A Review of the Governor's Reorganization Plan to Consolidate Information Technology Functions

L H C ITTLE OOVER OMMISSION A R G ' EVIEW OF THE OVERNOR S R P EORGANIZATION LAN C TO ONSOLIDATE I T F NFORMATION ECHNOLOGY UNCTIONS Recommendation to the Legislature March 26, 2009 State of California L I T T L E H O O V E R C O M M I S S I O N March 26, 2009 The Honorable Arnold Schwarzenegger Governor of California The Honorable Darrell Steinberg The Honorable Dennis Hollingsworth President pro Tempore of the Senate Senate Minority Leader And members of the Senate The Honorable Karen Bass The Honorable Michael Villines Speaker of the Assembly Assembly Minority Leader And members of the Assembly Dear Governor and members of the Legislature: The Governor’s Reorganization Plan to consolidate state information technology functions under the Office of the State Chief Information Officer (OCIO) represents a critical step to better manage state resources, improve decision-making tools for state managers and legislators, and serve the public. The Commission recommends that the plan be allowed to go into effect. The proposal offers significant fiscal benefits by allowing the OCIO to consolidate contracts and services, and guide smarter administration of information technology (IT) resources across agencies. The Governor’s Reorganization Plan incorporates many of the previous Little Hoover Commission recommendations about empowering the state chief information officer. In its November 2008 report, however, the Commission took a more ambitious approach toward strengthening the OCIO’s role over the state’s technology workforce. The reorganization plan makes a solid case to fold certain offices into the OCIO immediately and to review the need for further consolidation in the future. The reorganization plan can be seen as an important step in a multi-phase process toward a single point of accountability for the state’s information technology systems and projects, which started with the data center consolidation and creation of the Department of Technology Services in 2005. The next step came in 2006, when the Legislature restored the state CIO to a business executive in the governor’s cabinet and gave the OCIO authority to approve and terminate IT projects. The current reorganization proposal expands the authority of the OCIO to include new responsibilities, such as: (cid:131) Infrastructure, by moving the Department of Technology Services into the OCIO. (cid:131) Information security, by moving the information security functions of the Office of Information Security and Privacy Protection into the OCIO. (cid:131) Procurement, by clarifying the roles of the OCIO and the Department of General Services. (cid:131) Telecommunications, by moving the public-safety telecommunications unit of the Department of General Services into the OCIO. Future steps could involve revisiting the plan’s federated approach to coordinate IT implementation at the agency and department levels. The state CIO told the Commission that the OCIO has ample statutory authority to review new projects before they are approved – and intervene and stop broken ones. State officials will need to observe how the OCIO exercises this authority and how department and agency leaders respond cooperatively with the OCIO. As the birthplace of technology and Silicon Valley innovation, California deserves a reputation for executing smart technology in government. For too long, California has been the punch line for failed technology projects. Firmly establishing the OCIO at the center of decision-making for IT investment and deployment is a solution shared by IT leaders in other states and the private sector. Other states, from Utah to Virginia, discovered in recent years that the potential for consolidating IT lies beyond the very real cost savings and more in the state’s ability to extract and share information from large data-collection systems with policy-makers and state managers to drive improvement. California has fallen behind because a culture of fear has led to a decentralized, over-cautious approach to technology planning. The state’s multibillion-dollar investment in technology projects is no more secure for it. The Governor’s Reorganization Plan appropriately looks forward, focusing on the structure governing the Office of the Chief Information Officer and the state’s IT assets. The reorganization plan represents a necessary step in the evolution of California’s IT governance that will add coherency and accountability to the state’s technology decisions and investments. As the Governor’s Reorganization Plan proposes, viewing the state government as a single enterprise, instead of isolated, agency silos, will lead to a better coordination and alignment of state policies and resources. Using technology as the backbone, the OCIO is best equipped to cut across all agencies to lead this effort. Sincerely, Daniel W. Hancock Chairman A REVIEW OF THE GOVERNOR’S REORGANIZATION PLAN TO CONSOLIDATE INFORMATION TECHNOLOGY FUNCTIONS Table of Contents Introduction………..……………..……….…………………………………………………………… 1 The Reorganization Plan..…………………………………………………………………………… 5 Proposed Consolidation Must Move Forward…………………………………….…………….. 17 Appendices…………………………………………………………………………………………….. 21 Appendix A: Governor’s Reorganization Plan………………………………..………………………..…… 23 Appendix B: February 2009 Public Hearing Witnesses….……………………………………………..... 49 Appendix C: Comparing Plans……………………………..….……………………………………………..... 51 Notes…………………………………………………………………………………………………….. 53 Table of Sidebars & Charts The Reorganization Statute………..………………………………………………………………. 1 Timeline: Little Hoover Commission Recommendations and Organizational Changes.……………………………………………………………………………. 3 Cost Savings and Avoidance..……………………………………………………………………… 5 State Technology Resources………………………….……………………………………………. 6 Governor’s Reorganization Plan: Consolidation Under OCIO…………………………..… 7 Tracking and Measuring IT Consolidation.………………………………………...…………… 8 State Information Technology: Moving Toward Consolidation……………………………. 9 Federated Governance Model………………………………..…………………………………… 12 Utah’s IT Consolidation…………………………………………………………………………….. 18 INTRODUCTION Introduction U nder the law, the governor has the obligation to periodically examine the organization of all agencies to determine the changes that are necessary to reduce expenditures, increase efficiencies and improve the management of public programs. The legal authority for the reorganization process is established in Article 5, Section 6 of the Constitution, and detailed in the Government Code. The statute defines and limits the kinds of changes that can be made through the reorganization process. Plans, for example, can transfer, consolidate and even abolish functions that “may not be necessary to the efficient operation of the state government.” But plans cannot, for example, include agencies “whose primary function is service to the Legislature or judicial branches of state government or to any agency that is administered by an elected officer.” The law requires that plans make provisions for transferring civil service employees, property records and fund balances of the agencies affected by a plan.1 The law provides for the governor to pursue those changes through an accelerated and streamlined legislative process. The reorganization process calls for the governor to propose a plan, for the Little Hoover Commission to review and make an advisory recommendation regarding The Reorganization Statute Government Code Section 12080.1. The governor, from time to time, shall examine the organization of all agencies and shall determine what changes therein are necessary to accomplish one or more of the following purposes. (a) To promote the better execution of the laws, the more effective management of the executive and administrative branch of the state government and of its agencies and functions and the expeditious administration of the public business; (b) To reduce expenditures and promote economy to the fullest extent practicable consistent with the efficient operation of the state government; (c) To increase the efficiency of the operation of the state government to the fullest extent practicable; (d) To group, consolidate and coordinate agencies and functions thereof as nearly as possible according to major purposes; (e) To reduce the number of agencies by consolidating those having similar functions under a single head and to abolish such agencies or functions thereof as may not be necessary for the efficient operation of the state government; (f) To eliminate overlapping and duplication of effort. 1 LITTLE HOOVER COMMISSION the plan and for the Legislature to either allow the reorganization to go into effect or to reject it by a majority vote in either house. The Governor's Reorganization Plan proposing a consolidation of state information technology functions under the Office of the State Chief Information Officer was submitted to the Commission on February 5, 2009. A copy of the plan is contained in Appendix A. Under the reorganization statute, the governor must submit the plan to the Commission 30 days prior to submitting it to the Legislature. The Commission, in turn, must make a recommendation regarding the plan within 30 days of the plan being submitted to the Legislature. On March 10, 2009, the governor submitted the plan to the Legislature. In reviewing the plan, the Commission conducted a public hearing on February 25, 2009. The Commission invited testimony from the state’s chief information officer and representatives of all of the state units involved, including the Department of Technology Services, the Office of Information Security and Privacy Protection, the Department of General Services and the State and Consumer Services Agency. The Commission also heard from the Health and Human Services Agency about its project management office for large-scale IT projects and from the California State Employees Association about the reorganization plan’s impact on state workers. Testimony also was received from the state chief information officer of Utah, who recently led the state’s consolidation of its IT functions into one agency. The Commission consulted with a number of additional experts, and solicited and received testimony from, among others, the former state chief information officer, the Legislative Analyst’s Office, the technology trade association TechAmerica and the Consumer Federation of California and Privacy Rights Clearinghouse. A list of the hearing witnesses is contained in Appendix B. The Commission also drew from its previous work analyzing California’s use and administration of technology, contained in the following reports: (cid:131) A New Legacy System: Using Technology to Drive Performance (November 2008). (cid:131) The Governor’s Reorganization Plan to Create a Department of Technology Services (May 2005). (cid:131) Historic Opportunities: Transforming California State Government (December 2004). (cid:131) Better.Gov: Engineering Technology-Enhanced Government (November 2000). The agendas, written testimony and the Commission’s reports are available on its Web site: www.lhc.ca.gov. 2 INTRODUCTION Little Hoover Commission Recommendations Organizational Changes 2000 In Better.Gov, the Commission recommended strengthening the state’s management of technology through an empowered state chief information officer. The statute authorizing the Department of 2002 Information Technology expired following the Oracle scandal of 2001 and the department’s responsibilities fell to the Departments of Finance and General Services. A state chief information officer still acted in an advisory role. 2004 In Historic Opportunities, the Commission recommended the state create a cabinet-level chief information officer with statutory authority to facilitate the strategic use of technology and to head a technology agency. 2005 In Reconstructing Government, the The Governor’s Reorganization Plan 2005 Commission supported the Governor’s consolidated the state’s two largest data Reorganization Plan, but cautioned that the centers and the telecommunication network state still needed a powerful state chief function at the Department of General Services information officer and governing board to in a new Department of Technology Services oversee technology investments and policies. and created a Technology Service Board. The Legislature enacted legislation (SB 834, 2006 Chapter 533, Statutes of 2006) to establish the Office of the State Chief Information Officer and make the state chief information officer a member of the governor’s cabinet. The Budget Act of 2007 and related 2007 legislation (SB 90, Chapter 183, Statutes of 2007) expanded on the prior year’s work and provided positions and an appropriation to establish the Office of the State Chief Information Officer. 