STATE OF CALIFORNIA Budget Change Proposal DF-46 (REV 08/17)

Cover Sheet

Fiscal Year Business Unit Department Priority No. 2019-20 3560 State Lands Commission

Budget Request Name Program Subprogram 3560-003-BCP-2019-GB 9900100-ADMINISTRATION

Budget Request Description Critical Business Technology Needs

Budget Request Summary The State Lands Commission requests $525,000 and 1.0 permanent position in Fiscal Year 2019-20 and $320,000 ongoing. This request addresses critical business technology needs to efficiently and effectively manage the Commission's information technology assets, as well as increased workload resulting from the redirection of technical staff to address legislative mandates and Agency policies.

This request includes funding and resources to address the unmet Internet Technology (IT) burden resulting from myriad new mandates and policies. These include addressing mission-critical legal e-discovery and Public Records Act (PRA) requirements and volume, replacing labor-intensive financial reporting with new systems and processes, and meeting the demands of new control agency requirements, such as CalHR's new reporting mandates, the California Department of Technology's Project Approval Lifecycle, and statewide "Cloud First" IT initiatives.

Requires Legislation

• Yes No

Code Section(s) to be Added/Amended/Repealed

Does this BCP contain information technology (IT) components? O Yes ^ No

If yes, departmental Chief Information Officer must sign.

Department CIO Date

For IT requests, specify the project number, the most recent project approval document (FSR, SPR, S i BA, S2AA, S3SD, S4PRA), and the approval date.

Project No. Project Approval Document: Approval Date:

If proposal affects another department, does other department concur with proposal? • Yes • No Attach comments of affected department, signed and dated by the department director or designee.

Prepared By Date Reviewed By Date

Rosemary Mulligan, Chief, ISD Denise Cook, Chief, ASD Department Director Date Agency Secretary Date

Jennifer Lucchesi, Exec Officer Bryan Cash, Asst. Secretary Department of Finance Use Only 1

Additional Review: • Capital Outlay • ITCU • FSCU • OSAE • CALSTARS • Dept. of Technology

PPBA Original Signed By Sergio Aguilar

Date submitted to the Legislature

JAN t 0 2Qt9

Analysis of Problem

A. Budget Request Summary

The State Lands Commission (Commission) requests $525,000 and 1.0 permanent position in Fiscal Year (FY) 2019-20 and $320,000 ongoing. This request addresses critical business technology needs to efficiently and effectively manage the Commission's information technology (IT) assets, as well as increased workload resulting from the redirection of technical staff to address legislative mandates and Agency policies.

This request includes funding and resources to address the unmet IT burden resulting from myriad new mandates and policies. These include addressing mission-critical legal e-discovery and PRA requirements and volume, replacing labor-intensive financial reporting with new systems and processes, and meeting the demands of new control agency requirements, such as CalHR's new reporting mandates, the California Department of Technology's (CDT) Project Approval Lifecycle, and statewide "Cloud First" IT initiatives.

Due to the many technology changes and requirements over the past several years, the Commission has redirected multiple positions to the Information Services Division (ISD) to address new technology software applications and address previously identified vulnerabilities by the military and Department of Technology (CDT). Any further redirection of program staff would negatively impact revenue producing and mandated program activities. In addition, the Information Services Division (ISD) must continue to focus on meeting, and supporting, the Commission's most critical technical programmatic demands. This is accomplished by diverting technical staff from other priority duties, which are detailed below. It has become apparent that the current level of IT staffing and funding is insufficient to meet the changing Commission technical environment and continue secure information service operations, including properly maintaining network systems and applications.

B. Background/History

The Commission protects the lands and resources entrusted to its care through balanced management, marine protection and pollution prevention, adaptation to climate change, and ensuring public access to lands and waters for current and future generations.

Established in 1938, the Commission manages 4 million acres of tide and submerged lands and the beds of navigable rivers, streams, lakes, bays, estuaries, inlets, and straits. These lands, often referred to as sovereign or Public Trust lands, stretch from the Klamath River and Goose Lake in the north to the Tijuana Estuary in the south, and from the Pacific Coast 3 miles offshore in the west to world-famous Lake Tahoe and the Colorado River in the east, and includes California's two longest rivers, the Sacramento and San Joaquin. The Commission also manages about 458,000 acres of school lands held in fee ownership and the reserved mineral interests on about 790,000 acres where the surface land was sold. These lands are predominantly in the deserts in the southeast and the forested areas of the northeast portions of California.

