The 2021-22 Budget: California Department of Technology

analysis full gutter The 2021-22 Budget: California Department of Technology FEBRUARY 2021 Budget Overview The California Department of Technology (CDT) is from the department. As a result, General Fund the administration’s central information technology expenditures for CDT would increase $32.7 million (IT) entity with broad authority over most aspects of year over year—from $6.8 million in 2020-21 to technology in state government. CDT traditionally $39.5 million in 2021-22. (Total expenditures funds its operations, programs, and services from all funds would increase from $434 million using a cost-recovery model that charges both to $493 million.) This post assesses whether this administrative fees and set rates for services to proposed increase in General Fund expenditures entities. The Governor’s 2021-22 Budget proposes is prudent, weighs the merits of the department’s to pay the costs of some existing CDT programs budget proposals, and provides associated and services from the General Fund instead, and recommendations. to use General Fund for other budget proposals Budget Proposals Security Operations Center and Audit an entity to perform an initial assessment of the entity’s compliance; perform field work at the entity, Program Funding Conversion such as interviews with state staff; and issue a final CDT Office of Information Security (OIS). CDT report to the entity with findings of non- or partial OIS is responsible for the creation and enforcement compliance with state IS policies, standards, of information security (IS) policies, standards, and and/or procedures that require corrective action. procedures that many state entities must follow. OIS bills audited entities for these services. (For OIS also operates the state’s Security Operations more information about state IS strategy, please Center (SOC), which continuously monitors and see our February 25, 2020 post—The 2020-21 reacts to threats on the California Government Budget: The Governor’s Information Security Enterprise Network (CGEN), the state government’s Proposals.) primary enterprise network. (An enterprise Budget Requests $21 Million General Fund network is a combination of physical and virtual IT to Pay for Costs of SOC and IS Program Audit infrastructure that connects applications, devices, Services Directly. CDT requests $21 million systems, and users.) A number of state entities General Fund in 2021-22 and ongoing to pay the connect to CGEN, which allows SOC to identify and costs of OIS SOC and IS program audit services, respond more quickly to any attacks reflecting a shift away from funding these activities and/or threats to these entities. OIS also provides through CDT’s cost recovery fund—the Technology IS program audit services, which determine whether Services Revolving Fund. The intent of the a state entity is compliant with state IS policy and administration is to allow state entities with funding standards. Auditors request documentation from currently budgeted for IS program audits and SOC 2021-22 LAO Budget Series 1 analysis full gutter services to instead use those funds freed up by this Service Assessment Program in the Office of proposal to remediate identified IS deficiencies. Statewide Project Delivery (OSPD), (2) a Service Proposed Statutory Changes Would Allow Transformation Program in the Office of Enterprise General Fund to Pay for IS Program Audit Technology (OET), and (3) an Infrastructure/Platform Services. The administration also is proposing Transformation Program in the Office of Technology statutory changes that would repeal a requirement Services (OTech). that state entities audited by CDT are required to • Service Assessment Program. The fund the cost of their audits, and instead allow administration’s intent for OSPD’s new Service General Fund to be used for this purpose. Assessment Program is to help state entities Stabilize Critical Services and IT evaluate the critical services they deliver using IT systems, and identify opportunities Infrastructure for system improvement to prevent failure or Budget Requests $11.4 Million General substandard performance. Tentatively, OSPD Fund to Expand Existing Programs and would form and manage assessment teams Services and Create New Ones. CDT requests with staff from OET and/or OTech, the Office $11.4 million General Fund and 17 positions in of Digital Innovation (in the Government 2021-22 to hire additional staff and contract with Operations Agency), and the assessed entity. vendors across five different departmental offices. Teams would look at evaluated services Figure 1 identifies and describes each affected within the context of entity-specific and office, and Figure 2 on the next page specifies state IT operations and policy, measure how the amount of funding and number of positions by IT systems perform when delivering these office, program, and/or service. services, and work with entities to prioritize Proposal Creates Three New Programs. their IT expenditures in the short and long CDT proposes to create three new programs terms. across three departmental offices: (1) a Figure 1 Descriptions of CDT Offices With Proposed Budget Augmentations Office Description Office of Enterprise Technology Provides platforms and technology such as geographic information systems and open data, as well as services ranging from development and operations engineering to planning and product management to software engineering. Office of Governmental Affairs, Supports the California Broadband Council, which