2008 In A New Legacy System, the Commission recommended further consolidation of the state’s technology functions including the Department of Technology Services, information security, geospatial information systems and project management, as well as the state’s information technology workforce under the The governor submitted to the Little Hoover 2009 Office of the State Chief Information Officer. Commission and the Legislature a reorganization plan to consolidate statewide information technology functions under the Office of the State Chief Information Officer. 3 LITTLE HOOVER COMMISSION 4 GOVERNOR’S REORGANIZATION PLAN Governor’s Reorganization Plan The Governor’s Reorganization Plan (GRP) proposes a consolidation of several information technology functions under the Office of the State Chief Information Officer (OCIO). The plan would integrate the OCIO, the Department of Technology Services, the information security component of the Office of Information Security and Privacy Protection and the telecommunications division of the Department of General Services. The newly reconfigured Office of Privacy Protection, responsible for public outreach about privacy issues, will remain in the State and Consumer Services Agency and report directly to the agency secretary. The proposal also would give the state chief information officer (CIO) the authority for information technology (IT) procurement policy and statewide “enterprise” IT management, providing a platform for the state CIO to expand its policy role from an advisory role into an operational one. The OCIO also would lead the governor’s “Broadband Initiative” to promote high-speed Internet connections across the state. The merger would go into effect on May 10, 2009, and the transition would be complete in early Cost Savings and Avoidance 2010.2 The Governor’s Reorganization Plan of 2009 The Governor’s Reorganization Plan is framed estimates approximately $1.7 billion in savings and avoidance by authorizing the Office of the around the concept that California’s state State Chief Information Officer to consolidate government is a single enterprise in its use of IT resources, reduce spending and better information technology. “Ultimately, this manage IT growth. The estimated savings by reorganization plan proposes to transform the year are: existing IT governance framework from one that is focused on the needs of individual agencies to one Fiscal Year Estimated Savings that provides affordable, consistent and reliable 2009-10 $180 million technology services to all state agencies,” according to the GRP.3 2010-11 $250 million 2011-12 $370 million In more practical terms, the GRP would give the 2012-13 $420 million state CIO greater authority to consolidate software contracts, e-mail systems, data centers, servers and 2013-14 $445 million networks across state government. The Source: Adrian Farley, Chief Deputy Director, Office of administration projects approximately $1.7 billion the State Chief Information Officer. Sacramento, CA. February 27, 2009. Personal communication. in savings and cost avoidance over the next five 5 LITTLE HOOVER COMMISSION years by enabling the state CIO, for example, to consolidate the state’s 9,500 servers, a number expected to increase to more than 18,000 by 2014 if left unchecked. The plan calls for reducing the number of servers by half and stopping future growth of servers. The reorganization would allow the OCIO to identify unused server space at isolated departments, then pool those resources together into virtual super-servers for a more efficient allocation of capacity, reducing operating and energy costs, and ultimately the physical need for so many servers – without impacting system performance or service levels.4 The GRP also would allow an empowered OCIO to take the following steps: (cid:131) Reduce $65 million in annual costs for office systems and networks by consolidating e-mail, archives, encryption, anti-spam, backup and disaster recovery. (cid:131) Reduce total square footage for data centers and computer rooms, resulting in lower rent and energy costs. (cid:131) Reduce storage costs by 50 percent. (cid:131) Reduce the cost of outsourcing IT oversight, now about $20 million annually, by 50 percent. (cid:131) Review the number of software licenses to individual departments; reduce and consolidate software contracts. (cid:131) Increase strategic sourcing of IT resources. (cid:131) Reduce by half the required 10 percent contingency set-aside fee for IT projects.5 State Technology Resources The Legislative Analyst’s Office has expressed skepticism (cid:131) More than 10,000 IT employees, about the administration’s cost-savings claims.6 Though including 130 CIOs. the Commission did not validate the GRP’s financial (cid:131) More than 400,000 sq. ft. of data-center projections, the Commission long has called for and server floor space in 405 locations. equipping the state CIO with the tools, resources and authority to transform state government and improve (cid:131) $3 billion in annual IT expenditures. services through such consolidations. (cid:131) More than 120 large IT projects under development, estimated to cost $6.8 As important as cost savings are during the state’s fiscal billion. crisis, the Commission’s previous recommendations to (cid:131) 9,500 servers. consolidate technology functions under the OCIO were Source: Office of the State Chief Information Officer. driven more by the need to improve government services November 2008. “Statewide Technology Survey.” and public outcomes. Cost savings inevitably result from cleaning up an inefficient system. 6 GOVERNOR’S REORGANIZATION PLAN The GRP would combine the following functions into the OCIO: Office Staff 08-09 Budget Current Agency Office of the State Chief Information Office of Chief Information Officer 32 $6.7 million Officer Department of Technology Services 802 $278 million State and Consumer Services Agency Information security unit, Office of 14 $1.9 million State and Consumer Services Agency Information Security and Privacy Telecommunications division, 368 $223 million State and Consumer Services Agency Department of General Services IT procurement policy, N/A N/A State and Consumer Services Agency Department of General Services Business, Transportation and Broadband policy N/A N/A Housing Agency Source: Governor’s Reorganization Plan #1. January 2009. “Organizing for Success: IT Governance for California State Government.” Sacramento, CA. The current inefficiency of the state’s IT system stems from the state’s reactive approach to technology funding and management. Rather than build a governance structure that could capitalize on success, the state’s IT system has been strangled by fear of both failure and scandal. As the Commission confirmed in its November 2008 study, state IT governance is fragmented and lacks real accountability to the public and to the Legislature.7 Since the closure of the Department of Information Technology in 2002, the state made incremental though critical steps toward rebuilding a governance structure that clarifies the roles and responsibilities of state IT decision-makers. In many ways, the current GRP is a progression of the 2005 reorganization effort that combined the state’s telecommunications network and two general-purpose data centers into the Department of Technology Services. The Commission recommended that the 2005 plan move forward though noted the need for a more comprehensive governance plan for managing state IT through an empowered state CIO.8 Then-state CIO J. Clark Kelso served in an advisory role to the governor and though he worked collaboratively with agencies to begin restoring confidence and legitimacy in state information technology, he lacked the statutory authority to ensure a more efficient coordination of resources across state government. Mr. Kelso advocated a new governance model that, under legislation passed in 2006 and 2007, placed the state CIO in the governor’s cabinet with planning and oversight duties for state technology.9 7 LITTLE HOOVER COMMISSION The Office of the State Chief Information Officer opened in January 2008 as a cabinet-level agency. The OCIO was charged with creating a strategic vision for technology planning, and was given authority for approving, suspending, terminating and reinstating large technology projects.10 When Teresa Takai took over in 2008, she inherited a complicated technology environment: 130 department CIOs pursuing their own plans to manage technology and replace aging computer systems, and a Legislature skeptical of investing in the state’s historically shaky technology program. As state CIO, Ms. Takai could start and stop projects, but lacked the ability and resources to manage the state’s IT workers, outside contractors Tracking and Measuring IT Consolidation and billions of dollars in projects the state already What are the expected outcomes? had underway. Responsibility for the state’s IT Consolidation will result in an enterprise approach operations remained divided across the executive to technology that will enable: branch. The structure left the OCIO, in many (cid:131) Expanded access to government services ways, as a policy shop. In practice, the state CIO and information. can write the strategic plan for using technology, (cid:131) Enhanced accountability and but cannot fully implement it. performance. In written remarks to the Commission, Mr. Kelso (cid:131) Improved public safety and disaster noted that many of the components of the current recovery capabilities. reorganization effort were placed on hold in 2005 (cid:131) Consistent information security and when the data centers were merged because a fully privacy practices. functioning OCIO did not exist at the time. “We put How will success be measured? The Office of through the OCIO legislation (in 2006) with the the State Chief Information Officer will use anticipation that another round of reorganization quantitative and qualitative metrics, such as: would be coming,” he said.11 (cid:131) Number of new online services. (cid:131) Service use and satisfaction. P.K. Agarwal, director of the Department of Technology Services, also told the Commission: (cid:131) System up-time. “This proposed consolidation is a necessary second (cid:131) Cost savings/avoidance. step in the evolution of IT in the state of (cid:131) Project success rates. California.”12 (cid:131) Policy compliance. In A New Legacy System, the Commission (cid:131) Number of security breaches. acknowledged that governance issues remained How will progress be reported? Through the unresolved and recommended a broad IT Strategic Plan, which according to statute, must centralization of IT infrastructure, human capital be published each year on January 15th and and decision-making under the OCIO to optimize delivered to the Joint Legislative Budget the state’s investment in technology and personnel. Committee. The Commission felt Ms. Takai was well-suited for Source: Teresa “Teri” Takai, Chief Information Officer, State of this role: She had earned a national reputation for California. Sacramento, CA. February 20, 2009. Written testimony to the Commission. overseeing such a consolidation while serving as state CIO in Michigan. 8 GOVERNOR’S REORGANIZATION PLAN State Information Technology: Moving Toward Consolidation 2002-2005 Governor Following the closure of the Department of Information Business, Technology, the state’s technology State Chief Health and State and Department of Transportation functions were distributed to other Information Human Services Consumer Finance and Housing agencies. The state chief Officer Agency Services Agency Agency information officer operated in an advisory capacity without formal authority. Health and Human Systems Integration Department of Stephen P. Teale Services Agency Division General Services Data Center Data Center Current Governor The Governor’s Reorganization Plan of 2005 centralized the state’s major data centers in the Office of the State Health and State and Department of Technology Department of Chief Information Human Services Consumer Services. Finance Officer Agency Services Agency Legislation in 2006 and 2007 elevated the state chief information officer to the governor’s cabinet and Office of Systems Department of gave the Office of the State Chief Integration General Services Information Officer (OCIO) shared duties over project planning, approval and oversight with the Office of Department of Finance. Information Security and Privacy Protection Department of Technology Services Governor Governor’s Reorganization Plan Office of the State Health and Department of Chief Information Human Services Officer Finance Agency The Governor’s Reorganization Plan of 2009 would centralize additional information technology organizations and give additional Office of responsibilities to the OCIO. The Technology Information Enterprise Policy & Systems Department of Finance will Services Security Services Program Management Integration continue to share responsibility with the OCIO to approve new Includes former Includes former Includes enterprise Includes program funding for technology projects. DTS and information security programs and management, telecommunications functions of OISPP public safety project functions of DGS communication management, policy functions from & strategic planning DGS; formalizes and administration GIS office 9 LITTLE HOOVER COMMISSION In testimony to the Commission, Ms. Takai said the organizational changes proposed in the GRP – enabling the OCIO to lead the state’s IT program and execute its strategic plan – provide the foundation to better coordinate activities and improve services to state departments and to the public.13 Consistent with the Commission’s prior recommendations, the GRP would continue the evolution of IT governance by folding into the OCIO other existing technology organizations and increasing the responsibilities of the office. The major components of the GRP include: Infrastructure. The Department of Technology Services, which provides networking, computing, storage and training services, currently falls awkwardly under the State and Consumer Services Agency. As the Commission noted in its 2008 study of IT governance, separating the state’s technology assets from the jurisdiction of the OCIO makes it difficult to enact consolidation, standardization and spending priorities. The Commission recommended that the OCIO be given a direct connection to how departments use technology so it could more easily implement and enforce common standards and applications, reduce costs and share data.14 In remarks to the Commission, the Legislative Analyst’s Office also noted that DTS currently provides services based on individual department needs, resulting in an inconsistent use of hardware and other technologies. A greater alignment of technology resources based on overall state IT needs could increase efficiencies and save money, the LAO said. Simply put, the LAO said, moving the Department of Technology Services under the OCIO “makes practical sense.”15 Information Security. The ability of the state to provide adequate safeguards for protecting the state’s data and networking systems would gain greater visibility, attention and influence under the OCIO than they would under their current home in the State and Consumer Services Agency. As the Commission noted in its 2008 study, shifting the information security functions of the Office of Information Security and Privacy Protection (OISPP) would result in a more coordinated approach to developing security standards and a streamlined project approval process. Keeping those statewide roles in separate agencies could create another layer of bureaucracy during the approval process.16 As Mark Weatherford, the OISPP executive officer, told the Commission: “Close coordination between information security and IT operations is one of the key ingredients to an efficient and securely functioning organization.”17 The Office of Privacy Protection, with its focus on consumer protection issues, would be spun out of the OISPP and remain appropriately with 10 GOVERNOR’S REORGANIZATION PLAN the State and Consumer Services Agency. The Commission heard from privacy advocates who were concerned that the GRP does not recognize that “security” and “privacy” are distinct policy areas. While the job of the state’s information security officer is clear – preventing hacking, identity theft and unauthorized computer access – the Consumer Federation of California and the Privacy Rights Clearinghouse suggested that the OCIO include a specially designated privacy officer in its suite of oversight responsibilities to examine what information the state should collect, retain and aggregate.18 The Legislature should continue to monitor this issue. Procurement. Approval for California’s big technology projects wind through a multi-layered process that involves the home department and agency, the Office of the State Chief Information Officer (OCIO), the Department of Finance (DOF) and the Department of General Services (DGS). It is often conducted on a case-by-case basis according to the technology and business needs of the requesting agency, department or project staff. According to the LAO, this approach does not always allow the state to optimize service contracts, to buy in bulk, or to buy strategically.19 Under the GRP, the OCIO would be in charge of procurement policy. The OCIO would establish standards for what technologies can be acquired as well as policies that describe what must be done to have an IT project approved. DGS would maintain its role overseeing the state’s bidding, award and contracting needs. The DOF would continue to play a role in reviewing the financial feasibility of new projects. Giving the OCIO clear authority for procurement policy will lead to “fewer, faster and more effective procurements,” according to Ms. Takai.20 In testimony to the Commission, DGS officials noted that the department spends significant time working with other departments to create specifications, as well as documenting technology requirements and attempting to consolidate purchasing volume in an effort to leverage the state’s IT spending.21 Transferring the policy duties to the OCIO would allow the state to establish architectural standards, common requirements and uniform specifications for IT goods and services across all agencies, according to DGS.22 It also would lead to cost savings from greater purchasing leverage, reduced complexity and cost of maintenance by establishing common architecture, increased clarity of IT purpose and direction, and enhanced accountability, according to Ms. Takai.23 Telecommunications. The Governor’s Reorganization Plan of 2005 split the telecommunications division of the Department of General Services 11 LITTLE HOOVER COMMISSION (DGS) in two. The Office of Network Services moved to the new Department of Technology Services, while the remaining pieces – statewide 9-1-1 oversight and emergency radio – remained with DGS. The current GRP proposes moving the rest of the DGS telecommunications division to the OCIO. These functions include setting technical and operational standards for 9-1-1 operators, providing training to 9-1-1 coordinators and overseeing the pass-through of funds to 500 police, fire and paramedic dispatch centers. The division also installs and maintains radio and microwave communications equipment for the California Highway Patrol, the Department of Forestry and other agencies. During the 2005 reorganization, the administration said the public safety communication functions did not align with the state’s business technology activities because they were “unique and different, and focused on emergency communications and homeland security.”24 That thinking, however, has changed with the emergence of new technologies and continued focus on standardization and interoperability. In testimony to the Commission, DGS said that the OCIO is better equipped to coordinate these efforts.25 A Federated Governance Model The proposed consolidation would increase the OCIO’s staff to more than 1,200, providing the state CIO with greater leverage to manage the state’s IT workforce as well as specific expertise to shape development of the state’s IT infrastructure. In A New Legacy System, the Commission called for a sweeping centralization of the state’s 10,000 IT workers. The administration is proposing a three-tiered “federated Federated Governance Model governance model” divided among a statewide enterprise tier headed by the OCIO, an agency tier and a department 1. Enterprise/OCIO Tier – Statewide tier. Ms. Takai said in her February testimony that the infrastructure, shared services and broad IT consolidation that worked in her home state of common applications. Michigan will not necessarily translate to California 2. Agency Tier – Business direction, because of the size and complexity of California’s state investment authority, consolidated IT government.26 resources. 3. Department Tier – Under the federated model, the state CIO would develop and require agencies to use common applications, and set Desktop/network support, IT technology direction for agency and department CIOs purchases, program-level application. related to integrating statewide technology issues. The Source: Office of the State Chief Information Officer. January 15, 2009. “State Information Technology agencies would retain autonomy over program-specific Strategic Plan.” Sacramento, CA. technology priorities and budgets, and coordinate IT 12 GOVERNOR’S REORGANIZATION PLAN activities among departments within each agency. Technology workers would remain in their departments. Reporting relationships would not change; the state CIO would maintain a dotted-line relationship to agency IT officials. Ms. Takai said the GRP acknowledges that programmatic needs at the department and agency levels are the primary drivers of the state’s IT investment, while ensuring that accountability and authority are maintained at the appropriate tier.27 This area marks the greatest difference between the Commission’s recommendations to consolidate the state IT workforce under the OCIO and the administration’s proposal to incorporate a tiered structure among the OCIO, agencies and departments. This arrangement essentially exists today, and the Commission recommended a more consolidated model to ensure the OCIO was able to enforce statewide priorities down the chain.28 In testimony, Ms. Takai acknowledged that the federated model “requires a commitment to collaboration from leadership and line staff, and an inclusive governance process for stakeholders in and out of government.”29 Ms. Takai has used this approach successfully in at least one instance – developing a first-ever IT capital plan, released in January 2009.30 To develop the plan, agency IT officials worked with their department-level counterparts to craft agency-wide technology priorities based on each agency’s business needs – a process that identified overlap and created opportunities for efficiencies and collaboration. Ms. Takai has said that the 122 projects identified in the five-year capital plan will give policy- makers, business and IT leaders a clear picture of how technology investments are planned for the future and will establish the foundation for ensuring IT investments support state and agency priorities, business direction and alignment with other systems. The Department of Finance was involved in the process and already has signed off on the five-year IT capital plan. The IT capital plan is similar to the Commission’s recommendation in A New Legacy System that called for the OCIO to work with agency and department representatives, legislators and the Department of Finance to develop and advocate a statewide IT priority list that would keep the most critical projects on track to be funded fully and first. The labor union that represents state IT workers, Service Employees International Union Local 1000 (SEIU), also has been an advocate of a stronger, centralized IT governance model. In testimony to the 13 LITTLE HOOVER COMMISSION Commission, a union representative expressed concern about the state’s growing reliance on outside contractors. The union contends that an empowered OCIO can better manage and monitor the use of IT contractors across state agencies. The SEIU said: “Leaving in place an existing practice of allowing agencies to manage their own program- specific IT processes and systems does not appear to empower the CIO with much additional authority or resources.”31 In testimony to the Commission, Ms. Takai stated that existing statutes give the OCIO “sufficient authority to effectively implement policy and enhance accountability and coordination.”32 For example, the OCIO can stop a bad project from continuing, or reduce the dollar-level threshold for IT project approval for agencies or departments that fall out of compliance with these policies. Ms. Takai told the Commission that this authority extends to two of the largest IT projects underway that span all agencies, including other constitutional offices not under the governor’s purview: the payroll system upgrade known as the 21st Century Project and a new financial-management system known as Fi$Cal.33 Ms. Takai said the GRP places the OCIO in a strong position to constructively engage agencies and departments throughout the project lifecycle. According to Ms. Takai’s testimony, the OCIO will be engaged in the early stages of project development to determine the scope and budgets of projects, and ensure the OCIO has a strategic role in the allocation and deployment of resources.34 “We’re trying to catch the projects before they get started,” Ms. Takai told the Commission.35 Beginning in April 2009, project managers for all IT projects approved by the OCIO will provide the office with regular “report cards” about schedules, budgets, performance and other issues to determine if intervention is needed.36 The Commission is encouraged by the front-end planning of the five-year capital plan and commitment of the OCIO to get involved in projects and identify and address issues before they become problems. This arrangement will place reliance on the ability of the OCIO to work collaboratively with agencies and departments to surface issues and address them long before the OCIO would need to raise the specter of stopping a project to get it right. Under