North Carolina § 143B-1350 - Procurement of information technology.

§ 143B-1350. Procurement of information technology.

The State CIO is responsible for establishing policies and procedures for information technology procurement for State agencies. The Department shall review all procurements to ensure they meet current technology standards, are not duplicative, meet business objectives, are cost-effective, and are adequately funded. G.S. 143-135.9 shall apply to information technology procurements. The Department shall, subject to the provisions of this Part, do all of the following with respect to State information technology procurement: Purchase or contract for all information technology for participating State agencies. Approve all technology purchases for separate agencies. Establish standardized, consistent processes, specifications, and standards that shall apply to all information technology to be purchased, licensed, or leased by State agencies and relating to information technology personal services contract requirements for State agencies. Establish procedures to permit State agencies and local government entities to use the General Services Administration (GSA) Cooperative Purchasing Program to purchase information technology (i) awarded under GSA Supply Schedule 70 Information Technology and (ii) from contracts under the GSA's Consolidated Schedule containing information technology special item numbers. Establish procedures to permit State agencies and local government entities to use multiple award schedule contracts and other cooperative purchasing agreements. Comply with the State government-wide technical architecture, as required by the State CIO. Utilize the purchasing benchmarks established by the Secretary of Administration pursuant to G.S. 143-53.1. Provide strategic sourcing resources and detailed, documented planning to compile and consolidate all estimates of information technology goods and services needed and required by State agencies. Develop a process to provide a question and answer period for vendors prior to procurements. Each State agency shall furnish to the State CIO when requested, and on forms as prescribed, estimates of and budgets for all information technology goods and services needed and required by such department, institution, or agency for such periods in advance as may be designated by the State CIO. When requested, all State agencies shall provide to the State CIO on forms as prescribed, actual expenditures for all goods and services needed and required by the department, institution, or agency for such periods after the expenditures have been made as may be designated by the State CIO. Confidentiality. - Contract information compiled by the Department shall be made a matter of public record after the award of contract. Trade secrets, test data, similar proprietary information, and security information protected under G.S. 132-6.1(c) or other law shall remain confidential. Electronic Procurement. - The State CIO may authorize the use of the electronic procurement system established by G.S. 143-48.3, or other systems, to conduct reverse auctions and electronic bidding. For purposes of this Part, "reverse auction" means a real-time purchasing process in which vendors compete to provide goods or services at the lowest selling price in an open and interactive electronic environment. The vendor's price may be revealed during the reverse auction. The Department may contract with a third-party vendor to conduct the reverse auction. "Electronic bidding" means the electronic solicitation and receipt of offers to contract. Offers may be accepted and contracts may be entered by use of electronic bidding. All requirements relating to formal and competitive bids, including advertisement, seal, and signature, are satisfied when a procurement is conducted or a contract is entered in compliance with the reverse auction or electronic bidding requirements established by the Department. Multiple-Award Schedule Contracts. - The procurement of information technology may be conducted using multiple award schedule contracts. Contracts awarded under this subsection shall be periodically updated as directed by the State CIO to include the addition or deletion of particular vendors, goods, services, or pricing. The State CIO shall establish efficient, responsive procedures for the procurement of information technology. The procedures may include aggregation of hardware purchases, the use of formal bid procedures, restrictions on supplemental staffing, enterprise software licensing, hosting, and multiyear maintenance agreements. The State CIO may require agencies to submit information technology procurement requests on a regularly occurring schedule each fiscal year in order to allow for bulk purchasing. All offers to contract, whether through competitive bidding or other procurement method, shall be subject to evaluation and selection by acceptance of the most advantageous offer to the State. Evaluation shall include best value, as the term is defined in G.S. 143-135.9(a)(1), compliance with information technology project management policies, compliance with information technology security standards and policies, substantial conformity with the specifications, and other conditions set forth in the solicitation. All contracts subject to the provisions of this Part shall include a limitation on the contractor's liability