63A-16-205. Rulemaking -- Policies.
(1) Except as provided in Subsection, the chief information officer shall, by rule made in accordance with: (2) Title 63G, Chapter 3, Utah Administrative Rulemaking Act establish standards that impose requirements on executive branch agencies related to the security of the statewide area network; establish standards for when an agency must obtain approval before obtaining items described in Subsection; 63G-6a-109.5(2) specify the detail and format required in an agency information technology plan submitted in accordance with Section; 63A-16-203 establish standards related to the privacy policies of websites operated by or on behalf of an executive branch agency; subject to Subsection, establish standards for the acquisition, licensing, and sale of computer software; 63G-6a-109.5(9) specify the requirements for the project plan and business case analysis required under Section; 63G-6a-109.5 provide for project oversight of agency technology projects when required under Section; 63G-6a-109.5 establish, in accordance with Subsection, the implementation of the needs assessment for information technology purchases; 63G-6a-109.5(3) establish telecommunications standards and specifications in accordance with Subsection; and 63G-6a-109.5(25) establish standards for accessibility of information technology by individuals with disabilities in accordance with Section. 63A-16-209 The rulemaking authority granted by Subsectionis in addition to any other rulemaking authority granted under this chapter. (1)(a)
(2) Notwithstanding, and subject to Subsection, the chief information officer may adopt a policy that outlines procedures to be followed by the chief information officer in facilitating the implementation of this title by executive branch agencies if the policy: Title 63G, Chapter 3, Utah Administrative Rulemaking Act (2)(b) is consistent with the executive branch strategic plan; and is not required to be made by rule under Subsectionor Section. (1) 63G-3-201 A policy adopted by the chief information officer under Subsectionmay not take effect until 30 days after the day on which the chief information officer submits the policy to: (2)(a) the governor; and all cabinet level officials. During the 30-day period described in Subsection, cabinet level officials may review and comment on a policy submitted under Subsection. (2)(b)(i) (2)(b)(i)
(3) Notwithstanding Subsectionoror, without following the procedures of Subsectionor, the chief information officer may adopt a security procedure to be followed by executive branch agencies to protect the statewide area network if: (1) (2) Title 63G, Chapter 3, Utah Administrative Rulemaking Act (1) (2) broad communication of the security procedure would create a significant potential for increasing the vulnerability of the statewide area network to breach or attack; and after consultation with the chief information officer, the governor agrees that broad communication of the security procedure would create a significant potential increase in the vulnerability of the statewide area network to breach or attack. A security procedure described in Subsectionis classified as a protected record under. (3)(a) Title 63G, Chapter 2, Government Records Access and Management Act The chief information officer shall provide a copy of the security procedure as a protected record to: the chief justice of the Utah Supreme Court for the judicial branch; the speaker of the House of Representatives and the president of the Senate for the legislative branch; the chair of the Utah Board of Higher Education; and the chair of the State Board of Education.