Report of the Joint Committee on Information Technology to the 2019 Kansas Legislature
Total Page:16
File Type:pdf, Size:1020Kb
JOINT COMMITTEE Report of the Joint Committee on Information Technology to the 2019 Kansas Legislature CHAIRPERSON: Senator Mike Petersen VICE-CHAIRPERSON: Representative Blake Carpenter RANKING MINORITY MEMBER: Senator Tom Holland OTHER MEMBERS: Senators Marci Francisco, Dinah Sykes, and Caryn Tyson; and Representatives Pam Curtis, Keith Esau, Kyle Hoffman, and Brandon Whipple CHARGE The Committee is directed to: ● Study computers, telecommunications, and other information technologies used by state agencies and institutions, defined by KSA 2018 Supp. 75-7201 to include executive, judicial, and legislative agencies and Board of Regents institutions; ● Review proposed new acquisitions, including implementation plans, project budget estimates, and three-year strategic information technology plans of state agencies and institutions. All state governmental entities are required to comply with provisions of KSA 75-7209 et seq. by submitting such information for review by the Committee; ● Monitor newly implemented technologies of state agencies and institutions; ● Make recommendations to the Senate Committee on Ways and Means and House Committee on Appropriations on implementation plans, budget estimates, and three-year plans of state agencies and institutions; ● Report annually to the Legislative Coordinating Council and make special reports to other legislative committees as deemed appropriate; and ● Discuss the three recommendations for legislative consideration included in the Legislative Division of Post Audit’s recent information technology audit report titled “Enterprise Project Management Office: Evaluating the Statutory Definition and Monetary Threshold for Major IT Projects.” February 2019 This page intentionally left blank. Joint Committee on Information Technology ANNUAL REPORT Conclusions and Recommendations The Committee makes the following recommendations to the 2019 Legislature: ● Introduce legislation to require all state employees to participate in cybersecurity training at least once a year; ● The House Committee on Appropriations and the Senate Committee on Ways and Means should increase cybersecurity funding for state agencies; ● The Kansas Information Security Office should develop a prioritization plan for addressing security vulnerabilities among state agencies; ● Schedule a Joint Committee on Information Technology (Committee) meeting early in the 2019 Session for the purpose of approving language to be included in legislation to amend the Kansas Cybersecurity Act (created in 2018) to require agency heads to submit cybersecurity assessment reports to the Chief Information Security Officer on an annual basis and include an appropriate enforcement mechanism; ● The Executive, Judicial, and Legislative Chief Information Technology Officers (CITOs) should develop and use a risk score approach in the information technology (IT) project approval process; ● The Revisor of Statutes staff should review statutes related to the current $250,000 IT project threshold and report back to the Committee early in the 2019 Session for the purpose of drafting legislation that would clarify such statutes for university IT projects; ● The Enterprise Project Management Office should improve transparency of IT projects that have been recast so the Legislature is aware of the true cost of a project over the entire life of the project; ● For IT procurements exceeding $5.0 million, the Committee should review any request for quotation (RFQ) or request for proposal (RFP) before a contract is awarded, and such RFQ or RFP should include an impact assessment explaining how the contract will affect Kansas workers; ● The Director of Procurements should not authorize any sole-source contract that extends for a period exceeding ten years; ● The Chief Information Technology Architect position should be filled as soon as possible; ● The Executive CITO should continue developing partnerships with IT talent recruiters and increasing capacity for IT talent in the state; Kansas Legislative Research Department 0-1 2018 Joint Committee Information Technology ● The Legislative Coordinating Council should consider expanding the scope of the Committee to include exploring ways to provide more science, technology, engineering, and math (STEM) opportunities in the state; and ● The House and Senate Committees on Education should look for opportunities to increase STEM education (including coding classes) across the state. Proposed Legislation: None BACKGROUND and three-year plans of state agencies and institutions; and The Joint Committee on Information Technology (Committee) has statutory duties ● Report annually to the Legislative assigned by its authorizing legislation in