MASSACHUSETTS OFFICE OF INFORMATION TECHNOLOGY

M.G.L. pt. Part I, tit. Title II, ch. c. 7D

in effect

M.G.L. c. 7D, § 1 Definitions

c. 7D, § 1. Definitions Section 1. As used in this chapter, the following words shall, unless the context clearly requires otherwise, have the following meanings:— ''Chief information officer'' or ''CIO'', the chief information officer of the commonwealth. ''Deputy director'', the director of information technology of a state agency. ''Information technology'' or ''IT'', hardware, software, telecommunications equipment and related services designed for the storage, manipulation and retrieval of data by electronic or mechanical means including, but not limited to, personal computers, mainframes, wide and local area networks, servers, mobile or portable computers, peripheral equipment, telephones, wireless communications, handheld devices, cloud-based application and platform services, public safety radio services, facsimile machines, data centers, dedicated training facilities and switching facilities. ''Office'', the executive office of technology services and security. ''Secretariat chief information officer'' or ''SCIO'', the person responsible for technology services, security and information technology in each executive office other than the executive office of technology services and security, who reports to both the secretary of technology services and security and the secretary of the executive office for whose technology services the SCIO is responsible. ''State agency'', a legal entity of state government established by the general court as an agency, board, bureau, commission, council, department, office or division of the commonwealth with a specific mission and which is subject to the control of the governor or whose administration has been solely appointed by the governor.

M.G.L. c. 7D, § 2 Executive office of information technology services and security; secretary; chief information officer; adherence to information technology policies, procedures and objectives by executive department agencies

c. 7D, § 2. Executive office of information technology services and security; secretary; chief information officer; adherence to information technology policies, procedures and objectives by executive department agencies Section 2. There shall be an executive office of technology services and security that will be an executive office within the meaning of section 2 of chapter 6A. The office shall be administered by a secretary who shall be appointed by the governor and who shall supervise all activities concerning information technology of state agencies. The Governor may designate the secretary of the executive office of technology services and security as the chief information officer for the commonwealth. If the Governor does not designate the secretary as the chief information officer, the secretary shall, notwithstanding section 45 of chapter 30 and chapter 31, subject to the approval of the governor, appoint a chief information officer who shall report to the secretary and serve at the pleasure of the secretary. Notwithstanding any general or special law, rule, regulation, executive order, policy or procedure to the contrary, all executive department agencies shall, and other state agencies may, adhere to the policies, procedures and objectives established by the executive office of technology services and security with respect to activities concerning information technology.

M.G.L. c. 7D, § 3 Powers and duties

c. 7D, § 3. Powers and duties Section 3. (a) The office shall have all powers necessary or convenient to carry out its duties including, but not limited to, the power to: (i) establish bureaus and other functional units within the office and hire employees; (ii) as needed, require the consolidation of IT functions into a centralized service delivery model as determined by the executive office of technology services and security; (iii) oversee, coordinate with and provide assistance, advice, and expertise in connection with business relationships between state agencies and private sector providers of information technology; (iv) eliminate, where appropriate, duplication of duties and functions among IT personnel within state agencies; (v) monitor trends and advances in information technology resources; (vi) oversee and supervise the maintenance of information technology and the initiation of information technology updates or projects for state agencies; (vii) initiate procurements of information technology resources for state agencies and enter into agreements or contracts in connection with such procurement on behalf of a state agency or other political subdivision of the commonwealth; (viii) set policy regarding all procurements of information technology resources; (ix) review and approve the information technology budget requests of a state agency and IT spending priorities of executive offices and agencies within any executive office; (x) implement standards for product or service specifications, characteristics or performance requirements of IT resources that increase efficiency and improve security and identify opportunities for cost savings within state agencies based on such standardization; specifically, the office may implement the following: (a) the centralized acquisition and standardization of specifications for desktop computing equipment; (b) consolidation and centralized management of all network resources for the executive department; (c) the consolidation of information technology infrastructure; and (d) following consultation with the secretary of the executive office and the head of the agency or department within the executive offices, effectuate the centralization of other IT services and functions when centralization or standardization will promote greater security, improve service, or reduce costs; (xi) establish special requirements for vendors of IT services to state agencies; (xii) adapt standards as necessary for individual agencies to comply with federal law; and (xiii) maintain a page on the commonwealth's official website, open to the public through the Massachusetts open data portal, providing data, as transmitted by the department of criminal justice information services pursuant to subsection (i) of section 167A of chapter 6, concerning arrests; provided, however, that categories of data which constitute personally identifiable information shall not be posted or made available to the public. (b) The office may issue administrative directives pursuant to the authority set forth in this chapter, which shall be binding on all executive department agencies and offices.

M.G.L. c. 7D, § 4 Enterprise chief information security officer (CISO)

c. 7D, § 4. Enterprise chief information security officer (CISO) Section 4. The secretary shall, notwithstanding section 45 of chapter 30 and chapter 31, appoint a qualified individual to serve as an enterprise chief information security officer (CISO) for the commonwealth who shall serve at the pleasure of the secretary. The CISO shall advise the secretary and the CIO on preventing data loss and fraud and protecting privacy. The CISO shall ensure all existing IT policies applicable to executive offices and agencies reflect best practices related to security and privacy.

