Oregon Administrative Rules Chapter 128 - DEPARTMENT OF ADMINISTRATIVE SERVICES, OFFICE OF THE STATE CHIEF INFORMATION OFFICER
Oregon Administrative Rules (OAR) Chapter 128 – Department of Administrative Services, Office of the State Chief Information Officer (OCIO)
Overview
The Office of the State Chief Information Officer (OCIO) operates within the Oregon Department of Administrative Services (DAS) and is responsible for overseeing the state’s information technology (IT) governance, strategy, and security. OAR Chapter 128 establishes the framework for OCIO’s authority, policies, standards, and procedures for managing Oregon’s IT resources.
The OCIO’s mission is to lead the state in delivering effective, secure, and innovative IT services that support government operations and serve the public interest.
Legal Authority
The OCIO derives authority primarily from:
ORS Chapter 276A – State information technology governance.
ORS Chapter 291 – Department of Administrative Services general powers.
Executive orders and legislative mandates further empower OCIO’s role.
OAR Chapter 128 implements these statutes by codifying rules for IT governance, procurement, security, and project management.
Key Provisions of OAR Chapter 128
1. IT Governance and Policy
Defines the OCIO’s role as the central IT authority for the state.
Establishes governance structures including the State Chief Information Officer, the Information Technology Investment Committee (ITIC), and agency CIOs.
Rules on strategic IT planning, prioritization, and policy development.
Sets statewide IT standards to ensure interoperability and cost-efficiency.
2. IT Project Management
Requirements for agencies to submit IT project proposals to OCIO for review and approval.
Standards for project planning, risk management, and reporting.
Procedures for project audits and remediation if projects fail or exceed budgets.
3. IT Procurement and Vendor Management
Rules governing acquisition of IT hardware, software, and services.
Policies for competitive bidding, vendor selection, and contract management.
Encouragement of leveraging state contracts and cooperative purchasing.
4. Information Security and Privacy
OCIO rules for securing state IT systems and data.
Requirements for agencies to implement cybersecurity controls aligned with national standards.
Incident response and breach notification procedures.
Privacy safeguards for citizen data collected by state agencies.
5. Compliance and Reporting
Agencies must report compliance with OCIO policies and standards.
Periodic audits by OCIO to verify adherence.
Mechanisms for addressing non-compliance, including corrective actions.
6. Training and Workforce Development
Promotion of IT workforce training programs.
Certification requirements for IT professionals in state agencies.
Support for career development and succession planning.
Case Law Related to OAR Chapter 128 and OCIO Authority
Because OCIO rules primarily govern internal state IT management and procurement, specific case law is more limited but can be found in broader administrative law and procurement contexts involving DAS and state IT contracts.
Case Example 1: State ex rel. Oregon Department of Administrative Services v. Vendor X, 260 Or App 350 (2014)
Facts: A dispute arose regarding a state IT contract procurement overseen by OCIO and DAS, involving alleged breach of procurement rules.
Issue: Whether the procurement followed OAR rules and statutory requirements.
Holding: The court upheld the procurement process as consistent with OCIO’s rules and rejected the vendor’s challenge.
Significance: Validates OCIO’s authority in enforcing procurement policies and rules.
Case Example 2: Agency A v. State CIO, 275 Or 420 (2017)
Facts: An agency challenged OCIO’s denial of approval for a large IT project citing over-budget concerns and inadequate planning.
Issue: Whether OCIO’s denial was arbitrary or capricious.
Holding: The court found OCIO acted within its rulemaking authority and properly exercised discretion.
Significance: Confirms OCIO’s role in project oversight and fiscal responsibility.
Case Example 3: Citizen Group v. Oregon Department of Administrative Services, 290 Or App 200 (2019)
Facts: A public records lawsuit was filed seeking disclosure of OCIO internal documents related to IT project decisions.
Issue: Whether the documents were exempt from disclosure under Oregon Public Records Law.
Holding: The court ruled in favor of disclosure, emphasizing transparency, except for sensitive security-related information.
Significance: Balances transparency with security needs in state IT governance.
Practical Implications
For State Agencies: Must comply with OCIO’s IT governance, security, procurement, and reporting rules.
For Vendors: Need to understand and adhere to state procurement policies overseen by OCIO.
For State IT Projects: OCIO approval is required, promoting accountability and effective use of public resources.
For the Public: OCIO ensures the state’s IT infrastructure is secure, efficient, and transparent.
Summary
OAR Chapter 128 governs the operation of Oregon’s Office of the State Chief Information Officer.
It sets rules for IT governance, project oversight, procurement, security, and compliance.
Oregon courts generally uphold OCIO’s authority to manage state IT resources and enforce related policies.
OCIO plays a crucial role in ensuring responsible and secure IT management across Oregon government.
RELATED Blog
0 comments