Chapter 4 – Information Technology

41010.1 Policy

• The Director, Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)) and Executive Management of the California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation) recognize Information Technology (ITInformation Technology) as an indispensable tool of modern government. Therefore, it is the policy of the Director to support and promote the departmental use of innovative information technologies in order to increase worker productivity, improve departmental services, and strengthen the overall effectiveness of management, while saving money and reducing the overall cost of government. The definitions and acronyms contained here ensure the consistent use of ITInformation Technology definitions and acronyms throughout the Department Operations Manual (DOMDepartment Operations Manual) Chapter 4 – Information Technology.

41010.2 Purpose

• The purpose of the Department’s ITInformation Technology Definitions and Acronyms policy is to ensure that proven management methods for the guidance and control of planning, acquisition, development, operation, maintenance, and evaluation of information management applications are established in a manner that provides for the most efficient, effective, and economical use of the Department’s resources for ITInformation Technology.

41010.3 Definitions

• -A-

  • Access

    • Ability and means to communicate with or otherwise interact with a system, to use system resources to handle information, to gain knowledge of the information the system contains, or to control system components and functions.

  • Access Authorization

    • The granting of permission to execute a set of operations in a computer system.

  • Access Control

    • The process of granting or denying specific requests to: 1) obtain and use information and related information processing services; and 2) enter specific physical facilities (e.g., federal buildings, military establishments, and border crossing entrances).

  • Access Management Group

    • A group that is responsible for access permissions granted to CDCRCalifornia Department of Corrections and Rehabilitation’s Information Assets, including the CDCRCalifornia Department of Corrections and Rehabilitation Network, and departmental applications and databases.

  • Accountability

    • The state of being liable, responsible and answerable.

  • AISO

    • Agency Information Security Office – Provides information security recommendations, guidance, and authority.

  • AMS

    • Application Maintenance and Support – Provides ITInformation Technology business application development, maintenance and support services spanning across all CDCRCalifornia Department of Corrections and Rehabilitation divisions, including adult and juvenile offenders, parole operations, and administration.

  • Application Disaster Recovery Plan

    • A plan devised to process a computer application (application) after is has been distrupted for some period of time.

  • Asset

    • Anything (tangible or intangible) that has value to CDCRCalifornia Department of Corrections and Rehabilitation.

  • Authentication

    • Authentication is the process of determining whether someone or something is, in fact, who or what it is declared to be. To access most technology services you must provide such proof of identity. In private and public computer networks (including the Internet), authentication is commonly used by requiring login passwords or passphrases; knowledge of such is assumed to guarantee that the user is authentic. Thus, when you are asked to “authenticate” to a system, it usually means that you enter your username and/or password for that system.

  • Authorization

    • In computing systems, authorization is the process of determining which permissions a person or system is supposed to have. In multi-user computing systems, a system administrator defines which users are allowed access to the system, as well as the level of privileges they are eligible to access (e.g., access to file directories, hours of access, amount of allocated storage space). Authorization can be seen as both the preliminary setting of permissions by a system administrator, and the actual checking of the permission values when a user obtains access. Authorization is usually preceded by authentication.

  • Availability

    • Assurance that the systems responsible for delivering, storing and processing information are accessible when needed, by those who need them.

• -B-

  • Back-up

    • A process by which data is copied in some form so as to be available and used if the original data from which it originated is lost, destroyed or corrupted.

  • BIS

    • Business Information System – A fully implemented automated business management system that creates, tracks, and reports all of the Department’s business transactions.

  • Blog

    • A web site containing frequent publications of personal thoughts and web links, coined from the words weblog, maintained for the purpose of commentary, or other material such as graphics or video.

  • BPHBoard of Parole Hearings (formerly Board of Prison Terms)

    • Board of Parole Hearings – Conducts parole consideration; rescission, parole, revocation, and parole progress hearings for adult inmates and parolees.

  • Business Continuity Management Program

    • An ongoing governance process supported by senior management and resourced to ensure that the necessary steps are taken to identify the impact of potential losses, maintain viable recovery strategies and plans, and ensure continuity of products/services through exercising, rehearsal, testing, training, and maintenance.

  • Business Continuity Plan (BCPBudget Change Proposal)

    • A plan that documents arrangements and procedures that enable an organization to respond to an event that lasts for an unacceptable period of time and return to performing its critical business functions after an interruption.

• -C-

  • CALPIACalifornia Prison Industry Authority (formerly PIA) California Prison Industry Authority

    • A State-operated agency that provides productive work assignments for offenders in California’s adult correctional institutions. CALPIACalifornia Prison Industry Authority (formerly PIA) operates more than 60 service, manufacturing, and agricultural industries at prisons throughout California.

  • CAS

    • Corrections Application Solutions – Develops and maintains applications and systems used by divisions and programs throughout CDCRCalifornia Department of Corrections and Rehabilitation to support statewide offender, parole, and juvenile operations.

  • CCHCS

    • California Correctional Health Care Services – A department under federal receivership responsible for providing constitutionally adequate medical care to patient-inmates of the CDCRCalifornia Department of Corrections and Rehabilitation within a delivery system the state can successfully manage and sustain.

  • CDCRCalifornia Department of Corrections and Rehabilitation Network

    • The system of telecommunication devices, workstations, servers, and peripherals used to provide inter- and intra-facility connectivity that enable CDCRCalifornia Department of Corrections and Rehabilitation employees to access information assets and electronic communications. The CDCRCalifornia Department of Corrections and Rehabilitation Network is managed by the CDCRCalifornia Department of Corrections and Rehabilitation Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)) division and the Office of Technology Services (OTech).

  • Chain E-mail or Letter

    • E-mail sent to successive people. Typically the email contains directions for the recipient to forward the email to multiple people. The contents usually contain promises of good luck for the recipient or money if the directions are followed.

  • Classification

    • The assignment of information, including a document, to a category on the basis of its sensitivity concerning disclosure, modification, or destruction.

  • Client (User)

    • The individual or organization that utilizes a product.

  • Community Transition Program (CTP)

    • CTP obtains and utilizes information about offenders in order to develop and implement effective and specific reentry plans that maximize a parolee’s opportunity to successfully reintegrate into the community.

  • Component

    • A component is defined in SAMState Administrative Manual § 5013 as any individually identified piece of hardware, such as the mainframe, tape drive, disk drive, power supply unit, controller, punch, reader, printer, modem, CRTCrisis Response Team, keyboard, remote device, and the like.

  • Computer Contaminant

    • Any set of computer instructions that, outside the intent and without the permission of the owner of such information, is designed to modify, damage, or destroy a computer, system, or network, or to record or transmit information within a computer, system, or network. Such contaminants include, but are not limited to, the group of self-replicating or self-propagating computer instructions commonly termed viruses, Trojans, and worms which are designed to affect computer programs or data, consume computer resources, modify, destroy, record or transmit data, or otherwise usurp the normal operation of the computer, system, or network.

  • Computer Network

    • Any system that provides communication among one or more computer systems and input/output devices including, but not limited to, display terminals and printers connected by telecommunication facilities.

  • Computer Program or Software

    • A set of instructions, or statements or related data, that when executed in actual or modified form cause a computer, system, or network to perform specified functions.

  • Computer Security

    • The technological safeguards and managerial procedures that can be applied to computer hardware, programs, data, and facilities to ensure the availability, integrity, and confidentiality of computer-based resources. This can also include assurance that intended functions are performed as planned.

  • Computer Services

    • Includes, but is not limited to, computer time, data processing, storage functions, other uses of a computer, system, or network.

  • Computer System

    • A device or collection of devices, including support devices but excluding calculators that are not programmable and not capable of being used in conjunction with external files, one or more of which contains computer programs, electronic instructions, input data, and output data, and which performs functions including, but not limited to, logic, arithmetic, data storage and retrieval, communication, and control.

  • Computer-Based Tools

    • Software or computer programs that improve or enable a user’s ability to configure and manage ITInformation Technology components.

  • Confidential Information

    • Information maintained by State agencies that is exempt from disclosure under provisions of the California Public Records Act (PRAPublic Records Act) (GCGovernment Code § 6250 et seq.) or other applicable state or federal laws. All inmate, parolee, ward, and employee information that has not been explicitly defined as public information in §3261.2 of Title 15 should be treated as Confidential Information.

  • Confidentiality

    • Assurance that information is shared only among authorized persons or organizations. Breaches of confidentiality can occur when data is not handled in a manner adequate to safeguard the confidentiality of the information concerned. Such disclosure can take place by word of mouth, by printing, copying, e-mailing or creating other data. The classification of the information should determine its confidentiality and the appropriate safeguards.

  • Correctional Offender Management

    • Profiling for Alternative Sanctions (COMPAS) Enables CDCRCalifornia Department of Corrections and Rehabilitation to perform needs assessments and follow adult offenders from their intake at the reception centers through the completion of their parole supervision requirements.

  • Cost Thresholds

    • Cost thresholds are the set dollar amounts assigned to agencies based on their size and past experiences with Department delegations can be found at: http://www.cio.ca.gov/Contact_Us/staff_assignments.html CPAT California Parole Apprehension Team – Enhances public safety through parole intervention and parolee-at-large apprehension.

  • Critical Application

    • An application that is so important to the Department that its loss or unavailability is unacceptable. With a critical application, even short-term unavailability of the information provided by the application would have a significant negative impact on the health and safety of the public or Department employees, the fiscal or legal integrity of operations, or the continuation of essential programs.

  • CTA

    • California Technology Agency – State of California’s ITInformation Technology control agency.

  • Custodian of Information

    • An employee or organizational unit (such as a data center or information processing facility) acting as caretaker of an automated file or database.

• -D-

  • DART Desktop Advanced Research Team

    • Provides system level operational support of all end-point devices.

  • Data

    • A representation of facts, concepts, or instructions in a formalized manner suitable for communication, interpretation, or processing by humans or by automated means.

  • Data Classification

    • Data Classification is the conscious decision to assign a level of sensitivity to data as it is being created, amended, enhanced, sorted, or transmitted. The classification of the data should then determine the extent to which the data needs to be controlled/secured and is indicative of its value in terms of Business Assets. The classification of data and documents is essential to differentiate between that which is of little (if any) value, and that which is highly sensitive and confidential. The classification of data helps determine what baseline security controls are appropriate.

  • Data Processing Equipment

    • Computers, network components, and other devices that facilitate, enable, or depend upon data communications. Network devices such as, but not limited to, routers, hubs, wires, and servers are data processing equipment.

  • Data Processing Systems

    • A system, including computer systems and associated personnel, that performs input, processing, storage, output, and control functions to accomplish a sequence of operations on data.

  • Data Security

    • Protecting data from unauthorized access, modification, destruction, or disclosure.

  • Data Transmission

    • The conveying of data from one functional unit to one or more additional functional units through the transmission of signals by wire, radio, light beam, or any other electromagnetic means.

  • DEC

    • Disability Effective Communications System – An ITInformation Technology program created and maintained by EISEnterprise Information Services (formerly Information Services Division) that ensures that inmate and parolee due process rights are recognized by identifying and accommodating their disabilities and effective communication special needs.

  • Decentralized Applications

    • Systems that run on more than one computer in geographically separated locations. The term also refers to systems that are not supported by a single organization, such as EISEnterprise Information Services (formerly Information Services Division).

  • Defect

    • A variance from specifications/standards or an attribute/function not contained in the software requirements specifications.

  • Denial of Service

    • An attack that prevents or impairs the authorized use of networks, systems, or applications by exhausting resources.

  • Deputy Director Operations

    • Responsible for all aspects of EISEnterprise Information Services (formerly Information Services Division)’s day-to-day operations.

  • Development

    • Activities or costs associated with the analysis, design, programming, staff training, data conversion, acquisition, and implementation of new ITInformation Technology applications.

  • Disaster Recovery Operation

    • The act of recovering from the effects of a disaster or disruption to a computer facility, and the preplanned restoration of facility capabilities.

  • Disaster

    • A human or natural occurrence causing destruction and distress, after which a business is deemed unable to function.

  • Disaster Recovery

    • The ability of an organization to respond to a disaster or an interruption in services by implementing a disaster recovery plan to stabilize and restore the organization’s critical functions.

  • DRPDivision of Rehabilitative Programs

    • Disaster Recovery Plan – The management approved document that defines the resources, actions, tasks and data required to manage the technology recovery effort. Usually refers to the technology recovery effort. This is a component of the Business Continuity Plan.

  • Documentation

    • Information about how specific applications are constructed, maintained, and used. It includes, but is not limited to, system and program design specifications, record formats, report layouts, program source and object code, job control language specifications, run instructions, key entry instructions, and data definitions.

  • DRDDischarge Review Date Tracker

    • Discharge Review State Tracker – Creates a calendar-based event driven solution which allows field agents and case records staff to determine when a parolee is due for a Discharge Review.

• -E-

  • E-mail

    • Written communication transmitted electronically using computers connected to network(s). Today’s email systems are based on a store-and-forward model. Email servers accept, forward, deliver and store messages. Neither the users nor their computers are required to be online simultaneously; they need connect only briefly, typically to an email server, for as long as it takes to send or receive messages.

  • EdCATS

    • Education Classroom Attendance Tracking System – Allows teachers to log academic and vocational classroom hours and track milestones achieved by students while attending those classes.

  • EISEnterprise Information Services (formerly Information Services Division)

    • Enterprise Information Services – A division of CDCRCalifornia Department of Corrections and Rehabilitation responsible for the enterprise-wide execution of all ITInformation Technology systems and services.

  • Electronic Data Processing (EDPElectronic Data Processing (see IT))

    • Equipment EDPElectronic Data Processing (see IT) equipment is defined as:

      • Central processing units and all related features and peripheral units, including processor storage, console devices, channel devices, etc.

      • Minicomputers, microcomputers, personal computers, and all peripheral units associated with such computers.

      • Special purpose systems including word processing, magnetic ink character recognition, optical character recognition, photocomposition, typesetting, and electronic bookkeeping.

      • Communications devices used for data transmission such as modems, data sets, multiplexors, concentrators, switches, local area networks, private branch exchanges, network control equipment, and microwave or satellite communications systems.

      • Input-output (peripheral) units (off-line or on-line) including: terminals, card readers, optical character readers, magnetic tape units, mass storage devices, card punches, printers, computer output to microfilm converters, video display units, data entry devices, FAXs, teleprinters, plotters, or any device used as a terminal to a computer, and control units for such devices.

  • Encryption

    • Data encryption is a means of scrambling or ciphering the data so that it can be read only by the recipient – the person(s) holding the ‘key’ – a password of some sort. Without the ‘key,’ the ciphered data cannot be opened and read.

  • Enterprise Architecture (EA)

    • The CDCRCalifornia Department of Corrections and Rehabilitation unit responsible for managing CDCRCalifornia Department of Corrections and Rehabilitation’s enterprise architecture program, a strategic practice for maintaining the ITInformation Technology architecture portfolio to facilitate more informed and effective ITInformation Technology decisionmaking, both strategically and operationally. This includes, but is not limited to, the Business, Application, Information/Data, Technical, and Security Architecture domains.

  • eOMIS Electronic Offender Management Information System

    • A real-time application that increases the availability of accurate and complete offender information so CDCRCalifornia Department of Corrections and Rehabilitation can more efficiently manage inmates.

  • ERMSElectronic Records Management System

    • Electronic Records Management System – A document management system that provides a digitally scanned and uploaded central records repository.

  • EWACS

    • Enterprise Web and Collaboration Solutions – Provides web application development, operational support, and end user support for the enterprise. Develops public and internal facing web and client-based applications that meet various business needs.

• -F-

  • Failure

    • Inability of a product or service to perform its required functions within previously established limits.

  • FIS

    • Field Information System – Documents all contacts by parole agents with juvenile offenders.

  • Forwarded E-mail

    • E-mail resent from an internal network to an outside point, whether internal or external to CDCRCalifornia Department of Corrections and Rehabilitation.

• -G-

  • Guideline

    • A description that clarifies what should be done and how to achieve the objectives set out in policies.

• -H-

  • Handheld Computer Synonym for Personal Digital Assistant.

  • Hardening

    • A defense strategy to protect against attacks by removing vulnerable and unnecessary services, patching security holes, and securing access controls.

  • Hardware

    • The physical equipment or machinery (computers, terminals, printers, disc drives, etc.) used in ITInformation Technology systems.

  • HAWI

    • Holds and Warrants Interface – Easily accesses parolee information to automate the issuance of holds and warrants.

  • High Risk Confidential Information (HRCI)

    • Non-public information that if disclosed could result in a significant harm (including financial, legal, risk to life and safety or reputational damage) to the CDCRCalifornia Department of Corrections and Rehabilitation or individual(s). Examples of HRCI include, but are not limited to, information such as the following:

      • Personally identifiable information such as person’s name in conjunction with the person’s Social Security Number, credit or debit card information, individual financial account, driver’s license number, state IDInstitutions Division (see DAI) number, passport number, or a name in conjunction with biometric information;

      • Personal health information such as any information about health status, provisions of health care, or payment for health care information as protected under HIPAA;

      • Correctional Offender Record Information

      • Information that if disclosed would “reveal vulnerabilities to, or otherwise increase, the potential for an attack on an ITInformation Technology system of a public agency.” Examples include, but are not limited to, firewall and router configurations, server names, IP addresses, and other system configuration details;

      • Any documentation of information which contains information or data within any Gang Database.

      • Records of investigations, intelligence information, or security procedures. This includes, but is not limited to, information identifying confidential informants.

• -I-

  • Information Assets

    • All categories of information existing in any form, including electronic or hard copy that is stored, used, or created by CDCRCalifornia Department of Corrections and Rehabilitation and have value to the organization.

  • Information Governance

    • The process of official enterprise-level decision making for CDCRCalifornia Department of Corrections and Rehabilitation information standards to ensure the effective, efficient, and secure use of CDCRCalifornia Department of Corrections and Rehabilitation information. This includes officially making and adopting Data Classification decisions for CDCRCalifornia Department of Corrections and Rehabilitation information.

  • Information Integrity

    • The condition in which information or programs are preserved for their intended purpose, including the accuracy and completeness of information systems and the data maintenance within those systems.

  • Information Owner

    • Group(s) or person(s) responsible for individual and/or collective decision-making regarding specific CDCRCalifornia Department of Corrections and Rehabilitation Information Assets. This includes decision-making regarding the appropriate use, access, controls, and Data Classifications for those Information Assets.

  • Information Processing

    • The systematic performance of operations upon data such as handling, merging, sorting, and computing; synonymous with data processing systems.

  • Information Security

    • The protection of information from a wide range of threats in order to ensure business continuity, minimize business risk, and maximize return on investments and business opportunities. Information exists in many forms: printed or written on paper, stored electronically, transmitted by post or electronic means, on films, and spoken.

  • Information Security Incident

    • An information security incident is indicated by a single or a series of unwanted or unexpected information security events that have a significant probability of compromising business operations and threatening information security.

  • Information Security Standards and Guidelines (ISSG)

    • Compilation of the standards and guidelines comprising CDCRCalifornia Department of Corrections and Rehabilitation’s program to ensure the protection and security of information asssets.