to the State for damages. Except as otherwise provided in this subsection, the limitation of liability shall be for damages arising from any cause whatsoever, regardless of the form of action. The amount of liability shall be determined based on the nature of the goods or services covered by the contract; however, there shall be a presumptive limitation of no more than two times the value of the contract. Limitation of liability pursuant to this subsection shall specifically include, but not be limited to, the contractor's liability for damages and any other losses relating to the loss of, unauthorized access to, or unauthorized disclosure of data. The State CIO completes a risk assessment prior to the bid solicitation or request for proposal. The risk assessment determines that an increase in the liability amount is necessary to protect the State's best interests. The bid solicitation or request for proposal indicates that increased liability will be required for the resulting contract. Exceptions. - In addition to permitted waivers of competition, the requirements of competitive bidding shall not apply to information technology contracts and procurements: In cases of pressing need or emergency arising from a security incident. In the use of master licensing or purchasing agreements governing the Department's acquisition of proprietary intellectual property. In the procurement of cybersecurity and infrastructure security products, consistent with Best Value procurement principles as provided in G.S. 143-135.9. Information Technology Innovation Center. - The Department may operate a State Information Technology Innovation Center (iCenter) to develop and demonstrate technology solutions with potential benefit to the State and its citizens. The iCenter may facilitate the piloting of potential solutions to State technology requirements. In operating the iCenter, the State CIO shall ensure that all State laws, rules, and policies are followed. No contract subject to the provisions of this Part may be entered into unless the contractor and the contractor's subcontractors comply with the requirements of Article 2 of Chapter 64 of the General Statutes. Notwithstanding any other provision of law, the Department shall procure all information technology goods and services for participating agencies and shall approve information technology procurements for separate agencies. The State CIO may cancel or suspend any agency information technology procurement that occurs without State CIO approval. The amount of liability for damages and any other losses relating to the loss of, unauthorized access to, or unauthorized disclosure of data may be raised to no more than three times the value of the contract if all of the following apply: The State CIO shall report annually to the Joint Legislative Commission on Governmental Operations and the Joint Legislative Oversight Committee on Information Technology no later than March 1 regarding the contracts containing liability amounts of more than two times the value of the contract. Prior to entering into any contract subject to the provisions of this Part, the Department or the separate agency, as applicable, shall reasonably determine that the contractor possesses sufficient financial resources, either independently or through third-party sources, such as insurance, to satisfy the agreed upon limitation of liability. The limitation of liability required by this subsection shall not apply to liability of the contractor for intentional or willful misconduct, damage to tangible personal property, physical injuries to persons, or any notification costs resulting from compliance with G.S. 132-1.10(c1). Nothing in this subsection (i) limits the contractor's liability directly to third parties or (ii) affects the rights and obligations related to contribution among joint tortfeasors established by Chapter 1B of the General Statutes and other applicable law. Any exceptions shall immediately be reported to the Joint Legislative Oversight Committee on Information Technology and the Fiscal Research Division. Vendor participation in the iCenter shall not be construed to (i) create any type of preferred status for vendors or (ii) abrogate the requirement that agency and statewide requirements for information technology support, including those of the Department, are awarded based on a competitive process that follows information technology procurement guidelines. History (2015-241, s. 7A.2(b); 2015-268, ss. 2.14, 2.20; 2016-85, s. 1; 2019-200, s. 1; 2020-78, s. 19.2(a).) Editor's Note. - Session Laws 2015-241, s. 7A.2(b), enacted this section as G.S. 143B-1323. The section has been renumbered as G.S. 143B-1350 at the direction of the Revisor of Statutes. Session Laws 2011-145, s. 6A.2(e), provides: "Three-Year Contracts. - Notwithstanding the cash management provisions of G.S. 147-86.11 , the Office of Information Technology Services may procure information technology goods and services for periods of up to a total of three years where the terms of the procurement contract require payment of all, or a portion, of the contract price at the beginning of the contract agreement. All of the following conditions shall be met before payment for these agreements may be disbursed: "(1) Any advance payment can be accomplished within the Information Technology Internal Service Fund budget. "(2) The State Controller receives conclusive