the current structure, the OCIO cannot step in to correct a troubled project already underway to ensure success, short of shutting it down. To provide the OCIO with an intervention tool, the Commission recommended in its November 2008 study to transfer a successful 200-person project-management office in the Health and Human Services Agency to the OCIO. This unit – the Office of Systems 14 GOVERNOR’S REORGANIZATION PLAN Integration (OSI) – has worked directly under the agency secretary since 2005 and is charged, under statute, with managing the development and implementation of $1.3 billion in large-scale IT systems, including case management, payroll and eligibility projects for health care and social services. The Commission recommended that the OCIO should have the authority to deploy expert project managers from OSI to troubled projects in other departments and agencies. The OSI was not included in the GRP. Joe Munso, undersecretary of the Health and Human Services Agency, told the Commission the OSI projects are at critical stages and administrative changes could jeopardize their success.37 Ms. Takai agreed that moving the OSI currently poses too many risks. In testimony to the Commission, Ms. Takai said the OCIO is planning a complementary strategy to build OSI-type offices within each agency, as well as a small, five-person central project-management office inside the OCIO.38 The Legislative Analyst’s Office, noting the state’s lack of project management experience for large IT projects, suggested that the OCIO leverage the expertise of OSI’s project management staff by absorbing them as they rotate off completed projects. “This would give OCIO a small cadre of professional state staff that could be ‘loaned’ to different state IT projects,” according to Legislative Analyst Mac Taylor.39 Such an arrangement would require legislation due to restrictions on the OSI’s scope of work. The issue of project management – and project success – will remain one that will require continued monitoring by the Legislature and governor’s office. 15 LITTLE HOOVER COMMISSION 16 PROPOSED CONSOLIDATION MUST MOVE FORWARD Proposed Consolidation Must Move Forward The Legislature should allow the reorganization plan to go into effect. Economies of scale and cost savings will be gained from empowering the OCIO to consolidate contracts and reduce overlap and redundancy. Arguably more important than the financial impact, the Governor’s Reorganization Plan (GRP) represents another critical step toward providing the state CIO with real authority to align technology across state agencies and coordinate IT activity and data sharing. Implicit in the Commission’s recommendation is the understanding that the GRP marks progress, but more steps are expected. The phased-in approach to building a successful IT governance structure is a reasonable one for California, though the GRP is not the endpoint of California’s IT evolution. Assembling the pieces of the GRP – from information security to network services to procurement policy – is an important step. In testimony to the Commission, Utah’s state chief information officer painted an appealing picture of a consolidated IT approach that could be viewed as a “pilot project” for California. Recognized as a top-performing IT state by the Pew Center on the States and the Center for Digital Government, Utah gives its state CIO total oversight and control over all IT resources, personnel and procurement. In testimony to the Commission, Utah CIO Stephen Fletcher said: “The CIO must have the ability to facilitate, coordinate and control all IT functions in order to maximize resources and optimize the consolidation. If not, it is possible that the organization will fragmentize and dilute efficiencies.”40 The proof for Utah is in the results: Cost savings and faster service since the 2005 consolidation. Ms. Takai told the Commission that the success of the federated approach – delegating certain authority to agencies and departments for IT activities – will be evaluated in the coming year to determine if the proper balance of control with the OCIO has been struck. She posed the question that can be answered only after the GRP has been in place: “Are organizations willing to work with us?”41 17 LITTLE HOOVER COMMISSION Utah’s IT Consolidation The Utah Technology Governance Act of 2005 called for a major restructuring of the state’s IT services by consolidating all IT resources and services for the state’s executive branch – including more than 900 IT employees in 24 agencies – into a single department. The goal of the consolidation was to improve accountability, reduce costs, increase services to taxpayers and more closely align IT with the state’s business needs. Utah’s reorganization was designed to address a number of challenges including persistent management issues, perceived misalignment between IT investments and the priority of the state’s business needs, inconsistent service offerings between agencies, high costs, lack of standards and an inability to focus and align IT resources on urgent business activities. Rolled out slowly over the course of three years, the consolidation has resulted in few notable successes that Utah’s CIO, J. Stephen Fletcher, believes can be scaled to fit California. An empowered CIO. Prior to the legislation, Utah’s CIO served as an advisor to the governor. Now, Utah’s CIO is also the executive director of the state’s Department of Technology Services and oversees all IT resources including: managing and overseeing all aspects of IT within Utah; providing cost- effective and efficient information, communication systems and resources; achieving economies of scale and reducing costs through process efficiencies; standardizing and consolidating IT infrastructure and measuring results and reporting progress. Under the Utah model, flexibility and control are important components of a successful CIO. Organizationally, agency information officers serve as representatives of their agency, but report to the CIO’s office and have a dotted line to their agency. The CIO is authorized to control the amount of support given to an organization and deploy resources to meet changing needs. One of the strengths of the Utah model, Mr. Fletcher said, was that “executives feel comfortable because they do have control and they also have one throat to choke because the CIO is charged with providing all of the services.” Realized savings. Utah’s enterprise approach to IT services has resulted in both cost savings and service improvements through more efficient deployment of IT staff, economies of scale from enterprise purchasing and reduction in support costs to agencies from centralization. Additionally, as part of the reorganization, Utah’s Department of Technology Services streamlined operations and has added new services without increasing costs. According to Mr. Fletcher, Utah’s CIO now can provide a better service because the IT resources are centrally controlled and can be deployed where and when needed. Some savings include a 20 percent reduction in travel time to remote areas and a 50 percent reduction in time to repair in remote areas. A phased approach. In testimony to the Commission, Utah’s state chief information officer said that the Governor’s Reorganization Plan would work best as part of a phased approach that ultimately would place the state CIO in charge of all technology resources, including staff. He testified that the state CIO needs the ability to retrain and redeploy workers to fit enterprise needs: “In order to make the most impact, the CIO must have total oversight of all IT resources. The CIO must have the ability to facilitate, coordinate, and control all IT functions in order to maximize resources and optimize the consolidation,” Mr. Fletcher said in testimony to the Commission. “Governor Schwarzenegger’s IT plan must enable the CIO to reorganize IT resources. In order to make a significant change in an organizational structure, the CIO must be able to align and assign IT resources where needed.” Consolidation requires a culture change. In testimony to the Commission, Mr. Fletcher said that if he had the opportunity to revisit Utah’s consolidation he would enhance the current process by authorizing the CIO to incentivize agencies to be more efficient and to capture efficiencies in an innovation fund with money dedicated for special enterprise-wide projects. Source: J. Stephen Fletcher, Chief Information Officer, State of Utah. Sacramento, CA. February 25, 2009. Testimony to the Commission. 18 PROPOSED CONSOLIDATION MUST MOVE FORWARD In 2010, the Commission will review the progress made on implementing the GRP to track ongoing governance issues, including: (cid:131) Federated Governance. Did the GRP provide the OCIO with sufficient authority to execute the IT strategic plan? (cid:131) Project Management. Will the state CIO have deployed its project management unit to oversee and intervene with IT projects? What role will the Office of Systems Integration play? How has the OCIO guided the 21st Century and Fi$Cal projects? (cid:131) Privacy Protection. Is the OCIO providing sufficient attention to privacy issues, or will attention have focused exclusively on information security safeguards. Does the state need a chief privacy officer? Conclusion Information technology often is cited as a driver of government efficiency, but it goes beyond processing licenses online or automating an outdated system. The GRP helps reframe the state’s approach to governance by moving away from a collection of agencies with unique, mutually exclusively needs and toward a practice of operating the state as a single enterprise. The OCIO is the appropriate office to herald in this change through the building of a technology infrastructure that cuts across agencies to align policy goals and priorities. The Commission has heard from such states as Utah and Virginia that are using technology as the foundation for a cultural change toward performance measurement and management in state government. Consolidation of IT resources has allowed state CIOs in other states to better manage data collection systems across agencies and help policy-makers extract that information and analyze it to drive better decisions. This is the ultimate destination for technology in California. And it is a vision shared by Ms. Takai, who sees the OCIO as playing a lead role in establishing standards for classifying, storing and using data from state program operations, and developing a common platform that state agencies can use to track, measure and report program performance.42 Reaching that goal requires strengthening the authority and resources for the OCIO, called for in the GRP by bringing the Department of Technology Services, information security functions of the Office of Information Security and Privacy Protection, procurement policy and telecommunications division of the Department of General Services into the OCIO. The plan recognizes that the state has billions of dollars in 19 LITTLE HOOVER COMMISSION large, complex IT systems in development and production that cannot be an end unto themselves. The OCIO is best equipped to understand the dynamics of how these pieces fit together and guide their successful implementation. The job of the state CIO is political as much as it is technical and managerial. As former state CIO J. Clark Kelso told the Commission in written remarks: There are limits to what IT alone can do even if the state CIO is strongly empowered. Moving the state forward, to fully leverage its technology assets and potential, will require the cooperation and confidence of the governor, Legislature, agencies and workers.43 The OCIO must make clear the benefits of technology, as well as the risks of not embracing its potential. The Governor’s Reorganization Plan represents an evolutionary step more than a revolutionary one, but one that is urgently needed. It will move California forward. 20 APPENDICES & NOTES Appendices & Notes (cid:57) Governor’s Reorganization Plan (cid:57) February 2009 Public Hearing Witnesses (cid:57) Comparing Plans (cid:57) Notes 21 LITTLE HOOVER COMMISSION 22 APPENDICES & NOTES Appendix A Governor’s Reorganization Plan to Consolidate Information Technology Functions Under the Office of the State Chief Information Officer Organizing for Success IT Governance for California State Government GOVERNOR’S REORGANIZATION PLAN #1 FEBRUARY 2009 [Type the abstract of the document here. The abstract is typically a short summary of the contents of the document.] 