  • Information Technology

    • All computerized and auxiliary automated information handling, including: Systems design and analysis; conversion of data; computer programming; information storage and retrieval; voice, video, and data communications; requisite system controls; simulation; and, all related interactions between people and machines.

  • Input-Output Unit/Device

    • The equipment used to communicate with a computer; commonly termed I/O (Input/Output).

  • Instant Message (IMInstructional Memorandum)

    • A type of communications service that enables a user to exchange text messages in real time among two or more individuals logged into a particular instant messaging system from a computer workstation.

  • Integrity

    • As it pertains to data, is the assurance that the information is authentic and complete. Ensuring that information can be relied upon to be sufficiently accurate for its purpose. The integrity is not only whether the data is correct, but also whether it can be trusted and relied upon.

  • Internet

    • The World Wide Web (WWW), consisting of a network of networks.

  • Intranet

    • A term that refers to a closed network of networks. In the context of CDCRCalifornia Department of Corrections and Rehabilitation, it refers to the web portal used for hosting information and documents for internal CDCRCalifornia Department of Corrections and Rehabilitation users only.

  • ISInformation Systems

    • Infrastructure Services – Creates, maintains, and supports all enterprise data activity necessary to facilitate CDCRCalifornia Department of Corrections and Rehabilitation’s current and future business needs as well as provide ongoing operations, production implementation, and control in a secure manner.

  • ISCInformation Security Coordinators

    • Information Security Coordinator – Each entity’s ISCInformation Security Coordinators is responsible for ensuring that applicable CDCRCalifornia Department of Corrections and Rehabilitation ITInformation Technology security policies and procedures are followed.

  • ITInformation Technology CSFO

    • ITInformation Technology Customer Service and Field Operations – Provides quality service, guidance and direction to customers in order to support their business needs by implementing cost-effective, innovative technologies and adopting operational ITInformation Technology best practices and standards.

  • ITPSP

    • ITInformation Technology Policy and Strategic Planning – Drives enterprise ITInformation Technology planning efforts necessary to support the Agency’s mission and future investments while ensuring compliance with national, State and local mandates.

• -J-

• -K-

• -L-

  • Law Enforcement Automated Data System (LEADS)

    • Parole LEADS is a web-based computer system that provides local California law enforcement agencies with information on CDCRCalifornia Department of Corrections and Rehabilitation parolees.

  • Life Cycle

    • The anticipated length of time that the ITInformation Technology system or application can be expected to be efficient and cost-effective and can continue to meet the agency’s programmatic requirements; synonymous with operational life of a system.

  • LINX

    • Link Investigation and Network Cross-Reference – Centralized web-based application that contains inmate gang affiliations and validation for adult offenders.

  • Local Area Network

    • A Local Area Network (LANLocal Area Network) is a computer network consisting of telecommunications devices such as routers, hubs, switches, firewalls, and computers such as workstations, servers, and peripheral devices.

  • LSTS

    • Lifer Scheduling and Tracking System – Supports the inmates sentenced to life parole suitability hearing process.

• -M-

  • Mainframe

    • Refers to large computers typically housed in a data center environment and running legacy systems. Mainframe computers have security components, such as Resource Access Management Systems, integrated into the operating system and can support many hundreds of users simultaneously.

    • Malicious Software

      • Malicious software, or malware, is any set of computer instructions that, outside the intent and without the permission of the owner of such information, is designed to modify, damage, or destroy a computer, system, or network, or to record or transmit information within a computer, system, or network. Such contaminants include, but are not limited to, the group of self-replicating or self-propagating computer instructions commonly termed viruses. Trojan Horses and worms are designed to affect computer programs or data, consume computer resources, modify, destroy, record, or transmit data, or otherwise usurp the normal operation of the computer, computer system, or computer network. Malware includes computer viruses, computer worms, Trojan Horses, most root kits, spyware, dishonest adware and other malicious or unwanted software.

  • MDOMentally Disordered Offender

    • Mentally Disorder Offender – Database that tracks MDOMentally Disordered Offender holds, creates hearing schedules, generates confirmation letters for evaluators and attorneys, and tracks MDOMentally Disordered Offender cases.

  • Mission-Critical Applications

    • Applications defined by CDCRCalifornia Department of Corrections and Rehabilitation that support business activities or processes that cannot be interrupted or unavailable for the Recovery Time Objective (RTO) defined by the agency without significantly jeopardizing the organization.

• -N-

  • Need-to-Know

    • Refers to a person having both a legitimate right and a reason to obtain information.

  • NIST

    • National Institute of Standards and Technology – A measurement standards laboratory which is a non-regulatory agency. NIST promotes innovation and industrial competitiveness by advancing measurement science, standards, and technology.

• -O-

  • OBITS

    • Offender Based Information Tracking System – Mission critical master record for all juvenile offender activity that feeds information into multiple systems.

  • One-Time Costs

    • Costs occurring only once that are associated with the analysis, design, programming, staff training, data conversion, acquisition, and implementation of new ITInformation Technology applications.

  • Operational Life

    • See Life Cycle.

  • Operations

    • Activities or costs associated with the continued use of ITInformation Technology applications. Operations include personnel associated with computer operations, including network operations, job control, scheduling, and key entry. It also includes the costs of computer time and other resources needed for processing. See SAMState Administrative Manual Section 4819.2.

  • OTech

    • Office of Technology Services – Provides ITInformation Technology services to many state, county, federal and local government entities throughout California.

  • Owner of Information

    • See Information Owner.

• -P-

  • PACATS

    • Parolee Automated Cash Assistance Tracking System – Tracks cash assistance provided to parolees throughout the state, separated by assistance type.

  • PALParolee-At-Large Trax

    • Parolee At Large Tracking System – Tracks CPAT agent caseloads.

  • Parole-LEADS

    • See Law Enforcement Automated Data System.

  • Personal Digital Assistant (PDAParole District Administrator)

    • Palm-sized computer that syncs with a computer workstation and allows users to refer to information from the workstation without having to print it out. Schedules, e-mails, documents, and spreadsheets as well as reference material such as dictionaries and phone lists can be stored and accessed as needed on the device. PDAs often are capable of wireless connectivity with LANs and the Internet.

  • Personally Identifiable Information

    • Personally Identifiable Information (PII) is the manifestation of an individual’s first name or first initial and last name, in combination with one or more of the following:

      • Social Security Number;

      • Driver’s license number;

      • State issued IDInstitutions Division (see DAI) card;

      • Credit or debit card number in combination with any required security code or password that could permit access to an individual’s financial account;

      • Medical information, history, mental or physical condition, treatment or diagnosis by a health care professional;

      • Health information, policy number or subscriber IDInstitutions Division (see DAI), unique identifier, or any information in an application and claims history, including any appeals records.

  • Physical Security

    • The measures designed to safeguard personnel; to prevent unauthorized access to equipment, installations, material, and documents; and to safeguard them against unauthorized access, damage, and theft.

    • Post Implementation Evaluation Report (PIERPost Implementation Evaluation Report) The review of a computer, computer system, or computer network that has been in operation for at least six months and no longer than two years for the purpose of matching the requirements of the system against what has been produced so as to ensure that stated requirements have been met.

  • Policy

    • Overall intention and direction as formally expressed by management.

  • PPPMA

    • Policy/Planning, Project Management and Acquisitions is the EISEnterprise Information Services (formerly Information Services Division) unit responsible for EA, PPRM, QPAC, and ITPSP.

  • PPRM

    • Portfolio, Project and Resource Management is the EISEnterprise Information Services (formerly Information Services Division) unit that improves the management of ITInformation Technology investments by utilizing project and portfolio managements tools; incorporating proven methodologies; and following best practice disciplines to assist in the identification, ranking, and justification of investments and the implementation of funded projects.

  • PRAS

    • Parole Restitution Application System – Tracks original court ordered restitution payments and balances.

  • Privacy

    • The right of individuals and organizations to control the collection, storage, and dissemination of information about themselves.

  • Process

    • The work activities that produce products, including the efforts of people and equipment.

  • Product

    • The output of a process, including the goods and services produced by individuals and the organization.

  • Production Application

    • A computer-based process that stores, manipulates, or reports departmental information.

  • Program

    • In the ITInformation Technology field, a program is the set of instructions by which a computer operates to accomplish a specific task.

  • Program Application Manager

    • Department supervisory and management staff responsible for managing or supervising employees’ use of an automated file or database.

  • Programming

    • Detailed design encompassing the actual development and writing of program units or modules.

  • Project

    • A planned sequence of tasks to respond to a problem or opportunity; an activity with a beginning and an end and containing a set of resources.

  • Proprietary Software

    • Software packages which are developed by independent vendors and marketed to users.

  • Protected Health Information

    • Individually identifiable information in electronic or physical form created, received, or maintained by health care organizations such as health care payers, providers, plans, and contractors. State laws require special precautions to protect from unauthorized use, access or disclosure.

  • Protected Personal Information

    • Information that identifies or describes an individual and must be protected from inappropriate access, use, or disclosure as defined in applicable state and federal laws.

  • Protecting Sensitive Information

    • Typically means providing for one or more of the following:

      • Confidentiality – Disclosure of the information must be restricted to designated parties.

      • Integrity – The information must be protected from errors or unauthorized modification.

      • Availability – The information must be available within some given timeframe (i.e., protected against destruction). (NIST Computer System Laboratory CSL Bulletin 92-11.)

  • Public Information

    • Information maintained by State agencies that is not exempt from disclosure under the provisions of state or federal laws. Public Information is open to inspection by any person during normal business hours (PRAPublic Records Act § 6253(a)).

• -Q-

  • QPAC

    • Quality Project Authority and Compliance – Staff in EISEnterprise Information Services (formerly Information Services Division) that advocates for CDCRCalifornia Department of Corrections and Rehabilitation’s ITInformation Technology projects to Control Agencies for the purpose of securing project authority and funding approval, as well as the project’s successful completion.

  • Quality

    • The extent to which a product meets the expectations and requirements of the user.

  • Quality Assurance (QAQuality Assurance)

    • A staff function designed to support line management in performing the Quality Control function. As such, QAQuality Assurance identifies the processes (both good and bad) which affect quality, and is used to advise management of such effects. A management decision may then be necessary to ensure that QCQuality Control techniques are implemented and maintained; and, (2) The function that uses measurement and analysis to continually improve processing, procedures, and standards so that management can be reasonably assured of their staff following such methods, procedures, and standards, as well as staff’s ability to produce products which meet specified requirements.

  • Quality Control (QCQuality Control)

    • The collection of activities to ensure that defects are neither made nor implemented. While QAQuality Assurance monitors the processes involved in the production cycle, QCQuality Control is an integral part of work and is the responsibility of each employee; and, (2) A line function used to measure quality associated with specific products or services. QCQuality Control is the responsibility of each ITInformation Technology area, and it is the function responsible for the quality of the work being done within a specific area or for a specific project.

• -R-

  • Recovery Point Objective (RPO)

    • The maximum amount of data loss an organization can sustain during an event.

  • Recovery Time Objective (RTO)

    • The period of time within which systems, applications, or functions must be recovered after an outage (e.g. one business day). RTOs are used as the basis for the development of recovery strategies, and as a determinant as to whether or not to implement the recovery strategies during a disaster situation.

  • Requirement

    • The specification(s) for satisfying a user need is associated with a standard by which the satisfaction of that need can be measured.

  • Resource Access Management Facility

    • An application within IBM-based computer systems that reviews logons, passwords, and permissions before permitting access to information.

  • Risk

    • In the context of information systems, the likelihood or probability that a loss of information assets or breach of security will occur.

  • Risk Analysis

    • The process of identifying the vulnerabilities and threats to an organization by assessing the critical functions necessary for an organization to continue business operations, and defining the controls in place to reduce organization exposure and evaluating the cost for such controls.

  • Risk Assessment

    • Overall process of risk analysis and risk evaluation.

  • Risk Evaluation

    • The process of comparing the estimated risk against given risk criteria to determine the significance of the risk.

  • Risk Management

    • The process of coordinating activities to direct and control the organization with regard to risk.

• -S-

  • Sensitive Information

    • Information maintained by State agencies that requires special precautions to protect it from unauthorized use, access, disclosure, modification, loss, or deletion. Sensitive information may be either Public or Confidential. It is information that requires a higher than normal assurance of accuracy and completeness. The key factor for Sensitive Information is that of integrity. Typically, Sensitive Information includes records of financial transactions and regulatory actions.

  • Smartphone

    • A cellular telephone with built-in applications and Internet access. Smartphones provide digital voice service as well as text messaging, e-mail, Web browsing, still and video cameras, MP3 players, video viewing and often video calling. In addition to their built-in functions, smartphones can run a myriad of applications, turning the once single-minded cellphone into a mobile computer.

  • Software

    • Programs, procedures, rules, and any associated documentation pertaining to the operation of a system. (Contrast with hardware.) Spam Unauthorized and/or unsolicited electronic mass mailings.

  • Stakeholder

    • A person, group, organization, member, or system who affects or can be affected by an organization’s or system’s actions.

• -T-

  • Threat

    • The potential cause of an unwanted incident, which may result in harm to a system or organization.

• -U-

  • Unauthorized Disclosure

    • The intentional or unintentional disclosure of confidential information to people inside and/or outside the CDCRCalifornia Department of Corrections and Rehabilitation who do not have authorization predicated on a “need to know” basis.

  • Unit Testing

    • Testing performed on a single, stand-alone module or unit of code.

  • User Identification (IDInstitutions Division (see DAI))

    • The logon name an individual user to access a computer or network system.

  • User of Information

    • An individual having specific limited authority from the owner of information to view, change, add to, disseminate, or delete such information.

• -V-

  • Validation

    • The process of comparing a product in any stage of its development with specified requirements to determine whether the correct product is being produced.

  • Virus

    • Small but insidious piece of programming code that attacks computer and network systems through contaminated (infected) data files, introduced into a system via email, portable storage media or the Internet. The code attaches itself to the target computer’s operating system or other programs, and may automatically replicate itself to spread to other computers or networks.

  • Vulnerability

    • A weakness of an asset or group of assets that can be exploited by one or more threats.

• -W-

  • Wide Area Network (WAN)

    • Two or more LANs connected together. A communications network that uses devices over telephone lines, fiber-optics, satellite dishes, or radio waves to span a larger geographic area that can be covered by a LANLocal Area Network.

  • Wireless

    • Referring to communications transmitted without wires, such as radio, microwave, or infrared.

  • Workstation

    • Any device commonly called a microcomputer, personal computer, or terminal used for processing, storing, or sending information.

  • Worm

    • A computer worm is a standalone malware computer program that replicates itself in order to spread to other computers. Often, it uses a computer network to spread itself.

  • WWW

    • An abbreviation for World Wide Web. See Internet.

• -X-

• -Y-

• -Z-

41010.4 Revisions

• The Director of EISEnterprise Information Services (formerly Information Services Division), or designee, shall be responsible for ensuring that the contents of this Article are kept current and accurate.

41010.5 References

• GCGovernment Code §§ 6250 – 6265, and 11702 (a) Title 15 § 3261.2 SAMState Administrative Manual §§ 4819.2, 5013, 5320.5 DOMDepartment Operations Manual §§ 52070.22, 52070.24 Health Insurance Portability and Accountability Act (HIPAA) of 1996 PCPenal Code §§ 13100-13104 PRAPublic Records Act § 6254.19 PRAPublic Records Act § 6254 (f) California Senate Bill 1386 Confidentiality of Medical Information Act, California Civil Code § 56 et seq.

• Patients’ Access to Health Records Act

• California Health and Safety Code §§ 123100-123149.5

41020.1 Policy

• The Department’s executive management is responsible for the establishment of departmental policy pertaining to the use of information technology, the prioritization of departmental resources, and strategic planning and leadership to seek out opportunities for employing information technology toward achievement of the Department’s mission, goals, and objectives. Department executive leadership is responsible for ensuring that information technology is used within the guidelines contained in this manual section and those established by other control agencies.

41020.2 Purpose

• The purpose of this policy is to ensure that departmental resources and information technology are used optimally in achieving the Department’s mission, goals, and objectives. Additionally, this policy assures that uses of information technology follow the guidelines established internally by CDC management and externally by State control agencies.

41020.3 Management Information Systems Committee

• The MISManagement Information Systems Committee shall:

  • Provide executive leadership in the development of EDPElectronic Data Processing (see IT) projects and policy.

  • Enforce compliance of the project approval process with the Department’s Strategic Plan.

  • Prioritize EDPElectronic Data Processing (see IT) projects in terms of their importance to the Department’s Strategic Plan.

  • Review and enforce policy and procedures in support of EDPElectronic Data Processing (see IT) projects.

  • As individual committee members, serve as liaisons with their respective end user communities to promote, coordinate, and facilitate automation efforts, and to ensure effective communication regarding EDPElectronic Data Processing (see IT)-related issues throughout all levels of the Department.

  • Educate management in the advantages of automation, new EDPrelated technical innovations, and methods to maximize the efficiency and benefits of automation, and to minimize EDPElectronic Data Processing (see IT) development and operating costs.

  • Provide review and approval of all information technology procurements not covered under the approved Workgroup Computing Policy.

  • Provide ongoing review of CDC-approved EDPElectronic Data Processing (see IT) projects, terminating those projects which are no longer consistent with the Department’s Strategic Plan.

• Note that the MISManagement Information Systems Committee does not make any decisions on funding of ITS projects. The committee only recommends the prioritization of these projects.

• See DOMDepartment Operations Manual 43020.4, Information Management Annual Plan, for additional information about the role and responsibilities of the MISManagement Information Systems Committee.

41020.3.1 MIS Committee Composition

• The MISManagement Information Systems Committee is comprised of the following voting staff:

  • The Chief Deputy Director (Chairperson).

  • Three representatives from ASDSee Division of Administrative Services (DAS) (see ASB).

  • Three representatives from ECEvidence Code&ISDInformation Services Division (see EIS).

  • Five representatives from Institutions Division.

  • Three representatives from P&CSDParole & Community Services Division (see DAPO).

  • One representative from P&CDPlanning and Construction Division (see FPCM).

  • One representative from CalPIA.

• These representatives shall be appointed for an indeterminate period.

• In the absence of the Chief Deputy Director, the Deputy Director of ASDSee Division of Administrative Services (DAS) (see ASB) shall chair MISManagement Information Systems Committee meetings.

• The committee shall meet on a quarterly basis and more often as needed. MISManagement Information Systems Committee meetings are generally open to all wishing to attend.

41020.4 Responsibility MIS‑SU

• MISManagement Information Systems-SU provides functional support to the MISManagement Information Systems Committee. The MISManagement Information Systems-SU’s responsibilities include: (1) coordinating MISManagement Information Systems Committee meeting agendas; (2) coordinating the review of proposed ITS and to furnish recommendations for MISManagement Information Systems Committee review; (3) preparing annual updates for the Cabinet on all CDC automation efforts for the current year and on strategic planning for the coming year; (4) developing, coordinating, and participating in presentations for the committee that address current technical innovations; (5) coordinating the review of ITS concepts to ensure compliance and consonance with the budget cycle; (6) recording the actions and decisions of the MISManagement Information Systems Committee for distribution to appropriate departmental staff; and, (7) conducting special projects as assigned by the committee.