evidence that the proposed agreement would be more cost-effective than a multiyear agreement that complies with G.S. 147-86.11 . "(3) The procurement complies in all other aspects with applicable statutes and rules. "(4) The proposed agreement contains contract terms that protect the financial interest of the State against contractor nonperformance or insolvency through the creation of escrow accounts for funds, source codes, or both, or by any other reasonable means that have legally binding effect. "The Office of State Budget and Management shall ensure the savings from any authorized agreement shall be included in the Information Technology Internal Service Fund rate calculations before the Office of State Budget and Management annually approves proposed rates. Any savings resulting from the agreements shall be returned to agencies included in the contract in the form of reduced rates. The Office of Information Technology Services shall submit a quarterly written report to the Office of State Budget and Management on any State agency budget impacts resulting from multiyear contracts. Under no circumstances shall multiyear contracts result in rate increases for participating agencies. The Office of Information Technology Services shall submit a quarterly written report of any authorizations granted under this section to the Joint Legislative Oversight Committee on Information Technology and the Fiscal Research Division of the North Carolina General Assembly." For prior similar provisions, see Session Laws 2009-451, s. 6.14A(b). Session Laws 2011-145, s. 1.1, provides: "This act shall be known as the 'Current Operations and Capital Improvements Appropriations Act of 2011.'" Session Laws 2011-145, s. 32.2, provides: "Except for statutory changes or other provisions that clearly indicate an intention to have effects beyond the 2011-2013 fiscal biennium, the textual provisions of this act apply only to funds appropriated for, and activities occurring during, the 2011-2013 fiscal biennium." Session Laws 2011-145, s. 32.5, is a severability clause. Session Laws 2013-360, s. 7.5, provides: "Statewide information technology procurement shall be funded through fees charged to agencies using the services of the Statewide Information Technology Procurement Office. The Office of the State Chief Information Officer (CIO) shall provide to the Office of State Budget and Management (OSBM) a fee schedule to allow cost recovery. If an agency fails to pay for services within 30 days of billing, OSBM shall transfer the unpaid amount to the State Information Technology Procurement Office, following notification of the affected agency." Session Laws 2013-360, s. 7.7(a)-(c), provides: "(a) SCIO Review. - The State Chief Information Officer (State CIO) shall review all State information technology (IT) contracts and shall develop a plan to consolidate duplicate IT contracts and multiple IT contracts with the same vendor. "(b) Bulk Purchasing. - The State CIO shall develop a plan to modify bulk purchasing contracts, while maintaining economies of scale, to provide agencies with the option of purchasing equipment on an 'as-needed' basis. By December 15, 2013, the State CIO shall provide the plan to the Joint Legislative Oversight Committee on Information Technology and the Fiscal Research Division. The State CIO may modify the plan based upon input from the Joint Legislative Oversight Committee on Information Technology and, following the review, shall begin implementation of the plan. "(c) Sole Sourcing, Extensions, and Expansions Limited. - State IT contracts, including sole sourcing, extensions of the period of performance, or expansion of the scope of existing contracts, must receive the prior approval of the State CIO who may grant a specific exception. The State CIO shall immediately report any exceptions granted to the Joint Legislative Oversight Committee on Information Technology and the Fiscal Research Division. The report shall explain the reasons why the exception was deemed to be appropriate." Session Laws 2013-360, s. 7.7(e), (f), provides: "(e) Enterprise Contracts. - The State CIO shall consult participating agency chief information officers and obtain approval from the Office of State Budget and Management prior to the initiation of any enterprise project or contract and shall ensure that enterprise project and contract costs are allocated to participating agencies in an equitable manner. Enterprise agreements shall not exceed the participating State agencies' ability to financially support the contracts. "The State CIO shall not enter into any enterprise information technology contracts without obtaining written agreements from participating State agencies regarding the apportionment of the contract cost. State agencies agreeing to participate in a contract shall: "(1) Ensure that sufficient funds are budgeted to support their agreed shares of enterprise contracts throughout the life of the contract. "(2) Transfer the required funding to the Information Technology Internal Service Fund in sufficient time for the Office of Information Technology Services to meet vendor contract requirements. "(f) Three-Year Contracts. - Notwithstanding the cash management provisions of G.S. 147-86.11 , the Office of Information Technology Services may procure information technology goods and services for periods up to a total of three years where the terms of the