MISSISSIPPI LEGISLATURE
2025 Regular Session
To: State Affairs; Technology
By: Representatives Zuber, Ford (73rd)
AN ACT TO ESTABLISH A CLOUD CENTER OF EXCELLENCE (CCOE) WITHIN THE MISSISSIPPI DEPARTMENT OF INFORMATION TECHNOLOGY SERVICES; TO FACILITATE THE ADOPTION AND MANAGEMENT OF CLOUD COMPUTING ACROSS STATE AGENCIES AND POLITICAL SUBDIVISIONS; TO PROVIDE STRATEGIC GUIDANCE, BEST PRACTICES, AND GOVERNANCE FRAMEWORKS FOR CLOUD MIGRATION AND OPTIMIZATION; TO ENHANCE SECURITY, SCALABILITY, AND COST EFFICIENCY IN STATEWIDE CLOUD OPERATIONS; TO AUTHORIZE THE PHASED IMPLEMENTATION OF THE CCOE OVER A FIVE-YEAR PERIOD; TO PROVIDE REPORTING AND OVERSIGHT REQUIREMENTS; TO AUTHORIZE THE PROMULGATION OF RULES AND REGULATIONS NECESSARY FOR ITS ADMINISTRATION; TO BRING FORWARD SECTIONS 25-53-3 AND 25-53-21, MISSISSIPPI CODE OF 1972, FOR PURPOSES OF POSSIBLE AMENDMENTS; AND FOR RELATED PURPOSES.
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MISSISSIPPI:
SECTION 1. This act shall be known and may be cited as the "Cloud Center of Excellence Act."
SECTION 2. As used in this act, the following terms shall have the meanings ascribed herein, unless the context clearly requires otherwise:
(a) "Cloud Center of Excellence" or "CCOE" means the centralized body responsible for providing strategic guidance, best practices, governance, and technical support for cloud adoption and management across state agencies and political subdivisions.
(d) "Cloud computing" means on-demand access to computing resources, including storage, servers, and applications, delivered via the Internet or other networks.
(b) "Data processing" means information technology equipment and related services designed for the automated storage, manipulation, and retrieval of data by electronic or mechanical means. The term includes:
(i) Central processing units, front-end processing units, miniprocessors, microprocessors, and related peripheral equipment such as data storage devices, document scanners, data entry equipment, terminal controllers, data terminal equipment, computer-based word processing systems other than memory typewriters, and equipment and systems for computer networks;
(ii) All related services, including feasibility studies, systems design, software development, and time-sharing services, provided by state employees or others; and
(iii) The programs and routines used to employ and control the capabilities of data processing hardware, including operating systems, compilers, assemblers, utilities, library routines, maintenance routines, applications, and computer networking programs.
(c) "MDITS" or "department" means the Mississippi Department of Information Technology Services.
(d) "Political subdivision" means any body politic or body corporate other than the state responsible for governmental activities only in geographic areas smaller than that of the state, including, but not limited to, any county, municipality, school district, charter school, volunteer fire department that is a chartered nonprofit corporation providing emergency services under contract with a county or municipality, community hospital as defined in Section 41-13-10, airport authority, or other instrumentality of the state, whether or not the body or instrumentality has the authority to levy taxes or to sue or be sued in its own name.
(e) "State agency" means a department, commission, board, office, council, authority, or other agency in the executive or judicial branch of state government that is created by the constitution or a statute of this state, including a university system or institution of higher education.
SECTION 3. (1) There is established within the Mississippi Department of Information Technology Services (MDITS) a centralized Cloud Center of Excellence (CCOE) to facilitate cloud adoption across state agencies and political subdivisions, enhance technological infrastructure, improve security and scalability, and streamline cloud migrations in a cost-effective and efficient manner.