• Departmental Workgroup Computing Coordinator

  • The Workgroup Computing Coordinator’s responsibilities include: (1)ensuring that workgroup computing hardware and software requests comply with departmental and control agency policy requirements; (2)preparing the appropriate certification documents for workgroup computing procurements; (3) providing assistance in the completion of workgroup computing requests; (4) maintaining the departmental Workgroup Computing Policy and Modem Policy, as well as related equipment request forms for distribution to departmental staff; (5) overseeing the personal computer Post Implementation Evaluation Report (PIERPost Implementation Evaluation Report) process; (6) maintaining the departmental personal computer equipment inventory; and (7) maintaining a record of all personal computer procurements, including those justified through the use of an FSRFeasibility Study Reports, a CDC Internal Summary Fact Sheet, or the approved Workgroup Computing Policy.

• Department Information Security Officer

  • The CDC Information Security Officer (ISOInformation Security Officer) is assigned management responsibility for overseeing and administering the Centralized Information Security Program and is charged with the responsibility of assuring the Department’s compliance with the SAMState Administrative Manual 4840, Security and Risk Management; 4989.7, Security of Personal Computer Systems; and 20013, EDPElectronic Data Processing (see IT) Audit Requirements. This program encompasses all automated ITS for which CDC has administrative responsibility. It includes the procedures, guidelines, and safeguards that are required to protect data, confidentiality, and privacy rights and ensures the integrity, audibility, and controllability of these ITS. All new policies and revisions of existing policy relating to automated information security will emanate from this office.

• ISDInformation Services Division (see EIS)

  • It is the responsibility of ISDInformation Services Division (see EIS) to establish and maintain the departmental EDPElectronic Data Processing (see IT) strategic planning process and to oversee the development of all departmental EDPElectronic Data Processing (see IT) policies, including assurance that such policies meet control agency guidelines. ISDInformation Services Division (see EIS) is also responsible for ensuring that such considerations as compatibility and connectivity of all proposed automated projects are taken into consideration in the project approval process.

  • ISDInformation Services Division (see EIS) is responsible for the development, maintenance, operation, and support of all departmental PCPenal Code applications except Institutions Division projects, and for all automated systems requiring control agency oversight unless specifically delegated to another unit by the MISManagement Information Systems Committee.

  • Under the User Project Management concept, the User Manager is responsible for all project reporting to control agencies, the user division, and the MISManagement Information Systems Committee. ISDInformation Services Division (see EIS) provides technical management and staff who work as team members accountable to the User Manager on the project and to ISDInformation Services Division (see EIS) on technical issues (e.g., project schedules).

  • ISDInformation Services Division (see EIS) is also responsible for tracking all projects approved by the MISManagement Information Systems Committee, and ensuring that all projects comply with State reporting requirements. All project reporting to control agencies shall be coordinated through ISDInformation Services Division (see EIS), which shall maintain correspondence files on control agency reporting.

  • ISDInformation Services Division (see EIS) shall report directly to the appropriate Division (User Manager Concept) associated with each EDPElectronic Data Processing (see IT) Project, and to the MISManagement Information Systems Committee on all approved projects.

  • ISDInformation Services Division (see EIS) is responsible for the security of information technology facilities, and for software and equipment used in automated information processing at all sites under ISDInformation Services Division (see EIS) custodial responsibility. ISDInformation Services Division (see EIS) also maintains the CDC Operational Recovery Plan for these systems.

  • ISDInformation Services Division (see EIS) provides functional support and assistance on all facility automated systems (except personal computers) to facility AISAs.

  • ISDInformation Services Division (see EIS) is also responsible for ensuring compliance with State audit requirements relating to the integrity of information assets. This includes systems auditing under ISDInformation Services Division (see EIS)’s custodial realm of responsibility through participation in the departmental Peer, and PFABProgram and Fiscal Audits Branch (see OACC)’s auditing processes.

  • ISDInformation Services Division (see EIS) is responsible for establishment of the Department’s overall automation infrastructure and the successful use of automation within the Department.

  • ISDInformation Services Division (see EIS) consists of five major areas: Application Development and Maintenance Section, Technology Support Section, Project Initiation Unit, CMIS Section, and the Data Center Section.

• Technology Support Section

  • The Technology Support Section provides support services to ISDInformation Services Division (see EIS) in the following areas: personnel, recruitment, staff training, budgeting, procurement, interagency agreements and contract management, quality programs, space planning, and general office support. This section also provides support services to all branches of the ECEvidence Code&ISDInformation Services Division (see EIS) for personnel, recruitment, and training.

• Project Initiation Unit

  • The role of the Project Initiation Unit (PIUProject Initiation Unit) is to provide guidance and assistance to CDC staff in starting new information technology projects. This includes providing guidance in the development of project concept proposals, feasibility studies, and other documentation required to obtain approval of an information system project. The PIUProject Initiation Unit is responsible for tracking all approved projects and ensuring that all projects comply with State reporting requirements. Functional support, assistance and direction is provided to the ISAs on all system related issues by the Applications Systems Section.

• Data Center Section

  • The Data Center manages maintenance and support functions with the best available tools in order to increase the time that ITS are available to the users/owners. This section of ISDInformation Services Division (see EIS) is responsible for the continuous operation and reliability of computer hardware, database systems software, the systems’ databases, and communications networks, as well as the security of departmental ITS. As part of the Data Center, the Network Services Unit and the Hardware/Telecommunications Unit provide data communications services and support to ISDInformation Services Division (see EIS) and to other functional units as needed, ensure that standard approved practices are adhered to within the Department, and provide and promote the use of consulting resources to the Department when developing new systems or planning changes to existing data facilities.

• CMIS Section

  • The role of the CMIS Section is to develop a single automated offender information system which satisfies the needs of all users of CDC’s offender information and serves as the hardware/software platform for all future systems development for the Department. Using stateoftheart analysis techniques and project management tools, the CMIS Section is committed to providing the Department with an offender information system that meets the needs of the user community.

• OISBOffender Information Services Branch

  • OISBOffender Information Services Branch has been designated the Department’s primary provider of summary statistical information about inmates and parolees. The OISBOffender Information Services Branch responds to special information requests, compiles statistical reports, and prepares legislative estimates and population projections. The OISBOffender Information Services Branch is responsible also for coordinating the timely, accurate, and consistent coding and entry of data, and performs data integrity QCQuality Control functions for OBISOffender Based Information System and for classification, incident, and other major computerized inmate and parolee databases.

• Estimates and Statistical Analysis Section

  • The Estimates and Statistical Analysis Section is the primary source of summary statistical information on inmates and parolees under the jurisdiction of the Department. This section ensures that the Department has accurate data upon which to base program planning and direction. It also compiles and analyzes information for special projects, court cases, special task forces or programs, and prepares periodic statistical reports about inmates and parolees used in budget planning, legislative responses, and audits. The section prepares all departmental projections of future facility and parole populations, including inmate classification levels, and all population estimates of the impact of proposed legislation, ballot initiatives, and administrative policy changes. It also reviews such information to be disseminated by other branches and divisions outside of the Department.

• TSS

  • TSS coordinates the timely, accurate, and consistent coding and entry of data, and performs data integrity QCQuality Control functions for major computerized inmate and parolee ITS.

  • This section provides support to the MISManagement Information Systems Committee to facilitate the development and automation of ITS, and conducts regular audits in the field and in Headquarters to maintain the accuracy and integrity of data. The section also provides necessary training for facility and parole region OBISOffender Based Information System operators.

• Business and Contract Services

  • BSS

    • BSS is responsible for the preparation of purchase documents for all EDPElectronic Data Processing (see IT) equipment and datarelated items that are obtained through Headquarters.

    • BSS shall ensure that all requests submitted for purchase are complete and that the necessary documentation, such as certifications or FSRs, is included.

    • BSS is the departmental contact with the DGSDepartment of General Services, Office of Procurement, for all EDPElectronic Data Processing (see IT) procurement.

• Contract Services

  • The Department’s Contract Services Section shall supervise contracts entered into by the Department in a manner which:

    • Conserves the financial interests of the State.

    • Prevents, so far as possible, any thriftless acts by employees of the Department.

    • Avoids thriftless expenditures.

  • The Contract Services Section assists departmental staff in the development of EDPElectronic Data Processing (see IT) contract requests, bids, and contracts to achieve program objectives within the legal and regulatory constraints of the State, and to ensure compliance with all departmental policies and procedures.

• Warden/Regional Administrators

  • Each Warden and RPARegional Parole Administrator is ultimately responsible for the security and utilization of all automated systems and data bases in the respective facility or region. This includes the integrity and accuracy of data entered and the physical security of the data, hardware, and the system itself.

• Facility/Parole AISAAssociate Information Systems Analyst/Regional AISAAssociate Information Systems Analyst

  • Under the direction of the Warden or designee, or Regional Administrator or designee, the facility or region AISAAssociate Information Systems Analyst is responsible for the coordination of automated systems issues for the facility. This position acts as the primary contact for Headquarters on automation-related issues, including PCPenal Code, the DDPSDistributed Data Processing System, and all other automated system concerns.

  • This position is responsible for coordination of staff training on PCPenal Code applications and systems, justification and acquisition of PCPenal Code equipment through use of PCPenal Code, policy, local automated system application support, inmate access to computers, on-site user assistance, information system security, and QCQuality Control oversight and audit coordination for all databases located in the area of assignment.

• Facility/Regional Information Security Coordinators

  • Facility/regional Information Security Coordinators (ISCInformation Security Coordinators), in accordance with State and departmental security policies, are responsible to the Warden/RPARegional Parole Administrator for overseeing policy and procedures on information security access at each facility.

  • The ISCInformation Security Coordinators shall work in coordination with the ISAs and the Department’s Information Security Officer.

• Departmental Managers/Supervisors

  • All managers and supervisors assigned supervision of a function automated by DDPSDistributed Data Processing System are responsible for:

    • Preserving the security and integrity of the Department’s information assets and managing the associated risks.

    • Ongoing auditing to verify the accuracy and integrity of the data entered by subordinate staff.

    • Ensuring that program staff and other users of the DDPSDistributed Data Processing System information are aware of and comply with information security policy and procedures.

• End Users of EDPElectronic Data Processing (see IT)

  • Users are ultimately responsible for:

    • The accuracy and integrity of the data they enter into any departmental application.

    • Complying with all applicable laws, regulations, and administrative policies, as well as with any additional security policies and procedures established by the Department.

    • Notifying their manager/supervisor of any actual or attempted violations of security policies, practices, or procedures.

41020.5 Revisions

• The Chief, ISDInformation Services Division (see EIS), or designee shall be responsible for ensuring that the contents of this article are kept current and accurate.

41020.6 References

• DOMDepartment Operations Manual §§ 43030 and 43020.4.

42010.1 Policy

• It is the policy of the Department to create and maintain an annual ITS plan. This plan, prepared by ISDInformation Services Division (see EIS) (see DOMDepartment Operations Manual 43010.3, Information Management Planning, Responsibilities) and approved by the MISManagement Information Systems Committee, shall be the primary basis for structuring the use of ITS in CDC.

• The annual departmental ITS plan shall, at a minimum, contain strategy for the use of:

  • State data centers for departmental critical systems.

  • Distributed systems for departmental critical systems.

  • Microcomputers for departmental critical systems.

  • Departmental telecommunications and networking systems.

  • Facility PBXs for data.

  • Local area networks.

  • Modems.

42010.2 Purpose

• The purpose of this policy is to disseminate the framework for the decision-making process used by the Department in deciding to apply automated solutions to the Department’s operations, accounting, and communications problems.

42010.3 ITS Selection Criteria

• It is the intent of the Department to employ the following factors when deciding whether to use CDC ITS resources to develop, design, and implement a critical departmental information system:

  • The priority of the ITS request (see DOMDepartment Operations Manual 43000).

  • The relationship to the Department’s goals and objectives.

  • The extent to which the application is critical to accomplishment of the Department’s goals and objectives.

  • The risk analysis report (see DOMDepartment Operations Manual 49000).

  • The results of a pilot project.

• The Department’s strategies for use of such technologies shall be utilized to determine the design of the approved information system and the choice of hardware, software, and communication.

42010.4 ITS Selection Process

• The Department’s vehicle for selection of technological alternatives is the FSRFeasibility Study Reports. When preparing an FSRFeasibility Study Reports, the above selection criteria shall be utilized as a basis. When automation is determined to be the approach to solving a business problem, the Department shall choose the automated system which best accomplishes the tasks involved.

• The Department currently maintains a multi-tiered automation platform that offers a wide spectrum of hardware/software choices and which provides several databases accessible to applications for data sharing.

• A significant feature of automated systems is the ability to share data. Benefits of data sharing include the saving of valuable input time and, in many cases, may solve cost justification problems by reducing or redirecting data input time and associated personnel years.

• There are many automation platforms available for expansion in the Department. However, there are also many elements listed in the selection criteria that lead to the appropriate solution. Regardless of the business problem, selection criteria, or platform (hardware/software) involved, State policy requires that the FSRFeasibility Study Reports shall show a cost reduction, a viable cost avoidance, increased revenue, operational necessity, or be the result of a legislative mandate before approval of the concept can become a funded project.

• In many instances, the FSRFeasibility Study Reports may have a concurrently associated pilot project to provide specific performance, cost, and technological justification for the continuance of the project.

42010.5 ITS Pilot Projects

• Pilot projects are scaled down versions of an overall project. They are intended to provide information on cost savings/avoidance, technology use, or performance of bench marking in order to justify implementation of the full project. A pilot project is a subset of the overall project and is subject to the same approval process as the full project.

• Many projects are approved through the Office of Information Technology (OITOffice of Information Technology) and the FSRFeasibility Study Reports process contingent upon pilot justification of the project.

• The typical contents of a Pilot Implementation and Evaluation Plan include the sections and contents described below:

  • Program Performance Improvements

    • This section defines the programmatic functions to be included in the pilot. It should include a description of the current processes, a description of the new processes, and a plan that includes quantified measurements for evaluating before-and-after program performance.

  • Physical and Technical Characteristics

    • This section describes the physical and technical characteristics of the pilot. It shall include descriptions of sites, equipment, software, and telecommunications as well as any other technical resources that are needed to complete the pilot.

  • Information Requirements

    • This section defines the informational processing requirements of the pilot. It should include definitions of data inputs (source, type, volume, timing, media, files, edits, etc.), processes (response times, interfaces, security, etc.), and outputs (reports and displays).

  • Security Requirements

    • This section addresses the process to be used to determine the potential problems and risks, the controls necessary to safeguard the information hardware and software of the pilot, and the fully-implemented system. Typically, a risk analysis as described in DOMDepartment Operations Manual 49030 shall supply the necessary information. The completion of this requirement is especially important since necessary security controls can often increase the required budget.

  • Financial Requirements

    • This section contains an estimate of all costs associated with the pilot phase of the project. Project accounting shall be defined so that actual pilot costs and benefits can be compared against estimates, and then used as a basis to refine full implementation estimates.

  • Operational Recovery Requirement

    • This section addresses the process to be used to determine the operational recovery requirements. A pilot project shall have an operational recovery plan just for the pilot, and shall address the issue of operational recovery of the proposed fully-implemented system. Often, operational recovery processes add to the overall cost of the project. All critical departmental systems shall have an operational recovery plan as part of their implementation (see DOMDepartment Operations Manual 44000).

  • Management Plan

    • This section contains a pilot management plan. The plan shall include:

      • Pilot responsibilities.

      • Pilot schedule.

      • Pilot reporting and review.

• Any special requirements shall be identified such as training, conversion, or impact on existing operations.

• At the end of the pilot and before continuing with the project, a Post Implementation Evaluation Report (PIERPost Implementation Evaluation Report) shall be completed and submitted to either the departmental MISManagement Information Systems Committee or OITOffice of Information Technology for review. The pilot PIERPost Implementation Evaluation Report shall contain an assessment of programmatic performance during the pilot. The results of the pilot PIERPost Implementation Evaluation Report shall be used to re-evaluate the analysis completed for the original feasibility study and, if necessary, be used to make changes to the project FSRFeasibility Study Reports.

• Once the pilot PIERPost Implementation Evaluation Report is approved and any necessary changes are made to the original FSRFeasibility Study Reports, the pilot PIERPost Implementation Evaluation Report shall be reviewed and the project may be initiated upon its approval.

42010.6 Determining Priorities on ITS Requests

• One of the criteria for project selection is the priority of the ITS request. To assist in decision-making, the following schema shall be utilized when assigning a priority to a particular request for information system resources: If multiple requests exist with the same priority, each division submitting requests shall determine the order of further prioritization. For example, if there are four priority 3.1 requests then these four requests should be renumbered as 3.1.1, 3.1.2, 3.1.3, and 3.1.4 in order of further priority.

• The following is a description of several different levels of priorities. These priorities can be thought of as an initial rationale for assignment of ITS design, development, and maintenance resources. Each prospective project shall be assigned one of the following priorities prior to its presentation before the MISManagement Information Systems Committee:

• Priority 1

  • This priority level is exclusive to the maintenance of computer programs that have been designed, implemented, and installed. Resources used in this area are for the purpose of keeping existing computer-based systems functional. This priority includes routine maintenance. Any changes to production systems requiring more than 32 person-hours shall not be considered as maintenance, but as a new request which must be justified.

• Priority 2

  • Those resource requirements over which the Department has little control. Responses to legislative action, requests from the Governor or the agency, and requests from local law enforcement for critical information are all examples of projects that are Priority 2.

• Priority 3

  • An ITS request shall be Priority 3 if the implementation of the proposed computer-based system will result in a measurable benefit to the Department. Most requests for information system resources fall within this area.

42010.7 Revision

• The Assistant Secretary EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

42010.8 References

• DOMDepartment Operations Manual §§ 43000, 44000, and 49000.

42020.1 Policy

• It is the policy of the Department to promote standardization in its information management planning and operations through adherence to applicable American National Standards Institute (ANSI), Federal Information Processing Standards (FIPS), and State standards and guidelines. All proposed application or information technology activities shall be evaluated to ensure that all hardware, software, and communications platforms comply with ANSI, FIPS, and State standards and guidelines.

42020.2 Purpose

• The purpose of this Policy is to facilitate the inter-organizational sharing and exchange of equipment, data, software, and personnel. The use of these EDPElectronic Data Processing (see IT) standards shall also facilitate communication:

  • Between the Department and other State agencies.

  • Between the Department and its EDPElectronic Data Processing (see IT) vendors.

  • Between the Department and its EDPElectronic Data Processing (see IT) information providers/recipients.

  • Among the various organizational units within the Department.

• Adherence to established EDPElectronic Data Processing (see IT) standards should result in improved communication, improved product quality, decreased development time and costs, improved project control, and reduced maintenance costs.

