Florida Administrative Code › 60 - DEPARTMENT OF MANAGEMENT SERVICES › 60GG - Florida Digital Service › Chapter 60GG-4 - CLOUD COMPUTING › Section 60GG-4.001 - Purpose and Applicability; Definitions

Current through Reg. 50, No. 138; July 16, 2024
(1) These rules apply to state agencies as
				defined in Section  282.0041, F.S.
(2) These rules are designed to further state
				agency implementation of the cloud-first policy as provided in Section
				 282.206, F.S., that requires
				state agencies to show a preference for cloud computing services that minimize
				or do not require the purchasing, financing, or leasing of state data center
				infrastructure when cloud-computing solutions meet the needs of the agency,
				reduce costs, and meet or exceed the applicable state and federal laws,
				regulations, and standards for information technology security.
(3) These rules establish the requirements
				for state agencies to create formal processes to provide a preference for and
				to properly evaluate cloud computing services during procurement while ensuring
				that state agencies have adequately addressed and demonstrated protections to
				ensure that systems provisioned in the cloud are appropriately secure and
				performant, appropriate to the workload and data hosted, and ultimately ensure
				the availability, integrity and confidentiality of state data and
				resources.
(4) Definitions:
(a) Breach - Has the same meaning as provided
				in Section  501.171, F.S.
(b) Cloud Computing - A service, solution or
				option as defined in Special Publication 800-145 issued by the National
				Institute for Standards and Technology (NIST).
(c) Cloud Service Provider - Person,
				organization, or entity responsible for making a cloud computing service,
				solution or option available to a consumer.
(d) Data - Has the same meaning as defined in
				Section 282.0041, Florida
				Statutes.
(e) Data Classification -
				The act of categorizing information systems and the information processed,
				stored, and transmitted by those systems based on the security impact analysis
				found under the risk assessment process outlined in Rule 60GG-2.002, F.A.C.,
				Information Security Categorization.
(f) Department of Management Services (DMS) -
				State agency created pursuant to Section
				 20.22, F.S., which includes the
				Florida Digital Service (FDS), responsible for operating the state data center
				and developing statewide information technology policy, among other
				functions.
(g) Information
				Technology - Has the same meaning as defined in Section
				 282.0041, Florida
				Statutes.
(h) Interoperability -
				The ability for two disparate information technology systems to exchange data
				in a coordinated manner and make use of the data exchanged.
(i) Managed Services - The delivery of
				information technology services, such as network, application, infrastructure
				and security, via continuous, regular management and support, to include active
				administration on the customer's premises, in the service provider's data
				center, or in a third-party data center.
(j) Open data - Has the same meaning as
				defined in Section 282.0041, F.S.
(k) Portability - The ease by which data or
				an information technology system can be extracted, transformed, and loaded from
				one computing environment to another.
(l) Service Level Agreement (SLA) - A
				component of an agreement between a cloud service provider and a customer. The
				SLA describes the IT service, documents service level requirements, and
				specifies the responsibilities of the cloud service provider and the
				customer.