23 LITTLE HOOVER COMMISSION I. Introduction The application of information technology permeates all aspects of California state government. From the collection of income and sales taxes, to providing health and social service benefits, to licensing vehicles and professionals, the use of technology within state government is multifaceted, supporting a multitude of programmatic missions, and evolving in response to changing policy and programmatic goals. Technology is no longer bolted onto the side of government programs; now, it is an integrated part of program design. The very ability of state agencies to manage their resources and efficiently deliver services to Californians is inextricably linked to their ability to effectively use technology. On the strategic level, as policy and programmatic initiatives move to “cross-boundary” models – cutting across traditional agency, organizational and jurisdictional boundaries – state executives will need to leverage technology to partner more closely with individuals and groups within and outside of government and must be able to seamlessly collaborate across the enterprise. Impeding this growing dependency is the fact that the state's technology programs are distributed across dozens of agencies, without a broad and cohesive organizing logic that informs the activities of information technology leaders as they build or acquire new systems or infrastructure. As a result, even the many positive advances in the state’s use of technology over the last decade, has failed to take advantage of these advances on an enterprise-wide basis. Further, the skillful use of information technology is particularly important now that residents and businesses expect to conduct their business with state government on the Internet, and also expect transparency and accountability from their government. Information Technology Governance Trends in the public sector, especially in those states that have been recognized by the Pew Center on the States for information performance, provide context as to the form, organization and benefits of effective information technology governance. In terms of information performance, among the states (Michigan, Missouri, Utah, Virginia and Washington)I earning the Pew’s Government Performance Project grade of “A” all have integrated policy and operational functions within information technology organizations that have an enterprise, or statewide, perspective. Beyond Pew’s assessment, the Little Hoover Commission, the Center for Digital Government, Deloitte Consulting, Gartner, the Legislative Analyst’s Office, and the RAND Corporation have observed that the state must transform the underlying way technology is governed and managed within state government if it is to be effectively leveraged as a strategic asset to improve public outcomes and maximize efficiency. Californians rightly expect affordable, accessible and responsive services from their state government and only the strategic use of information technology can enable California state government to meet these expectations. Doing so requires a framework to leverage existing technology assets and a statewide approach to the planning, design 24 APPENDICES & NOTES and implementation of future information technology systems and infrastructure. In the context of the state’s fiscal challenges, information technology also provides policymakers with a way to continue to provide needed services to the public by enhancing the performance and productivity of state government. Establishment of the Office of the State Chief Information Officer Since the early 1980s, the state tried several models for governing the way it manages information technology investments and operations. Nearly all of these models were shown to be insufficient for the management and oversight of complex technology infrastructures and large IT projects. Accordingly, in 2006, the Legislature enacted and Governor Arnold Schwarzenegger signed SB 834 (Chapter 533, Statutes of 2006) to establish the Office of the State Chief Information Officer (OCIO). Defining Federated IT Governance SB 834 made the State CIO a member of the Governor’s cabinet, with the position Federated IT governance establishes appointed by the Governor and subject to the relationship among the Agencies, Senate confirmation. The bill also codified departments and the state CIO. The the responsibilities of the State CIO, making federated governance model the State CIO the nominal leader for the maintains the authority of agencies to Executive Branch’s IT program. The Budget manage program-specific IT Act of 2007 and related legislation (SB 90, processes and systems. IT functions Chapter 183, Statutes of 2007) substantially that are common across the entire expanded on SB 834 and provided positions state are managed at the enterprise and an appropriation to establish the OCIO. level for all agencies by the central IT Government Code § 11545 et seq. provide organization. The federated the State CIO and the OCIO with governance model confirms that responsibility and authority for statewide programmatic needs are the primary technology vision, strategic planning and drivers for IT decisions and coordination, technology policy and acknowledges the importance of IT as standards (enterprise architecture), data an enabler of agency success. management policy and standards, and the review and approval of technology projects. With the creation of the OCIO, the Governor and the Legislature have established the structure on which a strong information technology program can be built. Greater expectations and new challenges require a new, more coordinated approach to the governance and management of information technology. This Reorganization Plan provides that approach - a federated governance model for information technology in California. 25 LITTLE HOOVER COMMISSION II. The Current State of IT Governance in California In its current state, IT governance responsibilities are dispersed across multiple entities and organizations. Existing Organizations Office of the State Chief Information Officer (OCIO) – The OCIO was formally established by Senate Bill 90 and began formal operation in January 2008. The State CIO’s specific responsibilities include the following: • Advising the Governor on the strategic management and direction of the state’s information technology resources. • Establishing and enforcing state information technology strategic plans, policies, standards and enterprise architecture. • Minimizing overlap, redundancy and cost in state operations. • Coordinating activities of agency information officers and the Director of Technology Services. • Improving organizational maturity and capacity in the effective management of information technology. • Establishing performance management practices and ensuring state information technology services are efficient and effective. • Approving, suspending, terminating and reinstating information technology projects. In the Budget Act of 2008, the Legislature provided the OCIO with 32 positions and a budget of approximately $6.7 million. The Governor’s 2009-10 January Budget proposal includes 29 new positions and an increase of $8.4 million ($5.7 million General Fund) to develop a strategic plan and overall structural design for education data systems and to provide sufficient resources to carry out the existing duties of the Chief Information Officer related to Enterprise Architecture, Geospatial Information Systems (GIS), human capital management, program and project management and information technology policy. Table 1, see below, describes key actions the OCIO has taken to date consistent with SB 90. 26 APPENDICES & NOTES Table 1: Key Actions by the Office of the State Chief Information Officer Statutory Role of the CIO Key Actions to Date Advise the Governor on the strategic (cid:57) School Finder/Education Data Project management and direction of the state’s (cid:57) Broadband and digital literacy IT resources. (cid:57) GIS Task Force Establish and enforce state IT strategic (cid:57) The IT Capital Planning process plans, policies, standards, and enterprise implemented by OCIO ensures all IT architecture. investments are consistent with state policy priorities, IT policy and standards, while reducing duplication and overlap. Minimize overlap, redundancy and cost in (cid:57) Moving forward with server consolidation state operations. plan that will significantly reduce costs when fully implemented. (cid:57) Leading effort to consolidate state e-mail systems to enhance security, reduce costs, and improve reliability. Coordinate activities of AIO’s and the (cid:57) With DTS Director, implemented spend Director of DTS. control program at DTS achieving savings on new hardware and significant cost avoidance related to capital expenditures. (cid:57) Significantly enhanced the state’s web presence through coordination with AIOs, recognized by Brookings institute and the Center for Digital Government. Improve organizational maturity and (cid:57) Establishing a Project/Risk management capacity in the effective management of methodology including a new training IT. program as a requirement for state IT Project Managers. (cid:57) Developing statewide workforce development and planning strategy focused on training, recruiting, and retaining IT staff Establishing performance management (cid:57) In establishing the Project Management and ensuring IT services are efficient and Methodology, developed key metrics to effective. assess performance of IT projects. Other information technology organizations/functions with a statewide operations or policy function include: The Department of Technology Services (DTS) – The DTS was established on July 9, 2005, via a Governor’s Reorganization Plan, and exists under the jurisdiction of the State and Consumer Services Agency. The DTS provides information technology (IT) services, on a “fee for service” basis, to state, county, federal and local government entities throughout California. Through the use of a scalable, reliable and secure statewide network, combined with expertise in voice and data technologies, DTS delivers comprehensive computing, networking, electronic messaging and training. The 27 LITTLE HOOVER COMMISSION DTS is made up of seven divisions, including: Data Center Operations, Security Management, Engineering, Customer Delivery, Policy and Planning, Statewide Telecommunications and Network, and Administration. [Describe Technology Services Board] In the Budget Act of 2008, the Legislature provided DTS with authority for 801.8 positions and $278 million in expenditure authority from the Technology Services Revolving Fund. The Technology Services Board (TSB) – The TSB, which was established on July 9, 2005, via a Governor’s Reorganization Plan, provides governance and guidance to the DTS, and ensures appropriate oversight and customer orientation. The TSB was designed to ensure that the DTS is governed by its major customers from a business perspective. Chaired by the State CIO, the TSB membership consists of top executives from all Cabinet agencies and the State Controller’s Office. Office of Information Security and Privacy Protection (OISPP) – The OISPP was established effective January 1, 2008, and is part of the State and Consumer Services Agency. The OISPP is responsible for leading state agencies in securing and protecting the State's information assets by identifying critical technology assets and addressing vulnerabilities; deterring identify theft and security incidents; sharing information and technology lessons promptly; enhancing government response and recovery; and developing consumer education programs. In the Budget Act of 2008, the Legislature provided OISPP with authority for 14 positions and a budget of $1.9 million. Department of General Services, Telecommunications Division (DGS-TD) – The DGS- TD was first established in 1947 and has existed in its current incarnation since the business telecommunications functions were transferred to the Department of Technology Services on July 9, 2005. The DGS-TD, as part of the DGS, exists under the jurisdiction of the State and Consumer Services Agency. The DGS-TD is made up of two distinct offices, the Office of Public Safety Communications Services (OPSCS) and the State of California 9-1-1 Emergency Communications Office. The OPSCS provides engineering and technical support services for public safety related communications systems, including: design, installation, and maintenance services. The 9-1-1 Emergency Communications Office provides oversight of the 9-1-1 network and approximately 500 police, fire, and paramedic dispatch centers, also known as Public Safety Answering Points (PSAPs) and assists PSAPs in the administration and funding of 9-1-1 services. In the Budget Act of 2008, the Legislature provided DGS-TD with authority for 368 positions and $223 million ($152 million for local assistance, $71 million for state operations) in expenditure authority. IT Procurement Policy – In enacting Public Contract Code Sections (PCC) §12100- 12113, the Legislature drew a distinction between the role of IT procurement policy and IT procurement procedure by granting the Department of Information Technology (DOIT) authority for IT procurement policy and the Department of General Services with authority over IT procurement procedure. When the Department sunset on July 1, 2002, this authority was transferred to the Department of Finance (DOF) and Management Memo 02-20 clarified the delineation of responsibilities in the area of IT 28 APPENDICES & NOTES procurement. Several references in PCC §12100-12113 still