A state data center system that includes all primary data centers, other nonprimary data centers, and computing facilities, and that provides an enterprise information technology service as defined in s. 282.0041, is established.

   (1) INTENT.—The Legislature finds that the most efficient and effective means of providing quality utility data processing services to state agencies requires that computing resources be concentrated in quality facilities that provide the proper security, infrastructure, and staff resources to ensure that the state’s data is maintained reliably and safely, and is recoverable in the event of a disaster. Efficiencies resulting from such consolidation include the increased ability to leverage technological expertise and hardware and software capabilities; increased savings through consolidated purchasing decisions; and the enhanced ability to deploy technology improvements and implement new policies consistently throughout the consolidated organization. Therefore it is the intent of the Legislature that agency data centers and computing facilities be consolidated into primary data centers to the maximum extent possible by 2019.

   (2) AGENCY FOR ENTERPRISE INFORMATION TECHNOLOGY DUTIES.—The Agency for Enterprise Information Technology shall:

   (a)() Collect and maintain information necessary for developing policies relating to the data center system, including, but not limited to, an inventory of facilities.

   (b)() Annually approve cost-recovery mechanisms and rate structures for primary data centers which recover costs through charges to customer entities.

   (c)() By December 31 of each year, submit to the Legislature recommendations to improve the efficiency and effectiveness of computing services provided by state data center system facilities. Such recommendations may include, but need not be limited to:

   (1.) Policies for improving the cost-effectiveness and efficiency of the state data center system.

   (2.) Infrastructure improvements supporting the consolidation of facilities or preempting the need to create additional data centers or computing facilities.

   (3.) Standards for an objective, credible energy performance rating system that data center boards of trustees can use to measure state data center energy consumption and efficiency on a biannual basis.

   (4.) Uniform disaster recovery standards.

   (5.) Standards for primary data centers providing transparent financial data to user agencies.

   (6.) Consolidation of contract practices or coordination of software, hardware, or other technology-related procurements.

   (7.) Improvements to data center governance structures.

   (d)() By October 1 of each year beginning in 2009, recommend to the Governor and Legislature at least two nonprimary data centers for consolidation into a primary data center or nonprimary data center facility.

   (1.) The consolidation proposal must provide a transition plan that includes:

   (a.) Estimated transition costs for each data center or computing facility recommended for consolidation;

   (b.) Detailed timeframes for the complete transition of each data center or computing facility recommended for consolidation;

   (c.) Proposed recurring and nonrecurring fiscal impacts, including increased or decreased costs and associated budget impacts for affected budget entities;

   (d.) Substantive legislative changes necessary to implement the transition; and

   (e.) Identification of computing resources to be transferred and those that will remain in the agency. The transfer of resources must include all hardware, software, staff, contracted services, and facility resources performing data center management and operations, security, backup and recovery, disaster recovery, system administration, database administration, system programming, job control, production control, print, storage, technical support, help desk, and managed services but excluding application development.

   (2.) Recommendations shall be based on the goal of maximizing current and future cost savings. The agency shall consider the following criteria in selecting consolidations that maximize efficiencies by providing the ability to:

   (a.) Consolidate purchase decisions;

   (b.) Leverage expertise and other resources to gain economies of scale;

   (c.) Implement state information technology policies more effectively;

   (d.) Maintain or improve the level of service provision to customer entities; and

   (e.) Make progress towards the state’s goal of consolidating data centers and computing facilities into primary data centers.

   (3.) The agency shall establish workgroups as necessary to ensure participation by affected agencies in the development of recommendations related to consolidations.

   (e)() By December 31, 2010, the agency shall develop and submit to the Legislature an overall consolidation plan for state data centers. The plan shall indicate a timeframe for the consolidation of all remaining nonprimary data centers into primary data centers, including existing and proposed primary data centers, by 2019.

   (f)() Develop and establish rules relating to the operation of the state data center system which comply with applicable federal regulations, including 2 C.F.R. part 225 and 45 C.F.R. The rules may address:

   (1.) Ensuring that financial information is captured and reported consistently and accurately.

   (2.) Requiring the establishment of service-level agreements executed between a data center and its customer entities for services provided.

   (3.) Requiring annual full cost recovery on an equitable rational basis. The cost-recovery methodology must ensure that no service is subsidizing another service and may include adjusting the subsequent year’s rates as a means to recover deficits or refund surpluses from a prior year.

   (4.) Requiring that any special assessment imposed to fund expansion is based on a methodology that apportions the assessment according to the proportional benefit to each customer entity.

   (5.) Requiring that rebates be given when revenues have exceeded costs, that rebates be applied to offset charges to those customer entities that have subsidized the costs of other customer entities, and that such rebates may be in the form of credits against future billings.

