, consumer rights advocates, and other public interest advocates appointed by the Senate Rules Committee.

(4) Four experts in technology and artificial intelligence to provide technical assistance appointed by the Secretary of Government Operations.

(h) The members of the consortium shall serve without compensation, but shall be reimbursed for all necessary expenses actually incurred in the performance of their duties.

(i) The consortium shall be dissolved upon submission of the report required by paragraph (1) of subdivision (f) to the Legislature.

(j) If CalCompute is established within the University of California, the University of California may receive private donations for the purposes of implementing CalCompute.

(k) This section shall become operative only upon an appropriation in a budget act, or other measure, for the purposes of this section.

history: (History: Added by Stats. 2025, Ch. 138, Sec. 3. (SB 53) Effective January 1, 2026. Conditionally operative as prescribed by its own provisions.)


text:
(a) On or before May 1, 2024, the Department of Technology, with input from relevant state agencies and relevant stakeholders, shall conduct, complete, and submit a report to the Senate Committee on Energy, Utilities and Communications and the Assembly Committee on Communications and Conveyance that reviews and identifies all of the following:

(1) Barriers to, and opportunities for, the investment in and efficient building of broadband access points on private and government-owned structures and property, private and public lands and buildings, and public rights of way.

(2) Barriers to, and opportunities for, access to mobile and fixed broadband internet service infrastructure by low-income tribal, urban, and rural customers, and to underserved communities.

(b) The report shall provide recommendations on how to accelerate deployment of broadband access points to serve tribes, low-income customers, and disadvantaged or underserved communities.

(c) At a minimum, the report shall consider whether, and if so, the extent to which the following factors serve as barriers to investment or deployment of broadband access points and shall make recommendations on how to overcome these barriers:

(1) The processes for and cost of obtaining electric service to broadband access points.

(2) Processes for obtaining state, county, or local permits to deploy broadband access points.

(3) Regulatory and legal obstacles in deploying fiber to transport broadband traffic from broadband access points.

(4) The lack of legal limitations on the price for leasing private or public property to deploy broadband access points on public and private property and buildings.

(5) The cost of leasing access to middle-mile broadband networks.

(6) California Coastal Commission permitting policies.

(7) Local coastal plans that use California Coastal Commission policies.

(8) The permitting policies and processes to deploy on property governed by port authorities.

(9) Air quality management district permitting requirements.

(10) Noise abatement regulations that result in delay or block investment in, and deployment of, broadband access points.

(11) The income of households in the area and the economic feasibility for internet service providers to deploy in areas.

(d) For purposes of this section:

(1) “Broadband access points” means both wireless broadband access points and wireline broadband access points.

(2) “Relevant stakeholders” means representatives of each of the following: law enforcement agencies, public safety community, public first responder personnel and providers, wireless service and infrastructure providers and their trade associations, cable communications providers and their trade association, wireline communications providers and their trade association, tribes, municipal government and city associations, county governments and county associations, investor-owned utilities, publicly owned utilities, organized labor, California manufacturing associations, consumer and ratepayer advocacy organizations, and technology associations.

(3) “Relevant state agencies” means the Department of Transportation, the Public Utilities Commission, the Department of Forestry and Fire Protection, Office of Emergency Services, and the California Coastal Commission.

(4) “Wireless broadband access points” means poles, buildings, property, towers, and base stations upon which wireless transmission and transport facilities are installed.

(5) “Wireline broadband access points” includes coax and fiber transport and distribution facilities and the poles, buildings, property, and structures, upon which these facilities are installed.

history: (History: Added by Stats. 2022, Ch. 813, Sec. 2. (SB 717) Effective January 1, 2023.)


text:
(a) (1) The Department of Technology shall identify, assess, and prioritize high-risk, critical information technology services and systems across state government, as determined by the Department of Technology, for modernization, stabilization, or remediation.

(2) The Department of Technology shall submit an annual report to the Legislature that includes all of the following:

(A) An explanation of how the Department of Technology is prioritizing these efforts across state government.

(B) The impediments and risks that could, or issues that already have, led to changes in how the Department of Technology identifies, assesses, and prioritizes these efforts.

