File #: Int 1234-2023    Version: * Name: Assessment of a cloud-first policy for city technology systems.
Type: Introduction Status: Filed (End of Session)
Committee: Committee on Technology
On agenda: 11/2/2023
Enactment date: Law number:
Title: A Local Law in relation to an assessment of a cloud-first policy for city technology systems
Sponsors: Justin L. Brannan, Gale A. Brewer, Farah N. Louis
Council Member Sponsors: 3
Summary: The proposed legislation would require the Department of Information Technology and Telecommunications to conduct an assessment of a cloud-first policy for city technology systems. The Department would also be required to submit a report of the results of the assessment to the Council.
Indexes: Report Required
Attachments: 1. Summary of Int. No. 1234, 2. Int. No. 1234, 3. November 2, 2023 - Stated Meeting Agenda, 4. Hearing Transcript - Stated Meeting 11-2-23, 5. Minutes of the Stated Meeting - November 2, 2023
Date Ver.Prime SponsorAction ByActionResultAction DetailsMeeting DetailsMultimedia
12/31/2023*Justin L. Brannan City Council Filed (End of Session)  Action details Meeting details Not available
11/2/2023*Justin L. Brannan City Council Referred to Comm by Council  Action details Meeting details Not available
11/2/2023*Justin L. Brannan City Council Introduced by Council  Action details Meeting details Not available

Int. No. 1234

 

By Council Members Brannan, Brewer and Louis

 

A Local Law in relation to an assessment of a cloud-first policy for city technology systems

 

Be it enacted by the Council as follows:

 

                     Section 1. Assessment of a cloud-first policy for city technology systems.

a. Definitions. As used in this section, the following terms have the following meanings:

Cloud computing system. The term “cloud computing system” means a system providing ubiquitous on-demand network access to a shared pool of configurable computing resources, including but not limited to networks, servers, storage, applications, and services, that can be rapidly provisioned and released to a requesting party with minimal management intervention or service provider interaction.

Department. The term “department” means the department of information technology and telecommunications.

b. The department shall assess the feasibility of a cloud-first policy in which the use of a cloud computing system would be given preferential consideration when city agencies are developing technology solutions, strategies, and operational deployment plans for any software program, mobile application, or data storage need. Such assessment shall include an evaluation of current usage of cloud computing systems by city agencies and determine the feasibility of storing additional city agency electronic data at rest on cloud computing systems, rather than on physical data storage systems owned by the city, as well as the feasibility of further utilizing cloud computing systems in the operation of city agency mobile applications, software programs, and the provision of information technology services. Such assessment shall further assess the readiness of city agencies for such a cloud-first policy.

c. No later than one year after the effective date of this local law, the department shall submit to the speaker of the council a report of the results of the assessment conducted pursuant to subdivision b of this section. Such report shall include, but not be limited to, the following:

1. an analysis of the technology needs of city agencies and the ability of cloud computing systems to meet such needs, including consideration of what needs would be most or least suitable for utilization of cloud computing systems;

2. an analysis of whether any barriers in procurement process or policy prevent further utilization of cloud computing systems by city agencies;

3.  an analysis of any information or skills that would be required for city employees to utilize cloud computing systems for which training or retraining of such employees would be necessary;

4. an analysis of the security of cloud computing systems, relative to other information technology solutions;

5. an analysis of the feasibility of transitioning legacy systems to utilize cloud computing systems;

6. an analysis of any implications related to current software licenses;

7. an estimate of the costs, per unit of data, of storing, retrieving, and removing data from the average cloud computing system;

8. potential or actual cost differentials, in both personal services and other than personal services, between cloud computing systems and alternative technology solutions;

9. a brief analysis of the current and prospective cloud computing system providers, including a description of their physical principal places of business; and

10. a description of the requirements that a current cloud computing system provider is required to meet, and recommendations on the requirements that prospective cloud computing system providers should meet in the future, particularly in relation to the physical data center location, the physical security of the data center, the deployment model of the cloud computing system, the disaster recovery strategy, the mechanics of reporting a security breach, the data duplication process utilized, the level of encryption utilized, the financial stability of the provider, the auto-deletion options, suggested auditing protocols, and any terms that a contract with a cloud computing system provider should include, such as an indemnification clause.

§ 2. This local law takes effect immediately.

 

 

Session 12:

IB/BJR

LS 10731

9/29/23

 

Session 11:

IB

LS #13515; 15719

Int. 2193-2020

09/29/2020