<?xml version='1.0' encoding='utf-8'?>
<section article="gsf" article_name="State Finance and Procurement" number="3.5-404" title_number="3.5" title_name="Department of Information Technology" subtitle_number="4">
  <level label="a">
    <text>The General Assembly declares that:</text>
    <level label="1">
      <text>it is the policy of the State to foster telecommunication and computer networking among State and local governments, their agencies, and educational institutions in the State;</text>
    </level>
    <level label="2">
      <text>there is a need to improve access, especially in rural areas, to efficient telecommunication and computer network connections;</text>
    </level>
    <level label="3">
      <text>improvement of telecommunication and computer networking for State and local governments and educational institutions promotes economic development, educational resource use and development, and efficiency in State and local administration;</text>
    </level>
    <level label="4">
      <text>rates for the intrastate inter–LATA telephone communications needed for effective integration of telecommunication and computer resources are prohibitive for many smaller governments, agencies, and institutions; and</text>
    </level>
    <level label="5">
      <text>the use of improved State telecommunication and computer networking under this section is intended not to compete with commercial access to advanced network technology, but rather to foster fundamental efficiencies in government and education for the public good.</text>
    </level>
  </level>
  <level label="b">
    <level label="1">
      <text>The Department shall establish a telecommunication and computer network in the State.</text>
    </level>
    <level label="2">
      <text>The network shall consist of:</text>
      <level label="i">
        <text>one or more connection facilities for telecommunication and computer connection in each local access transport area (LATA) in the State; and</text>
      </level>
      <level label="ii">
        <text>facilities, auxiliary equipment, and services required to support the network in a reliable and secure manner.</text>
      </level>
    </level>
  </level>
  <level label="c">
    <text>The network shall be accessible through direct connection and through local intra–LATA telecommunications to State and local governments and public and private educational institutions in the State.</text>
  </level>
  <level label="d">
    <text>In a manner and frequency established in regulations adopted by the Department, each unit of local government and any local agencies that use the network established under subsection (b) of this section shall certify to the Department that the unit is in compliance with the Department’s minimum security standards.</text>
  </level>
  <level label="e">
    <level label="1">
      <text>The Office shall ensure that at least once every 2 years, or more often if required by regulations adopted by the Department, each unit of State government shall complete an external assessment.</text>
    </level>
    <level label="2">
      <text>The Office shall assist each unit to remediate any security vulnerabilities or high–risk configurations identified in the assessment required under paragraph (1) of this subsection.</text>
    </level>
  </level>
  <level label="f">
    <level label="1">
      <text>In this subsection, “IT unit” means a unit of the Legislative Branch or Judicial Branch of State government, the Office of the Attorney General, the Office of the Comptroller, or the Office of the State Treasurer that provides information technology services for another unit of government.</text>
    </level>
    <level label="2">
      <text>Each IT unit shall:</text>
      <level label="i">
        <text>be evaluated by an independent auditor with cybersecurity expertise to determine whether the IT unit, and the units it provides information technology services for, meet relevant cybersecurity standards recommended by the National Institute of Standards and Technology; and</text>
      </level>
      <level label="ii">
        <text>certify compliance with the recommended National Institutes of Standards and Technology cybersecurity standards to:</text>
        <level label="1">
          <text>if the IT unit is part of the Legislative Branch, the President of the Senate and the Speaker of the House;</text>
        </level>
        <level label="2">
          <text>if the IT unit is part of the Office of the Attorney General, to the Attorney General;</text>
        </level>
        <level label="3">
          <text>if the IT unit is part of the Comptroller’s Office, to the Comptroller;</text>
        </level>
        <level label="4">
          <text>if the IT unit is part of the State Treasurer’s Office, to the State Treasurer; and</text>
        </level>
        <level label="5">
          <text>if the IT unit is part of the Judicial Branch of State government, the Chief Judge.</text>
        </level>
      </level>
    </level>
  </level>
</section>