(2) Using existing resources, MDITS may review the process for the coordinated development, hosting and management of computer software for state agencies that use cloud computing services. The Cloud Center of Excellence (CCOE) shall:
(a) Develop and implement a statewide strategy for cloud adoption and management based on the Microsoft CCOE model;
(b) Provide guidance, best practices, and governance frameworks to state agencies and political subdivisions for the adoption and use of cloud services;
(c) Establish standardized processes for cloud migrations, resource optimization, and workload assessments;
(d) Enhance cybersecurity protocols and ensure compliance with state and federal security standards;
(e) Monitor and report on the scalability, cost efficiency, and performance of cloud infrastructure;
(f) Offer training and support to agency personnel to promote cloud literacy and effective utilization; and
(g) Coordinate with state agencies and political subdivisions to ensure a phased implementation schedule as required by the provision of Section 4 of this act.
SECTION 4. (1) The Cloud Center of Excellence (CCOE) shall establish a five-year phased implementation plan as follows:
(a) By July 1, 2026, conduct statewide readiness assessments and develop detailed cloud migration plans for pilot agencies;
(b) By July 1, 2027, initiate pilot migrations for selected state agencies, establish key performance indicators (KPIs) and refine processes based on feedback;
(c) By July 1, 2028, expand cloud adoption to additional state agencies, focusing on optimizing resource utilization and ensuring adherence to best practices;
(d) By July 1, 2029, begin integration of political subdivisions into the cloud ecosystem, providing support for local governments, postsecondary educational institutions and school districts; and
(e) By July 1, 2030, achieve full statewide adoption of cloud services, with ongoing monitoring, training, and optimization provided by the CCOE for all state agencies and political subdivisions.
(2) During the respective schedule of implementation described subsection (1), each state agency and political subdivision integrated into the CCOE at that time shall consider:
(a) Cloud computing service options, including any security benefits and cost savings associated with purchasing those service options from a cloud computing service provider and from a statewide technology center established by the department, when making purchases; and
(b) Cloud computing service options and compatibility with cloud computing services in the development of new information technology software applications.
(3) (a) Except as provided by paragraph (b) of this subsection, a state agency or political subdivision shall ensure, when making purchases for an automated information system, that the system is capable of being deployed and run on cloud computing services.
(b) When making a purchase for an automated information system, a state agency or political subdivision may determine that, due to integration limitations with legacy systems, security risks or costs, the state agency or political subdivision is unable to purchase a system capable of being deployed and run on cloud computing services.
(c) At least fourteen (14) days before the date a state agency or political subdivision solicits bids, proposals, offers or other applicable expressions of interest for a purchase described by paragraph (b) of this subsection, the state agency or political subdivision shall submit a report that describes the purchase and the agency's reasoning for making the purchase of an automated information system to the Mississippi Department of Information Technology Services (MDITS).
(4) The department shall provide administrative support and oversight to the CCOE and ensure compliance with this act.
(5) The department is authorized to:
(a) Enter into agreements with cloud service providers to facilitate cost-effective procurement of cloud solutions;
(b) Develop and enforce statewide cloud security and compliance standards;
(c) Establish funding mechanisms, including interagency agreements, to support the operations of the CCOE; and
(d) Promulgate rules and regulations necessary to carry out the provisions of this act.
SECTION 5. (1) Not later than November 15 of each even-numbered year, MDITS, using existing resources, shall submit a report to the Governor, Lieutenant Governor and Speaker, the Chairpersons of the House and Senate Committees on Technology and of the House State Affairs Committee on the use of cloud computing service options by state agencies and political subdivisions, detailing the progress of the implementation plan, challenges encountered, and recommendations for improvement. The report must include use cases that provided cost savings and other benefits, including security enhancements. All state agency and political subdivisions shall cooperate with MDITS in the creation of the report by providing timely and accurate information and any assistance required by the department.
SECTION 6. (1) The Legislature shall appropriate funds to the Department of Information Technology Services to implement and operate the Cloud Center of Excellence (CCOE). The CCOE may seek additional funding through federal grants, partnerships, and other available resources.
SECTION 7. Section 25-53-3, Mississippi Code of 1972, is brought forward as follows:
25-53-3. (1) Whenever the term "Central Data Processing Authority" or the term "authority," when referring to the Central Data Processing Authority, is used in any law, rule, regulation, document or elsewhere, it shall be construed to mean the Mississippi Department of Information Technology Services.