42020.3 Computer Programming Language Standards

• Where custom programming is needed, the Department requires the use of vendor-supplied programming languages which are departmental standard languages. The language chosen for development shall be consistent with the requirements of the application and platform for which it is intended.

  • For new system development on minicomputer or mainframe platforms, a high level language shall be used wherever feasible. In this case, high level languages include either a fourth generation language such as Oracle or a Computer Assisted Software Engineering (CASE) tool integrated with a COBOL code generator.

  • Where a high level language is not feasible or where maintenance shall be performed on applications already written in COBOL, the COBOL programming language shall be used.

  • In the personal computer (PCPenal Code) area, application programming shall use either a language or compiler compatible with the dBASE standard, a fourth generation language for the PCPenal Code, or a CASE tool integrated with a COBOL code generator.

• Use of vendor-supplied data base management, report generation, and file manipulation packages shall be considered in the design of ITS. For data management on all platforms, the use of a vendor-supplied relational data base management system compatible with structured query language (SQL) is recommended. The in-house development of data base management or file manipulation software is strongly discouraged and only permitted where there is no other alternative.

• Normally, high level languages possess their own query language and report generation software. Wherever possible, the query language and report generator provided with the high level language shall be used. In situations where such software is not provided with the high level language or will not meet the application’s needs, third party query languages and report generation software can be chosen from the wide variety of software supplied by vendors.

42020.3.1 Application Generators

• The Department encourages the investigation and use of application generator software.

• Application generators are integrated fourth-generation language tools which permit an entire application to be generated. The most useful full-function application generators support a wide range of integrated components including a data base management system (DBMS), data dictionary, security facilities, analysis tools, query language, report generator, documentation generator, screen painter, prototyping facilitator, graphics generator, decision support or financial modeling tools, multiple end-user interfaces, high-level procedural language, data definition language, distributed processing facilities, testing tools, a micro-to-mainframe communications link, and a separate version of the tool for a personal computer.

• Application generators for EDPElectronic Data Processing (see IT) professionals generally include a very high-level procedural language that is used to specify logical operations. These tools are usually integrated with a full-function DBMS that supports both relational and other data structures.

42020.3.2 Operating Software

• It is the Department’s policy that standard, unmodified, vendorsupplied and maintained software aids be used in lieu of developing unique programs. The objective is to minimize and control the development of specialized programs that allocate, schedule, and control the central processing unit, memory, peripherals, communication, and data storage and retrieval.

42020.3.3 Application Packages

• It is the Department’s policy that all feasibility studies shall have one alternative addressing the availability, usability, maintainability, and costeffectiveness of prewritten and tested application programs in lieu of developing major programs in-house. The PCPenal Code Policy in DOMDepartment Operations Manual 48010 addresses PCPenal Code application packages. The objective is to minimize the development time and costs of major application programs when such programs are available from other sources. For some custom applications, however, in-house development may be the most viable alternative.

42020.4 Systems Development Life Cycle

• The Systems Development Life Cycle (SDLCSystems Development Life Cycle) is a systematic approach to software development that defines development phases. It begins when a software product is conceived and ends when the product is in production and being maintained. It also specifies the activities, products, verification procedures, and completion criteria for each phase. It is an effective engineering management tool that can be used to help ensure that a delivered product is correct and meets the user’s needs.

• The Department advocates use of the SDLCSystems Development Life Cycle approach to software development, whether the platform is mini or mainframe. However, if the system being developed is a standalone PCPenal Code system, development phases may be combined or omitted so long as the delivered product meets the user’s needs.

• The Department has included the following phases in its SDLCSystems Development Life Cycle: Concept Phase, Requirements Phase, Design Phase, Development Phase, Testing Phase, and Operation and Maintenance Phase.

42020.4.1 Concept Phase

• The Concept Phase is the initial phase of system development during which user needs are described through documentation. The user group is formed during this phase. Examples of the documentation include a statement of needs, advance planning report, project initiation memo, feasibility studies, system definition documentation, regulations, and policies and procedures relevant to the project. Deliverables for this phase include:

  • The project charter.

  • The project management plan.

  • The initial project file.

42020.4.2 Requirements Phase

• The Requirements Phase is the period of time in the life cycle during which the requirements for a software product, such as functional and performance capabilities, are defined and documented. Major deliverables include the Software Requirements Specification documentation and the Baseline Report.

42020.4.3 Design Phase

• The Design Phase is the period of time in which the designs for architecture, software components, interfaces and data are created, documented, and verified to satisfy requirements. Major deliverables include the Detailed Design Specification, the Test Plan, the Implementation Plan, the Users’ Manual and Procedures Manual, and the Training Plan.

42020.4.4 Development Phase

• The Development Phase is the period of time in the development life cycle during which a software product is created from design, documentation is tested, and errors are corrected. Major deliverables of this phase include system documentation, program documentation, program code, and test results documentation.

42020.4.5 Testing Phase

• The Testing Phase is the period of time in the life cycle in which the software product is evaluated by users and technical staff to determine whether requirements have been satisfied. Tests performed include the Requirements Test, the Operational Environment Tests, the Acceptance Test, and the Pilot Test.

42020.4.6 Operation and Maintenance Phase

• The Operation and Maintenance Phase is the period of time in the life cycle during which a software product is used in its operational environment, monitored for satisfactory performance, and modified as necessary to correct problems or respond to changing requirements. The Post Implementation Evaluation Report (PIERPost Implementation Evaluation Report) is completed during this phase.

42020.5 User Computing Within CDCR

• The standards addressed in DOMDepartment Operations Manual 42020.3 above, Computer Programming Language Standards, apply to end-users as well as EDPElectronic Data Processing (see IT) professionals, although the end-user shall not use procedural or third generation languages and shall restrict any programming activity to the personal computer.

42020.5.1 Personal Computer

• The personal computer is meant to be a productivity tool to assist the user in fulfilling regular professional responsibilities.

42020.5.2 Database/Spreadsheet

• A user-developed system is defined as a database or spreadsheet that is created, accessed, or updated with an offtheshelf software application.

42020.5.3 Management Approval

• Approval shall be obtained from appropriate division management prior to expending any resources on a userdeveloped system that is used in an official capacity by any departmental personnel.

42020.5.4 Standard EDP Documentation

• In order to ensure continued operation of userdeveloped systems, documentation shall be provided. Documentation shall include:

  • A list of application software used (e.g., dBase, Foxbase, Lotus, Quattro, etc.).

  • System requirements.

  • A user manual to explain:

• Where the system is installed (PCPenal Code location, drive, directory).

  • How the system is started.

  • Any macros or batch files used.

  • Data entry procedures.

  • Report generation.

  • Backup procedures.

  • File descriptions for each file used in the system:

    • File name.

    • File type (report, label, index, memo, database, spreadsheet).

  • Structure of any data files:

    • Description of each data field.

• Refer also to DOMDepartment Operations Manual 48010, Departmental Workgroup Computer Policy.

42020.6 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

42020.7 References

• OITOffice of Information Technology, Information Management Guideline: A Manager’s Guide to End User Computing.

• DOMDepartment Operations Manual § 48010.

42030.1 Policy

• It is the policy of the Department to provide Quality Assurance (QAQuality Assurance) and Quality Control (QCQuality Control) functions to ensure the usability and effectiveness of all EDPElectronic Data Processing (see IT) applications and processes.

42030.2 Purpose

• The purpose of the QAQuality Assurance function is to facilitate the continuous review and improvement of processes which underlie the creation and maintenance of automated systems and databases. The purpose of the QCQuality Control function is to implement methods and practices that allow EDPElectronic Data Processing (see IT) products and processes to be measured against predefined standards. Together, QAQuality Assurance and QCQuality Control ensure that automated systems and their products better meet user needs.

42030.3 Responsibilities

• CDC recognizes that maintaining adequate, correct and current offender data is critical to departmental operations that directly affect staff, inmate, and public safety. OISBOffender Information Services Branch, in the ASDSee Division of Administrative Services (DAS) (see ASB), is responsible for major current, proposed, and future statewide offender ITS. QAQuality Assurance procedures to be applied to these departmental ITS include:

  • Continual monitoring of the validity and currency of data contained in offender ITS;

  • Establishment of methods to identify errors or inadequacies in these data; and

  • Development of appropriate procedures and solutions to correct inaccuracies or out-of-date data.

• The OISBOffender Information Services Branch does not directly implement most procedures and solutions. Rather, once a problem has been identified the OISBOffender Information Services Branch provides the owners of the data with tools and procedures aimed at eliminating the problem. After the owners of the data have implemented these tools and procedures, the OISBOffender Information Services Branch provides ongoing review of the data to ensure its accuracy, currency, and completeness.

• A QAQuality Assurance council shall be established to ensure that departmental QAQuality Assurance policies, standards, and procedures are implemented and maintained. Responsibility for implementing QAQuality Assurance resides with each entity (i.e., division, branch, or unit) that develops and maintains systems.

• QAQuality Assurance Council

  • The QAQuality Assurance council shall be comprised of the departmental Information Security Officer (Chairperson) and representatives from each division responsible for the development and maintenance of ITS. The QAQuality Assurance council shall:

    • Develop departmental QAQuality Assurance policies, standards, and procedures.

    • Develop and implement an annual QAQuality Assurance plan in support of the Department’s strategic plan.

    • Ensure that systems developed or maintained in the Department adhere to CDC QAQuality Assurance/QCQuality Control standards and procedures.

    • Support programs that educate CDC staff in the importance of quality concepts and in the tools, techniques, methods, and practices that facilitate QAQuality Assurance and QCQuality Control.

    • Act as a source of information on processing quality data and on the need for continued commitment to an improvement effort.

    • Review industry standards (e.g., ANSI/IEEE, FIPS) to facilitate the development of departmental EDPElectronic Data Processing (see IT) standards.

  • The QAQuality Assurance council shall meet quarterly or as needed.

• Division/Branch/Unit

  • Accountability for QAQuality Assurance and QCQuality Control is fixed on a system by system basis. See DOMDepartment Operations Manual 47000, Departmental Systems, for ownership designation and fixed responsibility for QCQuality Control.

  • OISBOffender Information Services Branch is responsible for data integrity in major, statewide offender ITS.

  • In fulfilling QAQuality Assurance/QCQuality Control responsibilities each entity shall, where applicable, ensure that:

    • ITS projects are reviewed during all phases of the systems development life cycle (SDLCSystems Development Life Cycle).

    • Data integrity is developed and maintained, both in the SDLCSystems Development Life Cycle and by the unit designated responsible for QCQuality Control, on each application or database.

    • User requirements are well-defined (for systems development or maintenance projects), all objectives of the work effort have been met, and results are appropriate keeping in mind each project’s overall objectives.

    • The ITS processes are monitored and measured for the purpose of improving these processes.

    • Quality improvement programs are established and quality concepts are promoted throughout Department branches that develop and maintain ITS.

42030.4 Definitions

• Acceptance Testing

  • Testing that insures a computer system meets the needs of the organization and the end-user.

• Client (User)

  • The individual or organization that utilizes a product.

• Correctness

  • The extent to which software conforms to its specifications and standards; (2) the extent to which software is free from design and coding defects (i.e., “fault-free”); and (3) the extent to which software meets user expectations.

• Cost of Quality

  • The cost of quality for a product is the sum of prevention, detection, correction, and client costs. Prevention cost is the total cost incurred during product development prior to general release. Detection, correction, and client costs are post-release costs associated with reworking due to defects. QAQuality Assurance shall be considered cost-effective when post-release costs are reduced by an amount greater than any increase in prevention costs resulting from the inclusion of QAQuality Assurance in the development process.

• Data Base Integrity

  • The accuracy, completeness, and timeliness of information contained in a database.

• Defect

  • A variance from specifications/standards or attribute/function not contained in the software requirements specifications.

• Defect-Prone Process

  • A process/activity during which a high number of defects occur.

• Desk Checking

  • An informal evaluation technique in which the person who developed a unit of code inspects it visually to identify possible errors or violations of development standards.

• Failure

  • Inability of a product or service to perform its required functions within previously established limits.

• Integration Testing

  • Testing performed on groups of modules to ensure data and control are passed properly between modules.

• Long-Term Capacity Planning

  • The objective of long-term capacity planning is to develop methods and means for ensuring that hardware, system software, communications, and system design shall meet the long-term objectives for additional processing required by new applications, integration of new processors and platforms, and new generations of software. This plan encompasses a five- to seven- year period and is designed to help determine budget requirements and goals for the Department.

• Post Implementation Evaluation Report

  • The review of a computer, computer system, or computer network that has been in operation for at least six months and no longer than two years for the purpose of matching the requirements of the system against what has been produced, so as to ensure that stated requirements have been met.

• Problem Reporting/ Tracking

  • A process of reporting outstanding problems, having them assigned for resolution, and closing them out when the user has been notified that the problems have been solved.

• Process

  • The work activities that produce products, including the efforts of people and equipment.

• Product

  • The output of a process including the goods and services produced by individuals and the organization.

• Quality

  • The extent to which a product meets the expectations and requirements of the user.

• QAQuality Assurance

  • A staff function designed to support line management in performing the QCQuality Control function. As such, QAQuality Assurance identifies those processes, both good and bad, that affect quality, and is used to advise management of such effects. A management decision may then be necessary to ensure that QCQuality Control techniques are implemented and maintained; and

  • The function that uses measurement and analysis to continually improve processing, procedures, and standards so that management can be “assured” of their staff following such methods, procedures, and standards, as well as their ability to produce products that meet specified requirements.

• QCQuality Control

  • The collection of activities to ensure that defects are neither made nor implemented. While QAQuality Assurance monitors the processes involved in the production cycle, QCQuality Control is an integral part of work and is the responsibility of each employee; and

  • A line function used to measure quality associated with specific products or services. QCQuality Control is the responsibility of each ITS area and is the function responsible for the quality of the work being done within a specific area or for a specific project.

• Quality Improvement Program

  • A program designed to reduce the number of defects produced.

• Regression Testing

  • Testing applied after changes have been made to ensure that no unwanted changes have been introduced.

• Requirement

  • The specification(s) for satisfying a user need; is associated with a standard by which the satisfaction of that need can be measured.

• Resource Management

  • The determination of current and short-term needs for hardware, system performance, and communications, and the allocation of such resources to meet the overall goals and current short-term plans of the Department. Resource Management requires the gathering of data about new processing needs and applications not addressed in longrange planning, as well as any other information that impacts current system resources.

• System Testing

  • A generic term that differentiates various types of higher order testing from unit testing.

• Total Quality Management

  • Consists of continuous process improvement activities involving everyone in an organization-managers and workers-in a totally integrated effort toward improving performance at every level. This improved performance is directed toward satisfying such crossfunctional goals as quality, cost, schedule, mission, need, and suitability. Total Quality Management, or TQM, integrates fundamental management techniques, existing improvement efforts, and technical tools under a disciplined approach focused on continuous process improvement. The activities are focused ultimately on increased client/user satisfaction.

• Unit Testing

  • Testing performed on a single, standalone module or unit of code.

• Validation

  • The process of comparing a product in any stage of its development with specified requirements in order to determine whether the correct product is being produced.

• Walk-Through

  • A review process in which a designer or programmer leads one or more members of the development team through a segment of documentation or code that he or she has written, and other team members ask questions and make comments about technique, style, possible errors, violation of development standards, and other issues.

42030.5 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

42030.6 References

• Quality Assurance Institute: Effective Methods For Quality Assurance In Information Systems.

• DOMDepartment Operations Manual § 47000.

43010.1 Policy

• The Department has established a management planning process that is consistent with the needs, resources, and use of information technology within the Department. In compliance with the SAMState Administrative Manual 4900.2, the established management planning process:

  • Is consistent with the current statewide policies contained in SAMand current management memos for managing information and information technology.

  • Is linked to and supportive of CDC’s overall program planning and budgeting processes.

  • Involves CDC executive management and program managers, as well as those who are responsible for the use, operation, and support of ITS.

  • Addresses current and projected relationships among the various aspects of information technology employed by CDC, including equipment (such as mainframes and minicomputers, personal computers, and office systems), software (such as computer languages, including fourth generation languages, and applications packages), and telecommunications.

  • Relates current and planned uses of information technology to the information required for the accomplishment of CDC’s mission and key programs.

  • Considers means for ensuring the continuing availability of the information required to support critical programs in the event of disaster, or other unforeseen events resulting in an interruption of CDC’s regular systems operation.

43010.2 Purpose

• Planning includes identifying needs and opportunities, defining objectives, and determining appropriate means of achieving those objectives. The purposes of information management planning are to:

  • Find ways that information technology can improve the effectiveness of CDC programs.

  • Analyze the costs and benefits of information technology and allocate resources systematically.

  • Clarify CDC’s priorities and be able to react to changes with a minimal amount of disruption.

  • Improve communication among executive managers, staff responsible for information technology, and the users of the programs.

  • Provide managers with a long-term perspective on current problems that simplifies making decisions and solving problems.

• In addition, planning requirements are intended to provide the Office of Information Technology (OITOffice of Information Technology) and other control and oversight organizations with the basic facts those organizations require to carry out their responsibilities concerning the use of information technology in State government.

43010.3 Responsibility

• It is the responsibility of ISDInformation Services Division (see EIS) to develop and maintain a departmental strategic plan. This plan shall be approved by the MISManagement Information Systems Committee. Once approved, this plan shall serve as the road map for planned automation efforts within the Department. This plan shall be utilized to link divisional planning efforts to the goals and objectives of the division and Department. The MISManagement Information Systems Committee shall ensure that all projects under its responsibility are consistent with and do not conflict with other planned efforts. Compatibility and connectivity shall be the shared vision of all planning.

43010.4 Information Management Planning Infrastructure

• CDC has developed a formal structure for planning which includes an MISManagement Information Systems Committee and an ongoing planning process that involves analysis, evaluation, and review of proposed projects. This project review, reporting, and evaluation process is covered in DOMDepartment Operations Manual Subchapter 44000, Project Review, Reporting and Evaluation. Alternately, this subchapter describes the MISManagement Information Systems Committee, the MISManagement Information Systems Support Unit (MISManagement Information Systems-SU), ISDInformation Services Division (see EIS), and the role each plays in the management planning process.

• MISManagement Information Systems Committee

  • The MISManagement Information Systems Committee, whose members represent the divisions within CDC and the CalPIA, is responsible for executive leadership and strategic planning in seeking out opportunities to employ information technology for the achievement of the Department’s mission, goals, and objectives. The MISManagement Information Systems Committee assesses all proposed ITS projects (ranked according to their importance to the Department’s mission) to assure conformance with the Department’s mission statement, strategic plan, and key programs. The committee also reviews and approves the Department’s Information Management Annual Plan (IMAPInformation Management Annual Plan) and endorses future needs identified in long-range planning documents. DOMDepartment Operations Manual 41020.3 describes the role of the MISManagement Information Systems Committee.

• ISDInformation Services Division (see EIS)

  • ISDInformation Services Division (see EIS) is responsible for development and maintenance of the overall strategic plan of the Department. This plan shall be the result of compiling all divisional automation needs into a single document for the prioritization of projects and alignment with the budget by the MISManagement Information Systems Committee.