(3) In accordance with Section 7929.210, this section shall not be construed to require the disclosure of information relating to high-risk, critical information technology services and systems by the Department of Technology, if, on the facts of the particular case, disclosure of that record would reveal vulnerabilities to, or otherwise increase the potential for an attack on, an information technology system of a public agency.

(b) (1) Notwithstanding any other law, all state agencies and state entities shall submit information relating to their information technology service contracts, as defined, to the Department of Technology before February 1, 2022, and annually thereafter, in a manner determined by the Department of Technology.

(2) The Department of Technology shall analyze the information submitted pursuant to subparagraph (1).

(3) After completing the analysis, the Department of Technology shall submit a report to the Legislature, as part of its annual information technology report submitted pursuant to subdivision (e) of Section 11545, that does all of the following:

(A) Identifies each service that the Department of Technology believes would be appropriately centralized as shared services contracts.

(B) Summarizes market research the department would conduct to estimate the one-time and ongoing costs to the state of each service.

(C) Calculates potential offsetting savings to the state from reduced overlap and redundancy of services.

(4) After submitting the report, the Department of Technology shall create a plan, coordinate with, and assist state agencies and state entities in, the implementation of a plan to establish centralized contracts for identified shared services, as defined. The plan may include, but is not limited to, a list of existing service contracts of state agencies and state entities that may be replaced with centralized service contracts managed by the Department of Technology and a proposed strategy and timeline for the transition from existing service contracts to centralized service contracts. The Department of Technology shall submit the plan to the Joint Legislative Budget Committee no later than February 1, 2023.

(c) For purposes of this section, the following definitions apply:

(1) “Information technology services and systems contracts” means contracts for services and systems, including, but not limited to, cloud services, including “Software as a Service,” “Infrastructure as a Service,” and “Platform as a Service,” on-premises services and systems, information technology personal services, and information technology consulting services for not less than five hundred thousand dollars ($500,000) annually, or such amounts determined by the Department of Technology pursuant to its policy.

(2) “Shared services” means information technology services commonly used across state agencies that may be consolidated under a single contract to achieve cost savings and process efficiencies.

history: (History: Amended by Stats. 2022, Ch. 28, Sec. 61. (SB 1380) Effective January 1, 2023.)


text:
(a) For purposes of this section:

(1) “Artificial intelligence” means an engineered or machine-based system that varies in its level of autonomy and that can, for explicit or implicit objectives, infer from the input it receives how to generate outputs that can influence physical or virtual environments.

(2) “Automated decision system” means a computational process derived from machine learning, statistical modeling, data analytics, or artificial intelligence that issues simplified output, including a score, classification, or recommendation, that is used to assist or replace human discretionary decisionmaking and materially impacts natural persons. “Automated decision system” does not include a spam email filter, firewall, antivirus software, identity and access management tools, calculator, database, dataset, or other compilation of data.

(3) “Board” means any administrative or regulatory board, commission, committee, council, association, or authority consisting of more than one person whose members are appointed by the Governor, the Legislature, or both.

(4) “Department” means the Department of Technology.

(5) “High-risk automated decision system” means an automated decision system that is used to assist or replace human discretionary decisions that have a legal or similarly significant effect, including decisions that materially impact access to, or approval for, housing or accommodations, education, employment, credit, health care, and criminal justice.

(6) (A) “State agency” means any of the following:

(i) Any state office, department, division, or bureau.

(ii) The California State University.

(iii) The Board of Parole Hearings.

(iv) Any board or other professional licensing and regulatory body under the administration or oversight of the Department of Consumer Affairs.

(B) “State agency” does not include the University of California, the Legislature, the judicial branch, or any board, except as provided in subparagraph (A).

(b) On or before September 1, 2024, the Department of Technology shall conduct, in coordination with other interagency bodies as it deems appropriate, a comprehensive inventory of all high-risk automated decision systems that have been proposed for use, development, or procurement by, or are being used, developed, or procured by, any state agency.

(c) The comprehensive inventory described by subdivision (b) shall include a description of all of the following:

(1) (A) Any decision the automated decision system can make or support and the intended benefits of that use.

