General, Definitions, Establishing and Maintaining Eligibility for Non-Required SUNCOM Customers, Required Users Filing SUNCOM Exemption Requests for Use of Network Resources Not Provided through SUNCOM, Exemption Request Part I: Description of the ...

 

DEPARTMENT OF MANAGEMENT SERVICES
Communications and Information Technology Services

RULE NO: RULE TITLE
60FF-1.001: General
60FF-1.002: Definitions
60FF-1.003: Establishing and Maintaining Eligibility for Non-Required SUNCOM Customers
60FF-1.004: Required Users Filing SUNCOM Exemption Requests for Use of Network Resources Not Provided through SUNCOM
60FF-1.005: Exemption Request Part I: Description of the Business Objectives
60FF-1.006: The Department’s Evaluation of Part I of Exemption Requests
60FF-1.007: Exemption Request Part II: Description of the Network Solution
60FF-1.008: The Department’s Evaluation of Part II of Exemption Requests
60FF-1.009: Exemption Request Part III: Verification that the Purchase and Implementation Met Rules Requirements
60FF-1.010: The Department’s Evaluation of Part III of Exemption Requests
60FF-1.011: State Intranet Users Clearance Requests Related to Interoperability and Security
60FF-1.012: Department Response to Clearance Requests
60FF-1.013: State Intranet Users: Clearance Requests Related to Interoperability and Security
60FF-1.014: Department Response to Clearance Requests

NOTICE OF CHANGE

Notice is hereby given that the following changes have been made to the proposed rule in accordance with subparagraph 120.54(3)(d)1., F.S., published in Vol. 34, No. 18, May 2, 2008 issue of the Florida Administrative Weekly.

These changes respond to comments by the Joint Administrative Procedures Committee and to suggestions filed through written comments and/or made during public hearings held January 28, February 7 and February 20, 2008. The following changes represent a substantial rewording of the proposed rules published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly.

60FF-1.001 General.

No change.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

60FF-1.002 Definitions.

(1) The following terms as defined below, are applicable to Chapters 60FF-1, 60FF-2 and 60FF-3, F.A.C.:

(a) No change.

(b) Backdoor – Any connection to a network outside of the State Intranet that directly or indirectly circumvents the State firewalls. Any Unauthorized Connection linking an part of the State Intranet to an outside network or the Internet.

(c) Billing Data – Data, in standardized formats established by the Department, used by the Department to charge Customers for the relative portions of SUNCOM Services they use.

(d) No change.

(e) Clearance Request – A request from a Customer, that is not a Required User, to implement a Network Solution that uses Internet technology and is not provided through SUNCOM.

(f)(e) Communications Device – Any device or software that which renders audio, video and/or data into Electronic Communications.

(g) Communications Purchase or Lease Authorization – The means that was used by Required Users to seek and obtain approval from the Department to purchase or lease communications equipment prior to establishment of Chapter 60FF, F.A.C.

(f) through (k) renumbered (h) through (m) No change.

(n) Custom Network Solution – A Network Solution that is designed for a Customer using communications and network resources not provided by SUNCOM.

(l) through (n) renumbered (o) through (q) No change.

(r) Exemption Request – A request from Required Users seeking Department approval to use Network Solutions that are not provided through SUNCOM.

(s) Maintenance – Activity to ensure the ongoing availability of a Network Solution through replacement of parts, software patches and associated services without expanding the scope, functionality, volume by more than 10% over the volume that was approved by the Department, or changes the architecture of the Network Solution.

(t)(o) Network Equipment – Any device or circuit that which establishes Physical or Virtual Connections from within the Customer’s Physical Network to networks or devices outside of the Customer’s Physical Network to facilitate communications on behalf of Communications Devices or other Network Equipment. A Communications Device, regardless of its primary use, shall be classified as Network Equipment if it also performs this Network Equipment function.

(u)(p) No change.

(v)(q) Network Security – The protection of network topologies and associated services from unauthorized modification, destruction, or disclosure and the reassurance that the network performs its critical function without harmful side effects and retains its integrity, availability and predictability.