procurement contracts require payment of all or a portion of the contract price at the beginning of the contract agreement. All of the following conditions shall be met before payment for these agreements may be disbursed: "(1) Any advance payment can be accomplished within the IT Internal Service Fund budget. "(2) The State Controller receives conclusive evidence that the proposed agreement would be more cost-effective than a multiyear agreement that complies with G.S. 147-86.11 . "(3) The procurement complies in all other aspects with applicable statutes and rules. "(4) The proposed agreement contains contract terms that protect the financial interest of the State against contractor nonperformance or insolvency through the creation of escrow accounts for funds, source codes, or both, or by any other reasonable means that have legally binding effect. "The Office of State Budget and Management shall ensure the savings from any authorized agreement shall be included in the IT Internal Service Fund rate calculations before approving annual proposed rates. Any savings resulting from the agreements shall be returned to agencies included in the contract in the form of reduced rates. Beginning October 1, 2013, ITS shall submit a quarterly written report of any authorizations granted under this section to the Joint Legislative Oversight Committee on Information Technology and the Fiscal Research Division." Session Laws 2013-360, s. 7.7(g), as added by Session Laws 2014-100, s. 7.7, provides: "(g) Enhance State IT Contract Expertise. - The State Chief Information Officer (State CIO), the Office of State Human Resources, the Department of Computer Science at North Carolina State University, the Schools of Government and Law at the University of North Carolina at Chapel Hill, and in the discretion of the State CIO, schools and departments at other public and private institutions of higher learning in the State, shall work jointly to create a career path for State government information technology contracting professionals that includes defined qualifications, career progression, training opportunities, and appropriate compensation. By December 1, 2014, the State CIO shall submit a detailed, fully implementable plan to create the career path for State government information technology contracting professionals to the Joint Legislative Oversight Committee on Information Technology and the Fiscal Research Division." Session Laws 2013-360, s. 7.8, as amended by Session Laws 2013-363, s. 2.3, provides: "Notwithstanding any provision of law to the contrary, no contract for information technology personal services, or that provides personnel to perform information technology functions, may be established or renewed without written approval from the Statewide Information Technology Procurement Office and the Office of State Budget and Management. To facilitate compliance with this requirement, the Statewide Information Technology Procurement Office shall develop and document the following: "(1) Standards for determining whether it is more appropriate for an agency to hire an employee or use the services of a vendor. "(2) A process to monitor all State agency personal services contracts, as well as any other State contracts providing personnel to perform information technology functions. "(3) A process for obtaining approval of contractor positions. "The Statewide Information Technology Procurement Office shall review current personal services contracts and determine if each contractor is performing a function that could more appropriately be performed by a State employee. Where the determination is made that a State employee should be performing the function, the Statewide Information Technology Procurement Office shall work with the impacted agency, the Office of State Budget and Management, and the Office of State Personnel to identify or create the position. "Beginning October 1, 2013, the Statewide Information Technology Procurement Office shall report to the Joint Legislative Oversight Committee on Information Technology and the Fiscal Research Division on its progress toward standardizing information technology personal services contracts. In addition, the report shall include detailed information on the number of personal service contractors in each State agency, the cost for each, and the comparable cost (including benefits) of a State employee serving in that capacity rather than a contractor." Session Laws 2013-360, s. 1.1, provides: "This act shall be known as the 'Current Operations and Capital Improvements Appropriations Act of 2013.'" Session Laws 2013-360, s. 38.2, provides: "Except for statutory changes or other provisions that clearly indicate an intention to have effects beyond the 2013-2015 fiscal biennium, the textual provisions of this act apply only to funds appropriated for, and activities occurring during, the 2013-2015 fiscal biennium." Session Laws 2013-360, s. 38.5, is a severability clause. Session Laws 2015-241, s. 8.14(b)-(d), provides: "(b) The Department of Public Instruction shall collaborate with the Friday Institute for Educational Innovation of North Carolina State University to implement public school cooperative purchasing agreements for the procurement of information technology goods and services to support public schools. For purposes of this section, the phrase 'public school cooperative purchasing agreement' means an