In support of these activities, ISD focuses on meeting the Commission's most critical technical programmatic demands. However, years of position redirections to meet other priorities have left ISD unable to support the growing demands of the Commission. Below are areas of concern:

• ISD is unable to convert or support legacy, risk-prone databases using a current technology stack (cloud services), including the ALID Database (Access 97) and Reimbursement Log Database (Access 2000). These databases consistently error out and crash two to three times a month. This requires 325 annual hours of technical staff time to remediate. After staff reprogram these databases using current cloud resources (a one-time effort of 100 hours), it is estimated that the databases require 350 hours of annual ongoing support hours.

• ISD has been unable to implement and fund the expansion of an existing Log Management/Analysis Tool (Solar Winds) and does not currently manage system and application logs (as required by the State), which is critical to ensuring that systems are functioning correctly and not compromised. Capturing, reviewing, and analyzing computer-generated, data-logged records assists with system troubleshooting, systems compliance with polices, forensics, incident response, and understanding of user behavior and productivity.

l:\Unit\BCP\2018-19 BCPs\DF-46_Cover_Sheet_August 2017.doc

A n a l y s i s of P r o b l e m

Performing this task and remediating any uncovered issues will require an estimated 680 hours of staff time.

• ISD has not had the staffing to prevent users from being locked out of their computers. For the past six months, users have been locked out of their computers by malicious access attempts. A work around is in place, but a permanent solution is needed and must be maintained to ensure that users can access their computers and the Commission network. ISD does not have a current Business Continuity and Disaster Recovery Management Plan, which would detail a strategy to strengthen and monitor privacy controls, harden servers, and implement network controls. Specific tasks include firewall management, cleaning up inactive accounts, removing Transport Layer Security (TLS; a commonly-used but outdated communication protocol that leaves the Commission vulnerable to attack), and upgrading unsupported and deprecated server unsupported software (for example. Access 97 and 2000). These ongoing tasks require 1,315 hours of annual staff time.

Resource History (Dollars in thousands)

Commiss ion Budget 2013-14 2014-15 2015-16 2016-17 2017-18

Authorized Expenditures 32,771 33,839 34,970 39,618 51,082 Actual Expenditures 28,843 30,030 32,885 36,445 46,687 Revenues 486,553 269,753 97,641 116,715 105,330 Authorized Positions 229 231 231 232 232 Filled Positions 208.8 222.8 208.6 208.1 198.8 Vacancies 20.2 8.2 22.4 23.9 33.2

C. state Level Considerations The responsibility of the Information Services Division is found in the Commission's strategic plan, under Goal 4.0 to cultivate operational excellence by integrating technology, Strategies 4.1 through 4.5.

4.1 Implement richer technologies and business processes

4.2 Extend GIS content management and capabilities

4.3 Implement an automated electronic data management system

4.4 Deliver enhancement information technology (IT) tools, services and applications

4.5 Deliver secure and available IT services

D. Justification

To carry forth the commitments set forth in the Commission's Strategic Plan, ISD requires additional financial and staff support.

The information provided above reflects the results of redirecting basic network responsibilities, including the inability to meet strategic objectives, the loss of staff productivity, the likelihood that ISD would not know if the network was under attack for months, and the possibility of more applications becoming unsupported and crashing.

The resources requested in this proposal will allow the Commission to address the increased business-related information technology workload and allow the Commission to stay in compliance with a host of federal, state, and agency policies. Considering the many technology changes and requirements since FY 2013-14, the Commission has redirected six program positions into ISD to address many new technology software applications and previously identified vulnerabilities by the military and CDT. Any further redirection of program staff would negatively impact revenue producing and mandated program activities. In addition, ISD must continue to focus on meeting, and supporting, the Commission's most critical technical programmatic demands. This is accomplished by diverting technical staff from other priority duties. It has become apparent that the current level of IT staffing and funding is insufficient to

l:\Unit\BCP\2018-19 BCPs\DF-46_Cover_Sheet_August 2017.doc

Analysis of Problem

meet the changing Commission technical environment and to continue secure information service operations, including properly maintaining network systems and applications.