(w)(r) Network Software – Any software that which establishes Physical or Virtual Connections from within the Customer’s Physical Network to networks or devices outside of the Customer’s Physical Network to facilitate communications on behalf of Communications Devices or Network Equipment.

(x)(s) No change.

(y) Network Solution Replacement Declaration – A commitment from a Customer to replace a Custom Network Solution with a SUNCOM solution by a specific date.

(z) Notice of Security Concern – A statement warning the Department that a condition exists that may violate the Department Security Standards.

(aa)(t) No change.

(bb)(u) Portfolio of Services – The electronic publication located on the official Web site of the Department defining SUNCOM contemporary Services and providing the latest associated technical standards, as mandated in Section 281.102(1), F.S. based upon current SUNCOM contracts, modern industry standards, new software and hardware releases, recent security threats, and/or technological improvements. The Portfolio shall also provide sample templates for requests and notices to the Department as they become available. The Web site address is: http://dms.myflorida.com/cits/portfolio_of_services.

(cc)(v) Required User – All state agencies and state universities mandated to use SUNCOM in Section 282.103 281.103, F.S.

(dd) Sanctioned Filtering – A configuration of a Network Solution designed to protect a network from Unauthorized Activity that has been evaluated in accordance with the process under subsection 60FF-3.004(3), F.A.C., and approved by the Department in accordance with the standards under Rule 60FF-3.004, F.A.C.

(ee)(w) No change.

(ff) Security Exposure – Any condition that is in violation of Rule 60FF-3.004, F.A.C., Network Protection Standards for State Network, or may lead to a Security Breach.

(gg)(x) State Intranet – That portion of the SUNCOM network protected from other networks or the Internet via the State Firewall maintained or sanctioned by the Department.

(hh)(y) No change.

(ii)(z) Sub-network – Networks established by customers within, or attached to, the broader State Network that is maintained by the Department.

(jj)(aa) No change.

(kk)(bb) SUNCOM Services – Network Equipment, Network Services, Network Software, Communications Devices or the configuration or management of any of these, obtained, secured or provided by the Department and rendered into services that are made available to Customers Eligible Users by the Department or SUNCOM Providers under agreements with the Department.

(ee) through (jj) renubered (ll) through (ss) No change.

(tt) User – Person authorized, through an user identification and password, to enter and/or see data in any Department of Management Services electronic system for establishing, maintaining, monitoring, auditing or accounting for SUNCOM services.

(uu)(kk) No change.

(2) No change.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

60FF-1.003 Establishing and Maintaining Eligibility for Non-Required SUNCOM Customers.

(1) Eligible Users that which are not Required Users must submit an electronic mail request to [e-mail], provide the associated information necessary to prove eligibility and agree to the provisions of these rules and SUNCOM policies and procedures prior to becoming a Customer.

(2) Once designated by the Department as eligible, Eligible Users have the obligation to maintain knowledge understanding of statutory eligibility requirements, verify their ongoing eligibility and notify the Department upon loss of eligibility.

(3) If At any time the Department discovers may declare an Eligible User ineligible if the Department finds that an Eligible User the Customer no longer qualifies in accordance with Sections 282.103-.107, F.S., the Department shall declare an Eligible User ineligible.

(4) through (6)(c) No change.

(7) Declining these terms will result in a statement akin to the following: Acceptance is required for the use of SUNCOM Service. Please contact your local SUNCOM Representative with questions or concerns at: 866-MY-DMS-IT 888-4SUNCOM.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

The following changes represent a substantial rewording of proposed Rule 60FF-1.004 published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly:

60FF-1.004 Standards for Submitting Requests, Notices and Declarations to the Department Required Users Filing SUNCOM Exemption Requests for Use of Network Resources Not Provided through SUNCOM.

(1) All of the following formal submittals to the Department shall comply with the standards of Rule 60FF-1.004, F.A.C.:

(a) Notices of Security Concern;

(b) Parts I and II of Exemption Requests;

(c) Clearance Requests;

(d) Network Solution Replacement Declarations.

(2) Customers shall use one of the following means of making submittals:

(a) Through the provisions of the CSAB System; or

(b) Via electronic mail with attachments to [e-mail] with the title of the submittal and the name of the Customer in the Subject line. Note that if the request contains sensitive information, use of electronic mail may pose security risks.