(2) For the purposes of this chapter the following terms shall have the meanings ascribed in this section unless the context otherwise requires:
(a) "Central Data Processing Authority" and "CDPA" mean "Mississippi Department of Information Technology Services (MDITS)" and the term "authority" means "board of the MDITS."
(b) "Bureau of Systems Policy and Planning," "Bureau of Telecommunications," "Bureau of Central Data Processing" and "bureau" mean "Mississippi Department of Information Technology Services."
(c) "Computer equipment or services" means any information technology, computer or computer related telecommunications equipment, electronic word processing and office systems, or services utilized in connection therewith, including, but not limited to, all phases of computer software and consulting services, and insurance on all state-owned computer equipment.
(d) "Acquisition" of computer or telecommunications equipment or services means the purchase, lease, rental, or acquisition in any other manner of any such computer or telecommunications equipment or services.
(e) "Agency" means and includes all the various state agencies, officers, departments, boards, commissions, offices and institutions of the state.
(f) "Governing authority" means boards of supervisors, governing boards of all school districts, all boards of directors of public water supply districts, boards of directors of master public water supply districts, municipal public utility commissions, governing authorities of all municipalities, port authorities, commissioners and boards of trustees of any public hospitals and any political subdivision of the state supported wholly or in part by public funds of the state or political subdivisions thereof.
(g) "Bid" means any of the valid source selection techniques and competitive procurement methods appropriate to information technology procurement in the public sector, including, but not limited to, competitive sealed bidding, competitive sealed proposals, simplified small purchase procedures, sole source procurements, and emergency procurements.
(h) "Telecommunications transmission facility" means any transmission medium, switch, instrument, inside wiring system or other facility which is used, in whole or part, to provide any transmission.
(i) "Equipment support contract" means a contract which covers a single, specific class or classes of telecommunications equipment or service and all features associated with that class, through which state agencies may purchase or lease the item of equipment or service specified by issuing a purchase order under the terms of the contract without the necessity of further competitive bidding.
(j) "Inside wiring system" means any wiring which:
(i) Directly or indirectly, interconnects any terminal equipment with any other terminal equipment or with any regulated facility or common carrier services; and
(ii) Is located at the premises of the customer and is not inside any terminal equipment.
(k) "Procurement" means the selling, buying, purchasing, renting, leasing or otherwise obtaining telecommunications equipment, system or related services, as well as activities engaged in, resulting in or expected to result in selling, buying, purchasing, renting, leasing or otherwise obtaining telecommunications equipment.
(l) "Telecommunications equipment, systems, related services" are limited to the equipment and means to provide:
(i) Telecommunications transmission facilities.
(ii) Telephone systems, including voice processing systems.
(iii) Facsimile systems.
(iv) Radio paging services.
(v) Mobile telephone services, including cellular mobile telephone service.
(vi) Intercom and paging systems.
(vii) Video teleconferencing systems.
(viii) Personal communications networks and services.
(ix) Any and all systems based on emerging and future telecommunications technologies relative to (i) through (viii) above.
(m) "Telecommunications system lease contract" means a contract between a supplier of telecommunications systems, including equipment and related services, and the Mississippi Department of Information Technology Services through which telecommunications systems, including equipment and related services, may be leased for a term which shall not exceed sixty (60) months for a system lease valued less than One Million Dollars ($1,000,000.00) and shall not exceed one hundred twenty (120) months for a system lease valued One Million Dollars ($1,000,000.00) or more.
(n) "Tariffed or regulated service" means telecommunications service offered by common carriers and subject to control by the Mississippi Public Service Commission or the Federal Communications Commission.
(o) "State Data Center" means one or more facilities operated by the Mississippi Department of Information Technology Services to provide information technology resources requiring enterprise computing resources or any other centrally managed information resources.
SECTION 8. Section 25-53-21, Mississippi Code of 1972, is brought forward as follows:
25-53-21. The executive director shall have the following duties, responsibilities and authority:
(a) He shall conduct continuing studies of all information technology activities carried out by all agencies of the state and shall develop a long-range plan for the efficient and economical performance of such activities in state government. Such plan shall be submitted to the authority for its approval and, having been approved by the authority, shall be implemented by the executive director and all state agencies. Such plan shall be continuously reviewed and modifications thereof shall be proposed to the authority by the executive director as developments in information technology techniques and changes in the structure, activities, and functions of state government may require.