Over the past 18 months, ISD has reacted to changing business requirements by diverting staff to address the following critical business technology needs:

a. Credit Card Payment System:

The contract and software application went unsupported by ISD for several years. As a result, the software fell several versions behind, failed, and was no longer supported by the vendor. For six months, the public was unable to pay for lease renewals via credit card, until ISD shifted focus to research and implement a new payment card solution.

Staff time to resolve: Approximately 220 hours.

b. Litigation Software:

The Commission's Legal Division uses ZyLAB litigation support software to provide an array of critical legal functions including:

• Initiating and monitoring compliance with legal holds

• Preparing (uploading, deduplicating, reviewing, redacting, labeling, and producing) electronic documents efficiently with few technical and legal staff resources

The lack of funding to purchase, maintain, and support ZyLAB led to a recent failure that prohibited legal staff from accessing the software application, resulting is a lengthy delay to produce legal documentation for pending litigation. Consequently, the Commission is now requesting a one-time budget augmentation of $75,000 to relocate the software application from locally hosted servers to the cloud to meet the State's "Cloud First" policy mandate; this will also provide a more stable, comprehensive, and vendor-supported environment for the application to reside within. The licensing and ZyLAB subscription fees are estimated at $35,000 per year thereafter. Funding for the ZyLAB cloud solution will also allow the Commission to initiate the planning process to re-architect the e-discovery process to fit the Commission's current technical environment and decommission antiquated hardware and software used to search and index the Commission's data on the file server.

The request to fund the Commission's litigation software will allow ISD to maintain a host of critical activities necessary to initiate and monitor compliance with legal holds and to meet the federal and state laws, requirements, standards, and guidelines that comprise an effective information technology environment.

ISD is unable to consistently manage the maintenance and operation components of the ZyLAB contract or software. The litigation solution must be rearchitected to fit the Commission's new technical environment—specifically, moving to ZyLAB's cloud solution and decommissioning antiquated searching and indexing tools. (The current process uses an external redundant array of independent disks that is over 15 years old and has an average life expectancy 7 to 10 years.) The average ongoing annual staff time required to support and resolve litigation software issues is approximately 500 to 600 hours annually. Staff intends to use partial funding from this request to migrate to a cloud Software-as-a-Service solution, reducing current annual support hours by approximately 100 hours and reducing annual expenditures from $75,000 to $35,000. Supporting the ZyLAB cloud solution will require an estimated 172 annual hours.

c. Human Resources Comprehensive End to End Service Solution:

Human Resources is responsible for providing holistic services relating to training, hiring, separating, benefits, and other common HR functions. To meet the increasing mandates, a comprehensive solution to manage HR functions is desperately needed.

For example, CalHR has created a new Statewide Leadership Development Model that establishes a consistent and comprehensive framework for progressively developing state leaders in accordance with Government Code section 19995.4. Training periods must be tracked on a rolling calendar basis, which means that each employee in a leadership role has a different two-year period in which to complete their mandatory training. The Commission's

l:\Unit\BCP\2018-19 BCPs\DF-46_Cover_Sheet_August 2017.doc

Analysis of Problem

current training database cannot provide reports indicating which employees have or have not met this requirement, so the Human Resources office currently maintains an Access database to document completed training. This tool will not meet the needs of the new training requirements on a per-employee, rolling-calendar basis, and tracking these requirements manually is an unwieldy and time-consuming process ripe for automation. CalHR was aware of the complexity of tracking these new requirements, and two Learning Management System vendors have been identified that will allow the Commission to generate reports and track other existing training requirements. This system will negate the need to redirect staff away from other critical HR functions to meet this new CalHR mandate.