(B) The alternatives to any use described in subparagraph (A).

(2) The results of any research assessing the efficacy and relative benefits of the uses and alternatives of the automated decision system described by paragraph (1).

(3) The categories of data and personal information the automated decision system uses to make its decisions.

(4) (A) The measures in place, if any, to mitigate the risks, including cybersecurity risk and the risk of inaccurate, unfairly discriminatory, or biased decisions, of the automated decision system.

(B) Measures described by this paragraph may include, but are not limited to, any of the following:

(i) Performance metrics to gauge the accuracy of the system.

(ii) Cybersecurity controls.

(iii) Privacy controls.

(iv) Risk assessments or audits for potential risks.

(v) Measures or processes in place to contest an automated decision.

(d) (1) On or before January 1, 2025, and annually thereafter, the department shall submit a report of the comprehensive inventory described in subdivision (b) to the Assembly Committee on Privacy and Consumer Protection and the Senate Committee on Governmental Organization.

(2) The requirement for submitting a report imposed under paragraph (1) is inoperative on January 1, 2029, pursuant to Section 10231.5.

(3) A report to be submitted pursuant to paragraph (1) shall be submitted in compliance with Section 9795.

history: (History: Amended by Stats. 2024, Ch. 843, Sec. 3. (AB 2885) Effective January 1, 2025.)


text:
(a) (1) By January 1, 2024, the Department of Technology, in consultation with the public, the Public Utilities Commission, and the California Broadband Council, shall develop a state digital equity plan.

(2) The Department of Technology, to the extent practicable, shall obtain all available federal funding for purposes of developing and implementing the state digital equity plan.

(b) The state digital equity plan shall include the following:

(1) The identification of barriers to digital equity faced by covered populations in this state. Barriers include, but are not limited to, the following:

(A) The availability and affordability of access to fixed and wireless broadband technology.

(B) Accessibility and inclusivity of online public resources and services.

(C) Digital literacy.

(D) Awareness and use of measures to secure the online privacy and cybersecurity of an individual.

(E) Availability and affordability of consumer devices and technical support for those devices.

(2) Measurable objectives for documenting and promoting digital equity among covered populations located in the state.

(3) An assessment of how the objectives described will impact and interact with the following:

(A) Economic and workforce development goals, plans, and outcomes of the state.

(B) Educational outcomes, including, but not limited to, digital equity barriers for individuals with learning disabilities and English learners.

(C) Health outcomes.

(D) Civic and social engagement.

(E) Delivery of other essential services.

(4) A description of how the department plans to collaborate with key stakeholders, including, but not limited to, the following:

(A) Community anchor institutions.

(B) Local governments.

(C) Local educational agencies.

(D) Native American tribes.

(E) Nonprofit organizations.

(F) Organizations that represent covered populations.

(G) Civil rights organizations.

(H) Entities that carry out workforce development programs.

(I) State and local agencies that are responsible for administering or supervising adult education and literacy activities.

(J) State and local public housing authorities.

(K) Internet service providers (ISPs).

(L) Digital navigator programs.

(M) Partnerships between any of the entities described in subparagraphs (A) through (L), inclusive.

(5) A list of organizations with which the department collaborated in developing and implementing the state digital equity plan.

(6) An assessment of existing digital navigator programs in the state and recommendations for a statewide strategy for digital navigators to serve covered populations, including opportunities to integrate with other social service outreach programs and opportunities for covered populations to participate as navigators with training they can then leverage to enter careers in the information technology sector.

(c) For purposes of this section:

(1) The definitions in Section 60302 of the federal Infrastructure Investment and Jobs Act (Public Law 117-58) apply unless otherwise specified in this section.

(2) “Consultation with the public” means soliciting and receiving policy recommendation letters from key stakeholders as listed in paragraph (4) of subdivision (b), soliciting and receiving public comment, and hosting public workshops and meetings.

(3) “Covered populations” means demographics that are underserved in regards to internet access and digital literacy, and includes, but is not limited to, the following:

(A) Households whose income is 150 percent of the federal poverty level or less for the prior calendar year.

(B) Individuals 60 years of age or older.

