A.R.S. tit. 18 ch. 1 — Arizona Revised Statutes Title 18 Chapter 1 — Government Information Technology

18-101. Definitions In this chapter, unless the context otherwise requires: 1. "Budget unit" means a department, commission, board, institution or other agency of the state receiving, expending or disbursing state funds or incurring obligations of the state including the Arizona board of regents but excluding the universities under the jurisdiction of the Arizona board of regents, the community college districts and the legislative or judicial branches. 2. "Committee" means the information technology authorization committee. 3. "Department" means the department of administration. 4. "Director" means the director of the department. 5. "Disaster recovery" means the measures required to mitigate the loss of information technology capability. 6. "Information technology" means all computerized and auxiliary automated information processing, telecommunications and related technology, including hardware, software, vendor support and related services, equipment and projects. 18-102. Government information technology The department is responsible for government information technology functions as prescribed in this chapter. 18-103. Powers and duties of director In regard to government information technology, the director shall: 1. Appoint a chief information officer for information technology. 2. Establish minimum qualifications for each position authorized for the department for government information technology. The qualifications shall be subject to the review of the information technology authorization committee. 3. Employ, determine the conditions of employment and prescribe the duties and powers of administrative, professional, technical, secretarial, clerical and other persons subject to title 41, chapter 4, article 4 as may be necessary in the performance of the department's duties and contract for the services of outside advisors, consultants and aides as may be reasonably necessary. Employees of the department shall meet the minimum qualifications established pursuant to this section. 18-104. Powers and duties of the department; violation; classification A. The department shall: 1. Develop, implement and maintain a coordinated statewide plan for information technology. This includes: (a) Adopting statewide technical and coordination standards for information technology, which may include a requirement that budget units adopt certain technologies and data sharing practices to improve the efficiency of administering information technology. (b) Serving as statewide coordinator for information technology resources. (c) Developing a statewide disaster recovery plan, identifying risks in each budget unit and directing agencies to adopt risk mitigation strategies, methods and procedures to minimize the risks. (d) Developing a list of approved department projects by priority category. (e) Developing a detailed list of information technology assets that are owned, leased or employed by this state. (f) Evaluating and either approving or disapproving budget unit information technology plans. Budget units shall submit information technology plans that include quality assurance plans and disaster recovery plans to the department each year on or before May 15. The legislative and judicial departments of state government shall submit information technology plans on or before September 1 for information purposes. (g) Evaluating specific information technology projects relating to the approved budget unit and statewide information technology plans in consultation with the statewide information security and privacy office in the Arizona department of homeland security. The department shall approve or reject projects with total costs of at least $25,000 but not more than $1,000,000 and may establish conditional approval criteria, including procurement purchase authority. If the total project costs exceed $1,000,000, the department shall evaluate the project and make recommendations to the information technology authorization committee. If the total project costs exceed $5,000,000, the department shall require the budget unit to contract with an independent third party to review and guide the technology approach, scope, estimated cost, timeline for completion and overall feasibility of the project before making recommendations to the information technology authorization committee. On or before the thirtieth day following the last day of each calendar quarter, the budget unit shall submit a report from the independent third party to the information technology authorization committee and the joint legislative budget committee regarding the progress of each ongoing project. As part of a budget request for an information technology project that has total costs of at least $25,000, a budget unit shall indicate the status of review by the department. Projects shall not be artificially divided to avoid review by the department. (h) Developing a statewide data strategic plan for the purposes of improving the efficiency and effectiveness of data sharing and data governance activities. 2. Require that budget units incorporate a life-cycle analysis into the information technology planning, budgeting and procurement processes. 3. Require that budget units demonstrate expertise to carry out information technology plans, either by employing staff or contracting for outside services. 4. Monitor information technology projects that the department considers to be major or critical, including expenditure and activity reports and periodic review. 5. Temporarily suspend the expenditure of monies if the department determines that the information technology project is at risk of failing to achieve its intended results or does not comply with the requirements of this section. 6. Continuously study emergent technology and evaluate its impact on this state's system. 7. Advise each budget unit as necessary and report to the committee on an annual basis. 8. Provide to budget units information technology consulting services it deems necessary, either directly or by procuring outside consulting services. 9. Maintain all otherwise confidential information received from a budget unit pursuant to this section as confidential. 10. Provide staff support to the committee. 11. Subject to section 35-149, accept, spend and account for grants, monies and direct payments from public or private sources and other grants of monies or property to conduct programs that it deems consistent with the government information technology purposes and objectives of the department. 