Alabama Administrative Code Chapter 471-X-1 — Organization

471 Alabama Office of Information Technology

Ala. Admin. Code r. 471-X-1-.01 Name And Legal Authority

Code of Ala. 1975, §§41-28-1 et seq. sets forth the authority for the creation of an autonomous state agency to be known hereafter as the Office of Information Technology and for the promulgation of rules, regulations, and policies and to establish procedures and standards for the management and operation of information technology by state agencies, including coordinating state information technology. For purposes of clarity and to reduce confusion with similar entities, the Office of Information Technology may also be referred to as “the State of Alabama Office of Information Technology” or “the Office of Information Technology, State of Alabama” and may be abbreviated “OIT.”

History

• Author: Taylor Nichols
• Authority: Code of Ala. 1975, §§41-28-1 et seq.
• New Rule: Published August 31, 2021; effective October 15, 2021.

Ala. Admin. Code r. 471-X-1-.02 Purpose And Composition

(1) Code of Ala. 1975, §41-28-1.1 sets forth the purpose of the Office of Information Technology:

(a) The streamlining and consolidation of governmental functions is a priority and is of great importance to the economic well-being of the State of Alabama, to its citizens, and to ensuring appropriate and responsible use of taxpayer funds.

(b) The Office of Information Technology was created in furtherance of the goal to streamline information technology in the state.

(c) Effective utilization of information technology is paramount to reducing the cost of governmental operations and to serving the citizens of the state.

(d) Excellence in support for all state agency information technology needs is critical to serving the people of Alabama.

(2) The Section further states that the Legislature enacted Act 2017-282 “to transfer the responsibility and authority for information technology service delivery from the Department of Finance to the Office of Information Technology.”

(3) The Secretary of Information Technology is the chief administrative and executive officer of the Office of Information Technology, pursuant to Code of Ala. 1975, §41-28-1. Pursuant to Code of Ala. 1975, §41-28-3, the Secretary of Information Technology is appointed by and serves at the pleasure of the Governor, is a member of the Governor's Cabinet, serves as the State Chief Information Officer (“CIO”), and is the principal advisor to the Governor on information technology policy, including policy on the acquisition and management of information technology and resources.

History

• Author: Taylor Nichols
• Authority: Code of Ala. 1975, §§41-28-1 et seq.
• New Rule: Published August 31, 2021; effective October 15, 2021.

Ala. Admin. Code r. 471-X-1-.03 Powers And Duties

(1) The powers and duties of the Office of Information Technology and the Secretary of Information Technology are set forth primarily in three statutory sections:

(a) Code of Ala. 1975, §41-28-4, in the Chapter which established the Office of Information Technology and the Secretary of Information Technology.

(b) Code of Ala. 1975, §41-4-221, in the Article which established the Data Systems Management Division of the Alabama Department of Finance, merged with OIT and its powers and duties incorporated by reference pursuant to Code of Ala. 1975, §41-28-9.

(c) Code of Ala. 1975, §§41-4-283 and 41-4-284, in the Article which established the Telecommunications Division of the Alabama Department of Finance, merged with OIT and its powers and duties incorporated by reference pursuant to Code of Ala. 1975, §41-28-9.

History

• Author: Taylor Nichols
• Authority: Code of Ala. 1975, §§41-28-1 et seq.
• New Rule: Published August 31, 2021; effective October 15, 2021.

Ala. Admin. Code r. 471-X-1-.04 Electronic Records And Signatures

(1) Legal Basis: The Alabama Uniform Electronic Transactions Act ("UETA"), Code of Ala. 1975, §8-1A-1 et seq., enacted in 2002, is intended to facilitate the use of electronic documents in business, commercial, and governmental transactions. UETA promotes but not require the use of electronic signatures and creation of electronic documents. Section 8-1A-1B(a) provides that “each government agency of this state with rule-making authority...may determine by rule whether, and the extent to which, it will send and accept electronic records and electronic signatures to and from other persons and otherwise create, generate, communicate, store, process, use, and rely upon electronic records and electronic signatures.” Section 8-1A-12(a) provides that an electronic record meets other state law requirements for record retention if the electronic record both accurately reflects the original document and is accessible for later reference. Section 8-1A-13 provides that an electronic record may not be excluded from evidence in court solely because it is in electronic form. Section 8-1A-12{g) provides that the State Records Commission is not precluded by UETA from placing additional requirements for record retention on agencies.

(2) Definitions: Except as otherwise specified in this rule, undefined terms have the respective meanings set forth in the Uniform Electronic Transactions Act. Notwithstanding the forgoing, the following words where used in this rule shall have the following meanings:

(a) OIT. The State of Alabama Office of Information Technology, as established in Code of Ala. 1975, §41-28-1.

(b) Records Disposition Authority or RDA. An agency- level records retention schedule issued by the State Records Commission under the authority granted by the Code of Ala. 1975, §§41-13-5 and 41-13-20 through 21.

(c) State Records Commission. The State Records Commission, as established in Code of Ala. 1975, §41-13-20.

(d) UETA. Alabama Uniform Electronic Transaction Act, Code of Ala. 1975, §8-1A-1 et seq.

(3) Use of Electronic Signatures and Electronic Records: In accordance with Code of Ala. 1975, §8-1A-18(a), OIT hereby establishes that to the fullest extent permitted by UETA and except as otherwise provided in this administrative rule, OIT will send and accept electronic records and electronic signatures to and from other persons and otherwise create, generate, communicate, store, process, use, and rely upon electronic records and electronic signatures. In accordance with §8-1A-18{b), OIT use of electronic records and electronic signatures will comply with the following requirements:

(a) Provide an identical copy of the original signed and executed document to the signer.