KSA 46- Coordinating Council (LCC) and make 2101 et seq. The Committee may set its own special reports to other legislative agenda, meet on call of its Chairperson at any time committees as deemed appropriate. and any place within the state, and introduce legislation. The Committee consists of ten members: five senators and five representatives. In addition to the Committee’s statutory The duties assigned to the Committee by KSA 46- duties, the Legislature or its committees, including 2101 and KSA 2018 Supp. 75-7201 et seq. are as the LCC, may direct the Committee to undertake follows: special studies and to perform other specific duties. ● Study computers, telecommunications, and other information technologies used KSA 2018 Supp. 75-7210 requires the by state agencies and institutions. The Executive, Judicial, and Legislative Chief state governmental entities defined by Information Technology Officers (CITOs) to KSA 2018 Supp. 75-7201 include submit annually to the Committee all IT project executive, judicial, and legislative budget estimates and revisions, all three-year agencies and Board of Regents plans, and all deviations from the state IT institutions; architecture. The Legislative CITO is directed to review the estimates and revisions, the three-year ● Review proposed new acquisitions, plans, and the deviations, and then make including implementation plans, project recommendations to the Committee regarding the budget estimates, and three-year strategic merits of and appropriations for the projects. In information technology (IT) plans of state addition, the Executive and Judicial CITOs are agencies and institutions. All state required to report to the Legislative CITO the governmental entities are required to progress regarding implementation of projects and comply with provisions of KSA 2018 proposed expenditures, including revisions to such Supp. 75-7209 et seq. by submitting such proposed expenditures. information for review by the Committee; COMMITTEE ACTIVITIES ● Monitor newly implemented technologies of state agencies and institutions; The Committee met during the 2018 Interim as authorized by the LCC, on December 17 and ● Make recommendations to the Senate 18, 2018. In addition to these days, the Committee Committee on Ways and Means and the met during the 2018 Session on March 8, April 26, House Committee on Appropriations on and May 2, 2018. implementation plans, budget estimates, Kansas Legislative Research Department 0-2 2018 Joint Committee Information Technology March 8 ● A Kansas Criminal Justice Information System eCitation II project that requires Election of Chairperson and Vice- refreshing business projects. A chairperson representative of the Kansas Sheriffs’ The Committee elected a new chairperson and Association explained major business vice-chairperson for the 2018 calendar year. The practices were being changed in the new Chairperson announced the intention to elect project. The representative predicted the a ranking minority member, selected from the project to be completed sometime between same chamber as the chairperson, at the next October 2018 and the first quarter of meeting. 2019; Executive Branch Quarterly IT Project ● KDOL’s Incarceration Database/Victim Report Notification Service, which needed to include more county jails; and The Interim Executive CITO reviewed the executive branch agency reports for the October- December 2017 quarter. The Executive CITO ● KDOL’s tax-audit software, which was reported five new “active” projects: slightly behind schedule. ● Electronic tracking for the Women, Infants The Interim Executive CITO described three and Children program by the Kansas Department of Health and Environment projects that had to be recast: (KDHE); ● Pittsburg State University’s cloud implementation, which was behind ● Implementation of a new KDHE air- schedule and over budget; quality project combining six obsolete air compliance systems; ● Kansas Department of Revenue’s (KDOR’s) KanLicense II project, which ● Office of Information Technology was behind schedule and was undergoing Services (OITS) consolidation of 23 more regression testing at the request of service desks into a centralized service the Secretary of Revenue; and desk; ● The Kansas Bureau of Investigation’s ● Kansas Department of Labor (KDOL) (KBI’s) Identity Access Management data management/data analytics; and project, which was operating under a new schedule. ● KDOL’s new tax-audit software. The Interim Executive CITO noted one project The Interim Executive CITO reported five in “caution” status for being behind schedule: the projects in “alert” status: KDHE Medicaid Management Information System Modernization (MMIS) Project, a joint ● A Fort Hays State University (FHSU) venture among five states. Responding to enterprise resource planning system that questions,