12. Adopt rules it deems necessary or desirable to further the government information technology objectives and programs of the department. 13. Formulate policies, plans and programs to effectuate the government information technology purposes of the department. 14. Advise and make recommendations to the governor and the legislature on all matters concerning its objectives. 15. Contract and enter into interagency and intergovernmental agreements pursuant to title 11, chapter 7, article 3 with any public or private party. 16. Have an official seal that shall be judicially noticed. 17. Establish an interactive online directory of codes, rules, ordinances, if available electronically, and statutes to assist individuals and businesses with regulatory requirements and obligations. As provided in this paragraph, counties, municipalities and budget units shall submit information in a manner and format prescribed by the agency. 18. Manage enterprise-level information technology infrastructure, except that the statewide information security and privacy office in the Arizona department of homeland security shall manage the information security aspects of the infrastructure. 19. Develop strategies to protect the information technology infrastructure of this state and the data that is stored on or transmitted by the infrastructure. 20. Temporarily suspend access to information technology infrastructure when directed by the Arizona department of homeland security and consult with the Arizona department of homeland security regarding security policies, standards and procedures. 21. Have the ability to delegate authority or specific information technology functions to any budget unit. 22. Have the authority to enter into agreements with any state agency or political subdivision of this state to furnish information technology services. Unless monies have been appropriated by the legislature for this purpose, any agreement shall provide for reimbursement to the department for the costs of the services furnished as determined by the department. B. The department shall advise the judicial and legislative branches of state government concerning information technology. C. The department may examine all books, papers, records and documents in the office of any budget unit and may require any state officer of the budget unit to furnish information or statements necessary to carry out this chapter. D. The director, any member of the director's staff or any employee who knowingly divulges or makes known in any manner not permitted by law any particulars of any confidential record, document or information is guilty of a class 5 felony. 18-106. Electronic and digital signatures; exemptions; definitions A. The department, in consultation with the state treasurer, shall adopt policies or rules pursuant to title 41, chapter 6 establishing policies and procedures for the use of electronic and digital signatures by all state agencies, boards and commissions for documents filed with and by all state agencies, boards and commissions. B. Unless otherwise provided by law, an electronic signature that complies with this section may be used to sign a writing on a document that is filed with or by a state agency, board or commission, and the electronic signature has the same force and effect as a written signature. C. An electronic signature shall be unique to the person using it, shall be capable of reliable verification and shall be linked to a record in a manner so that if the record is changed the electronic signature is invalidated. D. Except for returns, statements or other documents filed pursuant to titles 42 and 43, a document that contains an electronic signature that is a digital signature shall comply with the policies or rules adopted pursuant to subsection A of this section. E. The following records are not public records and are exempt from public inspection and reproduction pursuant to title 39, chapter 1, article 2: 1. Records containing information that would disclose or may reasonably lead to the disclosure of any component in the process used to execute or adopt an electronic or digital signature if the disclosure would or may reasonably cause the loss of sole control over the electronic or digital signature from the person using it. 2. Records that if disclosed would jeopardize or may reasonably lead to jeopardizing the security of a certificate issued in conjunction with a digital signature. F. For the purposes of this section: 1. "Certificate" means a computer-based record that is contained in a document with a digital signature and that identifies the subscriber, contains the subscriber's public key and is digitally signed by the entity issuing the certificate. 2. "Digital signature" means a type of electronic signature. 3. "Electronic signature" either: (a) Means an electronic or digital method of identification that complies with the requirements of this section and that is executed or adopted by a person with the intent to be bound by or to authenticate a record. (b) Includes a digital signature. 4. "Entity issuing the certificate" means a person that creates and issues a certificate and notifies the subscriber listed in the certificate of the contents of the certificate. 5. "Person" means a human being or an organization capable of signing a document, either legally or as a matter of fact. 6. "Private key" means the key of a key pair that is used to create a digital signature. 7. "Public key" means the key of a key pair that is used to verify a digital signature. 8. "Record" means information that is inscribed in a tangible medium or that is stored in an electronic or other medium and that is retrievable in a physically perceivable form. Record includes electronic records and printed, typewritten and tangible records. 9. "Subscriber" means a person that is the subject listed in a certificate, accepts that certificate and holds a private key that corresponds to a public key listed in that certificate. 18-121. Information technology authorization committee; members; terms; duties; compensation; definition A. The information technology authorization committee is established consisting of the following members: 1. One member of the house of representatives who is appointed by the speaker of the house of representatives and who shall serve as an advisory member. 2. One member of the senate who is appointed by the president of the senate and who shall serve as an advisory member. 3. Four members from private industry who are appointed by the governor pursuant to section 38-211, or their designees, and who are knowledgeable in information technology. 4. One local government member and one federal government member who are appointed by the governor and who shall serve as advisory members. 