identifies public and private Office of Broadband and resources and recommends policies to expand Internet access in the state. Digital Literacy Supports and monitors the implementation of the new State Broadband Action Plan, including ongoing annual plan reviews. Office of Legal Services Supports department operations with legal research and advice, as well as review of contracts, law, and policy. Office of Statewide Project Approves IT projects through the state’s IT project planning process—the Project Delivery Approval Lifecycle—and provides independent oversight services for projects in development and implementation. Conducts IT project procurements and tele-communications acquisitions. Provides project consulting and management services for certain IT projects. Office of Technology Services Manages and operates the State Data Center to provide shared infrastructure, platforms, software, storage, and other solutions for (among others) state government entities. CDT = California Department of Technology and IT = information technology. 2021-22 LAO Budget Series 2 analysis full gutter • Service Transformation Program. The term, requested OET staff would support the administration’s intent for OET’s new Service applications deployed for coronavirus disease Transformation Program is to build on 2019 and wildfire emergency response. the initial service assessments performed ($3 million of the $11.4 million requested by OSPD with additional “deep dive” is to fund operational expenses for these assessments. The deep dive assessments applications, some amount of which might be would identify (at a minimum) application, eligible for federal reimbursement.) In the long data, and web issues affecting an assessed term, the scope of the program is expected entity’s delivery of critical services. OET to include service transformation initiatives, development and operations engineering, such as a single digital identifier for applicants planning and product management, and across state programs and services. software engineering staff would focus on • Infrastructure/Platform Transformation short-term service stabilization and the Program. The administration’s intent remediation of urgent issues. In the immediate for OTech’s new Infrastructure/Platform Figure 2 Five CDT Offices Request General Fund Support and Positions for Existing and New Programs/Services General Fund (In Thousands) Requested Requested Office Relevant Program and/or Service Funding Positions Existing Programs and Services Office of Enterprise Technology COVID-19 Cloud Services and Softwarea $3,000 — Office of Enterprise Technology Data and Geospatial Services Staff 456 3 Office of Government Affairs Broadband and Digital Literacy Staff 326 2 Office of Legal Services Legal Services Staff 203 1 Subtotals ($3,985) (6) New Service Assessment Program Specialist Diagnostic Capabilities Consultinga,b $2,500 — Service Assessment Program Development and Testing Consultinga 500 — Office of Statewide Project Service Assessment Program Staff 352 2 Delivery California Project Management Office - Statewide Project Delivery 426 2 Services Staff Subtotals ($3,778) (4) New Service Transformation Program Specialist Diagnostic Capabilities Consultingb $2,500 — Service Transformation Program Staff 214 1 Office of Enterprise Technology Technology Innovation Services - Software Engineering Staff 139 1 Technology Innovation Services - DevOps Engineering Staff 139 1 Technology Innovation Services - Planning and Product Management Staff 139 1 Subtotals ($3,131) (4) New Infrastructure/Platform Transformation Program Office of Technology Services Infrastructure/Platform Transformation Program Staff $538 3 Subtotals ($538) (3) Total $11,432 17 a Funding requested for external consulting and contracted specialized expertise. b Table reflects even split in requested funding for specialist diagnostic capabilities, but exact split between programs unknown. CDT = California Department of Technology and COVID-19 = coronavirus disease 2019. 2021-22 LAO Budget Series 3 analysis full gutter Transformation Program also is to build platform issues. Similar to OET’s Service on OSPD’s initial service assessments, Transformation Program, OTech’s program but to focus its deep dive assessments would focus new CDT staff on short-term on the identification of (at a minimum) an infrastructure and platform stabilization and entity’s legacy system infrastructure and the remediation of immediate issues. Assessment Budget Proposals Have Merit… The intent of and services, the proposed use of General Fund the administration that is reflected in the package should be given an appropriate level of scrutiny of budget proposals is to (1) improve the statewide by the Legislature. Accordingly, while the intent delivery of IS services and (2) proactively address of the proposals has merit, it will be important for the performance and stability issues of IT systems the Legislature to consider the likelihood of the that hinder state entities’ ability to deliver critical proposals successfully meeting this intent when services. We find that the administration’s intent, implemented. We understand the administration and thus the proposed new programs and services, also is considering different ways of funding some have merit. The proposed use of General Fund for of the services in these proposals, such as a Pro these proposals, instead of CDT’s traditional cost Rata and/or Statewide Cost Allocation Plan process recovery fund, also is intended to (1) provide a for SOC services. (State Pro Rata and