  • ISDInformation Services Division (see EIS) is also responsible for maintaining and updating the IMAPInformation Management Annual Plan. This includes: working with the user to develop appropriate documents for inclusion in the IMAPInformation Management Annual Plan for those projects reportable to OITOffice of Information Technology, ensuring that the appropriate reportable project forms are completed, notifying the user once a project has been approved, whether it is delegated or non-delegated, maintaining copies of all reports, and, as appropriate, acting as a liaison between OITOffice of Information Technology and CDC project management concerning reporting requirements throughout the life cycle of the project.

• MISManagement Information Systems-SU

  • The MISManagement Information Systems-SU provides functional support to the MISManagement Information Systems Committee by coordinating MISManagement Information Systems Committee meeting agendas, coordinating the review of proposed ITS projects, preparing annual updates for the Department cabinet on all CDC automation efforts for the current year as well as strategic planning for the coming year, and participating in the development of presentations for the committee addressing current technical innovations and coordinating the review of information system concepts to ensure compliance and consonance with the budget cycle. Refer to DOMDepartment Operations Manual 41020.4 for more details on the role of the MISManagement Information Systems-SU.

43010.5 Information Management Planning Process

• The Department uses the MBO approach for planning information management. The Department’s mission and philosophy statement were developed based on MBO principles, and resulted from many planning sessions held to enlist ideas from numerous levels, disciplines, and segments within the Department.

• Each Division formulates its own goals and objectives using departmental goals and objectives as the foundation for the effort. The CDC ITS planning process originates with the development of the strategic plan (see also DOMDepartment Operations Manual 43010.3). MBO goals and objectives are developed to structure the Department’s efforts to achieve the purposes specified in the strategic plan. The establishment of such goals and objectives allows the identification of automation opportunities consistent with the plan, and the planning process then provides for the development of various concept statements to enable articulation of methods that may be used to benefit from the identified automation opportunities. All automation concept papers are reviewed by the MISManagement Information Systems Committee and, if approved, become part of the IMAPInformation Management Annual Plan. Implementation of an automation concept that requires increased or new source funding may require the preparation of a Budget Concept Statement, and a BCPBudget Change Proposal may also be necessary. Establishment of certain automation projects as specified in this Chapter shall require prior approval of an FSRFeasibility Study Reports.

• ISDInformation Services Division (see EIS) shall provide the general guidelines for objectives that require automated solutions. The resulting document, the Information Systems Budget Concept Statement (ISInformation Systems-BCSBudget Concept Statement), is submitted to ISDInformation Services Division (see EIS) and the MISSU for review and recommendations.

• ISDInformation Services Division (see EIS) shall coordinate development of the IMAPInformation Management Annual Plan, and shall maintain it to ensure that a vision of connectivity and compatibility is followed. Redundancy of data input is another area of concern, and this plan shall help ensure that a planned automation effort is coordinated within the department. Duplication of automation efforts is a costly and time-consuming waste. The IMAPInformation Management Annual Plan shall serve as a road map for automated efforts.

• The MISManagement Information Systems Committee shall measure proposed projects against CDC’s, mission and established departmental priorities so as to best prioritize and approve proposed EDPElectronic Data Processing (see IT) projects.

43010.6 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

43010.7 References

• SAMState Administrative Manual § 4900.2.

• DOMDepartment Operations Manual §§ 44000, 41020.3 and 41020.4.

43020.1 Policy

• It is the policy of the California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation or the department) that all information system proposals shall receive departmental and, as required, California Department of Technology (CDT) approval before project development can proceed.

43020.2 Purpose

• The purpose of this policy is to ensure that the department is in compliance with all CDT requirements. The ultimate authority for approval of Information Technology (ITInformation Technology) projects lies with the CDT, but it is the intention of the director of CDT to delegate such approval authority selectively, to the maximum extent practicable, to the department director. Refer to State Administrative Manual (SAMState Administrative Manual), section 4819.34, for the factors considered by CDT in determining whether a project can be delegated.

43020.3 Objectives

• All project proposals in the department requiring technology must collaborate with Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)) to determine if the project’s classification is for maintenance and operations, an ITInformation Technology project, or a service request.

43020.3.1 PAL Stages and Deliverables

• The Project Approval Lifecycle (PALParolee-At-Large) is a process that will be used by the department to manage and assess the full implications of any project proposals. The PALParolee-At-Large is a means of linking ITInformation Technology projects to the department’s strategic business and ITInformation Technology plans. The PALParolee-At-Large is divided into the following four stages which include the following types of analysis: Stage1 business analysis, Stage 2 alternatives analysis, Stage 3 procurement analysis and Stage 4 solution analysis. Refer to the CDT Reportable Project Decision Tree Reference Guide. Per the guidelines outlined in SAMState Administrative Manual, section 4928, the PALParolee-At-Large Stage/Gate deliverables, here and after referred to as “deliverables”, must provide an accurate summary of the results from all four stages of PALParolee-At-Large. The deliverables include a complete summary of the four stages of a proposed project to establish the business case for investment of state resources by setting out the reasons for undertaking the project and analyzing its costs and benefits.

• PALParolee-At-Large deliverables must be submitted to CDT, the Office of Legislation (OOLOffice Of Legislation) Analyst, and to the Department of Finance’s Information Technology Consulting Unit for review. CDT publishes detailed instructions and guidelines for preparing deliverables, which are available in the Statewide Information Management Manual (SIMM), section 19. The deliverables must use the format specified by CDT and signed by the Chief Information Officer (CIO) or their designee. The department must maintain documentation of each analysis to ensure that project participants, management, and the CDT personnel can resolve any questions about the intent, justification, nature, and scope of the project.

• If during the PALParolee-At-Large process the technology solution incorporates or utilizes Generative Intelligence (GenAI), per SIMM section 5305-F, the project team is required to complete the GenAI risk assessment.

43020.3.2 Internal Project Approval Lifecycle

• In coordination with the EISEnterprise Information Services (formerly Information Services Division), ITInformation Technology Portfolio Management Office (PMO), the Internal Project Approval Lifecycle should be developed as outlined in this article.

43020.3.3 Requests Requiring a Change in the Governor’s Budget

• If funding for a project is already available, approval is still necessary, and is discussed in this article.

  • Early each calendar year, the Budget Management Branch (BMBBudget Management Branch) shall distribute a memorandum to CDCRCalifornia Department of Corrections and Rehabilitation Executive Staff, Wardens, and Regional Parole Administrators (RPAs) detailing the Budget Concept Statement (BCSBudget Concept Statement) request process for the fiscal year beginning approximately 18 months later. This memorandum shall include a timeline containing significant deadlines which shall be met in order for a request to proceed through the approval process.

  • The designated EISEnterprise Information Services (formerly Information Services Division) section or team shall utilize the BCSBudget Concept Statement format when presenting an ITInformation Technology proposal to executives. The purpose of this format is to provide sufficient information to departmental executive staff to allow for a determination of whether the proposal warrants further development as a Budget Change Proposal (BCPBudget Change Proposal). BCPs are discussed in Department Operations Manual (DOMDepartment Operations Manual), Chapter 2, Article 1, section 21010.6 and SAMState Administrative Manual, section 6120.

  • Refer to the annual budget instruction bulletin from the BMBBudget Management Branch, which the BMBBudget Management Branch emails all staff each year, when completing the BCSBudget Concept Statement and note that the format shall not exceed two pages in length including any supporting documentation. Requests out of compliance with the established format and instructions shall be returned to the requester without consideration.

43020.3.4 Project Cost Delegation

• The CDT assigns CDCRCalifornia Department of Corrections and Rehabilitation a minimum total Project Cost Delegation for reporting purposes (see SIMM, section 15). CDT delegates to the department the approval authority for any ITInformation Technology proposal with an estimated total development cost equal to or less than the department’s assigned Project Cost Delegation, provided the proposal does not meet any other CDT established reporting criteria defined in SAMState Administrative Manual, section 4819.37.

43020.3.5 Revisions

• The CIO or designee shall be responsible for ensuring the contents of this article are kept current and accurate.

43020.4.1 IMAP Composition

• The IMAPInformation Management Annual Plan consists of three parts:

  • Part A: Overview.

  • Part B: Information Technology Activities.

  • Part C: Exhibits and Supporting Documents.

43020.4.1.1 Part A – Overview

• Part A contains a brief description of the agency’s mission, its current problems and opportunities associated with information management, and its strategy and objectives for the use of information technology.

43020.4.1.2 Part B – Information Technology

• Part B provides an overview of current and proposed development projects and potential acquisition activities, with particular emphasis on those projects and activities that are relatively costly, require a BCPBudget Change Proposal, or meet any of the other special criteria described in SAMState Administrative Manual Section 4902.1.

43020.4.1.3 Part C – Exhibits and Supporting Documents

• Part C contains Documents that supplement the information in Parts A and B of the IMAPInformation Management Annual Plan by providing details about the agency’s organization of information management and its available resources.

43020.4.2 IMAP Purpose

• The purpose of the IMAPInformation Management Annual Plan is to ensure that CDC is systematic in identifying and satisfying its information requirements and provides OITOffice of Information Technology and other control and oversight agencies with the basic facts those organizations require to carry out their responsibilities regarding the use of information technology in State government.

43020.4.3 IMAP Responsibilities

• ISDInformation Services Division (see EIS) is responsible for assembling and maintaining the IMAPInformation Management Annual Plan. ISDInformation Services Division (see EIS) develops IMAPInformation Management Annual Plan – Part A and the support documents contained in Part C. Part B of the IMAPInformation Management Annual Plan consists of New Reportable Project Forms that are completed by the project teams involved in the information technology projects, and summaries of project status for any major projects.

43020.4.4 Reportable Projects

• SAMState Administrative Manual Section 4902.1 lists the criteria used to determine if a project is considered reportable. Reportable projects require completion of a New Reportable Project Form. This form is included in Section B of the IMAPInformation Management Annual Plan and provides OITOffice of Information Technology with information on the proposed project. OITOffice of Information Technology uses this information to determine whether approval authority for the project shall be delegated to CDC or if OITOffice of Information Technology shall retain the approval authority.

• All proposed projects that do not meet the criteria in SAMState Administrative Manual Section 4902.1 are considered non-reportable projects. The costs of agency development or new acquisition projects, whether reportable or not, shall be included in the Agency Information Technology Costs spreadsheet included in Part C of the IMAPInformation Management Annual Plan.

43020.4.4.1 Definition of Reportable Project

• A Reportable Project is defined as a planned development activity or the planned acquisition of a new or enhanced information technology capability (as defined in SAMState Administrative Manual Section 4819.2) which meets one or more of the following criteria:

  • The project involves total estimated development or acquisition costs that are greater than the cost threshold established for the agency (see DOMDepartment Operations Manual 43020.4.4.2 for further information on cost thresholds).

  • The project involves a budget augmentation through submission of a BCPBudget Change Proposal or Budget Revision to increase the agency’s existing information technology activities.

  • The project is a new system development or acquisition made in response to a legislative mandate or the project is subject to special legislative review as specified in budget control language or other legislation.

  • The project involves direct public access by private sector organizations or individuals to State data bases .

  • The project involves contracts for professional, managerial, or technical services (excluding services received through interagency agreements) totalling more than $25,000.

  • The project involves acquisition of one or more personal computers, personal computer software, or related peripherals, and the agency does not have an approved Workroup Computing Policy (SAMState Administrative Manual Section 4989 et seq.).

  • The project involves installation or expansion of wide area network data communication services other than those offered by the DGSDepartment of General Services, Division of Telecommunications, or a State consolidated data center as defined in SAMState Administrative Manual Section 4982.

  • The project involves one or more of the following emerging technologies and more than $25,000 will be spent on acquisition of hardware or software required for the technology:

    • Document imaging.

    • Geographic information systems.

    • Computer aided systems engineering.

    • Expert systems/artificial intelligence.

43020.5 FSR

• CDC adheres strictly to State policy requiring that a feasibility study be conducted and a FSRFeasibility Study Reports be approved prior to the expenditure of resources on any information technology project. The only exception to this requirement is the justification and acquisition of personal computers and related commodities through use of the Workgroup Computing Justification Form (SAMState Administrative Manual Section 4991.1).

• The term Information Technology Project is defined in DOMDepartment Operations Manual 41010.3, EDPElectronic Data Processing (see IT) Definitions.

• The feasibility study shall be performed in conformance with the requirements of SAMState Administrative Manual Sections 4922 through 4927.

• The FSRFeasibility Study Reports shall be prepared in accordance with SAMState Administrative Manual Sections 4928 through 4928.4.

• The FSRFeasibility Study Reports shall be reviewed and approved in accordance with the general requirement of SAMState Administrative Manual Section 4819.3, State Information Management Authority and Responsibility, as well as the specific requirements of SAMState Administrative Manual Sections 4926 through 4926.5.

• Refer to SAMState Administrative Manual and the handbook, “How To Conduct A Feasibility Study,” published by OITOffice of Information Technology, for specific guidelines for completing each step of the process.

43020.5.1 FSR Purpose

• The Feasibility Study represents the first opportunity within the project management sequence for State management to assess the full implications of a proposed information technology project. The purposes of the Feasibility Study are to:

  • Determine whether a proposed project represents a justified expenditure of public resources in terms of whether it:

    • Is responsive to a clearly defined, program-related problem or opportunity.

    • Is the best of the possible alternatives.

    • Is within the technical and managerial capabilities of the agency.

    • Would provide benefits over the life of the application that exceed development and operations costs. Such benefits typically include reduced program costs, avoidance of future program cost increases, increased program revenues, or provision of program services that can be provided only through the use of information technology.

  • Provide a means for achieving agreement between agency executive management, program management, and project management as to:

    • The nature, benefits, schedule, and costs of proposed project.

    • Their respective management responsibilities over the course of the project.

  • Provide executive branch control agencies and the Legislature with sufficient information to assess the merits of the proposed project and determine the nature and extent of project oversight requirements.

43020.5.2 Internal Approval Process

• In addition to the State policy and procedures which govern information technology projects, FSRs shall be developed and approved according to the following internal process. Once the FSRFeasibility Study Reports and/or CDC internal Project Summary Fact Sheet is completed and approved by the Division approving authority, it is submitted to:

  • ISDInformation Services Division (see EIS), Project Initiation Unit (PIUProject Initiation Unit), for technical review and recommendation.

  • MISManagement Information Systems-SU for inclusion on MISManagement Information Systems Committee agenda.

  • MISManagement Information Systems Committee for final departmental approval.

  • ISDInformation Services Division (see EIS)/PIUProject Initiation Unit for submission to OITOffice of Information Technology for review and approval if the project is reportable.

  • ISDInformation Services Division (see EIS)/PIUProject Initiation Unit for preparation of certification statement (Certifications for Personal Computer systems approved through the Personal Computer Policy are prepared by the MISManagement Information Systems-SU).

  • Chairperson, MISManagement Information Systems Committee, to sign certification.

  • Deputy Director, ASDSee Division of Administrative Services (DAS) (see ASB), and Assistant Director, OOCOffice Of Compliance (see OACC), to sign certification.

• OITOffice of Information Technology’s response to the Department regarding project approval/disapproval is sent directly to the Chief Deputy Director and then to ISDInformation Services Division (see EIS). Subsequently, ISDInformation Services Division (see EIS) shall update the project file and route copies to the project initiator(s) and to MISManagement Information Systems-SU.

• The process differs slightly if a BCPBudget Change Proposal is required. In order to ensure that the FSRFeasibility Study Reports is developed and approved within the mandatory time frames, refer to DOMDepartment Operations Manual 43020.3.1.

• In addition to a project file, ISDInformation Services Division (see EIS) (Systems Support) also monitors initial and subsequent equipment procurements to ensure they fall within the scope of the approved FSRFeasibility Study Reports or CDC Internal Summary Fact Sheet. Copies of all approved procurement documents shall be routed to the MISManagement Information Systems-SU.

References

• (1) CDT, Reportable Project Decision Tree Reference Guide.

• (2) DOMDepartment Operations Manual, Chapter 2, Article 1, § 21010.6.

• (3) SAMState Administrative Manual §§ 4819.34, 4819.37, 4928, and 6120.

• (4) SIMM §§ 15, 19, and 5305-F.

Revision History

• (1) Revised: October 17, 1994.

• (2) Revised: January 4, 2010.

• (3) Revised: October 28, 2025.

43030.1 Policy

• It is the policy of the Department to create an automation organizational structure that is conducive to the successful implementation, maintenance, and control of the EDPElectronic Data Processing (see IT) environment.

43030.2 Purpose

• The purpose of this policy is to ensure that an EDPElectronic Data Processing (see IT) infrastructure is created which meets the needs of the Department and fixes responsibility and authority for the development and maintenance of EDPElectronic Data Processing (see IT) systems.

43030.3 Responsibility

• EDPElectronic Data Processing (see IT) project management is project team oriented. Maintenance and development projects each have a technical project manager. New development projects also have a user project manager. Each project, whether maintenance or new development, is uniquely and individually staffed with a separate project team. DOMDepartment Operations Manual 43030.4 describes the structure of project teams.

• Team Concept

• Project Team Structure

  • The project team is a self-sufficient unit staffed with the appropriate technical and managerial resources to address the complexity and size of a project through its life cycle-from initiation through the development, implementation, and maintenance phases. A project team shall have the following composition:

    • A core technical staff of analysts and programmers to construct the system.

    • Users to participate in requirements definition, design “walkthroughs,” and test planning and execution.

    • Trainers to develop user manuals and to train users.

    • Administrative staff to support project tracking and management reporting.

  • Each project shall have a technical project manager and an associated user group. New development projects shall also have a user project manager who shall stay with the project through implementation. The user project manager shall be responsible for “what” needs to be automated. The technical project manager shall be responsible for the technical aspects (i.e., the “how”) of the project. DOMDepartment Operations Manual 43030.5 (User Project Manager) and DOMDepartment Operations Manual 43030.6 (Technical Project Manager) outline the roles and responsibilities of the user and technical project managers, respectively.

• User Project Manager

  • The user project manager is selected by CDC executive management from one of the functional areas affected by the project and reports to the appropriate Deputy Director on the MISManagement Information Systems Committee.

  • The user project manager provides overall guidance to the technical project manager. The user project manager keeps fully apprised of the status of the project through regular written project reports from the technical project manager, although the technical project manager reports formally to ISDInformation Services Division (see EIS) management.

  • The user project manager is fully responsible for the project and, in effect, is subcontracting for technical expertise. Therefore, this contract is with ISDInformation Services Division (see EIS) rather than a specific technical project manager. This means that the usual reporting structure for ISDInformation Services Division (see EIS) is maintained.