(c) Or via U. S. Postal Service address to:

Department of Management Services

SUNCOM

Attention: Submittal Processing

4030 Esplanade Way

Tallahassee, Florida 32399-0950.

(3) The Customer shall provide the following standard information with all submittal packages.

(a) SUNCOM account number;

(b) The Customer account number;

(c) Customer organization name, address, city, state, zip code;

(d) The submittal author’s name and contact information;

(e) The name and contact information of the person who is an employee of the Customer holding a full-time position who shall speak on behalf of the Customer and shall be available to answer related questions.

(f) Category of service the submittal pertains to (e.g., Voice, Data, Conferencing, Wireless).

(4) Submittals shall use common practices of readability including tables of contents where appropriate, headings, executive summaries or cover letters, proper grammar and spelling. Recommended examples shall be provided through the Portfolio of Services as they become available.

(5) Single submittals that describe the same conditions in multiple locations or describe conditions that are repeated in multiple events over time shall be accepted by the Department in lieu of multiple submittals if all of the locations, events and timing of the events are named in the submittal.

(6) The Department will protect any information contained in these submittals in accordance with exemptions to Chapter 119, F.S.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

The following changes represent a substantial rewording of proposed Rule 60FF-1.005 published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly:

60FF-1.005 Customer Notice of Security Concern Regarding a Network Solution.

(1) All Customers shall submit a Notice of Security Concern Regarding any Network Solution that is in use, or the Customer intends to use, and not in compliance with Rule 60FF-3.004, F.A.C. This requirement to submit a notice is not obviated by the submittal of a corresponding notice by a vendor.

(2) All vendors selling or implementing Network Solutions that are not provided as a part of SUNCOM services for use by SUNCOM Customers shall submit a Notice of Security Concern to the Department and the purchasing Customer prior to entering into associated agreements or contracts, or accepting associated purchase orders if prior to impending engagement or during engagement, the vendor is aware that Network Solution is not, or is not expected to be in compliance with Rule 60FF-3.004, F.A.C. This requirement to submit a notice is not obviated by the submittal of a corresponding notice by a Customer.

(3) The Notice of Security Concern Regarding a Network Solution shall:

(a) Follow the submittal standards established under Rule 60FF-1.004, F.A.C.;

(b) Contain a description of the Network Solution;

(c) Contain descriptions of all the circumstances where the Network Solution does not comply with Rule 60FF-3.004, F.A.C.; and

1. The security measures currently in place to address the Security Exposures; and

2. The security guidelines that have been made available from the Network Solution provider to Customer, and measures that are and expected to be in place to address the Security Exposures; and

3. Highlighted liability provisions that are applicable to these security conditions in complete copies of the related contracts, agreements and purchase orders.

(d) Contain a statement specifying how long the Customer intends to use the Network Solution.

(4) Customers and vendors using or implementing Network Solutions that are in violation of Rule 60FF-3.004, F.A.C., shall provide the Department the following:

1. All related information requested by the Department.

2. Upon request from the Department, all the cooperation, access and authorities described in Rule 60FF-3.006, F.A.C.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

The following changes represent a substantial rewording of proposed Rule 60FF-1.006 published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly:

60FF-1.006 Required Users: Replacement Declarations and Terminations for Existing Network Solutions that are Not Provided through SUNCOM.

(1) All Required Users must submit a Network Solution Replacement Declaration for, or cease usage of, all Network Solutions under the following conditions:

(a) The Network Solution is not provided through SUNCOM and;

(b) The Network Solution would otherwise be in use after March 31, 2009, and;

(c) No applicable Exemption Request or Communication Purchase or Lease Authorization has been approved by the Department in accordance with the requirements under Rules 60FF-1.007 through 60FF-1.012, F.A.C.

(2) A Network Solution Replacement Declaration shall follow the submittal standards established under Rule 60FF-1.004, F.A.C., and shall consist of the following:

(a) A description of the Custom Network Solution to be replaced by a SUNCOM alternative.

(b) The date, known as the “replacement date,” on which the Custom Network Solution will have been completely replaced by a SUNCOM alternative. The replacement date shall be no later than March 31, 2009.