   (6.) Requiring that all service-level agreements have a contract term of up to 3 years, but may include an option to renew for up to 3 additional years contingent on approval by the board, and require at least a 180-day notice of termination.

   (7.) Designating any nonstate data center as a primary data center if the center:

   (a.) Has an established governance structure that represents customer entities proportionally.

   (b.) Maintains an appropriate cost-allocation methodology that accurately bills a customer entity based on the actual direct and indirect costs to the customer entity, and prohibits the subsidization of one customer entity’s costs by another entity.

   (c.) Has sufficient raised floor space, cooling, and redundant power capacity, including uninterruptible power supply and backup power generation, to accommodate the computer processing platforms and support necessary to host the computing requirements of additional customer entities.

   (8.) Removing a nonstate data center from primary data center designation if the nonstate data center fails to meet standards necessary to ensure that the state’s data is maintained pursuant to subparagraph 7.

   (3) STATE AGENCY DUTIES.—

   (a)() For the purpose of completing its work activities as described in subsection (1), each state agency shall provide to the Agency for Enterprise Information Technology all requested information and any other information relevant to the agency’s ability to effectively transition its computer services into a primary data center. The agency shall also participate as required in workgroups relating to specific consolidation planning and implementation tasks as assigned by the Agency for Enterprise Information Technology and determined necessary to accomplish consolidation goals.

   (b)() Each state agency shall submit to the Agency for Enterprise Information Technology information relating to its data centers and computing facilities as required in instructions issued by July 1 of each year by the Agency for Enterprise Information Technology. The information required may include:

   (1.) Amount of floor space used and available.

   (2.) Numbers and capacities of mainframes and servers.

   (3.) Storage and network capacity.

   (4.) Amount of power used and the available capacity.

   (5.) Estimated expenditures by service area, including hardware and software, numbers of full-time equivalent positions, personnel turnover, and position reclassifications.

   (6.) A list of contracts in effect for the fiscal year, including, but not limited to, contracts for hardware, software and maintenance, including the expiration date, the contract parties, and the cost of the contract.

   (7.) Service-level agreements by customer entity.

   (c)() The chief information officer of each state agency shall assist the Agency for Enterprise Information Technology at the request of the Agency for Enterprise Information Technology.

   (d)() Each state agency customer of a primary data center shall notify the data center, by May 31 and November 30 of each year, of any significant changes in anticipated utilization of data center services pursuant to requirements established by the boards of trustees of each primary data center.

   (4) AGENCY LIMITATIONS.—

   (a)() Unless authorized by the Legislature or as provided in paragraphs (b) and (c), a state agency may not:

   (1.) Create a new computing facility or data center, or expand the capability to support additional computer equipment in an existing computing facility or nonprimary data center;

   (2.) Transfer existing computer services to a nonprimary data center or computing facility;

   (3.) Terminate services with a primary data center or transfer services between primary data centers without giving written notice of intent to terminate or transfer services 180 days before such termination or transfer; or

   (4.) Initiate a new computer service if it does not currently have an internal data center except with a primary data center.

   (b)() Exceptions to the limitations in subparagraphs (a)1., 2., and 4. may be granted by the Agency for Enterprise Information Technology if there is insufficient capacity in a primary data center to absorb the workload associated with agency computing services.

   (1.) A request for an exception must be submitted in writing to the Agency for Enterprise Information Technology. The agency must accept, accept with conditions, or deny the request within 60 days after receipt of the written request. The agency’s decision is not subject to chapter 120.

   (2.) At a minimum, the agency may not approve a request unless it includes:

   (a.) Documentation approved by the primary data center’s board of trustees which confirms that the center cannot meet the capacity requirements of the agency requesting the exception within the current fiscal year.

   (b.) A description of the capacity requirements of the agency requesting the exception.

   (c.) Documentation from the agency demonstrating why it is critical to the agency’s mission that the expansion or transfer must be completed within the fiscal year rather than when capacity is established at a primary data center.

   (c)() Exceptions to subparagraph (a)3. may be granted by the board of trustees of the primary data center if the termination or transfer of services can be absorbed within the current cost-allocation plan.

   (d)() Upon the termination of or transfer of agency computing services from the primary data center, the primary data center shall require information sufficient to determine compliance with this section. If a primary data center determines that an agency is in violation of this section, it shall report the violation to the Agency for Enterprise Information Technology.

   (5) RULES.—The Agency for Enterprise Information Technology is authorized to adopt rules pursuant to ss. 120.536(1) and 120.54 to administer the provisions of this part relating to the state data center system including the primary data centers.

s. 8, ch. 2008-116; s. 24, ch. 2009-21; s. 8, ch. 2009-8