reference that the DOIT and the DGS are jointly responsible to create and coordinate policies and procedures for the acquisition of information technology goods and services. Clearly defining the roles and responsibilities for IT procurement policy and procedure is necessary to implement common technology standards statewide. Information Technology in California State Government In May 2008, the OCIO conducted a statewide survey in an effort to understand and baseline key data to gain a clearer picture about the state of information technology in California state government.II The survey requested information about several areas, including: general information about agencies IT organizations and how services are delivered; infrastructure (including mainframe, servers, and storage); e-mail services; and technical environment. The OCIO aggregated the data from the survey and validated it against other reliable sources of information. Key Findings from the Survey • Top Line Information: o Operating expenditures of more than $3 billion annually. o 130 individuals serving as CIOs or in an equivalent function within state agencies. o More than 10,000 authorized positions in IT classifications (annual payroll/overhead in excess of $1.5 billion). • IT Projects o More than 120 large IT projects under development with estimated budgets exceeding $6.8 billion over 11 years. o More than 500 small to medium IT projects under development. • IT Human Capital o More than 50% of the state’s IT workforce will be eligible to retire within the next five years. o Existing IT leadership capabilities require further development. o Deferred spending on workforce development has resulted in skill gaps and shortages in key areas (e.g. project management and business analytics). • IT Infrastructure - Data Centers, Servers and Storage o The state has approximately 409,000 sq. ft of floor space in 405 locations dedicated to data centers and server rooms. o Approximately 33 percent of data center floor space lacks sufficient disaster recovery and backup capabilities. o The state owns and operates more than 9,494 servers. More than a third of these servers are at, or near, end of life (3+ years old). o Agencies are operating 259 storage systems (159 Storage Attached Network (SAN) systems and 100 Network Attached Storage (NAS) systems. 29 LITTLE HOOVER COMMISSION • IT Infrastructure – Desktop o More than 200,000 desktops/laptops in use by Executive Branch agencies, with a refresh cycle ranging between three to five years. o The average desktop in use requires 4 to 16 times more energy than a laptop computer operating with advanced power management. o More than 100 different email systems. (cid:131) 180,000 active email boxes. (cid:131) 75 terabytes of storage (75,000 gigabytes). (cid:131) 15 million emails per day. • IT Security o Explosion in e-mail spam – ~95% of the e-mail the state receives each day is spam. o The state’s network vulnerability is projected to increase by more than 800 percent by 2018 if we maintain the current operating model. From the information gathered from the survey, the OCIO reached the following conclusions: • The State maintains a significant number of IT facilities, equipment, and staff across individual organizations. This provides an opportunity for consolidation, particularly with email services. • The State could improve governance, stake holder buy in, and communication of IT investments by standardizing reporting relationships as well as roles and responsibilities within state agencies for setting IT priorities. • The State could improve the management of IT resources by increasing the centralization of services. • State data centers are a prime target for efforts to improve energy efficiency. • Web and e-mail security threats are increasingly sophisticated. 30 APPENDICES & NOTES III. The Case for Reorganization Modern technology governance is no longer just about technology; it is about leadership in effectively and efficiently managing an organization’s use of technology to meet its business needs. It includes the structures and processes for setting direction, establishing standards and principles, and prioritizing IT investments that improve business value. IT governance is the mechanism for deciding who makes what decisions about technology use and it creates an accountability framework that drives the desired use of technology. Effective information technology governance also includes the processes by which key decisions are made about IT investments. Similarly, IT project success depends on effective, ongoing communication across all levels of an organization. The central question, which this plan addresses, is why reorganize and why reorganize now? California must reorganize its information technology governance structure to: • Establish a common sense governance model that aligns with best practices. • Increase coordination and operational efficiency, reduce costs and improve energy efficiency through statewide IT shared services, common IT standards, and consolidated IT infrastructure. • Meet growing public expectations for services accessible anytime and anywhere over the Internet. The Challenges and Opportunities of the Status Quo While significant progress has been made toward enhancing information technology governance and management in California state government over the last several years, significant challenges and opportunities remain. These challenges and opportunities occur at every level of the state’s business and technical architecture (see Figure 1 below) and result in sub-optimized efforts that dissipate resources and produce inconsistent results. They expose the state to higher overall operational costs from program overlaps, redundancies, inefficient use of resources and increased vulnerabilities to security threats and architecture breakdowns. 31 LITTLE HOOVER COMMISSION Figure 1: The Challenges and Opportunities of Status Quo IT Governance As the Little Hoover Commission recently observed, the dispersion of information technology assets, including human and economic capital and technology infrastructure, across agencies is the greatest challenge to accountable and effective information technology governance in California state government.III This condition reinforces organizational silos, adversely impacting technology operations as well as programmatic efficiency and fiscal performance. Computing Infrastructure Challenges To support the automation of business processes, agencies rely on a wide assortment of systems and storage devices that include: file and print servers, application and database servers; Internet and Intranet servers; and Network Attached Storage and Storage Attached Network Systems. The management of these systems is intended to ensure that data is physically stored, retrieved, archived and deleted as needed to support business functions. Outside of the state's data center environments, the 32 APPENDICES & NOTES management of systems and storage technologies is distributed across all agencies and results in diverse technical environments. The proliferation of distributed systems and storage devices has brought with it the necessity to manage increasingly complex environments. The total cost of ownership is inevitably higher in a complex environment. Research by Gartner shows that 40 percent of all application unavailability experienced by end users is caused by human error; these errors are more likely to occur in complex technical environments. Additional challenges due to highly differentiated technical environments include: • Difficulty in coordination resulting in technology inefficiency as well as functional and data redundancy. • Challenges to integrating IT systems, which impedes information sharing across the enterprise. • Duplication of effort, which limits the state’s ability to leverage its scale to reduce the cost of operations. • Dilution of the state’s ability to reliably operate its technology infrastructure, exposing the state to increasingly sophisticated security threats. • Underutilization of servers and data storage equipment resulting in increased technology operating costs, the inefficient use of energy and ultimately diverting resources from accomplishing programmatic missions. Computing Infrastructure Opportunities Centralized management and the careful consolidation of systems and storage devices offer the state numerous benefits that include: reduced complexity and support costs, lower error rates, better support for new business applications, as well as improved security, business continuity protection, and scalability and performance. • Case Example – The state currently owns and operates more than 9,494 servers. If growth in the number of servers continues at the current pace, it is estimated that the state will own and operate more than 18,000 servers by 2014. Informed by industry best practices around server consolidation and virtualization, the OCIO estimates that the state could reduce the total number of servers it owns and operates by 50 percent without impacting system performance or service levels. This common sense approach to technology management would result in significant cost savings, cost avoidance and reduced energy usage over time. 33 LITTLE HOOVER COMMISSION IV. Governance Aligned The building blocks for a strong IT program are in place. By creating the Office of the State CIO at the Cabinet level, appointing an accomplished CIO and supporting the effective use of information technology throughout his Administration, the Governor in partnership with the legislature have established the necessary conditions for success. Success, however, requires more than building blocks. Providing the appropriate governance structure is essential. The governance process must facilitate good decision-making and ensure that services are delivered cost-effectively. In arguing for an invigorated IT governance structure, the Little Hoover Commission said: “The state CIO must be given the authority to set and execute technology priorities as laid out in the state’s (2008) IT Strategic Plan. The state CIO must be given the resources to accomplish the task.”IV Also, the governance model should make possible transformation of service delivery across state government. Figure 2, below, depicts how California would transform the provision of IT services in support of agency programmatic missions. Figure 2 – IT Services in Support of Agency Missions 34 APPENDICES & NOTES The governance model should align with the organization and decision-making structure of the Executive Branch, with Agencies establishing the policies and business priorities in program areas and Departments, within Agencies, execute policy direction and deliver government programs. Statewide control agencies, including the Department of Finance and the Department of General Services, manage and oversee the budget, support services and procurement. The Governor appoints Agency Secretaries, which (along with other appointees) comprise his Cabinet. In addition to aligning with the decision authorities of the California Executive Branch, an effective IT governance process should also: • Maintain decision authority at the appropriate tier; • Provide statewide IT infrastructures and services; • Consolidate IT resources to increase capacity and reduce costs; • Improve management of IT projects; • Streamline approval, purchase and oversight processes; and • Foster collaboration and data sharing. The federated governance model articulated in this Reorganization Plan (see Figure 3 below) satisfies the goals listed above while maintaining accountability at the responsible tier. Figure 3 – Accountabilities in the Federated Governance Model Enterprise Statewide infrastructure Tier Shared services (OCIO) Common applications Business direction Agency Investment authority Tier Consolidated IT resources Desktop/LAN support Department IT purchases Tier Program‐level applications 35 LITTLE HOOVER COMMISSION In the federated governance model, depicted in Figure 3 above, responsibilities will be divided as follows: • The Enterprise Tier will provide robust IT infrastructure for the entire government, offer shared technology services across government, provide oversight to reduce risk in IT project management, and enhance security and stakeholder privacy. • The Agency Tier will provide program policy and direction, prioritize Agency IT investments, and consolidate IT resources reduce operational costs. • The Department Tier will provide local desktop/LAN support, manage business specific applications and purchase IT resources necessary for department activities. Ultimately, this Reorganization Plan proposes to transform the existing IT governance framework from one that is focused on the needs of individual agencies to one that provides affordable, consistent and reliable technology services to all state agencies, while supporting the diverse needs of individual agencies. The plan introduces the concept of California’s state government as a single enterprise in its use of information technology. This governance framework consolidates enterprise information technology functions under the Office of the State Chief Information Officer to improve coordination and realize significant efficiencies in procurement and technology implementation. This approach flows from business strategies and drivers and uses enterprise architecture to ensure the wise investment of limited resources. The federated governance framework enables operational improvements by defining common or shared technology (enterprise architecture) standards across diverse program areas, providing interoperability and supporting the diverse programmatic missions of state agencies. This approach also establishes a common platform and standards for operations and growth, improves the speed of implementations and provides an optimal return on investment. 