(C) Incarcerated individuals, other than individuals who are incarcerated in a federal correctional facility.

(D) Veterans.

(E) Individuals with disabilities.

(F) Individuals with language barriers, such as English learners and individuals with low literacy levels.

(G) Members of a racial or ethnic minority group.

(H) Residents of rural areas.

history: (History: Added by Stats. 2022, Ch. 597, Sec. 2. (AB 2750) Effective January 1, 2023.)


text: The Department of Finance shall perform fiscal oversight of the state’s information technology projects. This oversight shall consist of a determination of the availability of project funding from appropriate sources, and project consistency with state fiscal policy. Projects shall continue to be funded through the established Budget Act process.

history: (History: Added by Stats. 2007, Ch. 183, Sec. 6. Effective January 1, 2008.)


text: This chapter shall not apply to the State Compensation Insurance Fund, the Legislature, or the Legislative Data Center in the Legislative Counsel Bureau.


text:
(a) There is in state government, in the Department of Technology, the Office of Information Security. The purpose of the Office of Information Security is to ensure the confidentiality, integrity, and availability of state systems and applications, and to promote and protect privacy as part of the development and operations of state systems and applications to ensure the trust of the residents of this state.

(b) The office shall be under the direction of a chief, who shall be appointed by, and serve at the pleasure of, the Governor. The chief shall report to the Director of Technology, and shall lead the Office of Information Security in carrying out its mission.

(c) The duties of the Office of Information Security, under the direction of the chief, shall be to provide direction for information security and privacy to state government agencies, departments, and offices, pursuant to Section 11549.3.

(d) (1) Unless the context clearly requires otherwise, whenever the term “Office of Information Security and Privacy Protection” appears in any statute, regulation, or contract, it shall be deemed to refer to the Office of Information Security, and whenever the term “executive director of the Office of Information Security and Privacy Protection” appears in statute, regulation, or contract, it shall be deemed to refer to the Chief of the Office of Information Security.

(2) All employees serving in state civil service, other than temporary employees, who are engaged in the performance of functions transferred from the Office of Information Security and Privacy Protection to the Office of Information Security, are transferred to the Office of Information Security. The status, positions, and rights of those persons shall not be affected by their transfer and shall continue to be retained by them pursuant to the State Civil Service Act (Part 2 (commencing with Section 18500) of Division 5), except as to positions the duties of which are vested in a position exempt from civil service. The personnel records of all transferred employees shall be transferred to the Office of Information Security.

(3) The property of any office, agency, or department related to functions transferred to the Office of Information Security is transferred to the Office of Information Security. If any doubt arises as to where that property is transferred, the Department of General Services shall determine where the property is transferred.

(4) All unexpended balances of appropriations and other funds available for use in connection with any function or the administration of any law transferred to the Office of Information Security shall be transferred to the Office of Information Security for the use and for the purpose for which the appropriation was originally made or the funds were originally available. If there is any doubt as to where those balances and funds are transferred, the Department of Finance shall determine where the balances and funds are transferred.

history: (History: Amended by Stats. 2013, Ch. 353, Sec. 78. (SB 820) Effective September 26, 2013. Operative July 1, 2013, by Sec. 129 of Ch. 353.)

article: 1. Office of Information Security

path: 2. GOVERNMENT OF THE STATE OF CALIFORNIA > 3. EXECUTIVE DEPARTMENT > 5.7. Office of Information Security and Office of Privacy Protection > 1. Office of Information Security


text:
As used in this article, the following terms have the following meanings:

(a) “Chief” means the Chief of the Office of Information Security.

(b) “Office” means the Office of Information Security.

(c) “Program” means an information security program established pursuant to Section 11549.3.

history: (History: Amended by Stats. 2013, Ch. 353, Sec. 79. (SB 820) Effective September 26, 2013. Operative July 1, 2013, by Sec. 129 of Ch. 353.)

chapter: 5.7. Office of Information Security and Office of Privacy Protection

article: 1. Office of Information Security


text:
(a) The chief shall establish an information security program. The program responsibilities include, but are not limited to, all of the following:

(1) The creation, updating, and publishing of information security and privacy policies, standards, and procedures for state agencies in the State Administrative Manual.