  • The user project manager is responsible for securing the necessary project funding and project resources. In addition, the user project manager is responsible for ensuring that the IMAPInformation Management Annual Plan, BCSBudget Concept Statement, BCPBudget Change Proposal, FSRFeasibility Study Reports, Special Project Report (SPRSpecial Project Reports), Quarterly Project Report (QPR), Post implementation Evaluation Report (PIERPost Implementation Evaluation Report), and any other required documentation is prepared and approved by departmental management. ISDInformation Services Division (see EIS) shall be responsible to review, log, and submit these reports to EDPElectronic Data Processing (see IT) control agencies as required.

  • The user project manager communicates project needs and priorities to the technical project manager, as reported by the user group. The user project manager is also responsible for ensuring that the user community provides the necessary time and resources required throughout the project, such as needs and requirements analysis, data conversion, and user training, as addressed in the approved project management plan.

• Technical Project Manager

  • The technical project manager is appointed by ISDInformation Services Division (see EIS) and reports to a unit manager within the Applications Systems Section who, in turn, reports to the ISDInformation Services Division (see EIS) Application Systems Manager. The technical project team members report directly to the technical project manager.

  • The technical project manager has full authority over and responsibility for the technical aspects of the project and the technical project team members. This responsibility includes:

    • Detailed planning.

    • Staff recruitment and management.

    • Project budget control.

    • Requirements specifications.

    • System design.

    • Programming and testing.

    • System implementation.

    • Data file conversion (responsibility for this task shall be shared with user staff depending upon the resources allocated to the project and the conversion approach approved in the implementation plan).

    • System maintenance.

    • User training (responsibility for this task may vary depending upon the resources allocated to the project and the training approach approved in the project management plan).

• User Groups

  • Each project (whether new development or maintenance) shall establish an associated user group comprised of representatives from the user community. The purpose of these user groups is to provide a forum for communication between the project teams and those who use the application systems, in order to facilitate more effective use of existing application systems and assist in the development of new systems.

  • The user group representatives prioritize requests for system enhancements, exchange information on system usage, and provide feedback on system modifications.

43030.4 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

43030.5 References

• DOMDepartment Operations Manual §§ 43030.4 – 43030.6.

44010.1 Policy

• The Department has established policy regarding project reporting and evaluation for each approved information technology project, in accordance with the requirements of SAMState Administrative Manual 4940 of the. All operating units within CDC shall adhere to the requirements set forth in the current section concerning project review, reporting, and evaluation. Additional requirements may be specified by the Office of Information Technology (OITOffice of Information Technology) in response to the Department’s IMAPInformation Management Annual Plan or in response to other needs reported by the Department (agency requirements are provided in SAMState Administrative Manual 4819.3 through 4819.39).

44010.2 Purpose

• The purpose of this policy is to ensure that State and CDC project review requirements are implemented on an ongoing basis.

44010.3 Project Review Overview

• Once the FSRFeasibility Study Reports for an information technology project has been approved by the MISManagement Information Systems Committee (also by OITOffice of Information Technology for non-delegated projects or the DGSDepartment of General Services for projects involving communications), the design, acquisition, development, and implementation phases of the project may proceed.

• The success of each phase of the project shall be evaluated and reported in terms of the project objectives. Included are project reports, a formal management review, and a post-implementation assessment. (SAMState Administrative Manual 4944 through 4946.2 provide a framework for project monitoring and evaluation.)

44010.3.1 Information Technology Project Reports

• Two information technology project reports are specified, the Quarterly Project Report (QPR) and the Special Project Report (SPRSpecial Project Reports). These reports:

  • Support continuing communication among all project participants (project management, program management and executive management).

  • Expose potential problems with respect to the availability of resources or the meeting of mandated project dates.

  • Provide for CDC management and control agency review of project progress at appropriate intervals throughout the life of the project.

44010.3.2 Formal Project Review

• In addition to the QPR and SPRSpecial Project Reports, a major management briefing, known as the Formal Project Review (FPRFormal Project Review) may be initiated by CDC management or required by the OITOffice of Information Technology for any information technology project. The FPRFormal Project Review allows for CDC management or control agency review of large projects after completion of the general design phase, but before substantial resources have been committed to the project. It may also be employed to provide a formal management assessment of a project at any point during the development cycle.

44010.3.3 Post Implementation Assessment

• Following completion of each information technology project, CDC shall carry out a post-implementation assessment. The assessment shall:

  • Measure the benefits and costs of the newly-implemented information technology application or system against the original objectives.

  • Document projected operations and maintenance costs over the life of the application or system.

44010.3.4 EDP Audit

• Every two years the Department shall carry out and submit to the DOFDepartment Of Finance an EDPElectronic Data Processing (see IT) audit. This audit is the responsibility of the Internal Audit Unit of PFABProgram and Fiscal Audits Branch (see OACC) (see DOMDepartment Operations Manual 49040). The audit shall be consistent with the DOFDepartment Of Finance publication, “Information Technology Security and Risk Management Guidelines.” This guide reflects the SAMState Administrative Manual requirements regarding the responsibility and control of EDPElectronic Data Processing (see IT) policy, and provides audit guidelines; however, it may not cover all areas to be audited. The guide and information about it are available through the Internal Audit Unit of PFABProgram and Fiscal Audits Branch (see OACC).

• To accomplish this audit it is likely that ITS under development shall be selected for audit on a sample basis. The intent of the audit is to make an assessment of the degree of compliance by CDC with departmental and State policies and procedures. The scope of the audit shall include, but not be limited to, the following:

  • Project approvals, feasibility study, and risk analysis (DOMDepartment Operations Manual 49020).

  • Operational recovery plan (DOMDepartment Operations Manual 49030).

  • Information security practices.

• The Project Manager is responsible for ensuring that the project documentation is in compliance with policy.

44010.4 Project Review Central Control/Clearinghouse

• All IMAPInformation Management Annual Plan “external” and “internal” reporting activities shall be monitored by CDC management through a central control agency/contact with regard to OITOffice of Information Technology reportable projects, OITOffice of Information Technology projects delegated to the Department, and all other Department information technology projects with an approved FSRFeasibility Study Reports, including those requiring a Summary Fact Sheet or Workgroup Computing Justification Form. The ISDInformation Services Division (see EIS), System Support Unit (ISDInformation Services Division (see EIS)-SSUSpecial Services Unit) shall be responsible for the central clearinghouse function. Refer to DOMDepartment Operations Manual 43030.3, User Project Manager, for project reporting responsibilities.

• Responsibilities

  • The ISDInformation Services Division (see EIS)-SSUSpecial Services Unit central clearinghouse monitors all external and internal quarterly project reports, special project reports, and post-implementation assessments. Project managers shall ensure that appropriate sign-off is attained on all projects before documents are submitted to the central clearinghouse. It is the responsibility of the central clearinghouse to:

    • Develop a cataloging system to monitor the completion and distribution of required reporting per schedule.

    • Notify project managers of scheduled reports prior to the report due date.

    • Review completed reports to ensure adherence to the Staterequired format.

    • Maintain copies of all reports and, in effect, act as a liaison between OITOffice of Information Technology and CDC project management concerning reporting requirements throughout the life cycle of the project.

• Summary Information Report

  • Since ITS approval and oversight are the responsibility of the MISManagement Information Systems Committee, the central clearinghouse function shall provide summary information on each ITS project to the MISManagement Information Systems Staff Committee at its quarterly meetings. This summary information shall include:

    • The project title.

    • MISManagement Information Systems approval date.

    • Projected completion date.

    • OITOffice of Information Technology delegation status.

    • FSRFeasibility Study Reports status.

    • QPR status.

    • PIERPost Implementation Evaluation Report status.

• The central clearinghouse shall also provide the MISManagement Information Systems Committee with a summary project status profile which may be in the form of the project’s most current QPR and, if necessary, SPRSpecial Project Reports.

44010.5 Project Compliance Review

• The Department is subject to compliance reviews conducted by OITOffice of Information Technology, or by specified units within CDC. The purpose of a compliance review is to verify CDC adherence to Department and State information technology policies and procedures.

• Types of Compliance Reviews

  • ITS within CDC are subject to four types of reviews:

    • Type 1. Policy compliance reviews (SAMState Administrative Manual Section 4942).

    • Type 2. EDPElectronic Data Processing (see IT) audit reviews (see DOMDepartment Operations Manual 49050).

    • Type 3. Information security, risk management, operational recovery compliance reviews (SAMState Administrative Manual Sections 4840 through 4845; DOMDepartment Operations Manual 49000).

    • Type 4. Facility peer reviews.

• Policy Compliance Review

  • Type 1 – Policy compliance reviews are conducted by OITOffice of Information Technology. Responses to this type of review shall be coordinated by the central clearinghouse function of ISDInformation Services Division (see EIS).

• EDPElectronic Data Processing (see IT) Audit Reviews

  • Type 2 – EDPElectronic Data Processing (see IT) audit reviews are part of an audit required by SAMState Administrative Manual, and are usually conducted by the Internal Audits Unit of PFABProgram and Fiscal Audits Branch (see OACC). Alternately, it is possible that Type 2 reviews shall be carried out by the Audits Group of DOFDepartment Of Finance, but responsibility for the audit reviews remains with PFABProgram and Fiscal Audits Branch (see OACC). The owner of an information system is responsible for providing responses to audit findings regarding that system.

• Security, Risk, and Operational Compliance Reviews

  • Type 3 – Information security, risk management, and operational recovery compliance reviews are ongoing and conducted by the Information Security Unit within PFABProgram and Fiscal Audits Branch (see OACC). These reviews are usually not oriented to a specific system or project, and are limited in scope to the policies contained in SAMState Administrative Manual Sections 4840 through 4845, and DOMDepartment Operations Manual Subchapter 49000.

• Facility Peer Reviews

  • Type 4 – Facility peer reviews are reviews of business services operations conducted by the Department on a rotational basis at each of CDC’s facilities. The EDPElectronic Data Processing (see IT) portion of the peer review includes a functional review of Offender Based Information Services, the DDPSDistributed Data Processing System, and personal computer security practices and system utilization.

  • The review teams are composed of business services and administrative staff from headquarters and the facilities.

• NonDelegated Projects

  • OITOffice of Information Technology reviews project reporting documentation in conjunction with its compliance review and oversight responsibilities.

• Delegated Projects

  • For delegated projects, the MISManagement Information Systems Committee shall determine when a compliance review is to be conducted, the scope of the review, and who shall perform the review.

44010.6 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

44010.7 References

• SAMState Administrative Manual §§ 4819.3 to 4819.39, 4840 – 4845, 4940, 4942, and 4944 – 4946.2.

• DOMDepartment Operations Manual §§ 49000, 49020, 49030, 49040, 49050, 43030.5.

• DOFDepartment Of Finance publication, “Information Technology Security and Risk Management Guidelines.”

44020.1 Policy

• It is the policy of the Department to monitor the implementation and outcome of EDPElectronic Data Processing (see IT) projects within the Department to ensure that progress and outcome information is tracked and reported, as specified by SAMState Administrative Manual 4940 and as otherwise required by State oversight agencies. Additional requirements may be specified by the Office of Information Technology (OITOffice of Information Technology) in response to the Department’s Information Management Annual Plan (IMAPInformation Management Annual Plan) or in response to other needs reported by the Department (see SAMState Administrative Manual 4819.3 through 4819.39 for departmental requirements).

44020.2 Purpose

• The purpose of this policy is to ensure that adherence to all project reporting requirements outlined by State oversight agencies is monitored and met.

44020.3 Project Reporting Requirements Compliance Review Reporting Schedule

• The Compliance Review Reporting Schedule for both delegated and non-delegated projects is set by the MISManagement Information Systems Committee in accordance with central control agency and Department requirements, and is reported to the central clearinghouse.

44020.4 Project Reporting Requirements‑Audit of Information Technology Projects

• All information technology projects are subject to audit, with project reporting and evaluation documents being an essential aspect of the audit trail (SAMState Administrative Manual Section 4943). CDC is subject to project audits by control agencies as well as internal audits. Documentation supporting project decisions shall be kept by the Department in the central clearinghouse for a minimum period of two years following approval of the post-implementation assessment.

• Nondelegated Projects

  • OITOffice of Information Technology audits project reporting documentation in conjunction with its audit and oversight responsibilities.

• Delegated Projects

  • For delegated projects, the MISManagement Information Systems Committee shall determine when an audit is to be conducted, the scope of the audit, and who shall perform the audit.

44020.5 Project Reporting Requirements Project Audit Reporting Schedule

• The project audit reporting schedule for both delegated and non-delegated projects is set by the MISManagement Information Systems Committee in accordance with central control agency and Department requirements, and is reported to the central clearinghouse.

44020.6 Project Reporting Requirements Quarterly Project Report Requirements

• Quarterly Project Reports (QPR) are usually required of the project manager in the case of projects subject to monitoring by OITOffice of Information Technology, and may be required as an additional reporting responsibility for delegated projects. OITOffice of Information Technology’s response to the Department’s IMAPInformation Management Annual Plan or FSRFeasibility Study Reports specifies the necessity of preparing QPRs for particular projects. On occasion, reporting on other than a quarterly basis is established by the FSRFeasibility Study Reports and approved by the MISManagement Information Systems Committee.

• Every external QPR shall be reviewed and approved by the affected division, and by the Director, or designee. Two copies of the QPR shall be submitted to the central clearinghouse for submittal to OITOffice of Information Technology by no later than the 15th day of the month following the end of each fiscal quarter (i.e., October 15, January 15, April 15, and July 15). A copy of the QPR shall be forwarded to the Office of the Legislative Analyst.

• CDC also encourages use of the QPR format to document project activity for projects that do not qualify as reportable, or for which project monitoring has been delegated to the Department. These internal QPRs shall be reviewed and approved by the affected division. It is not necessary to forward copies of these reports to OITOffice of Information Technology or the Office of the Legislative Analyst unless so required by OITOffice of Information Technology.

• The QPR shall contain a brief summary of project status including an explanation of any minor deviations from the original project plan. An updated Project Management Schedule (see SAMState Administrative Manual Section 4928.4) showing actual completion dates of specific tasks/deliverables shall be attached. The QPR shall conform to the standard format provided in SAMState Administrative Manual Section 4944.1.

• Some deviations from the project plan require preparation and submission of a Special Project Report (SPRSpecial Project Reports). The conditions that require preparation of an SPRSpecial Project Reports are defined in SAMState Administrative Manual Sections 4945 and 4945.1.

44020.7 Project Reporting Requirements Special Project Reports

• General Reporting Requirements (SAMState Administrative Manual Section 4945): Preparation of an SPRSpecial Project Reports is required whenever a project deviates substantially from the costs, benefits or schedules documented in the approved FSRFeasibility Study Reports, or when a major revision occurs in project requirements or methodology. No expenditure of funds shall be made to implement an alternative course of action until approval has been received from OITOffice of Information Technology or the Director of CDC, as appropriate (SAMState Administrative Manual Section 4945). SAMState Administrative Manual Section 4945.1 lists specific conditions for the required submission of an SPRSpecial Project Reports to OITOffice of Information Technology.

• SPRs, which must be submitted to OITOffice of Information Technology, shall be transmitted within 30 days after recognition of a substantial deviation. Two copies of the SPRSpecial Project Reports shall be submitted to OITOffice of Information Technology and one copy to the Office of the Legislative Analyst. SPRs shall be signed by the Director of CDC or designee.

• If a QPR is due to OITOffice of Information Technology during the period the Department is engaged in preparing the SPRSpecial Project Reports, CDC shall submit the QPR (see SAMState Administrative Manual Sections 4944 through 4944.1) stating that an SPRSpecial Project Reports is under development and providing an approximate date for its completion.

• The format and content of the SPRSpecial Project Reports transmittal letter for each non-delegated or delegated project shall conform to the standard formats provided in SAMState Administrative Manual Section 4945.

• Conditions Requiring Submission to OITOffice of Information Technology (SAMState Administrative Manual Section 4945.1):

  • Projects subject to OITOffice of Information Technology approval/oversight – an SPRSpecial Project Reports shall be submitted to OITOffice of Information Technology if:

    • The information technology project’s total costs deviate p roj, or are anticipated to deviate, by ten percent (higher or lower) from the estimated information technology ect budget (to be measured against the combined total of each fiscal year’s One-time Costs plus Continuing Costs on the Summary Fact Sheet, SAMState Administrative Manual 4930 Illustration 1.

    • The project schedule falls behind or is anticipated to fall behind by 10 percent or more (to be measured using the key management milestones critical to project success reported on the Summary Fact Sheet, SAMState Administrative Manual Section 4930, Illustration1).

    • The total program benefits deviate or are anticipated to deviate by 10 percent (higher or lower) from the estimated total program benefits (to be measured against the combined total of each fiscal year’s Cost Savings and Cost Avoidances on the Summary Fact Sheet, SAMState Administrative Manual 4930, Illustration 1).

    • A major change occurs in project requirements or methodology.

  • Projects subject to approval and oversight by the Special Project Director (delegated or nonreportable), and projects for which project reporting has been delegated to the Director after OITOffice of Information Technology approval of the FSRFeasibility Study Reports: Submission of an SPRSpecial Project Reports to OITOffice of Information Technology is required if the revised project costs exceed or are estimated to exceed CDC’s IMAPInformation Management Annual Plan cost threshold (SAMState Administrative Manual Section 4902.12), and one or more of the following conditions are true:

    • The total information technology project costs deviate or are anticipated to deviate by 10 percent (higher or lower) from the estimated information technology project budget (to be measured against the combined total of each fiscal year’s One-time Costs vs. Continuing Costs on the Summary Fact Sheet, SAMState Administrative Manual Section 4930 Illustration 1).

    • The project schedule falls behind or is anticipated to fall behind by 10 percent or more (to be measured using the key management milestones critical to project success reported on the Summary Fact Sheet, SAMState Administrative Manual 4930, Illustration 1).

    • The total program benefits deviate or are anticipated to deviate by 10 percent (higher or lower) from the estimated total program benefits (to be measured against the combined total of each fiscal year’s Cost Savings and CostAvoidances on the Summary Fact Sheet, SAMState Administrative Manual Section 4930, Illustration 1.

    • A major change occurs in project requirements or methodology.

  • If an SPRSpecial Project Reports for a delegated project must be submitted to OITOffice of Information Technology, attach to the SPRSpecial Project Reports a copy of the approved FSRFeasibility Study Reports and the project approval letter signed by the Director or designee.

  • Internal special project reports Delegated or nonreportable projects which exceed projected project development costs but do not (according to control agency requirements) require an SPRSpecial Project Reports.

• An internal SPRSpecial Project Reports shall be required when the cost thresholds below are exceeded:

  • By less than $100,000 The project exceeds cost projections by 25 percent or more.

  • Between $100,000 and $200,000 The project exceeds costs projections by 15 percent or more.

  • Over $200,000 The project exceeds cost projections by 10 percent or more.

• The SPRSpecial Project Reports shall provide sufficient information for Department management, executive branch control agencies, and the Legislature to assess the merits of the proposed project change and determine the nature and extent of future project oversight requirements. If an SPRSpecial Project Reports lacks sufficient information for these purposes, OITOffice of Information Technology may request that the Department provide additional information.