36 APPENDICES & NOTES V. The New Organization The federated governance framework ensures the integrated and strategic use of technology resources statewide by bringing together the state’s key IT policy and operating functions and organizations, defining the role of the State CIO and the OCIO as well as providing the organizational framework for Agency and Department technology leadership. When it takes effect, this Reorganization Plan would establish an expanded Office of the State Chief Information Officer made up of the following existing organizations: • The Office of the Chief Information Officer; • The Office of Information Security and Privacy Protection (information security functions); • The Department of Technology Services (including the Technology Services Board); and • The Department of General Services – Telecommunications Division. In addition to its existing functions, the expanded OCIO would gain responsibility for key functions, including: • Enterprise Information Technology Management; • Enterprise Information Security; • Data Center and Shared Services; • Unified Communications Services (voice/video/data networks and radio systems); • IT Human Capital Management; • Information Technology Procurement Policy; and • Broadband and Advanced Communications Services Policy. The organization that would result from this Reorganization Plan (see Figure 4 below) aligns with best practices in the public sector and directly supports the state’s policy goals and programmatic initiatives. 37 LITTLE HOOVER COMMISSION Figure 4 – Proposed Office of the State Chief Information Officer 38 APPENDICES & NOTES Executive Office of the CIO The CIO will continue to report directly to the Governor and serve as the primary point of accountability for the management of the state’s integrated information technology and security program. The Executive Office will consolidate functions that cut across program areas to create a unified, enterprise-wide approach to IT and information security policy and operations. The CIO will continue to fulfill all current Agency Secretary roles. In addition, the CIO will advise and assist in the implementation of major policy and program matters and be the principal communication link between the Governor and the constituent units of the Office. The CIO remains a cabinet-level position, appointed by the Governor and confirmed by the Senate. Crosscutting and coordinating responsibilities that will be consolidated in the Executive Office, include the following: • California Broadband Initiative Office –The Office will provide leadership on policy initiatives related to broadband and advanced communications services, including coordinating the implementation of the California Broadband Task Force Report (except those recommendations related to right-of-way). • Office of Government Affairs – The Office will serve as the OCIO’s liaison to the Legislature, analyze federal and state legislation related to information technology and security issues, coordinate the development of legislation and monitor legislatively mandated reports. • Office of Communications – The Office will act as the OCIO’s liaison to employees, the news media, community groups and other external organizations. • Office of Legal Affairs – The Office will coordinate the OCIO’s legal activities and provide the CIO with legal counsel. Transferred Functions: The CIO will fulfill all current responsibilities of the State CIO as well as the functions of the director of the DTS, the director of OISPP for information security and the Director of General Services’ responsibilities related to telecommunications. The State CIO will now provide IT direction to Agency and Department Chief Information Officers. In addition, the State CIO will assume authority for IT procurement policy and performing enterprise technology functions. Divisional Structure and Responsibilities The OCIO will be comprised of the Technology Services Board and four offices – the Policy and Program Management Office, the Office of Technology Services, the Office of Information Security and the Enterprise Services Office. 39 LITTLE HOOVER COMMISSION Policy and Program Management Office – The Office, which will be led by the Chief Deputy CIO, will be responsible for the information technology performance management and ensuring that the state strategically manages its use of information technology resources to achieve the highest possible programmatic value. The office will be comprised of three IT policy/management focused groups (Program Management; Project Management; and Policy and Strategic Planning) as well as the Administration Group. • Program Management: Will be responsible for providing primary support for program and project planning, investment analysis, portfolio management and support for agency projects as necessary. In addition, will participate in the development of state IT policies, standards and procedures for project development and management and provide statewide orientation and training on these subjects. The PMO will also ensure standardization in project management processes and project performance metrics for effective project management and uniform project performance assessment. Additionally, the PMO will coordinate and implement project remediation actions. • Project Management: Will provide the execution leadership for large IT projects, including responsibility for the technology and change management components of IT projects, such as communications about objectives, roles and responsibilities, status and direction. • Policy and Strategic Planning: Will be responsible for coordinating the development of the Statewide IT Strategic Plan, developing statewide policies and standards for the use and procurement of information technology, managing internal projects and initiatives, and coordinating other planning efforts. • Administration: Will provide essential services for the administration of the OCIO and its programs, including facilities operations, financial management, human resources, and procurement and contracting. Office of Technology Services – The OTS, which will be led by the Director of Technology ServicesV, will be comprised of two key functional groups focused on technology operations and infrastructure – Data Center & Shared Services and Telecommunications and Network Services. • Data Center Services: The DCS group will be responsible for core data center operations and services and will be made up of the Operations and Engineering Divisions. o Operations: Will provide information technology infrastructure platforms and network connectivity to meet customers' information technology needs 24 hours per day, seven days a week. o Engineering: Will install and maintain software and hardware for customers to ensure system reliability, availability and serviceability. • Telecommunications and Network: Will provide statewide telecommunications services, including strategic and tactical policies and planning for the state to a wide variety of state and local government customers. 40 APPENDICES & NOTES Technology Services Board – The Board, which will be chaired by the State CIO, will be responsible for approving the OTS’ budget and rates. Office of Information Security – The OIS, which will be led by the Director of Information Security,VI will be responsible for ensuring the confidentiality, integrity, and availability of state systems and applications, and promoting and protecting the privacy of Californians. The OIS will implement enterprise information security and privacy protection policies and practices to safeguard information to ensure the confidentiality, integrity and availability. Enterprise Services Office – The ESO, which will be led by the Chief Deputy CIO for Enterprise Services, will be responsible for developing the state’s enterprise architecture as well as robust, reliable and affordable enterprise services. • Enterprise Architecture: Will define, maintain and guide the implementation of the state’s enterprise architecture - the statewide roadmap to achieve the state’s mission and goals through improving the performance of its core business processes within an efficient information technology environment. • Enterprise Solutions and Services: Will manage the development and implementation of policy driven technology solutions and services. • Geospatial Information Systems: Will build and manage the California Geospatial Data Infrastructure as a shared service to enable all state agencies to share the cost of storing, accessing, utilizing and distributing GIS data. • Human Capital Management: Will be responsible for leading statewide efforts to recruit and retain skilled IT professionals, developing a statewide IT succession/workforce plan, and establishing a comprehensive development, training and performance management program for state IT employees. • Public Safety Communications o Public Safety Communications Services: Will provide engineering and technical support services for public safety related communications systems. o 9-1-1 Emergency Communications: Will provide oversight of the 9-1-1 network and approximately 500 police, fire, and paramedic dispatch centers and assist in the administration and funding of 9-1-1 services. Transferred Functions This new organizational structure would result in the transfer of all of the functions from DTS, the functions of the Telecommunications Division of the Department of General Services, the information security functions of the OISPP as well as responsibility for information technology procurement policy.VII 41 LITTLE HOOVER COMMISSION Figure 5 – Federated Information Technology Governance Framework Other Roles and Responsibilities in the Federated Governance Framework When this Reorganization Plan goes into effect, the State CIO will be responsible for providing technology direction to Agency Chief Information Officers (AIOs) and Department Chief Information Officers (CIOs), see Figure 5 above. Specific activities include: 1. Integrating statewide technology initiatives; 2. Ensuring compliance with information technology policies and standards; and 3. Promoting the alignment and effective management of IT resources. Agency Chief Information Officers (AIOs)/Non-Affiliated Chief Information Officers – AIOs will be responsible for overseeing the management of IT assets, projects, data systems, infrastructure, services and telecommunications, through the oversight and management of departmental CIOs. Each Agency CIO will be responsible for developing an Agency Enterprise Architecture to rationalize, standardize and consolidate IT infrastructure, data, and procedures for all departments within their Agency. 42 APPENDICES & NOTES Department Chief Information Officers (CIOs) – CIOs will be directly responsible for all IT activities within the department and report to the State CIO through the Agency CIO for purposes of departmental IT performance management. All departmental employees in IT classifications will report to the Department CIO. CIOs will be responsible for all IT systems, assets, projects, purchases, and contracts and will ensure departmental conformity with the Agency Enterprise Architecture. Department CIOs will also be responsible for: 1. Portfolio management of the department’s technology initiatives; 2. Operational oversight of IT functions, personnel and operations, including: • Web and application development; • Application and database management; • Security administration; • Telecommunications; • Project planning, consulting and management; and • Help desk and customer service management. Chief Information Officers for Departments that are not affiliated with an Agency will have the responsibilities of an AIO, except those responsibilities related to oversight of Departmental CIOs, and the responsibilities of Agency-affiliated Departmental CIOs. Consistent with the federated governance model, the OCIO will work with agencies and departments to implement this operating model in a way that aligns with their business operations. Other Organizational Changes The transfer of the information security functions of the Office of Information Security and Privacy Protection (OISPP) to the OCIO that will occur when this Reorganization Plan goes into effect will result in the creation of the Office of Privacy Protection (OPP) within the State and Consumer Services Agency. The OPP will continue to carry out the consumer focused privacy protection functions of the OISPP. 