(c) An irrevocable order for services from SUNCOM that will replace the Custom Network Solution by the replacement date. Irrevocable orders may be modified in consultation with a representative of the Department to accommodate changing conditions and implementation plans as long as the ordered SUNCOM services fully replace the Custom Network Solution by the replacement date.

(d) The following written statement from an authorized representative of the Required User: “The entire Network Solution described in this Replacement Declaration shall be replaced with SUNCOM services as of the replacement date and shall not be in use after the replacement date.”

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

The following changes represent a substantial rewording of proposed Rule 60FF-1.007 published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly:

60FF-1.007 Required Users: Criteria for Obligation to Submit Exemption Requests for Custom Network Solutions.

(1) All Required Users must obtain Exemptions from the Department to use Custom Network Solutions when the Custom Network Solution is not provided through SUNCOM under the following conditions:

(a) The Required User seeks to implement the new Custom Network Solution or;

(b) The Required User seeks to continue use of an existing Custom Network Solution later than December 31, 2008, under the following conditions:

1. A previous Exemption had not been granted by the Department through a Communication Purchase or Lease Authorization (CPLA) or Exemption Request for the Network Solution. Required Users shall submit these Exemption Requests on or before September 30, 2008.

2. A previous Exemption had been granted by the Department through a Communication Purchase or Lease Authorization (CPLA) or Exemption Request for the Network Solution and the current contract terms will expire later than July 1, 2008, and the Customer intends to continue services, use software or obtain hardware related to the Network Solution for any purpose other than Maintenance. Use of any associated Network Solution requires an Exemption before establishing a new contract, contract renewal, contract extension, contract amendment, major upgrade or replacement purchase, for any purpose other than Maintenance.

(2) Upon identifying a Business Objective requiring a new or continuation of a Custom Network Solution and before seeking exemptions in accordance with Rule 60FF-1.008, F.A.C., Required Users shall discuss the Required User’s need with the Department to find out if SUNCOM’s existing or impending services, or a collaborative effort between the Department and the Required User, can accommodate the Business Objective.

(3) Exemption Requests shall be submitted prior to the procurement planning stage of any Custom Network Solution if the Network Solution was not established by contract prior to July 1, 2008.

(4) With exceptions for maintenance described in subparagraph 60FF-1.007(1)(b)2., F.A.C., exemptions are granted for periods no longer than the terms of the contract for the associated Network Solution.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

60FF-1.008 Required Users: Part I Exemption Requests for Existing and Future Custom Network Solutions.

Exemption Requests shall comply with submittal standards established under Rule 60FF-1.004, F.A.C., and shall include the following:

(1) A description of the Required User’s findings from the initial inquiry to the Department regarding the Required User’s needs in accordance with subsection 60FF-1.008(2), F.A.C.

(2) A description of the Business Objectives (to be) satisfied by the Custom Network Solution for which the Required User is seeking an Exemption. The description shall contain the same essential information the Required User used (shall use) to formulate the Required User’s proposed Custom Network Solution.

(3) A general description of the Custom Network Solution and technical means to achieve the Business Objectives for which the Required User is seeking an Exemption in sufficient detail for the Department to evaluate whether the Department can currently, or shall soon be able to, provide a comparable solution.

(4) The purpose of the Exemption Request indicating which of the conditions listed in paragraph 60FF-1.007(1)(c), F.A.C., is applicable.

(5) A statement explaining how long the Customer intends to use the Custom Network Solution. That statement must comport with the associated contract terms for the Network Solution.

(6) Descriptions of all the circumstances where the Custom Network Solution does not comply with Rule 60FF-3.004, F.A.C.

(a) If conditions exist where the Custom Network Solution does not comply with Rule 60FF-3.004, F.A.C., the Customer must submit a Notice of Security Concern in accordance with Rule 60FF-1.005, F.A.C.

(b) If the customer asserts that the Custom Network Solution is in compliance with Rule 60FF-3.004, F.A.C., the Customer must include the following statement: “The Network Solution described in this Exemption Request complies with Rule 60FF-3.004, F.A.C.”