• SPRs shall be commensurate with the level of deviation from the approved FSRFeasibility Study Reports. Therefore, the Department shall determine whether to prepare a revised FSRFeasibility Study Reports, provide the information required by the minimum content for an SPRSpecial Project Reports (defined below), or do something in between these two extremes.

• The minimum content for an SPRSpecial Project Reports consists of a description of the project status, an explanation of the reason for the project deviation, a revised project management schedule, and economic summary information. CDC shall prepare an SPRSpecial Project Reports with at least the minimum content described below:

  • Project Status – An explanation of the problems encountered or opportunities identified that have led to the preparation of the SPRSpecial Project Reports. This section of the SPRSpecial Project Reports shall include as appropriate:

    • Changes in Project Requirements or Methodology – An explanation of the proposed change from the anticipated course of action, including the reasons for the change and why this proposed alternative methodology is now the preferred course of action.

    • Cost Benefit or Schedule Deviations – An explanation of the deviation from the originally anticipated costs, benefits or schedule. This section shall include the reasons for the deviation and the proposed course of action to bring the project back within planned costs, benefits, or schedule.

  • Summary Fact Sheet – This section shall include a revised Summary Fact Sheet (SAMState Administrative Manual Sections 4930 through 4930.1) indicating accomplishments to date by using actual dates in the Target Date fields of the Project Schedule, then continuing the schedule by focusing on the yet to be accomplished milestones critical to project success. The cost analysis portion shall contain all actual costs to date plus revised projected costs through the end of the project.

• For example, this may be the second fiscal year that the project has been under development: indicate the actual project costs for last year and place them in the first column of Personnel Years (PYs) and Costs, then combine the actual costs for the current fiscal year-to-date with the anticipated costs for the remainder of this fiscal year, and place them in the second column of PYs and Costs. Indicate the anticipated costs for each succeeding budget year through the end of the project.

• If the feasibility of the project was documented through the preparation of a FSRFeasibility Study Reports, the following additional content shall be provided:

  • Project Management Schedule – A revised Project Management Schedule (SAMState Administrative Manual Section 4928.4) indicating accomplishments to date and focusing on the duration of critical tasks, major management decision-points, and progress reporting milestones shall be included in the SPRSpecial Project Reports.

  • Economic Analysis Worksheet – A revised Economic Analysis Worksheet (SAMState Administrative Manual Sections 4929 through 4929.2) shall be provided. The worksheet shall contain all actual costs to date plus revised projected costs through the end of the project.

• For example, this may be the second fiscal year that the project has been under development: Indicate the actual project costs for last year and place them in the first column of PYs and Costs, then combine the actual costs for the current fiscal year-to-date with the anticipated costs for the remainder of this fiscal year, and place them in the second column of PYs and Costs. Indicate the anticipated costs for each succeeding budget year through the end of the project.

44020.8 Project Reporting Requirements – Formal Project Review

• A Formal Project Review (FPRFormal Project Review) may be initiated by Department management or required by OITOffice of Information Technology for any information technology project. The FPRFormal Project Review typically provides a formal management or control agency checkpoint after completion of the project’s general design phase, but before substantial resources have been committed. It may also provide a formal management assessment of a project at any point during the development cycle. FPRs may be scheduled during the procurement process if doing so does not violate procurement requirements.) OITOffice of Information Technology may notify the Department that an FPRFormal Project Review is required in its response to the Department’s IMAPInformation Management Annual Plan, in an FSRFeasibility Study Reports approval document, or in any correspondence subsequent to project approval.

• SAMState Administrative Manual Section 4946.1 provides guidance in the form of recommended content for the preparation and presentation of an FPRFormal Project Review. Depending upon the complexity, sensitivity, and size of the project, an FPRFormal Project Review presentation shall usually require between two and four hours. When the Department receives services from a data center or from another agency, responsible staff should request that representatives of the data center or the servicing agency attend.

• Content and Organization

  • The FPRFormal Project Review provides an opportunity for a final critique of the merits of the proposed information technology project prior to commitment of substantial resources. It shall be used also as a checkpoint during project development to maintain management involvement and awareness with respect to crucial decision points. The FPRFormal Project Review allows assessment of: (1) systems design, (2) current estimates of costs and benefits, (3) management controls, and (4) probability of project success.

• Composition of Formal Project Reviews (FPRFormal Project Review)

  • An FPRFormal Project Review topic outline is provided in SAMState Administrative Manual Section 4946.1, Illustration 1. Typically, the FPRFormal Project Review is organized into four major sections:

    • Background.

    • Technical Strategy.

    • Project Management Controls.

    • Summary.

  • The suggested content of each of these sections is specified in SAMState Administrative Manual Sections 4946.11 through 4946.14.

  • It is important to adapt the presentation to suit the audience. Executive management, for example, may not be interested in the technical details of a project, but may be anxious to know the time frames for system operation and the capture of proposed tangible and intangible benefits.

• Background Section

  • The Background Section of the FPRFormal Project Review shall provide the facts necessary to understand the problem or opportunity being addressed by the project, and the defined project objectives within their program context.

  • Typically, this portion of the presentation shall include:

    • A summary of the information contained in the requirements section of the FSRFeasibility Study Reports, with a note of any significant changes since preparation of the FSRFeasibility Study Reports.

    • A brief overview of the project technical strategy as defined in the FSRFeasibility Study Reports’s functional requirements (technical topics are normally covered in detail during the technical strategy section of the FPRFormal Project Review).

    • A brief description of project organization as it relates to the overall organization of the Department, and any specific user organization within the Department.

    • An overview of the information contained in the Management Plan Section of the FSRFeasibility Study Reports.

    • A management summary that concentrates on costs, benefits, savings, PYPersonnel Year reductions, or other quantifiable or non-quantifiable management benefits that were described in the FSRFeasibility Study Reports.

    • A synopsis of anticipated decisions that shall be necessary at the conclusion of the presentation.

  • Ideally, the FPRFormal Project Review is based upon information that is more current than is contained in the FSRFeasibility Study Reports; therefore, the estimates should be an update to the economic analysis portions of the FSRFeasibility Study Reports.

  • The presentation on technical strategy shall include typically:

    • Major system processes, including file or data section base relationships, interfaces with existing systems, and impact on other systems currently in operation, planned, or under development. This overview of systems capabilities should inform the audience regarding methods for processing information, input mechanisms, output mechanisms, error detection techniques, and data distribution or access.

    • Specific hardware and software requirements for development and operation of the system; the level of presentation detail should be based on the audience’s technical background and need to make informed decisions.

    • Lease versus purchase decisions for equipment and software, and the procurement mechanism and schedule.

    • Requirements for security and asset protection: level of security, security methods, and contingency plans.

• Project Management

  • This section provides an overview of the project management plan based upon the Management Plan section of the FSRFeasibility Study Reports with updates to reflect changes since the preparation of the FSRFeasibility Study Reports. Additionally, a review of the project phases is typically presented including design, development, testing, implementation, conversion, and acceptance. Coordination of responsibility for these phases is also presented.

  • Other topics included in the project management section of the presentation are:

    • Training requirements, plans, and costs for technical and user staff.

    • Special management requirements for system conversion.

    • User or technical responsibilities for data conversion.

    • The time frame for accomplishment of conversion.

• Summary

  • The concluding section of the FPRFormal Project Review normally summarizes the current status of the project, describes the next steps in the project, highlights potential problems for the project, and closes with any required decisions that may be necessary.

44020.9 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

44020.10 References

• SAMState Administrative Manual §§ 4819.3 – 4819.39, 4902.12, 4928.4, 4929 to 4929.2, 4930 to 4930.1, 4940, 4943, 4944 to 4944.1, 4945 to 4945.1, 4946.1, and 4946.11 – 4946.14.

44030.1 Policy

• It is the policy of the Department to evaluate its EDPElectronic Data Processing (see IT) projects as required by the SAMState Administrative Manual 4940, and as otherwise required by State oversight agencies. Additional requirements may be specified by the Office of Information Technology (OITOffice of Information Technology) in response to the Department’s Information Management Annual Plan (IMAPInformation Management Annual Plan) or in response to other needs reported by the Department.

44030.2 Purpose

• The purpose of this policy is to ensure the implementation of all project evaluation requirements specified by laws and regulations, and State and departmental policies.

44030.3 Post‑implementation Evaluation Report (PIER) General Information

• A post-implementation assessment shall be carried out by the Department following the completion of each information technology project. No project is considered complete until the report of that assessment, the Post-implementation Evaluation Report (PIERPost Implementation Evaluation Report), has been approved by OITOffice of Information Technology or the Department Director, as specified in OITOffice of Information Technology’s response to the Department’s IMAPInformation Management Annual Plan and in accordance with SAMState Administrative Manual 4819.36 and 4941. Approval of a PIERPost Implementation Evaluation Report by OITOffice of Information Technology or The Director, as required, terminates project reporting requirements.

• The post-implementation assessment shall be conducted after the new information technology capability has been operational for a sufficient period of time to allow its benefits and costs to be accurately assessed. Initial operational problems shall have been resolved and sufficient experience and data shall have been accumulated to determine whether the project met the proposed objectives, was completed within the anticipated time and budgetary constraints, and achieved the proposed benefits. The optimum time after implementation to conduct the assessment depends upon the nature of the project. Six months after implementation is typical. The assessment shall be completed within two years of implementation of the information technology capability.

• The required content for a PIERPost Implementation Evaluation Report is defined in SAMState Administrative Manual Section 4947.2. The format and content of the PIERPost Implementation Evaluation Report Transmittal Letter for each nondelegated project shall conform to the standard format shown in SAMState Administrative Manual 4947, Illustration 1. The format and content of the Transmittal Letter for each delegated project requiring submission of the PIERPost Implementation Evaluation Report to OITOffice of Information Technology shall conform to the standard format shown in SAMState Administrative Manual 4947, Illustration 2.

44030.4 PIER Reporting Requirements

• Two copies of the PIERPost Implementation Evaluation Report shall be submitted to OITOffice of Information Technology and one copy to the Office of the Legislative Analyst if the project was subject to approval and oversight by OITOffice of Information Technology. If OITOffice of Information Technology has delegated project approval authority to CDC, but in conjunction with that delegation has required that CDC submit a copy of the PIERPost Implementation Evaluation Report following completion of the project, CDC’s submission of the PIERPost Implementation Evaluation Report shall include a copy of the approved FSRFeasibility Study Reports with its signed Project Approval Letter.

• PIERs for projects subject to approval and oversight by the Department Director (delegated or non-reportable) or projects for which project reporting has been delegated to the Department Director after OITOffice of Information Technology approval of the FSRFeasibility Study Reports shall be approved by the Director or designee (see SAMState Administrative Manual 4971.1).

44030.5 PIER Content and Format

• The level of detail included in the PIERPost Implementation Evaluation Report shall be commensurate with the scope and complexity of the project and its anticipated benefits. The narrative portion of the PIERPost Implementation Evaluation Report for a minor project can be as brief as one or two pages. However, it shall provide sufficient information for Department management, executive branch control agencies, and the Legislature to assess the success of the project (see SAMState Administrative Manual Section 4947.2).

• PIERPost Implementation Evaluation Report Composition

  • The PIERPost Implementation Evaluation Report is comprised of five sections:

    • Background and Summary of Results Section. A brief summary is provided of the project history, objectives, and results. Topics to be discussed normally include: how the project was initiated, how it progressed, problems that were overcome, user and management acceptance of the operational application, how Department management views the management of the project, and how the application fits into the Department’s overall management and operations strategy.

    • Attainment of Objectives Section. Specific objectives are established during the feasibility study for each project and are documented in the FSRFeasibility Study Reports. These objectives, which are normally defined in terms of measurable impact on Department programs and resources, provide the baseline for measurement of the project’s success. Accordingly, the narrative portion of this section of the PIERPost Implementation Evaluation Report shall describe the project outcome with respect to each objective included in the FSRFeasibility Study Reports. This section shall also include a clear statement regarding the capture of benefits and whether they were achieved as anticipated.

  • Two attachments shall be included with this section of the PIERPost Implementation Evaluation Report:

    • Attachment 1 – PIERPost Implementation Evaluation Report Economic Summary Report. Project costs and benefits shall be summarized using the PIERPost Implementation Evaluation Report Economic Summary (SAMState Administrative Manual 4947.2 Illustration1). This spreadsheet allows comparison of the anticipated costs of the selected alternative, as documented in the FSRFeasibility Study Reports Economic Analysis Summary (SAMState Administrative Manual 4929.3), with actual project costs from the project start date through the period of project operation chosen as the basis for the PIERPost Implementation Evaluation Report. For detailed information on the completion of entries in the PIEREconomic Summary, see the instructions for the FSREconomic Analysis Worksheet (SAMState Administrative Manual 4929.1 through 4929.2) and the Economic Analysis Summary (SAMState Administrative Manual 4929.3).

    • Significant deviations from the anticipated costs shall be explained in the narrative portion of this section.

    • Attachment 2 Project Management Schedule Report. Arevised Project Management Schedule (see SAMState Administrative Manual 4928.4) showing targeted and actual completion dates for major accomplishments during the project shall be provided, with significant deviations from the original schedule explained in the narrative.

    • Projected Operations/Maintenance Costs Section. The Summary of Projected Operations/Maintenance Costs documents anticipated costs of systems operation and maintenance by fiscal year over the expected operational life of the application or system. These costs shall begin where the costs contained in the PIERPost Implementation Evaluation Report Economic Summary ended. For detailed information on completion of the specific line items in the Summary of Projected Operations/Maintenance Costs, see the instructions for continuing costs found on lines 9-16 of the FSRFeasibility Study Reports Economic Analysis Worksheet contained in SAMState Administrative Manual 4929.1 through 4929.2.

    • Special Observations Section. This section is optional. If completed, it should contain a narrative of any notable occurrences or factors that contributed to the project’s success, or problems or other information that could be helpful during future project efforts.

    • Corrective Actions Section. This section shall be included when the project is deemed to be a limited success or a failure, or when there are significant differences between project expectations (as expressed in the FSRFeasibility Study Reports) and project results.

      • If the project was a limited success or involved significant differences between expectations and results, alternatives for improving the outcome shall be summarized. If the project was a failure, available alternatives for addressing the problem or opportunity shall be summarized.

44030.6 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

44030.7 References

• SAMState Administrative Manual §§ 4819.36, 4928.4, 4929.1 – 4929.3, 4941, 4941, 4941.1, and 4947 – 4947.1.

45010.1 Policy

• The Department shall require competitive acquisition of EDPElectronic Data Processing (see IT) goods and services in accordance with applicable provisions of the SAMState Administrative Manual, the PCCPublic Contract Code, the GCGovernment Code, and the LCLabor Code.

45010.2 Purpose

• This section describes the departmental requirements for procurement and contract of EDPElectronic Data Processing (see IT) goods and services.

45010.3 EDP

• EDPElectronic Data Processing (see IT) is referred to as information technology, encompassing all computerized and auxiliary automated information handling including systems analysis and design, conversion of data, computer programming, information storage and retrieval, voice/video aspects, requisite system controls, data communications, simulation, and all related interactions between people and machines.

45010.4 Responsibility

• Contract Services Section

  • The Department’s Contract Services Section (CSS) shall supervise EDPElectronic Data Processing (see IT) contracts entered into by CDC in a manner that:

    • Conserves the financial interests of the Department and the State.

    • Prevents, so far as possible, any thriftless acts by employees of CDC.

    • Avoids unnecessary expenditures.

• BSS

  • The BSS is responsible for the preparation of purchase documents for all EDPElectronic Data Processing (see IT) equipment and data-related items for use in CDC headquarters or by the P&CSDParole & Community Services Division (see DAPO). As directed by the Department, the BSS is responsible also for the procurement of EDPElectronic Data Processing (see IT) equipment by specific facilities.

    • BSS shall ensure that all requests submitted for purchase are complete and the necessary documentation is included, such as certifications or FSRs.

    • BSS is the departmental contact with the DGSDepartment of General Services, Office of Procurement, for all EDPElectronic Data Processing (see IT) procurements processed for CDC headquarters and P&CSDParole & Community Services Division (see DAPO), as well as for specified facility procurements.

  • P&CDPlanning and Construction Division (see FPCM) The P&CDPlanning and Construction Division (see FPCM) is responsible for procurement of EDPElectronic Data Processing (see IT) equipment for new prison construction projects.

• DGSDepartment of General Services

  • The DGSDepartment of General Services is the State agency that exercises supervision over EDPElectronic Data Processing (see IT) contracts entered into by all other State agencies.

  • The DOFDepartment Of Finance and DGSDepartment of General Services have general powers of supervision over matters concerning the financial and business policies of the State, and they are empowered to institute investigations and procedures deemed proper in the best interests of the State.

  • While most types of contracts are reviewed and approved by the Legal Services Division of DGSDepartment of General Services, EDPElectronic Data Processing (see IT) contracts are reviewed and approved by the DGSDepartment of General Services, EDPElectronic Data Processing (see IT) Acquisitions Unit. This unit reviews contracts to ensure that the best interests of the State are preserved, that State agencies comply with applicable laws, rules, and regulations, and that expenditures are made as wisely and economically as possible given the needs of agencies.

45010.5 Procurement/Contracting Project Authorization

• Before a contract or purchase order for a new EDPElectronic Data Processing (see IT) project can be let for the purchase of goods and services, the program concept and any needed equipment and services shall be evaluated by the Department’s MISManagement Information Systems Committee. Also, the program concept and any equipment/services shall be contained in the Department’s Information Management Annual Plan (IMAPInformation Management Annual Plan) filed with DOFDepartment Of Finance (see DOMDepartment Operations Manual 43010, Information Management Planning, for additional information). If accepted for incorporation in the IMAPInformation Management Annual Plan, a feasibility study is conducted to thoroughly evaluate the concept and analyze the cost/benefits. The completed FSRFeasibility Study Reports shall be approved at all appropriate levels of Department management, and by the Director.

• The FSRFeasibility Study Reports shall then be forwarded to the DOFDepartment Of Finance, Office of Information Technology (OITOffice of Information Technology) for review and approval, unless the project is delegated to the Department (refer to DOMDepartment Operations Manual 43020, FSRFeasibility Study Reports Policy, for additional information). If approved, a budget concept paper may be prepared or a BCPBudget Change Proposal initiated for review and approval by top management of the Department and DOFDepartment Of Finance. Approval of the Legislature and the Governor also may be required through the budget enactment process. If the project is authorized, the drafting of contracts shall be initiated.

45010.6 Certification Affidavit for an EDP Purchase Order/Contract

• Certain EDPElectronic Data Processing (see IT) purchase orders and contracts must be accompanied by a “Certification of Compliance with Policies Pursuant to SAMState Administrative Manual 4819.39 and 4832,” as specified in SAMState Administrative Manual 4819.39 and 4832. Procurements not requiring such certification are:

  • Procurements for less than $10,000;

  • Procurements limited to only maintenance services;

  • Procurements in support of previously approved efforts (see SAMState Administrative Manual 4819.38);

  • Procurements of services to conduct a feasibility study provided the services are limited to supporting or conducting the feasibility study and/or preparing the FSRFeasibility Study Reports; or

  • Procurements of/for excluded activities as described in SAMState Administrative Manual 4819.32.

