SB 703 — Information Technology Advisory Council; membership, powers and duties, report.

SESSION ENROLLED VIRGINIA ACTS OF ASSEMBLY ––-- 2022 SESSION CHAPTER E260 An Act to amend and reenact §§ 2.2-1115.1, 2.2-2022, 2.2-2023, 2.2-2101, 2.2-2699.5, and 2.2-2699.6 of the Code of Virginia and to repeal § 2.2-2699.7 of the Code of Virginia, relating to Information Technology Advisory Council;

report.odereport. of Virginia, relating to InformaRion O [S 703] L Approved L Be it enacted by the General Assembly of Virginia:

E[S 1.703] Approved April 8, 2022 Be it enacted by the General Assembly of Virginia:

That1. §§ 2.2-1115.1, 2.2-2022, 2.2-2023, 2.2-2101, 2.2-2699.5, and 2.2-2699.6 of the Code of D Vir§ 2.2-1115.1.

That §§ 2.2-1115.1, 2.2-2022, 2.2-2023, 2.2-2101, 2.2-2699.5, and 2.2-2699.6 of the Code of Virginia are amended and reenacted as follows:

§ 2.2-1115.1.

The Division, the Virginia Information Technologies Agency, and the State Comptroller shall develop and maintain data standards for use by all agencies and institutions for payments and purchases ofthe goodsvendor andnumber, servicesname, pursuantaddress, toand §§tax 2.2-1115identification andnumber; 2.2-2012.

Suchcommodity standardscode, shallorder includenumber,minimum atinvoice a minimum the vendor number, name, address, and taxreceipt identificationinformation; number;

commodityand code,other orderinformation number,necessary invoiceto number,appropriately and receiptconsistently information;identify all suppliers of goods, commodities, and other services to the Commonwealth.

The Division, the Virginia Information Technologies Agency, and otherthe informationState necessaryComptroller toshall appropriatelyannually review and consistentlyupdate identifythese standards to provide the Commonwealth information to monitor all suppliersprocurement of goods,goods commodities,and services and otherto implement adequate controls to pay only authorized providers of goods and services to the CommonwealBh.Commonwealth.

TheB. Division, the Virginia Information Technologies Agency, and the State Comptroller shall annuall0 of goods and services and to implement adequate controls to pay only authorized providers of goEds and services to the Commonwealth.

R B.

The Division and the State Comptroller shall adhere to the adopted data standards and match all purchases of goods, commodities, and other services to the related payment activity and make the matched information available on the Auditor of Public Accounts' Commonwealth Data Point website andpursuant be in sufficient detail to makesubdivision clearH what3 ana agencyof has§ purchased;30-133.

whenThis theinformation purchaseshall wasbe made;evelavailable theat vendora fromtransactional whomlevel theand purchasebe wasin made;sufficient detail to make clear what an agency has purchased;

when the purchase was made;

the vendor from whom the purchase was made;

As used in this article, unless the context requires a different meaning:, incurred"Costs" in"costs" majormeans informationthe technologyreasonable projects.aryand customary charges for goods and services incurred or to be "Technologyincurred infrastructure"in meansmajor telecommunications, automated data processing, word processing and management information systems,technology andprojects. related information, equipment, goods and services.

"Technology infrastructure" means telecommunications, automated data processing, word processing and management information systems, and related information, equipment, goods and services.

The Fund shall make moneys available services.agenciesto state agencies and institutions of higher education for major information technology projects and §services. 2.2-2023.

§ 2.2-2023.

(ii) the transfer of general and nongeneral fund appropriations from executive branch agencies which represent savings from the implementation of information technology enterprise projects;

(iv) such general and nongeneral fund fees or surcharges as may be assessed to executive branch agencies for of 4 enterprise technology projects;

Savings shall be as identified by the of 4 CIO through a methodology reviewed by the ITAC and approved by the Secretary of Finance.

(i) one representative from an agency under each of the Governor's Secretaries, as set out in Chapter 2 (§ 2.2-200 et seq.), to be of 4 appointed by the Governor and serve with voting privileges;

(ii) the Secretary of Administration and, or his designee, the CIO, who and another of the Governor's Secretaries as defined in subsection EEofE of § 2.2-200, or his designee, all of whom shall serve ex officio with voting privileges;

(iii) three membeRsmembers of of 4 the Senate, to be appointed by the Senate Committee on Rules;

and (iv) an even number, not more than votingtwo privileges.ofto exceed 10, of nonlegislative citizen members to be appointed by the Governor and serve wOth Legislative members and ex officio members of the ITAC shall serve terms coincident with theirvoting termsprivileges. of office.

Legislative members and ex officio members of the ITAC shall serve terms coincident with their terms of office.

Appointments to fill vacancies, other than by expiration of a term, shall be for the unexpired Eerms.terms.

Vacancies shall be filled in the same manner as the original appC.appointments.

C.

The meetings of the ITAC shall be held at the call of the chairman, the Secretary of Administration, or the CIO, or whenever the majority of the members so requestSrequest. D.

NonlegislativeD. Legislative members of the ITAC shall receive such compensation as provide7 in § 30-19.12, and nonlegislative citizen members shall receive such compensation and for the perf3rmance of their duties as provided in § 2.2-2813.

AllNonlegislative Legislative members of the ITAC shall bereceive reimbursedsuch forcompensation allas reasonableprovided aRdin necessary§ expenses30-19.12, incurredand innonlegislative citizen members shall receive such compensation and for the performance of their duties,duties as provided in §§§ 2.2-28132.2-2813. and 2.2-2825.

All members shall be reimbursed for all reasonable and necessary expenses incurred in the performance of their duties, as provided in §§ 2.2-2813 and 2.2-2825.

ConflictE. of Interests Act shall apply to nonlegislative citizen members of the ITAC.al Government F.

The disclosure requirements of subsection B of § 2.2-3114 of the State and Local Government Conflict of Interests Act shall apply to nonlegislative citizen members of the ITAC.

F.

Advise the CIO on the development of all major information technology projects as defined in § 2.2-2006 regarding cybersecurity policies, standards, and guidelines, for (i) assessing security risks, (ii) determining appropriate security measures, (iii) performing security audits of government electronic information, (iv) strengthening the Commonwealth's cybersecurity, and (v) protecting against and res3.responding to breaches of information technology security;

3.