43 LITTLE HOOVER COMMISSION VI. Benefits of the Reorganization Plan The federated governance framework articulated in this Reorganization Plan enables the strategic use of both human and IT resources to achieve a higher level of efficiency and effectiveness in the delivery of services, improve accountability and transparency and increase return on taxpayer investment. While this Reorganization Plan is the beginning of the transformation process, it: Establishes a Single-Point of Accountability for Information Technology • Integrating resources will result in greater transparency and accountability of operations, a more comprehensive and integrated investment planning process, and significantly improve the output and outcome reporting and analytic information base. This in turn will improve the state’s ability to manage IT programs. Consolidates Key Technology Assets and Policy Functions • The federated operating model envisioned by this Reorganization Plan will place a premium on developing 'enterprise solutions' that are deployed across multiple agencies while consolidating other technology resources. • Centralized management and the careful consolidation of systems and storage devices offer the state numerous benefits that include: reduced complexity and support costs, lower error rates, better support for new business applications, improved security, improved business continuity protection, and improved scalability and performance. • In addition to improved technology and program alignment, increased efficiency and effectiveness, and supporting a statewide and cross-boundary approach, the organizational changes proposed in this Reorganization Plan enable a greater emphasis on data, information and knowledge management, and provide an improved platform for the transformation of government services and operations. Supports Integrated Business and IT Planning • Building on the IT Capital Planning Process, this Plan supports a robust integrated business-IT planning process that provides a coherent, repeatable process ensuring the alignment of IT strategy with public priorities and agency business plans. This process will result in a more efficient allocation of resources, with the potential for making more resources available for other policy priorities, as overall IT costs are reduced. Promotes Data Sharing and Management • This Reorganization Plan will enable a greater emphasis on data, information and knowledge management, including information sharing among and within agencies as well as information sharing with different levels of government. 44 APPENDICES & NOTES Enhances Information Security and Disaster Recovery • The statewide approach to information security and disaster recovery enabled by this Reorganization Plan will provide a consistent, integrated approach across agencies thereby making individual agencies less vulnerable to security breaches and operational downtime. 45 LITTLE HOOVER COMMISSION VII. General Provisions This Reorganization Plan is effective on May 7, 2009. On the effective date, the plan shall become operative. Transfer of Employees Pursuant to Government Code Sections 12080.3 and 19370, all employees serving in the State Civil Service, other than temporary employees, who are engaged in the performance of functions transferred to the Office of the State Chief Information Officer or engaged in the administration of a law, the administration of which is transferred to the Office of the State Chief Information Officer by this Reorganization Plan, are transferred to the Office of the State Chief Information Officer. The status, positions, and rights of such persons shall not be affected by their transfer and shall continue to be retained by them pursuant to the State Civil Service Act, except as to positions the duties of which are vested in a position exempt from civil service. The personnel records of all transferred employees shall be transferred to the Office of the State Chief Information Officer. Transfer of Property The property of any agency or department, related to functions transferred as part of this reorganization, is transferred to the Office of the State Chief Information Officer. If any doubt arises as to where such property is transferred, the Department of General Services shall determine where the property is transferred. Transfer of Funds All unexpended balances of appropriations and other funds available for use in connection with any function or the administration of any law transferred by this Reorganization Plan shall be transferred to the Office of the State Chief Information Officer for use for the purpose for which the appropriation was originally made or the funds were originally available. If there is any doubt as to where such balances and funds are transferred, the Department of Finance shall determine where such balances and funds are transferred. 46 APPENDICES & NOTES Endnotes I See “50 State Information Summary,” The Pew Center on the States, Government Performance Project, Information Performance Grades. Online at: www.pewcenteronthestates.org/uploadedFiles/Information%20Performance.pdf II The survey can be viewed online at: cio.ca.gov/Publications/pubs/OCIO%20StatewideITSurveyReport.pdf III See “A New Legacy System: Using Technology to Drive Performance,” Little Hoover Commission, November 2008. IV See “A New Legacy System: Using Technology to Drive Performance,” Little Hoover Commission, November 2008. V The Director of Technology Services will be appointed by and serve at the pleasure of the Governor, and subject to Senate Confirmation. VI The Director of Information Security will be appointed by, and serve at the pleasure of, the Governor. VII Public Contract Code Sections 12101 and 12103 reference the Department of Information Technology as responsible for IT procurement policy. 47 LITTLE HOOVER COMMISSION 48 APPENDICES & NOTES Appendix B February 2009 Public Hearing Witnesses Witnesses Appearing at the Little Hoover Commission Public Hearing on the Governor’s Reorganization Plan to Consolidate Information Technology Functions Under the Office of the State Chief Information Officer February 25, 2009 Margarita Maldonado, Bargaining Chair, P.K. Agarwal, Director, Department of Unit 1, Service Employees International Union Technology Services Local 1000 Will Bush, Director, Department of General Joe Munso, Undersecretary, Health and Services Human Services Agency (invited) J. Stephen Fletcher, State Chief Information Teresa “Teri” Takai, Chief Information Officer, Officer, State of Utah, and Executive Director, State of California Utah Department of Technology Services Gregory Hurner, Deputy Secretary for Mark Weatherford, Executive Officer, Office of Legislation, State and Consumer Services Information Security and Privacy Protection Agency 49 APPENDICES & NOTES 50 LITTLE HOOVER COMMISSION Appendix C Comparing Plans Little Hoover Commission Recommendations Governor’s Reorganization Plan (GRP) Transfer functions of the Department of Technology Implements Little Hoover Commission Services’ director to the Office of the Chief Information recommendation. Officer. Transfer the Office of Information Security and Privacy Implements Little Hoover Commission Protection’s information security functions to the Office recommendation. of the Chief Information Officer. Transfer project management functions of Office of The new Policy and Program Management Office in Systems Integration in the Health and Human Services the Office of the Chief Information Officer will be Agency to the Office of the Chief Information Officer. responsible for project management. Transfer management of enterprise-wide IT projects, Expands authority of state chief information officer such as Fi$Cal and 21st Century, to the Office of the over enterprise projects, but responsibility for Chief Information Officer. current projects remains unclear. Create a Geospatial Information Systems Office in the Implements Little Hoover Commission Office of the Chief Information Officer. recommendation. State chief information officer remains a Appoint state chief information officer to a 5-year term. gubernatorial appointment. Consolidate state IT workforce under the Office of the Adopt “federated” model through agencies and Chief Information Officer. departments. Combine IT Council with other technology boards and Does not address. commissions. Develop aggregated IT budget and priority list with Not addressed in the GRP, but included in the new department and agency representatives to advocate to IT Strategic Plan as Five-Year IT Capital Plan. administration and Legislature. Not addressed in the GRP, but the concept is Build foundation to collect, report and share included in the IT Strategic Plan. Implementation is performance data with the public and policy-makers. unclear. 51 APPENDICES & NOTES 52 LITTLE HOOVER COMMISSION Notes 1. California Government Code, section 12080-12081.2. 2. Teresa “Teri” Takai, Chief Information Officer, State of California. Sacramento, CA. February 20, 2009. Written testimony to the Commission. 3. Governor’s Reorganization Plan #1. February 2009. “Organizing for Success: IT Governance for California State Government.” Sacramento, CA. 4. Teresa “Teri” Takai, Chief Information Officer, State of California. Sacramento, CA. February 25, 2009. Little Hoover Commission hearing. Testimony to the Commission. Also, Governor’s Reorganization Plan #1. See endnote 3. Page 12. 5. Adrian Farley, Chief Deputy Director, Office of the State Chief Information Officer. Sacramento, CA. February 27, 2009. Personal communication. 6. Mac Taylor, Legislative Analyst. March 9, 2009. Sacramento, CA. Written communication. 7. Little Hoover Commission. November 2008. “A New Legacy System: Using Technology to Drive Performance.” Sacramento, CA. 8. Little Hoover Commission. May 2005. “The Governor’s Reorganization Plan to Create a Department of Technology Services.” Sacramento, CA. 9. J. Clark Kelso, Chief Information Officer, State of California. November 8, 2007. “Annual Report on the Executive Branch’s Information Technology Program – 2006-2007.” Pages 36-37. Sacramento, CA. 10. J. Clark Kelso. See endnote 9. Pages 36-37. 11. J. Clark Kelso, former Chief Information Office, State of California. Sacramento, CA. February 9, 2009. Written communication. 12. P.K. Agarwal, Director, Department of Technology Services. Sacramento, CA. February 20, 2009. Written testimony to the Commission. 13. Teresa “Teri” Takai. See endnote 2. 14. Little Hoover Commission. See endnote 7. Pages 22, 34-35. 15. Mac Taylor. See endnote 6. 16. Little Hoover Commission. See endnote 7. Pages 22-23, 34-35. 17. Mark Weatherford, Executive Officer, Office of Information Security and Privacy Protection. February 20, 2009. Sacramento, CA. Written testimony to the Commission. 18. Richard Holober, Executive Director, Consumer Federation of California, and Beth Givens, Director, Privacy Rights Clearinghouse. February 19, 2009. San Mateo, CA. Written communication. 19. Mac Taylor. See endnote 6. 53 APPENDICES & NOTES 20. Teresa “Teri” Takai. See endnote 2. 21. Scott Harvey, Chief Deputy Director, Department of General Services. February 20, 2009. Sacramento, CA. Written testimony to the Commission. 22. Scott Harvey. See endnote 21. 23. Teresa “Teri” Takai. See endnote 2. 24. Barry Hemphill, Deputy Director, Telecommunications Division, Department of General Services. Sacramento, CA. April 28, 2005. Testimony to the Commission. 25. Scott Harvey, Chief Deputy Director, Department of General Services. Sacramento, CA. February 25, 2009. Testimony to the Commission. 26. Teresa “Teri” Takai. See endnote 4. Also, Matt Williams. January 21, 2009. “California CIO Teri Takai: IT Consolidation Will Be ‘Federated.’” Government Technology. http://www.govtech.com/gt/print_article.php?id=591614. Accessed January 29, 2009. 27. Teresa “Teri” Takai. See endnote 2. 28. Little Hoover Commission. See endnote 7. 29. Teresa “Teri” Takai. See endnote 2. 30. Office of the State Chief Information Officer. 2009. “Statewide Information Technology Capital Plan. Transforming Strategic Goals into Action, Volume 2.” Sacramento, CA. 31. Margarita Maldonado, Bargaining Chair, Unit 1, SEIU Local 1000. February 20, 2009. Written testimony to the Commission. 32. Teresa “Teri” Takai. See endnote 2. 33. Teresa “Teri” Takai. See endnote 4. 34. Teresa “Teri” Takai. See endnote 2. 35. Teresa “Teri” Takai. See endnote 4. 36. Teresa “Teri” Takai. See endnote 2. 37. Joe Munso, Undersecretary, Health and Human Services Agency. Sacramento, CA. February 24, 2009. Written testimony to the Commission. 38. Teresa “Teri” Takai. See endnote 2. 39. Mac Taylor. See endnote 6. 40. J. Stephen Fletcher, Chief Information Officer, State of Utah. Salt Lake City, UT. February 25, 2009. Written testimony to the Commission. 41. Teresa “Teri” Takai. See endnote 4. 42. Teresa “Teri” Takai. See endnote 2. 43. J. Clark Kelso. See endnote 11. 54