(2) The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies to effectively manage security and risk for both of the following:

(A) Information technology, which includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, telecommunications, requisite system controls, simulation, electronic commerce, and all related interactions between people and machines.

(B) Information that is identified as mission critical, confidential, sensitive, or personal, as defined and published by the office.

(3) The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies for the collection, tracking, and reporting of information regarding security and privacy incidents.

(4) The creation, issuance, and maintenance of policies, standards, and procedures directing state agencies in the development, maintenance, testing, and filing of each state agency’s disaster recovery plan.

(5) Coordination of the activities of state agency information security officers, for purposes of integrating statewide security initiatives and ensuring compliance with information security and privacy policies and standards.

(6) Promotion and enhancement of the state agencies’ risk management and privacy programs through education, awareness, collaboration, and consultation.

(7) Representing the state before the federal government, other state agencies, local government entities, and private industry on issues that have statewide impact on information security and privacy.

(b) All state entities defined in Section 11546.1 shall implement the policies and procedures issued by the office, including, but not limited to, performing both of the following duties:

(1) Comply with the information security and privacy policies, standards, and procedures issued pursuant to this chapter by the office.

(2) Comply with filing requirements and incident notification by providing timely information and reports as required by the office.

(c) (1) The office may conduct, or require to be conducted, an independent security assessment of every state agency, department, or office. The cost of the independent security assessment shall be funded by the state agency, department, or office being assessed.

(2) In addition to the independent security assessments authorized by paragraph (1), the office, in consultation with the Office of Emergency Services, shall perform all the following duties:

(A) Annually require no fewer than 35 state entities to perform an independent security assessment, the cost of which shall be funded by the state agency, department, or office being assessed.

(B) Determine criteria and rank state entities based on an information security risk index that may include, but not be limited to, analysis of the relative amount of the following factors within state agencies:

(i) Personally identifiable information protected by law.

(ii) Health information protected by law.

(iii) Confidential financial data.

(iv) Self-certification of compliance and indicators of unreported noncompliance with security provisions in the following areas:

(I) Information asset management.

(II) Risk management.

(III) Information security program management.

(IV) Information security incident management.

(V) Technology recovery planning.

(C) Determine the basic standards of services to be performed as part of independent security assessments required by this subdivision.

(3) The Military Department may perform an independent security assessment of any state agency, department, or office, the cost of which shall be funded by the state agency, department, or office being assessed.

(d) State agencies and entities required to conduct or receive an independent security assessment pursuant to subdivision (c) shall transmit the complete results of that assessment and recommendations for mitigating system vulnerabilities, if any, to the office and the Office of Emergency Services.

(e) The office shall report to the Department of Technology and the Office of Emergency Services any state entity found to be noncompliant with information security program requirements.

(f) (1) Every state agency, as defined in Section 11000, that is not subject to subdivision (b) shall do all of the following:

(A) Adopt and implement information security and privacy policies, standards, and procedures that adhere to the following standards:

(i) The National Institute of Standards and Technology (NIST) Special Publication 800-53, Revision 5, Security and Privacy Controls for Federal Information Systems and Organizations, and its successor publications.

(ii) Federal Information Processing Standards (FIPS) 199 Standards for Security Categorization of Federal Information and Information Systems, and its successor publications.

(iii) Federal Information Processing Standards (FIPS) 200 Minimum Security Requirements for Federal Information and Information Systems, and its successor publications.

(B) Perform a comprehensive, independent security assessment every two years. The independent assessment shall assess all policies, standards, and procedures adopted pursuant to subparagraph (A) and paragraph (2), if applicable.

(2) A state agency described in paragraph (1) may adopt and implement information security and privacy policies, standards, and procedures following Chapter 5300 - Information Technology - Office of Information Security of the State Administrative Manual. A state agency described in paragraph (1) may discontinue a policy, standard, or procedure adopted pursuant to this paragraph at any time.

(3) A state agency described in paragraph (1) may contract with the Military Department, or with a qualified responsible vendor, to perform an independent security assessment of the state agency pursuant to subparagraph (B) of paragraph (1), the cost of which shall be funded by the state agency being assessed.