The cost estimate to hire a consultant to assist in configuring a comprehensive Human Resources solution, in the Commission's existing SharePoint environment, is a one-time cost of $55,000. The approximate annual hours to support the HR SharePoint solution is 300 hours to make changes to the workflow as requirements and mandates change. The solution will enable staff to track the progress of requests and create a central, electronic system.

d. Statewide Leasing Information Center (SLIC) Accela Database

The Commission's State Lease Information Center (SLIC) database currently uses a one-off platform (Accela) that does not integrate with the Commission's developing enterprise environment. Currently, ISD staff spend over 825 annual hours supporting SLIC to maintain and support the database. The one-off Accela solution has proven difficult to enhance, due to the Lease Management Program's unique business needs and the platform's difficulties integrating with Microsoft (MS) products, including MS Dynamics and Power Bl.

In July 2019, SLIC will become a part of the Spatially Indexed Records Management System (SIRMS). To compliment SIRMS, additional MS Dynamics licenses are required to centralize the lease data in SLIC. MS Dynamics will seamlessly provide analytical reports, allowing for intelligent business decisions, facilitating communications, and cutting down on response time to lessees and other stakeholders. Staff estimates that MS Dynamics will reduce the number of staff hours spent on SLIB by 45 percent to 50 percent. The Commission is requesting $45,000 for annual MS Dynamics licensing costs.

e. Microsoft Premier Technical Support Contract

The Commission redirected funds last year to allow ISD to purchase, on a pilot basis, a MS Premier support service for $64,000. Over the last seven years, the Commission has become a predominantly Microsoft shop, even migrating to Azure cloud services. Approximately 17 months ago, it became apparent that specialized Microsoft engineering assistance was critical to keeping the Commission's network functioning. As a test, ISD purchased MS Premier services to assist with network issues. The contract has proven invaluable, and ISD believes that this is now an essential service to assist technical staff with Tier II and Tier III service disruptions and technical environment changes.

For example, during the process of migrating to a central active directory, a Microsoft glitch deleted the Commission's entire directory, stopping all email traffic. It took a team of MS engineers, plus three technical Commission staff, two and half weeks to identify and resolve the issue. Without access to the MS Premier service, ISD would have had to hire a consultant, paying the same amount to resolve one problem as the annual service agreement with MS

• Premier costs. ISD uses this service, on average, one time per month, with the Commission receiving quick and efficient service from the experts who are knowledgeable of its technical environment.

f. Increased IT Workload

In addition to the above licensing and software costs, the Commission requests ongoing funding for 1.0 permanent position to address increased business-related information technology workload. The primary responsibility of this position is to help ISD stay in compliance with a host of federal, state, and agency policies. Given the many technology changes and requirements over the last several years, the Commission has redirected several program positions to ISD. Further redirection to address the many new and increased technology support assets and

l;\Unit\BCP\2018-19 BCPs\DF-46_Cover_Sheet_August 2017.doc

Analysis of Problem

identified vulnerabilities is simply not an option. Any further redirection would negatively impact revenue-producing and mandated program activities. To maintain a secure and reliable computing environment, additional staff and resources are necessary.

Specifically, the requested position would develop and maintain a Business Continuity and Disaster Recovery Management Plan, strengthen and monitor privacy controls, harden existing servers, and implement network controls, to include firewall management, clean-up of inactive accounts, the removal of TLS, and upgrades to all unsupported and deprecated server software (Access 97 and 2000).

E. Outcomes and Accountability

The resources requested in this proposal will enable ISD to meet the growing IT demands of the Commission and build a technologically-sound foundation, in line with the 2016-2020 Strategic Plan's

. . charge to "cultivate operational excellence by integrating technology." If this proposal is approved as requested, the Commission will be able to meet currently unmet IT security and infrastructure demands and implement increasingly efficient business processes and solutions.

F. Analysis of All Feasible Alternatives

Alternative 1: Fund as Requested. Approve $525,000 and 1.0 permanent position in FY 2019-20 and $320,000 ongoing to support ongoing critical technology needs. These resources will be used to update outdated systems, migrate others to the cloud, and enter into new agreements, all with the intent of streamlining Commission business processes. Further, the staff augmentation will address both a current shortfall in staff time and allow previously redirected resources to be utilized in their intended specialty areas.

Alternative 2: Redirect Existing Resources. Over the past several years, the Commission has internally-redirected six positions to ISD since FY 2013-14, doubling the staff and exhausting vacant positions in other program areas. The Commission's limited budget cannot sustain this redirection and also meet the increasing number and complexity of technology mandates across the state.