M.G.L. c. 7D, § 4A Chief data officer

c. 7D, § 4A. Chief data officer Section 4A. The secretary may, notwithstanding section 45 of chapter 30 and chapter 31, appoint a qualified individual to serve as the chief data officer for the commonwealth, who shall serve at the pleasure of the secretary. Notwithstanding any general or special law, rule, regulation, executive order, policy or procedure to the contrary, the chief data officer shall develop administrative directives to govern the use, storage, collection, and dissemination of data assets for the executive department, and shall develop procedures for facilitating, where appropriate, resolution of disputes between or among agencies, departments, and executive offices regarding the use and sharing of data. The chief data officer shall have the role of promoting and facilitating, subject to all applicable federal and state laws, rules, and regulation, the sharing and use of data assets of the commonwealth in support of data-driven policymaking, research, analysis, study, or economic development.

M.G.L. c. 7D, § 4B Chief privacy officer

c. 7D, § 4B. Chief privacy officer Section 4B. The secretary may, notwithstanding section 45 of chapter 30 and chapter 31, appoint a qualified individual to serve as commonwealth chief privacy officer, who shall serve at the pleasure of the secretary. The chief privacy officer shall promote privacy and security in the use and dissemination of sensitive data, and shall serve as an ombudsperson to effectuate resolution of concerns regarding privacy and security in the use of data.

M.G.L. c. 7D, § 4C Chief digital officer

c. 7D, § 4C. Chief digital officer Section 4C. The secretary may, notwithstanding section 45 of chapter 30 and chapter 31, appoint a qualified individual to serve as chief digital officer, who shall serve at the pleasure of the secretary. The chief digital officer is directed to lead an effort to improve the public facing web presence and related services for executive department offices and agencies.

M.G.L. c. 7D, § 5 Bureau of geographic information

c. 7D, § 5. Bureau of geographic information Section 5. There shall be a bureau of geographic information within the office which shall develop, maintain, update and distribute geographic information, technology, data and services for use by state agencies, municipalities and the public. The office shall coordinate all geographic information activities in state and local government and shall collect, manage and distribute geographic information maintained by state agencies and local government agencies. Subject to sufficient appropriation, the office shall provide technical services related to geographic information to state agencies and municipalities. The secretary may, as needed, set standards for the acquisition, management and reporting of geographical information and for the acquisition, creation or use of applications employing such information by any state agency and the reporting of such information by municipalities.

M.G.L. c. 7D, § 6 Appointment of secretariat chief information officer (SCIO) of each executive office; duties; IT strategy plan; compliance reviews

c. 7D, § 6. Appointment of secretariat chief information officer (SCIO) of each executive office; duties; IT strategy plan; compliance reviews Section 6. (a) The secretary of each executive office established pursuant to section 2 of chapter 6A shall, in consultation with and approval by the secretary, appoint an SCIO of each executive office who shall report to the secretary of that executive office and to the secretary of technology services and security. Each SCIO shall manage all activities concerning information technology within the executive office and supervise all information technology personnel. (b) Each SCIO shall manage the information technology personnel needs of their respective executive offices. Each SCIO shall develop an IT strategic plan for the executive office that shall be approved by the CIO that sets forth: (i) operational and project priorities; (ii) budgets; (iii) planned procurements; (iv) efficiency goals; (v) security initiatives; and (vi) staffing plans. (c) The secretary shall supervise the activities of all SCIOs and may conduct annual compliance reviews across the executive offices to ensure full compliance with statutes, regulations, policies, standards and contractual obligations related to information technology and security.

M.G.L. c. 7D, § 7 Financial threshold for proposed IT expenditures; approval; contracts for IT services; project oversight committee; policies and guidelines