(4) (A) Every state agency described in paragraph (1) shall certify, on a form developed pursuant to subparagraph (C), by February 1 annually, to the office that the agency is in compliance with all policies, standards, and procedures adopted pursuant to this subdivision. The certification shall include a plan of action and milestones.

(B) Notwithstanding any other law, the certification made to the office shall be kept confidential and shall not be disclosed, except as provided in subparagraph (E). The office shall ensure the transferring, receiving, possessing, or disclosing of certifications is done in a manner that ensures the confidentiality and security of the certification, including restricting transfer and storage methods to electronic means and ensuring that certification data is encrypted in transport and at rest. The office shall only provide access to certifications to employees who have submitted to a criminal background check as a condition of employment.

(C) The office shall develop a form for certification based on the Statewide Information Management Manual (SIMM) 5330-B, making modifications as necessary to encompass the requirements on state agencies under paragraphs (1) to (4), inclusive.

(D) The office may make recommendations and offer assistance to any state agency described in paragraph (1) on completing the plan of action and milestones required under paragraph (A). However, the office shall not have the authority to require any recommendation be followed or to compel acceptance of any assistance.

(E) The office shall review the certifications and make an annual summary report available, by May 1, 2024, and by March 1 every year thereafter, to the appropriate legislative committees and the Legislative Analyst’s Office to further their oversight and budgetary responsibilities.

(5) As an alternative to complying with the requirements of paragraphs (1) to (4), inclusive, a state agency described in paragraph (1) may annually submit, by January 15, a declaration to the chief confirming that the state agency voluntarily and fully complies with subdivisions (b) and (c).

(6) This subdivision shall apply to the University of California only to the extent that the Regents of the University of California, by resolution, make any of these provisions applicable to the University.

(g) (1) Notwithstanding any other law, during the process of conducting an independent security assessment pursuant to subdivision (c) or (f), information and records concerning the independent security assessment are confidential and shall not be disclosed, except that the information and records may be transmitted to state employees and state contractors who have been approved as necessary to receive the information and records to perform that independent security assessment, subsequent remediation activity, or monitoring of remediation activity.

(2) The results of a completed independent security assessment performed pursuant to subdivision (c), (f), or (j), and any related information shall be subject to all disclosure and confidentiality provisions pursuant to any state law, including, but not limited to, the California Public Records Act (Division 10 (commencing with Section 7920.000) of Title 1), but not limited to Section 7929.210.

(h) The office may conduct or require to be conducted an audit of information security to ensure program compliance.

(i) The office shall notify the Office of Emergency Services, Department of the California Highway Patrol, and the Department of Justice regarding any criminal or alleged criminal cyber activity affecting any state entity or critical infrastructure of state government.

(j) (1) At the request of a local educational agency, and in consultation with the California Cybersecurity Integration Center, the Military Department may perform an independent security assessment of the local educational agency, or an individual schoolsite under its jurisdiction, the cost of which shall be funded by the local educational agency.

(2) The criteria for the independent security assessment shall be established by the Military Department in coordination with the local educational agency.

(3) The Military Department shall disclose the results of an independent security assessment only to the local educational agency and the California Cybersecurity Integration Center.

(4) For purposes of this subdivision, “local educational agency” means a school district, county office of education, charter school, or state special school.

history: (History: Amended by Stats. 2023, Ch. 45, Sec. 15. (AB 127) Effective July 10, 2023.)

article: 1. Office of Information Security


text: The office shall consult with the Director of Technology, the Office of Emergency Services, the Director of General Services, the Director of Finance, and any other relevant agencies concerning policies, standards, and procedures related to information security and privacy.

history: (History: Amended by Stats. 2013, Ch. 352, Sec. 241. (AB 1317) Effective September 26, 2013. Operative July 1, 2013, by Sec. 543 of Ch. 352.)

article: 1. Office of Information Security


text:
(a) There is hereby created, in the State and Consumer Services Agency, the Office of Privacy Protection. The purpose of the Office of Privacy Protection shall be to protect the privacy of individuals’ personal information in a manner consistent with the California Constitution by identifying consumer problems in the privacy area and facilitating the development of fair information practices in adherence with the Information Practices Act of 1977 (Chapter 1 (commencing with Section 1798) of Title 1.8 of Part 4 of Division 3 of the Civil Code) and to promote and protect consumer privacy to ensure the trust of the residents of this state.