Statewide more stable source of funding for services provided Cost Allocation Plan processes allow special fund to most state government entities, and (2) fund and federal fund reimbursement, respectively, of more proactive and targeted service delivery by the General Fund.) To avoid adding to ongoing CDT to state entities instead of state entities pressure on the General Fund, alternative funding paying CDT to provide select services or remediate sources for these programs and services should specific issues. We agree with the administration’s continue to be explored by the administration and stated rationale to use the General Fund for identified alternative funding sources presented to these proposals. A more stable funding source the Legislature in future proposals. would allow OIS to perform audits more routinely, Proposed Statutory Language Does Not especially of smaller entities with more limited Require Entities to Use Previously Budgeted budgets, and not limit SOC services to those Audit Funding to Remediate IS Deficiencies as entities that can pay for them. A more proactive Intended by Administration. We understand that CDT would also be able to assess, prioritize, and the intent of the statutory language proposed by remediate system issues across state government the administration is to allow state entities to use in a way that individual state entities are unable to funding they previously budgeted for IS program do. audits (and now freed up by the budget proposal) …But Significantly Increase General to remediate deficiencies in their IS programs. Fund Expenditures Year Over Year. However, While we find the intent of the administration has if the Legislature approves these proposals, merit, that intent is not reflected in the text of the General Fund expenditures for CDT will increase proposed language. Instead, the administration $32.7 million year over year from $6.8 million in anticipates using audits, independent security 2020-21 to $39.5 million in 2021-22. Given the assessments, and meetings with IS staff to make state’s projected multiyear budget deficits and the sure previously budgeted audit funding is used as fact that the General Fund has not traditionally intended. Given the confidential nature of IS-related been used to directly support most CDT programs activities, the Legislature has no means of ensuring 2021-22 LAO Budget Series 4 analysis full gutter funds are used in this manner absent revising the how the new programs would be implemented. For proposed language. example, administrative policy will need to address: No Administrative Policy or Statutory • How the administration will select entities for Changes Proposed to Support New Programs. an initial service assessment. The administration has stated that it is relying on • The length and scope of both initial and deep existing statutory authority for each of the new dive service assessments. programs in the Stabilize Critical Services and IT • The transition from short-term stabilization and Infrastructure proposal, and anticipates changes in issue remediation efforts to long-term planning state administrative policy would be made after the and future IT projects. proposal is approved. While we raise no issues with the department’s existing statutory authority, we • Reporting mechanisms to inform the suggest the Legislature consider whether statutory Legislature (and other stakeholders) about changes are warranted to establish goals for the assessments and their outcomes. new programs and/or prioritize certain entities for The Legislature should be given the opportunity assessments. We do, however, consider the lack to review the finalized changes in administrative of proposed administrative policy problematic in policy (which will provide more details on the new that it means the Legislature lacks key details on programs) as a condition of the department’s expenditure of some amount of approved funding. Recommendations Approve Security Operations Center and Approve Stabilize Critical Services and Audit Program Funding Conversion Proposal IT Infrastructure Proposal With Budget With Revised Statutory Language to Reflect Bill Language to Allow Legislative Review Administration’s Intent. We recommend the of Changes in Administrative Policy. We Legislature approve CDT’s IS budget proposal with recommend the Legislature approve CDT’s Stabilize revised statutory language to reflect the intent of Critical Services and IT Infrastructure proposal the administration for state entities to use funding with budget bill language that conditions the previously budgeted for IS program audits to expenditure of some amount of approved funding remediate deficiencies in their IS programs. We also on the completion of changes in administrative recommend the Legislature direct CDT to report policy and notification of (at a minimum) the Joint back at future budget hearings on the possibility Legislative Budget Committee for legislative review. of funding statewide SOC services in this proposal The exact amount of approved funding subject to through the state’s Pro Rata and Statewide this provision would be negotiated between the Cost Allocation Plan processes, as well as other administration and the Legislature. alternative funding sources for new programs and services. LAO Publications This report was prepared by Brian Metzker, and reviewed by Mark C. Newton and Carolyn Chu. The Legislative Analyst’s Office (LAO) is a nonpartisan office that provides fiscal and policy information and advice to the Legislature. 2021-22 LAO Budget Series 5