Alternative 3: Do Nothing. Without the resources requested in this proposal, the Commission will be forced to abandon or cut back critical technology services and projects, negatively impacting the Commission's ability to serve the public and meet its statutory mandates.

G. Implementation Plan

Upon approval, ISD will follow the technology roadmap and implementation plan, which dictates the following tasks: re-architecting and moving the litigation support tools to the cloud; hiring a SharePoint contractor to assist in creating workflows for the majority of HR tasks; purchasing additional licenses and implementing MS Dynamics and Power Bl for the Leasing Management Division; and increasing the level of work on the technology Plan of Action with Milestones (POAM) reported to the CDT. The POAM includes log management, server hardening, and disaster recovery, among other tasks.

H. Supplemental Information

None.

I. Recommendation

The Commission recommends Alternative 1: Approve $525,000 and 1.0 permanent position in FY 2019-20, plus $320,000 ongoing, to address critical technology needs.

l;\Unit\BCP\2018-19 BCPs\DF-46_Cover_Sheet_August 2017.doc

BCP Title: Critical Business Technology Needs

Budget R e q u e s t Summary

Personal Services Positions - Permanent

Total Positions

Salaries and Wages Earnings - Permanent

Total Salaries and Wages

Total Staff Benefits Total Personal Services

Operating Expenses and Equipment 5301 - General Expense 5302 - Printing 5306 - Postage 5320 - Travel: in-State 5322 - Training 5324 - Faciiities Operation 5340 - Consulting and Professional Services -5344 - Consolidated Data Centers 5346 - information Technoiogy

Total Operating Expenses and Equipment

Total Budget Request

Fund Summary Fund Source - State Operations

0001 - Generai Fund 0212 - Marine Invasive Species Control Fund 0320 - Oil Spill Prevention and Administration 0347 - School Land Bank Fund

Total State Operations Expenditures

Total All Funds

Program Summary Program Funding

2570 - Marine Environmental Protection Division 2560010 - Mineral Resources Management - State 2565019 - Land Management 9900100 - Administration 9900200 - Administration - Distributed

Total All Programs

B C P Fiscal Detail Sheet BR Name: 3560-003-BCP-2019-GB

FY19 CY BY BY+1 BY+2 BY+3 BY+4

0.0 1.0 1.0 1.0 1.0 1.0 0.0 1.0 1.0 1.0 1.0 1.0

0 80 80 80 80 80 $0 $80 $80 $80 $80 $80

0 44 44 44 44 44 $0 $124 $124 $124 $124 $124

0 10 5 5 5 5 0 2 2 2 2 2 0 1 1 1 1 1 0 2 2 2 2 2 0 1 1 1 1 1 0 7 7 7 7 7 0 369 169 169 169 169 0 2 2 2 2 2 0 7 7 7 7 7

$0 $401 $196 $196 $196 $196

$0 $525 $320 $320 $320 $320

0 231 141 141 141 141 0 52 32 32 32 32 0 210 127 127 127 127 0 32 20 20 20 20

$0 $525 $320 $320 $320 $320

$0 $525 $320 $320 $320 $320

0 178 108 108 108 108 0 173 106 106 106 106 0 174 106 106 106 106 0 525 320 320 320 320 0 -525 -320 -320 -320 -320

$0 $525 $320 $320 $320 $320

BCP Title: Critical Business Technoiogy Needs BR Name: 3560-003-BCP-2019-GB

Personal Services Details

Salary Information Positions Min Mid Max CY BY BY+1 BY+2 BY+3 BY+4

1402 - Info Tech Spec 1 0.0 1.0 1.0 1.0 1.0 1.0

Total Positions 0.0 1.0 1.0 1.0 1.0 1.0

Salaries and Wages CY BY BY+1 BY+2 BY+3 BY+4

1402 - Info Tech Spec 1 0 80 80 80 80 80 Total Salaries and Wages $0 $80 $80 $80 $80 $80

Staff Benefits 5150350 - Health Insurance 0 14 14 14 14 14 5150500 - OASDI 0 6 6 6 6 6 5150600 - Retirement - General 0 24 24 24 24 24

Total Staff Benefits $0 $44 $44 $44 $44 $44 Total Personal Services $0 $124 $124 $124 $124 $124