(b) The Office of Privacy Protection shall inform the public of potential options for protecting the privacy of, and avoiding the misuse of, personal information.

(c) The Office of Privacy Protection shall make recommendations to organizations for privacy policies and practices that promote and protect the interests of the consumers of this state.

(d) The Office of Privacy Protection may promote voluntary and mutually agreed upon nonbinding arbitration and mediation of privacy-related disputes where appropriate.

(e) The Office of Privacy Protection shall do all of the following:

(1) Receive complaints from individuals concerning a person obtaining, compiling, maintaining, using, disclosing, or disposing of personal information in a manner that may be potentially unlawful or violate a stated privacy policy relating to that individual, and provide advice, information, and referral, where available.

(2) Provide information to consumers on effective ways of handling complaints that involve violations of privacy-related laws, including identity theft and identity fraud. If appropriate local, state, or federal agencies are available to assist consumers with those complaints, the office shall refer those complaints to those agencies.

(3) Develop informational and educational programs and materials to foster public understanding and recognition of the purposes of this article.

(4) Assist and coordinate in the training of local, state, and federal law enforcement agencies regarding identity theft and other privacy-related crimes, as appropriate.

(5) The authority of the Office of Privacy Protection to adopt regulations under this article shall be limited exclusively to those regulations necessary and appropriate to implement subdivisions (b), (c), (d), and (e).

history: (History: Amended by Stats. 2010, Ch. 404, Sec. 31. (AB 2408) Effective January 1, 2011.)

article: 2. Office of Privacy Protection

path: 2. GOVERNMENT OF THE STATE OF CALIFORNIA > 3. EXECUTIVE DEPARTMENT > 5.7. Office of Information Security and Office of Privacy Protection > 2. Office of Privacy Protection


text: The Office of Privacy Protection shall be under the direction of a director who shall report to the Secretary of State and Consumer Services and lead the Office of Privacy Protection in carrying out its mission.

history: (History: Added by Stats. 2010, Ch. 404, Sec. 33. (AB 2408) Effective January 1, 2011.)

article: 2. Office of Privacy Protection


text:
As used in this article, the following terms have the following meanings:

(a) “Director” means the Director of the Office of Privacy Protection.

(b) “Office” means the Office of Privacy Protection.

history: (History: Added by Stats. 2010, Ch. 404, Sec. 34. (AB 2408) Effective January 1, 2011.)

article: 2. Office of Privacy Protection


history: (History: Added by renumbering Section 11549.6 by Stats. 2010, Ch. 404, Sec. 32. (AB 2408) Effective January 1, 2011.)

article: 2. Office of Privacy Protection


text:
For purposes of this chapter, the following definitions apply:

(a) “Commission” means the Public Utilities Commission.

(b) “Department” means the Department of Technology.

(c) “Mbps” means megabit per second.

(d) “Office” means the Office of Broadband and Digital Literacy established pursuant to Section 11549.51.

(e) “Open access” means equal non-discriminatory access to eligible entities on a technology and competitively neutral basis, regardless of whether the entity is privately or publicly owned.

(f) “Statewide open-access middle-mile broadband network” means the broadband infrastructure that is funded pursuant to Item 7502-062-8506 of the Budget Act of 2021.

(g) “Third-party administrator” means the third-party administrator retained by the office pursuant to Section 11549.53.

history: (History: Added by Stats. 2021, Ch. 112, Sec. 3. (SB 156) Effective July 20, 2021.)

path: 2. GOVERNMENT OF THE STATE OF CALIFORNIA > 3. EXECUTIVE DEPARTMENT > 5.8. Office of Broadband and Digital Literacy


text: There is in state government, within the department, the Office of Broadband and Digital Literacy.

chapter: 5.8. Office of Broadband and Digital Literacy