agreement implemented pursuant to this section and available for local school administrative units, regional schools, charter schools, or some combination thereof providing for collaborative or collective purchases of information technology goods and services in order to leverage economies of scale and to reduce costs. "(c) Each public school cooperative purchasing agreement shall be based on a defined statewide information technology need to support education in the public schools. Each public school cooperative purchasing agreement shall allow for equal access to technology tools and services and shall provide a standard competitive cost throughout North Carolina for each tool or service. Public school cooperative purchasing agreements shall follow State information technology procurement laws, rules, and procedures. "(d) By October 15, 2015, and annually thereafter, the Department of Public Instruction and the Friday Institute shall report on the establishment of the cooperative purchasing agreements, savings resulting from the establishment of the agreements, and any issues impacting the establishment of the agreements. The reports shall be made to the Joint Legislative Oversight Committee on Information Technology, the Joint Legislative Education Oversight Committee, and the Fiscal Research Division." Session Laws 2015-241, s. 1.1, provides: "This act shall be known as 'The Current Operations and Capital Improvements Appropriations Act of 2015.'" Session Laws 2015-241, s. 33.4, provides: "Except for statutory changes or other provisions that clearly indicate an intention to have effects beyond the 2015-2017 fiscal biennium, the textual provisions of this act apply only to funds appropriated for, and activities occurring during, the 2015-2017 fiscal biennium." Session Laws 2015-241, s. 33.6, is a severability clause. Session Laws 2016-85, s. 2, made subsection (h1), as added by Session Laws 2016-85, s. 1, applicable to contracts entered into, extended via the exercise of options or otherwise, renewed, or amended on or after June 30, 2016. Session Laws 2020-78, s. 19.2(b), made subdivision (i)(3), as added by Session Laws 2020-78, s. 19.2(a), effective July 1 2020, and applicable to product procurement occurring on or after that date. Session Laws 2020-78, s. 22.1, provides: "Except for statutory changes or other provisions that clearly indicate an intention to have effects beyond the 2019-2021 fiscal biennium, the textual provisions of this act apply only to the 2019-2021 fiscal biennium." Session Laws 2020-78, s. 22.3, is a severability clause. Session Laws 2020-81, s. 5, provides: "The Information Technology Innovation Center, established pursuant to G.S. 143B-1350(j), shall create a cybersecurity pilot program to establish and utilize public-private partnerships to provide cybersecurity support services from participating vendors to eligible counties. The Center shall receive proposals from vendors that demonstrate the capability to provide comprehensive cybersecurity support services to counties designated as development tier one or tier two areas, pursuant to G.S. 143B-437.08. The Center shall establish agreements with participating vendors that describe the funds or professional services to be offered in the cybersecurity pilot program described by this section. Participating vendors selected by the Center shall meet all of the following requirements: "(1) Demonstrated compliance with the security guidelines outlined in the National Institute of Standards and Technology Special Publication 800-171. "(2) Services offered must be complete and include all hardware, software, licenses, support, maintenance, training, and labor, as applicable. "(3) Services must account for evolving technology and security threats. "(4) Adequate ability for review and oversight of services by the Department of Information Technology. "(5) Services must be as integrated as possible and must identify accountability and responsibility measures for incident response. "(6) Projects and services shall be integrated with existing State cybersecurity infrastructure and shall share all resulting data with the State. "The Center shall develop criteria for eligible counties to demonstrate need and capacity to participate in the cybersecurity pilot program by March 31, 2021, and annually thereafter, the Center shall submit a report to the Joint Legislative Oversight Committee on Information Technology and the Fiscal Research Division on the cybersecurity pilot program, including the terms of partnerships initiated, eligible counties participating, and any results from partnerships." Effect of Amendments. - Session Laws 2015-268, ss. 2.14, 2.20, effective July 1, 2015, deleted "separate agency, and participating agency" following "Each State agency" at the beginning of the first sentence of subsection (d); and added subsection (k). Session Laws 2016-85, s. 1, effective June 30, 2016, added subsection (h1). See editor's note for applicability. Session Laws 2019-200, s. 1, effective August 21, 2019, deleted "including, but not limited to, requiring convenience contracts to be rebid prior to termination without extensions" at the end of subdivision (c)(3); inserted "multiple award schedule contracts and" in subdivision (c)(5); and added subsection (f1). Session Laws 2020-78, s. 19.2(a), added subdivision (i)(3). For effective date and applicability, see editor's note.