(b) He shall review the purchasing practices of all state agencies in the area of the purchasing of supplies for information technology and make recommendations to the authority and to the Public Procurement Review Board for the institution of purchasing procedures which will ensure the most economical procurement of such supplies commensurate with the efficient operation of all departments and agencies of state government.
(c) He shall see that all reports required of all agencies are promptly and accurately made in accordance with the rules and regulations adopted by the authority. Either in person or through his authorized agents, he shall make such inspections of information technology operations being conducted by any of the agencies of the state as may be necessary for the performance of his duties.
(d) He shall suggest and cause to be brought about cooperation between the several state agencies in order to provide efficiency in information technology operation. He shall, together with the heads of the agencies involved, reduce to writing and execute cooperative plans for the acquisition and operation of information technology equipment, and any such plan so adopted shall be carried out in accordance with the provisions of such plan unless the same shall be amended by the joint action of the executive director and the heads of agencies involved. The executive director shall report to the authority the details of any plan so adopted and all amendments or modifications thereof, and shall otherwise report to the authority and to the Public Procurement Review Board any failure on the part of any agency to carry out the provisions of such plan. In the event the head of any agency involved or the executive director shall propose amendments to a plan so adopted and such amendment is disapproved by the head of another agency involved or the executive director, an appeal may be taken to the authority which may, after full consideration thereof, order the adoption of the proposed amendment or any modification thereof. The executive director shall make decisions on all questions of the division of the cost of information technology operations among the several agencies, but his findings shall be subject to the approval or modification by the authority on appeal to it.
(e) He shall review all contracts for acquisition of computer and/or telecommunications equipment or services now or hereafter in force and may require the renegotiation, termination, amendment or execution of any such contracts in proper form and in accordance with the policies and rules and regulations and subject to the direction of the authority. In the negotiation and execution of such contracts, the executive director may negotiate a limitation on the liability to the state of prospective contractors provided such limitation affords the state reasonable protection and the limitation is approved by the state entity for whom the acquisition is being made.
(f) He shall act as the purchasing and contracting agent for the State of Mississippi in the negotiation and execution of all contracts for the acquisition of computer equipment or services. He shall receive, review, and promptly approve or disapprove all requests of agencies of the state for the acquisition of computer equipment or services, which are submitted in accordance with rules and regulations of the authority. In the event that any such request is disapproved, he shall immediately notify the requesting agency and the members of the authority in writing of such disapproval, stating his reasons therefor. The disapproval of any request by the executive director of the authority may be appealed to the authority or to the Public Procurement Review Board, respectively, in such manner as may be authorized by such reasonable rules and regulations hereby authorized to be adopted by the authority and by the Public Procurement Review Board to govern the same. The executive director shall report the approval of all such requests to the authority in such manner as may be directed by the authority, and shall execute any such contracts only after complying with rules and regulations which may be adopted by the authority in relation thereto. Any contracts for personal or professional services entered into by the executive director shall be exempted from the requirements of Section 25-9-120(3) relating to submission of such contract to the State Personal Service Contract Review Board.
(g) He shall suggest and cause to be brought about cooperation between the several state agencies, departments and institutions in order that work may be done by one agency for another agency, and equipment in one agency may be made available to another agency, and suggest and cause to be brought about such improvements as may be necessary in joint or cooperative information technology operations.
(h) He shall be designated as the "Chief Information Confidentiality Officer" after being duly sworn to the oath of this office by the chairman of the authority and shall be responsible for administering the oath to other qualified officers he may designate.
(i) He shall appoint employees of the Mississippi Department of Information Technology Services, or at his discretion, employees of other state agencies and institutions that are responsible for handling or processing data for any agency or institution other than that for which they are employed, to a position of information custodial care that shall be known as "Information Confidentiality Officer." The selection and swearing of all officers shall be reported to the authority at the next regular meeting and names, affirmation dates and employment dates shall be recorded in the permanent minutes of the authority.
SECTION 9. This act shall take effect and be in force from and after July 1, 2025.