c. 7D, § 7. Financial threshold for proposed IT expenditures; approval; contracts for IT services; project oversight committee; policies and guidelines Section 7. (a) The CIO shall determine and set a minimum financial threshold above which any proposed IT expenditure by a state agency shall be reviewed and approved by the office. The CIO may suspend an expenditure related to IT until approval has been granted by the office. The operational services division and the comptroller shall adopt procedures and policies to ensure cooperation with the executive office of technology services and security's IT procurement review policies and shall assist in enforcing them. (b) All state agency contracts for IT shall require the approval of the CIO. The executive office of technology services and security may require that it be named as a party to any IT contract that any agency or office within the executive department enters into. The CIO may negotiate state agency IT contracts and amendments to existing contracts entered into by a state agency for information technology services in order to expand the scope of the contract, extend the term of the contract, improve delivery of services under the contract or to safeguard information from threats to cyber security. The office shall review long-term contracts for information technology services on a quarterly basis to ensure that services delivered pursuant to those contracts are provided in a timely and cost-effective manner to the commonwealth. If the CIO determines that information technology services under any such contract could be improved, the office shall consult and negotiate with each agency and contractor who is a party to the existing contract to obtain terms and conditions more favorable to the commonwealth. (c) For IT projects that present a complex set of challenges as defined in an administrative directive promulgated by the executive office of technology services and security, the executive office of technology services and security may establish a project oversight function that may include the formation of a committee to develop criteria and benchmarks to evaluate the project and advise the executive office of technology services and security as to whether the project is accomplishing its objectives. A committee established pursuant to this section may include members from the private sector; provided, however, that members shall have no financial interest in the project overseen by the committee. (d) The CIO shall adopt policies, standards and guidelines governing information technology procurement, development and maintenance, specifically including provisions for: (i) ensuring effective project management and oversight configurations; (ii) establishing strategic incentive and requirement structures; (iii) increasing competition among information technology vendors, including, but not limited to, the undertaking of smaller, short-term information technology projects to provide improved programmatic flexibility; (iv) utilizing commercial off-the-shelf information technology products to achieve cost savings on information technology projects; (v) increasing technology procurement innovation using pilot programming; (vi) identifying which information technology projects and procurements shall require the services of an independent verification and validation consultant; (vii) creating a team of project managers to oversee and manage large information technology projects; (viii) gathering and maintaining relevant records, documents and information related to vendor performance on ongoing and completed projects to assist in assessing prospective vendors' past performance; and (ix) implementing other best practices which may include, but shall not be limited to, those identified in legislative reports and legislatively-required reports.

M.G.L. c. 7D, § 8 Interagency service agreements; consultation with division of local services in the department of revenue

c. 7D, § 8. Interagency service agreements; consultation with division of local services in the department of revenue Section 8. Through interagency service agreements, the office may consult and provide services to municipalities, constitutional officers, the judiciary, the legislature, institutions of higher education, authorities, quasi-public corporations and other political subdivisions of the commonwealth as well as other states of the United States if the provision of these services to other states will decrease the costs or improve the efficiency of the service provided by the office to the commonwealth. The office shall consult with the division of local services in the department of revenue to identify ways to better assist municipalities and regional entities in procuring and developing information technology services.

M.G.L. c. 7D, § 9 Statewide information technology plan

c. 7D, § 9. Statewide information technology plan Section 9. The office shall develop a statewide information technology plan that shall identify the immediate needs of information technology among state agencies as well as long-term investments in information technology that should be considered by the commonwealth. The plan shall be updated annually and shall be published on the website of the commonwealth.

M.G.L. c. 7D, § 10 Authorization of executive office of technology services and security to collect, maintain, store, share, utilize, analyze and disseminate data

c. 7D, § 10. Authorization of executive office of technology services and security to collect, maintain, store, share, utilize, analyze and disseminate data Section 10. Subject to and consistent with all applicable federal and state laws, rules, and regulations, the executive office of technology services and security is authorized to collect, maintain, store, share, utilize, analyze and disseminate data.

M.G.L. c. 7D, § 11 Inter-branch, interagency oversight board; justice reinvestment policies relative to data collection and its availability to the public

c. 7D, § 11. Inter-branch, interagency oversight board; justice reinvestment policies relative to data collection and its availability to the public Section 11. There shall be an inter-branch, interagency oversight board to monitor and ensure that the justice reinvestment policies relative to data collection and its availability to the public achieve anticipated goals. The board shall consist of 16 members: the secretary of the executive office of technology services and security, who shall serve as chairperson; the attorney general or a designee; the chief justice of the trial court or a designee; the secretary of the executive office of public safety and security or a designee; the commissioner of probation or a designee, the chief counsel of the committee for public counsel services or a designee; the commissioner of correction or a designee; a member of the Massachusetts District Attorneys Association; a member of the Massachusetts Sheriffs Association, Inc.; the senate chair of the joint committee on the judiciary or a designee; the house chair of the joint committee on the judiciary or a designee; the chief legal counsel of the Massachusetts Bar Association or a designee; the executive director of the American Civil Liberties Union of Massachusetts, Inc. or a designee; and 3 members appointed by the governor: 1 of whom shall be an expert in addressing racial, ethnic, gender or age bias and 2 of whom shall be experts in data collection and analysis. The board shall meet quarterly to review the compliance of: (i) criminal justice agencies and the trial court, including the probation service, the parole board, the executive office of public safety and security, the department of correction, houses of correction and county jails in: (1) collecting and submitting data required by paragraphs (12), (13) and (14) of section 183/4 of chapter 6A; (2) making said data available to the public as required by said paragraphs 12, 13 and 14 of said section 183/4 through the development of data portals to make data without personally identifiable information so available; and (ii) criminal justice agencies and the trial court, including the department of correction, houses of correction and county jails, with policies ensuring accurate data collection across racial, ethnic and gender classifications; provided, that compliance shall include a review of whether the methods of data collection are appropriately screening for gender-specific risk or needs that may be addressed by evidence-based programs. A report on the collection of data and the compliance with justice reinvestment policies shall be submitted annually to the clerks of the house of representatives and the senate on or before July 1.

Source: Massachusetts General Court (malegislature.gov)URL: https://malegislature.gov/Laws/GeneralLaws/PartI/TitleII/Chapter7DFetched: 10/20/2026