(b) Ensure non-repudiation; that the signer cannot deny the fact that he or she electronically signed the document.

(c) Capture information about the process used to capture signatures (i.e. create an audit trail), including:

1. Signer identification and verification

2. Date and time stamp of all events

3. All web pages, documents, disclosures, and other information presented

4. What each party acknowledged, agreed to, and signed

(d) Encrypt, end-to-end, all communication within the signature process. Encryption technologies shall comply with state encryption standards, including the requirements that cryptographic modules be validated to the current Federal Information Processing Standards (FIPS).

The information contained in this subsection constitutes the minimum that is required for a valid electronic signature. Any authorized person within OIT may require additional reasonable information from a signer in order to establish the identity and signature authority of the signer. OIT may provide additional requirements subject to a State of Alabama information technology policy as promulgated by OIT.

(4) Creation and Retention of Electronic Records: In accordance with Code of Ala. 1975, §8-1A-17, OIT hereby establishes that to the fullest extent permitted by UETA and except as otherwise provided in this administrative rule, it will create and retain electronic records and convert written records to electronic records. Any such electronic records will be retained in compliance with State Records Commission requirements, including the records retention schedules set forth in the OIT Records Disposition Authority. OIT may create a retrievable electronic record or copy, by optical scan or otherwise, of paper original documents or make other images or paper copies which accurately reproduce the originals and may destroy original paper documents so copied as specified in the RDA. Electronic copies of original documents, when certified by an authorized OIT record custodian, are admissible in OIT administrative proceedings as authorized by UETA as though they were the original document. The electronic document retains the confidential or public document characteristics of the original document.

History

• Author: Taylor Nichols
• Authority: Code of Ala. 1975, §§8-1A-7, 8-1A-12, 8-1A-13, 8-1A-17; 8-1A-18.
• New Rule: Published August 31, 2021; effective October 15, 2021. Amended: Published November 27, 2024; effective January 11, 2025.

Ala. Admin. Code r. 471-X-1-.05 Use Of Electronic Records And Signatures By State Agencies

(1) Applicability to State Agencies: Under the authority granted to OIT by Act 2021-304 to amend Code of Ala. 1975, §8-1A-19, the authority and requirements of Rule 471-X-1-.04 above apply to all state agencies.

(2) Exemptions: This rule shall apply to a state agency to the extent that it has not promulgated a rule contrary to the provisions of Rule 471-X-1-.04, and shall not apply to an agency which is exempt from OIT policy authority. Exemptions to OIT policy authority are found in Code of Ala. 1975, §§41-4-291, 41-4-293, 41-28-2(5), or by operation of agency-specific statutes. Agencies which are exempt from OIT policy authority and which have rulemaking authority may by rule adopt, in whole or in part, the provisions of Rule 471-X-1-.04.

(3) Construction: Nothing in this rule shall be construed to require any record or signature to be created, generated, sent, communicated, received, stored, or otherwise processed or used by electronic means or in electronic form. Any agency may, by rule or written policy, specify which signatures or documents it will or will not accept by electronic means or in electronic form.

History

• Author: Taylor Nichols
• Authority: Code of Ala. 1975, §8-1A-19, Ala. Act 2021-304.
• New Rule: Published August 31, 2021; effective October 15, 2021.

Ala. Admin. Code r. 471-X-1-.06 Open Records Requests

(1) The records of the Office of Information Technology are public records and are open to public inspection during normal working hours. Notwithstanding the foregoing, the following records shall be held confidential as records concerning security plans, procedures, assessments, measures, or systems, or records the disclosure of which would be detrimental to the best interests of the public:

(a) Information which is in the custody of OIT but which is owned by another public entity to which OIT provides services, and which can be disclosed via the owner entity. If such information is requested from OIT, OIT will redirect all such requests to the owner entity.

(b) Administrative or technical information regarding computer hardware, software, and networks which, if disclosed could aid or allow a security breach or any unauthorized access. This includes without limitation:

1. Software source code and configurations, whether developed by OIT or otherwise;

2. Login or authentication credentials for any electronic system, whether such credentials are administrative or individual;

3. Records pertaining to the administration of information technology systems, including cyber security plans; vulnerability testing, reports, and assessments materials; detailed network system designs, diagrams, and schematics; detailed hardware and software inventories, or other materials, the release of which would aid an attempted security breach or circumvention of law as to the items assessed;

4. Any audit, assessment, compliance report, work papers or any combination of these that if disclosed could allow unauthorized access to the state's information technology assets;

(c) Procurement documents prior to the award of any request for bid, request for proposal, or similar solicitation except as otherwise directed under the authority of the Chief Procurement Officer of the State of Alabama. Procurement documents pursuant to a cancelled or unawarded request for bid, request for proposal, or similar solicitation shall not be available for inspection or release if there is a pending procurement related to such documents.

(d) Data which is protected as a matter of state or federal security or privacy statute, regulation, or policy, including without limitation:

1. Sensitive Personally Identifying Information as defined in Code of Ala. 1975, §8-28-2(6);

2. Protected Health Information as defined in the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Privacy Rule;

3. Federal Tax Information as defined and regulated by the US Internal Revenue Service Publication 1075;

4. Criminal Justice Information as defined and regulated by the Federal Bureau of Investigation Criminal Justice Information Services (CJIS) Security Policy; and

5. In addition to any statutory or regulatory definitions, any biometric data or geolocation data of any individual.

History

• Author: Taylor Nichols
• Authority: Code of Ala. 1975, §36-12-40.
• New Rule: Published August 31, 2021; effective October 15, 2021.