5. Two members who are directors of state agencies and who are appointed by the governor, or their designees. 6. The administrative director of the courts or the director's designee. 7. The director of the department of administration or the director's designee, who shall be the chairperson of the committee but for all other purposes shall serve as an advisory member. 8. Two members from either private industry or state government who are appointed by the governor, or their designees. 9. The staff director of the joint legislative budget committee, or the staff director's designee, who shall serve as an advisory member. 10. The statewide chief information security officer or the officer's designee. B. Committee members who are from private industry serve two-year terms. The other members serve at the pleasure of their appointing officers. C. For all budget units and the legislative and judicial branches of state government, the committee shall: 1. Review established statewide information technology standards and the statewide information technology plan. 2. Review the minimum qualifications established by the director for each position authorized for the department for information technology. 3. Approve or disapprove all proposed information technology projects, including project changes and contract amendments, that exceed a total cost of $1,000,000, excluding public monies from county, municipal and other political subdivision sources that are not deposited in a state fund. The committee shall also approve or disapprove any proposed information technology project involving more than one budget unit if the collective total development cost of the project is expected to be more than $1,000,000. As part of a budget request for an information technology project that has total costs of more than $1,000,000, a budget unit and the legislative and judicial branches of state government shall indicate the status of review by the committee. Projects shall not be artificially divided to avoid review by the committee. 4. Develop a report format that incorporates the life-cycle analysis for use in submitting project requests to the committee. 5. Require expenditure and activity reports from a budget unit or the legislative or judicial branch of state government on implementing information technology projects approved by the committee. 6. Conduct periodic reviews on the progress of implementing information technology projects approved by the committee. 7. Monitor information technology projects that the committee considers to be major or critical. 8. Temporarily suspend the expenditure of monies if the committee determines that the information technology project is at risk of failing to achieve its intended results or does not comply with the requirements of this chapter. 9. Hear and decide appeals made by budget units regarding the department's rejection of their proposed information technology plans or projects. 10. Report to the governor, the speaker of the house of representatives, the president of the senate and the secretary of state at least annually on all matters concerning its objectives. This includes: (a) Its review of the statewide information technology plan developed by the department. (b) The findings and conclusions of its periodic reviews. (c) Its recommendations on desirable legislation relating to information technology. 11. Adopt rules it deems necessary or desirable to further the objectives and programs of the committee. D. The committee shall meet at the call of the chairperson. E. Members of the committee are not eligible to receive compensation but are eligible to receive reimbursement for expenses pursuant to title 38, chapter 4, article 2. F. For the purposes of this section, "advisory member" means a member who gives advice to the other members of the committee at committee meetings but who is not eligible to vote and is not a member for purposes of determining whether a quorum is present. 18-131. Definitions In this article, unless the context otherwise requires: 1. "Disability" means a physical or mental impairment that substantially limits one or more major life activities and includes having a record of or being regarded as having such an impairment. 2. "Electronic or information technology" means all electronic information processing hardware and software, including telecommunications and any electronic information equipment or interconnected system that is used in acquiring, storing, manipulating, managing, moving, controlling, displaying, switching, interchanging, transmitting and receiving data or information, including audio, graphics and text. 18-132. Alternative methods of access to electronic or information technology; complaint procedure; rules A. In order to improve accessibility of future electronic or information technology and increase the successful employment and access to government services for individuals with disabilities, particularly blind and visually impaired and deaf and hard-of-hearing persons, a budget unit, in developing, procuring, maintaining or using electronic or information technology through the use of state monies, shall ensure that the electronic or information technology provides comparable access to individuals with disabilities in accordance with the accessibility standards adopted under section 508 of the rehabilitation act of 1973 (29 United States Code section 794d) unless doing so would impose an undue burden on the budget unit. B. The budget unit that contracts with a vendor that provides these products or services is subject to this article for the provision of electronic or information technology or for the provision of related services and shall agree to respond to and make a good faith effort to resolve any complaint regarding accessibility. The department of administration shall establish a complaint procedure for all budget units, except the supreme court shall establish a complaint procedure for the courts. The complaint procedures for the department of administration and the supreme court shall be consistent with section 508 of the rehabilitation act of 1973 to be used by an individual with a disability who alleges that a budget unit failed to comply with this article. C. The department of administration shall adopt rules that are necessary to implement this article and revise those rules as necessary based on any amendments to section 508 of the rehabilitation act of 1973, including an undue burden process that is consistent with the section 508 federal acquisition regulation provisions. The department of administration shall begin the rule making process by October 1, 2004.