(7) An explanation of the reasons the Required User is seeking the Exemption. The explanation should focus on how the Custom Network Solution and underlying technology satisfies the associated Business Objective in a manner that is superior to the most appropriate SUNCOM alternative.

(8) Verification that Part I of the Exemption Request has been authorized by the Chief Information Officer or the equivalent (if a CIO does not exist) for the Required User.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

The following changes represent a substantial rewording of proposed Rule 60FF-1.009 published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly:

60FF-1.009 Required Users: Exemption Request Part IIA Providing a Business Case for Future Custom Network Solutions.

Part IIA Exemption Requests must be submitted only by Required Users seeking to implement a new or expand a current Custom Network Solution that is not provided by SUNCOM and has been denied an Exemption based upon a Part I submittal. A Part IIA Exemption Request shall follow the submittal standards established in Rule 60FF-1.004, F.A.C., and consist of the following:

(1) Standard Part I content described in Rule 60FF-1.008, F.A.C., with any elaboration or corrections the Required User chooses to include.

(2) An explanation of any deficiencies in the Part I submittal that may have led to the denial and/or errors in the Department’s denial finding.

(3) The general expected timing of the milestones for implementing the solution.

(4) General descriptions of the Network Equipment, Software or Services comprising the proposed Custom Network Solution categorized using the following three categories:

(a) “Internal Resources” – Required User full or part-time staff, Required User owned Equipment and Software developed by the Required User.

(b) “Vendor(s) Resources” – Vendor provided Equipment, Software and Services.

(c) “SUNCOM Resources” – SUNCOM provided Equipment, Software and Services.

(5) The procurement method expected to be used to obtain the Custom Network Solution such as: State Contract Number, Single Source, Invitation to Bid, or Request for Proposal.

(6) All of the projected one-time and recurring costs of the Custom Network Solution. This includes all of the costs of Network Services, Network Software and Network Equipment, project management, planning, consulting, procurement process, maintenance, required and expected upgrades, and miscellaneous costs associated with the entire project and ongoing usage of the Custom Network Solution.

(a) If cost savings are considered to be among the benefits claimed in the Exemption Request, then Return on Investment (ROI) calculations must be included. The ROI calculations must include estimated net cost savings from the proposed solution using all of the estimated short and long-term costs of the solution. The calculation methods and assumptions must be in sufficient detail to allow for replication and shall consider the most appropriate SUNCOM option for mathematical comparison.

(7) Any subsequent supplementary documentation requested by the Department that will clarify or elaborate and is needed to properly evaluate the Required User’s Exemption Request.

(8) Verification that Part IIA of the Exemption Request has been authorized by the Chief Information Officer or the equivalent (if a CIO does not exist) for the Required User.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

The following changes represent a substantial rewording of proposed rule 60FF-1.010 published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly:

60FF-1.010 Required Users: Exemption Requests Part IIB Business Case for Existing Custom Network Solutions.

Part IIB Exemption Requests must be submitted only by Required Users seeking to continue or renew use of a Custom Network Solution that is not provided by SUNCOM and has been denied an Exemption based upon a Part I submittal. A Part IIB Exemption Request shall follow the submittal standards established in Rule 60FF-1.004, F.A.C., and consist of the following:

(1) Standard Part I content described in Rule 60FF-1.008, F.A.C., with any elaboration or corrections the Required User chooses to include.

(2) An explanation of any deficiencies in the Part I submittal that may have led to the denial and/or flaws in the Department’s denial finding.

(3) A description, documentation and results of any previous requests to the Department seeking approval for the Customer to implement the Custom Network Solution.

(4) Descriptions of the Network Equipment, Software or Services comprising the Custom Network Solution categorized using the following three categories:

(a) “Internal Resources” – Required User full or part-time staff, Required User owned Equipment and Software developed by the Required User.

(b) “Vendor(s) Resources” – Vendor provided Equipment, Software and Services.

(c) “SUNCOM Resources” – SUNCOM provided Equipment, Software and Services.

(5) All of the costs associated with using the Custom Network Solution. This includes all of the costs of Network Services, Network Software and Network Equipment, ongoing project management, planning, consulting, procurement process, maintenance, required and expected upgrades, and miscellaneous costs associated with the entire project and ongoing usage of the Custom Network Solution.

(6) The name and contact information for the entity that is providing the solution.

(7) All of the contracts and agreements associated with the Custom Network Solution.

(8) A description of the operational, financial and contractual consequences if the Custom Network Solution is to be replaced with the most appropriate SUNCOM alternative.

(a) Descriptions of the operational consequences shall describe how the Business Objectives are affected.

(b) Descriptions of the financial consequences shall include comprehensive cost data associated with the Custom Network Solution, supporting documentation and a demonstration of the calculation methods and assumptions for determining the consequences in sufficient detail to allow for replication.

(c) Descriptions of the contractual consequences shall include complete copies of the contracts with the relevant contract language highlighted and an explanation of how the language is relevant to the impact if the Custom Network Solution were replaced with a SUNCOM service.

(9) Verification that Part IIB of the Exemption Request has been authorized by the Chief Information Officer or the equivalent (if a CIO does not exist) for the Required User.

Specific Authority 282.102(9) FS.  Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History–New ________.

 

The following changes represent a substantial rewording of proposed Rule 60FF-1.010 (renumbered 60FF-1.011) published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly:

60FF-1.011 The Department’s Criteria for Evaluating Exemption Requests.

The Department shall use the following combination of criteria in evaluating an Exemption Request:

(1) Availability of SUNCOM alternatives: The Department shall consider the current availability and expected ability of the Department to provide a viable, timely and cost effective alternative to the Custom Network Solution.

(2) Suitability of a SUNCOM solution: The Department will compare SUNCOM’s potential solution to the Custom Network Solution to determine if it can satisfy the Business Objective as well or better than the Custom Network Solution.

(3) Additional benefits from the SUNCOM solution: The Department shall consider any additional features or value provided by the SUNCOM solution that may go beyond the Business Objectives.

(4) Enterprise economies of scale: The Department will consider the additional bulk purchasing leverage and financial impact on the Department’s ability to achieve better prices for all of SUNCOM services resulting from implementing a SUNCOM solution.

(5) Ongoing costs to the Customer: The Department will consider the recurring cost difference between the Custom Network Solution and the SUNCOM alternative.

(6) The consequences of transition: The Department shall consider the operational, financial and contractual consequences if the Custom Network Solution is to be replaced with the most appropriate SUNCOM alternative.

(7) Compatibility of the Custom Network Solution with the State Network: The Department shall determine if the Custom Network Solution creates incompatibility with the State Network such that State communications or economies of scale shall be impaired.  The complexity and cost of maintaining conditions where compatibility is sustained for a Custom Network Solution will be a factor in this determination.

(8) Security Impact on the State Network: The Department shall determine if the Custom Network Solution will comport with the Network Protection Standards for State Network established in Rule 60FF-3.004, F.A.C.  The complexity and cost of maintaining conditions where security is sustained for a Custom Network Solution will be a factor in this determination.

(9) Congruity considerations:

(a) Congruity between the Required User’s Business Objectives and the associated Custom Network Solution: This criterion shall determine if the intended benefits of the Custom Network Solution satisfy the Required User’s Business Objectives.

(b) Congruity between the Required User’s estimated costs and the realistic resources required, market conditions and scope that drive costs: This criterion shall determine if the costs estimates are accurate.

(c) Congruity between the Required User’s estimated timing and the work effort required: This criterion shall determine if the milestones in Part IIA are realistic given the description of the Custom Network Solution.

(d) Congruity between the Required User’s expectations of the Custom Network Solution and the likelihood those expectations shall be or have been met: This criterion shall determine if the proposed technology described in Part IIA has been used before to satisfy equivalent Business Objectives and what is the likelihood of success based upon the scope, technological maturity and track-record of similar projects.

(10) Longevity of the Custom Network Solution: The Department will consider the life cycle of the solution and the length of time the Required User expects to use the Custom Network Solution.

Specific Authority 282.102(9) FS.  Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

60FF-1.012 The Department’s Responses to Exemption Requests.

(1) The Department shall respond in writing within 30 days after Part I or within 45 days after Part II of an Exemption Request has been submitted.  The Department shall render one of the following findings:

(a) The Exemption Request is approved.

(b) The Exemption Request is approved contingent upon certain conditions. Those conditions shall include the following where applicable:

1. Specified changes to the Custom Network Solution to address the Department’s security or compatibility concerns.

2. Unfettered monitoring of implementation of the Custom Network Solution by the Department to address the Department’s security or compatibility concerns.

3. Ongoing Department monitoring of use of the Custom Network Solution to address the Department’s security or compatibility concerns.

4. A commitment from the Required User to maintain certain compatibility and security related configurations and upgrades.

5. Specified changes to the Custom Network Solution to include a portion of SUNCOM services.

6. A commitment from the Required User to replace the Custom Network Solution with a SUNCOM alternative when a viable SUNCOM alternative becomes available.  The Required User may submit another Exemption Request for consideration when the SUNCOM alternative becomes available.

(c) The Exemption Request is denied.  The Department shall provide the following with this finding:

1. An explanation of the Department’s reasoning behind the finding.

2. A general proposal and plan describing the SUNCOM service that will replace the Network Solution. The Department shall subsequently work with the Required User to develop a more detailed consensus plan and proposal for collaboratively implementing the SUNCOM alternative.

(d) The Department requires more information to render a conclusive finding. The Department will specify the information required and render a finding within 45 days from its submittal.

(2) If the Required User seeks reconsideration of a denial or a contingent approval of a Part I Exemption Request, the Required User may refine its submittal and submit Part II of the Exemption Request.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (5) (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.

 

The following changes represent a substantial rewording of proposed Rule 60FF-1.011 (renumbered 60FF-1.013)  published in Vol. 33, No. 52, December 28, 2007 issue of the Florida Administrative Weekly:

60FF-1.013 State Intranet Users: Clearance Requests Related to Interoperability and Security.

(1) Clearance Requests must be submitted by SUNCOM Customers that are:

(a) Using the State Intranet; and

(b) Are not Required Users; and

(c) Are intending to initiate Network Solutions that result in the purchase or lease of Network Services, Network Software or Network Equipment and these network resources:

1. Make use of the Internet Protocol; and

2. Are  not provided through SUNCOM.

(2) These Customers must follow the submittal standards established in Rule 60FF-1.004, F.A.C., to provide the following as a part of the Clearance Request:

(a) Address, city, state, zip code where the primary part of the Network Solution shall take place;

(b) Date that the Network Solution is to be implemented;

(c) Any pending SUNCOM orders affected;

(d) Brief summary of Business Objectives.;

(e) General descriptions  of the Network Equipment, Software or Services comprising the Network Solution.;

(f) If known at the time of submittal of the Clearance Request, the entity that is expected to provide the solution with contact information including: entity name, city, state, representative name, telephone number and electronic mail address;.

(g)  A “Customer Notice of Security Concern Regarding a Network Solution” in accordance with Rule 60FF-1.005, F.A.C., if the Network Solution creates any Security Exposures in violation of Rule 60FF-3.004, F.A.C.

(3) A statement must be included that the Customer shall commit to Rule 60FF-3.005, F.A.C., and be prepared to demonstrate this commitment by also making  purchasing documents available to the Department.

(4) The Customer must provide any subsequent supplementary documentation requested by the Department that shall clarify or elaborate on the Network Solution and is needed to properly evaluate its potential impact on the State Intranet and its other Customers.

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_______.

 

60FF-1.014 60FF-1.012 Department Response to Clearance Requests.

(1) The Department shall evaluate the Customer’s Clearance Request for the following conditions:

(a) No change.

(b) Security Impact on the State Network – If the Department determines that the Network Solution shall not comport with the Network Protection Standards for State Network established in Rule 60FF-3.004, F.A.C., the Department shall request that the Customer modify its Network Solution accordingly.  If the Network Solution cannot be modified to comport with Rule 60FF-3.004, F.A.C., the Department shall deny the Clearance Request.

(2) No change

(a) No change

(b) No change

(c) No change

Specific Authority 282.102(9) FS. Law Implemented 282.102(2), (5) (8), (12), 282.103, 282.104, 282.105, 282.106, 282.107 FS. History– New_________.