• The certification attests that the program or function for which the purchase documents are being processed has been approved by the DOFDepartment Of Finance. SAMState Administrative Manual 4832 provides a sample of the certification affidavit.

• In order to comply with the certification requirement, all EDPElectronic Data Processing (see IT) contracts and purchase orders not included by the above criteria shall be forwarded to headquarters. Additionally, every amendment to such EDPElectronic Data Processing (see IT) contracts or interagency agreements shall include a certification affidavit.

• Certifications for microcomputers, peripheral equipment and software shall be prepared by MISManagement Information Systems-SU. Certification for all other EDPElectronic Data Processing (see IT) equipment shall be prepared by the ISDInformation Services Division (see EIS). The certification shall contain a statement signed by the Director, or designee affirming that the equipment is in compliance with SAMState Administrative Manual-requirements concerning information technology. In CDC, the Director has delegated approval authority to the Deputy Director, ASDSee Division of Administrative Services (DAS) (see ASB), and the Assistant Director, OOCOffice Of Compliance (see OACC). Adherence to this certification requirement adds approximately two weeks to the routing process within CDC headquarters.

45010.7 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

45010.8 References

• SAMState Administrative Manual §§ 4800, 4819.39, and 4832.

• DOMDepartment Operations Manual §§ 43010 and 43020.

45020.1 Policy

• The California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation or the department) shall utilize acceptable methods of procurement when purchasing or contracting for Information Technology (ITInformation Technology) goods and services. The department shall follow acceptable procurement practices and methods as defined by the Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)) and defined in the State Contracting Manual (SCM) Volume 2, State Administrative Manual (SAMState Administrative Manual), and the Department Operations Manual (DOMDepartment Operations Manual).

45020.2 Purpose

• The purpose of this section is to outline the acceptable methods of procurement and provide references to information and procedures for initiating an ITInformation Technology procurement, the methods used to purchase ITInformation Technology goods and services, and meeting the general contract requirements provided in SAMState Administrative Manual and SCM Volume 2.

45020.3 Process for the Procurement of IT Goods and Services

• The process for procurement of ITInformation Technology goods and services is more complicated than for procurement of non-ITInformation Technology goods and services. There is no single procurement method best suited universally for all categories of acquisition. Each procurement consists of differing elements that, overall, lend themselves more appropriately to one technique than to another. It is the responsibility of the EISEnterprise Information Services (formerly Information Services Division) Information Technology Goods and Services Procurement (ITGSP) to select the method of procurement to be used for each ITInformation Technology acquisition. All procurements for ITInformation Technology related goods and services shall be processed by ITGSP only, within EISEnterprise Information Services (formerly Information Services Division).

45020.4 Methods of Procurement

• There are three acquisition methods of procurement:

  • Competitive

  • Non-Competitive

  • Leveraged Procurements

45020.4.1 Competitive Methods

• Competitive procurement methods have several industry-standard methods established in SCM Vol. 2, that may be used for soliciting and awarding contracts and purchase orders. The competitive procurement methods include:

  • Formal

    • Invitation for Bid (IFBInvitation For Bids) – This is the most common written format for formal purchases at or above $1,000,000.

    • Request for Proposal (RFPRequest For Proposal) – Used for formal solicitations more than $1,000,000. The RFPRequest For Proposal identifies a complex business or elevated risk.

  • Informal

    • Request for Quote (RFQRequest For Quotations) – Used for competitive solicitations below $1,000,000.00.

  • Small Business (SB) and Disabled Veteran Business Enterprise (DVBEDisabled Veteran Business Enterprises) Option.

    • CDCRCalifornia Department of Corrections and Rehabilitation shall utilize the SB/DVBEDisabled Veteran Business Enterprises method first. This is the most recommended method to satisfy state mandates relating to SB/DVBEDisabled Veteran Business Enterprises or DVBEDisabled Veteran Business Enterprises guidelines and may be used for acquisitions between $5,000 and $249,999.99.

  • Limited to Brand (LTB)

    • This is used for specific brand or trade name solicitations in accordance with Public Contract Code (PCCPublic Contract Code) section 12102(b) for ITInformation Technology goods, and sections 10301 and 10302 for Non-ITInformation Technology goods. Refer to CDCRCalifornia Department of Corrections and Rehabilitation Purchasing Authority Approval Letter (PAAL) for maximum threshold for the department’s LTB justification purchasing authority, which requires departmental or the Department of General Services (DGSDepartment of General Services) approval prior to solicitation.

• For a complete detailed list of Competitive Methods of Procurement, refer to SCM Vol. 2, section 1401, Competitive Acquisition Methods List.

45020.4.2 Non‑Competitive Methods

• Non-competitive procurement methods most commonly used by the department include:
  

  • Non-Competitive Bid (NCB)

    • These are competitive transactions adhering to a specific approval process in which only a single supplier is afforded the opportunity to offer the state a price for the specified goods or services.

  • Fair and Reasonable (F&R)

    • If the transaction is less than $20,000, a F& R solicitation is acceptable.

    • The requestor shall solicit one vendor and utilize one of the five techniques to establish whether a supplier’s price can be determined to be F&R. See SCM Volume 2, section 1510.

  • Community-Based Rehabilitation Program (CRP)

    • Meets the criteria of Welfare and Institutions Code (WIC), section 19404. An NCB justification is NOT required.

  • Emergency

    • Emergency contracts are necessary for the immediate preservation of the public health, welfare, safety, or the protection of CDCRCalifornia Department of Corrections and Rehabilitation property and programs. EISEnterprise Information Services (formerly Information Services Division) must be notified as soon as the emergency has been identified.

      • Emergency – Non-Natural Disaster – Contracts that meet SCM criteria and that are subject to purchasing authority dollar thresholds, refer to CDCRCalifornia Department of Corrections and Rehabilitation PAAL for maximum threshold. EISEnterprise Information Services (formerly Information Services Division) must be notified as soon as the emergency has been identified.

  • Exempt by Law

    • Interagency Agreement (IAA) – Contracts for ITInformation Technology work or services with other state agencies, California State University, University of California institutions, or California Department of Technology (CDT).

    • Other – Contracts with other public entities such as another state, local, or Federal agency pursuant to PCCPublic Contract Code, sections 10335(a) and 10340(b)(3).

  • Exempt by Policy

    • Proprietary software maintenance services meeting criteria noted in the SCM may be executed without an NCB justification up to the dollar threshold identified in SCM, refer to CDCRCalifornia Department of Corrections and Rehabilitation PAAL for maximum threshold.

    • Proprietary software purchases meeting criteria noted in the SCM may be executed without an NCB justification up to the dollar thresholds identified in SCM and must not exceed purchasing authority dollar thresholds, refer to CDCRCalifornia Department of Corrections and Rehabilitation PAAL for maximum threshold.

    • Contracts with business entities operating Community-Based Rehabilitation Programs (CRP), which meet the criteria established by Welfare and Institutions Code, section 19404. Note: Exception does not apply to contracts justified pursuant to Government Code (GCGovernment Code), section 19130(a). See SCM Vol. 2, section 1506.

• Purchases, although exempt by law or policy, must still be reasonable in cost and justification. Procurement files must include documentation to support fair and reasonable pricing.

• For complete detailed list of Non-Competitive Methods of Procurement refer to SCM Vol. 2, section 1501, Non-Competitive Acquisitions Methods List.

45020.4.3 Leveraged Procurement Agreements

• Leveraged Procurement Agreements (LPA) are purchasing agreements established by the Department of General Services'(DGSDepartment of General Services) Procurement Division (PD), enabling streamlined State purchases by removing repetitive, resource intensive, costly and time-consuming bid processes by departments, per PCCPublic Contract Code, sections 10290, et seq. and 12101.5. The following are the LPAs offered by the DGSDepartment of General Services:

  • California Multiple Award Schedule (CMAS) – refer to CDCRCalifornia Department of Corrections and Rehabilitation PAAL for maximum threshold.

  • Cooperative Agreements (such as National Association of State Procurement Officials, Value Point which is consolidated with the former Western States Contracting Alliance, etc.) – refer to CDCRCalifornia Department of Corrections and Rehabilitation PAAL for maximum threshold.

  • Master Agreement/Master Service Agreement (MA/MSAMerit Salary Adjustment) – refer to CDCRCalifornia Department of Corrections and Rehabilitation PAAL for maximum threshold.

  • Software Licensing Program.

  • State Price Schedule (SPSState Price Schedule) – refer to CDCRCalifornia Department of Corrections and Rehabilitation PAAL for maximum threshold.

  • Statewide Contracts.

• Some LPAs are mandatory; therefore, buyers must know how to find LPAs and verify whether the specific goods and or services they require are available on a mandatory LPA. DGSDepartment of General Services maintains a State Contracts Index Listing, refer to DGSDepartment of General Services’s PD webpage for additional information. Buyer shall refer to LPA user instructions for details on procurement.

• For detailed information on each of these LPA methods, refer to the individual LPA user instructions.

45020.5 Responsibility

• EISEnterprise Information Services (formerly Information Services Division)/ITGSP is responsible to ensure that all State Contracting Guidelines for both ITInformation Technology good and services are followed.

45020.6 IT Procurement and Documentation

• All purchase documents for procurement of ITInformation Technology goods and services for CDCRCalifornia Department of Corrections and Rehabilitation shall be processed through EISEnterprise Information Services (formerly Information Services Division) ITGSP.

• Capital outlay purchases and/or by bond funds for new prison construction, including ITInformation Technology needs, are supported by the Facility Planning, Construction and Management. For further details see DOMDepartment Operations Manual, Chapter 1, Article 31, section 15040.2 – Facility Planning and Finance Branch.

45020.7 General IT Goods and Services Procurement Advertising Requirements in California State Contracts Register (CSCR)

• For specific ITInformation Technology advertising requirements refer to SCM Volume 2, section 1402.3.

45020.8 General IT Goods and Services Procurement Approval Authority

• The DGSDepartment of General Services has delegated authority to all State departments to approve procurements for ITInformation Technology goods and services per PAAL. All ITInformation Technology procurements for goods and services exceeding PAAL delegation shall be forwarded for review and approval to the appropriate DGSDepartment of General Services unit or CDT, whichever control agency applies.

• All contracts for the acquisition of Information Technology (ITInformation Technology) goods and services related to ITInformation Technology projects, as defined in SAMState Administrative Manual section 4819.2, shall be made by or under the supervision of the CDT. The department entities shall not conduct an acquisition for ITInformation Technology goods and services related to an ITInformation Technology project under acquisition authority (aka “purchasing” authority) granted by DGSDepartment of General Services unless the CDT has either:

  • Delegated project authority to the department; or

  • Authorized the department to conduct the acquisition.

45020.9 Revisions

• The Chief Information Officer (CIO) or designee, shall be responsible for ensuring the contents of this Article are kept current and accurate.

References

• (1) DOMDepartment Operations Manual, Chapter 1, Article 31, § 15040.2.

• (2) GCGovernment Code, § 19130(a).

• (3) PCCPublic Contract Code, §§ 10290 et seq., 10301-10302, 10335(a), 10340(b)(3), 12101.5, and 12102(b).

• (4) NCDOMNotice of Change to Department Operations Manual 26-03 1/16/26 5

• (5) SCM Volume 2, §§ 100.3, 1401, 1402.3, 1501, 1506, and 1510.

• (6) WIC, § 19404.

Revision History

• (1) Revised: October 19, 1994.

• (2) Revised Section 45020.6: January 4, 2010.

• (3) Revised: January 16, 2026.

46020.1 Policy

• The California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation or the department) shall maintain Information Technology (ITInformation Technology) equipment in accordance with State requirements and in ways that maximize the operating efficiency of the equipment while minimizing equipment failure and down time. Furthermore, ITInformation Technology equipment maintenance shall be performed by State personnel, or performed by maintenance service organizations in the private sector whose services are acquired through the Department Operations Manual (DOMDepartment Operations Manual), Chapter to the State Contracting Manual (SCM) Vol. 2 and Department Operations Manual (DOMDepartment Operations Manual), Chapter 4, Article 14. Specific criteria for ITInformation Technology equipment maintenance services shall be defined and applied in the development of procurement specifications. ITInformation Technology equipment maintenance policies and guidelines shall be applied in determining appropriate maintenance coverage for ITInformation Technology equipment installed throughout the department.

46020.2 Purpose

• The purpose of this section is to specify that ITInformation Technology equipment maintenance shall be performed as required by State Administrative Manual (SAMState Administrative Manual) sections 5001 and 5010.

46020.3 Responsibility for Maintenance of IT Equipment

• Maintenance coverage for ITInformation Technology equipment is the responsibility of the department ITInformation Technology personnel or designee at the user location. Funding for maintenance coverage is the responsibility of the division, facility, or parole region that is procuring the equipment.

46020.4 Acquisition of Maintenance Services for IT Equipment Within Department

• Acquisition of ITInformation Technology equipment maintenance services is conducted through the State’s procurement process. ITInformation Technology goods and services procurement follows all guidelines established by the Department of General Services (DGSDepartment of General Services).

46020.5 Revisions

• The Chief Information Officer (CIO) or designee shall be responsible for ensuring the contents of this Article are kept current and accurate.

46020.6 References

• (1) SAMState Administrative Manual, §§ 5001, 5010, and 5210-5291.

Revision History

• (1) Revised: October 20, 1994.

• (2) Revised Section 46020.5: January 4, 2010.

• (3) Revised: January 16, 2026.

46030.1 Policy

• The California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation or the department) shall maintain an accurate inventory of its Information Technology (ITInformation Technology) equipment, peripheral devices, and software. All purchased ITInformation Technology equipment shall concur with the technical specifications contained in the State Administrative Manual (SAMState Administrative Manual), section 4989.3. All ITInformation Technology hardware shall be inventoried at the time of installation, identified with a CDCRCalifornia Department of Corrections and Rehabilitation property tag, if applicable. The department shall ensure ITInformation Technology equipment does not sit idle pending procurement activities, and instead be implemented expeditiously for the benefit of CDCRCalifornia Department of Corrections and Rehabilitation’s mission and the proper oversight of taxpayer dollars.

46030.2 Purpose

• The purpose of this policy is to ensure that CDCRCalifornia Department of Corrections and Rehabilitation is in compliance with SAMState Administrative Manual, section 4989.3, and to provide departmental administrators with an accurate listing of their ITInformation Technology equipment resources. There shall be a biannual reconciliation of the ITInformation Technology inventory to update for changes in the system. This policy establishes the asset ownership for all ITInformation Technology equipment acquired by any CDCRCalifornia Department of Corrections and Rehabilitation division or project that will be identified and documented by the CDCRCalifornia Department of Corrections and Rehabilitation Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)).

46030.3 Inventory Responsibility

• The local information asset custodian or designee shall be responsible for maintaining an accurate ITInformation Technology equipment inventory for the corresponding division, facility or parole region. Inventories shall be forwarded no later than April 1 and October 1 of each year to Deputy Director of Operations, who shall be responsible for the coordination, compilation, and retention of the departmental ITInformation Technology equipment inventories and useful life-cycle schedule.

46030.4 IT Equipment Inventory Documentation

• The ITInformation Technology inventory shall include the following data elements:

  • Primary Location: division/branch, facility, or parole region where equipment is located.

  • Secondary Location: unit or office where equipment is located.

  • Brand of Equipment: monitors, keyboards, printers, etc.

  • Model Number: monitors, keyboards, printers, etc.

  • Serial Number: monitors, keyboards, printers, software, etc.

  • Ownership: whether CDCRCalifornia Department of Corrections and Rehabilitation or specified other owns.

  • Version Number: software.

  • Date of Acquisition: date equipment was received.

  • Date of Installation: date equipment/software was installed.

  • Date of Relocation: date equipment/software was relocated.

  • Relocation Location: unit or office where equipment has been relocated.

  • Signature: signature of the local ITInformation Technology personnel, or designee, or the ITInformation Technology personnel’s supervisor.

46030.5 IT Equipment Ownership and Inventory Redirection

• ITInformation Technology equipment purchased for use within the department’s EISEnterprise Information Services (formerly Information Services Division) ITInformation Technology services is a CDCRCalifornia Department of Corrections and Rehabilitation asset, not owned by the individual division, unit, or project that funded the purchase.

  • Exceptions include:

    • Equipment participating in non-routed communication and attached to the CDCRCalifornia Department of Corrections and Rehabilitation network. Examples of these types of equipment are networked printers and scanners, security cameras, et. cetera.

    • Equipment tied to State or Federal funding that requires the asset to be used exclusively for a one-time purpose.

  • When a reorganization occurs or a project is cancelled or completed, all the ITInformation Technology equipment utilized is entered into the CDCRCalifornia Department of Corrections and Rehabilitation general EISEnterprise Information Services (formerly Information Services Division) ITInformation Technology inventory.

    • The CDCRCalifornia Department of Corrections and Rehabilitation division responsible for the unit or project will be given first right of refusal to select new placement of the recovered equipment if there is an immediate use case for its redeployment.

    • Redeployment of ITInformation Technology equipment is not always necessary or possible, and therefore not guaranteed.

• Facility infrastructure services such as electrical infrastructure, cooling systems, fixed uninterruptible power supplies, and plant ITInformation Technology infrastructure (e.g. plant fiber optics, plant copper data cables) installation costs cannot be recouped (exceptions may exist with certain contracts). EISEnterprise Information Services (formerly Information Services Division) will not be responsible for the costs associated with redeployment of recovered ITInformation Technology equipment assets requiring new facility infrastructure.

46030.6 Roles and Responsibilities

• EISEnterprise Information Services (formerly Information Services Division) is responsible for:

  • ITInformation Technology development and enforcement standards.

  • ITInformation Technology assets and service procurement approval.

  • ITInformation Technology inventory control.

  • ITInformation Technology refresh deployment and configuration.

  • Configuration and management of ITInformation Technology assets.

  • ITInformation Technology security standards.

  • ITInformation Technology customer support for CDCRCalifornia Department of Corrections and Rehabilitation employees.

    • Direct ITInformation Technology customer support is not provided by EISEnterprise Information Services (formerly Information Services Division) staff to incarcerated persons. However, instructors or other CDCRCalifornia Department of Corrections and Rehabilitation staff may request and receive support for ITInformation Technology services and assets used by the incarcerated population.

• CDCRCalifornia Department of Corrections and Rehabilitation divisions are responsible for:

  • Identification of business needs and expected outcomes from ITInformation Technology services and systems.

  • Funding procurements for ITInformation Technology assets needed for the division’s specific efforts and projects.

    • Exceptions may occur where a Budget Change Proposal (BCPBudget Change Proposal) may be the funding source initiated by EISEnterprise Information Services (formerly Information Services Division) on behalf of the department for ITInformation Technology services and assets.

      • Fair Share may be a funding source based on prior negotiation and addition of the asset type to the Fair Share yearly allotments as approved by EISEnterprise Information Services (formerly Information Services Division), the Budget Management Branch (BMBBudget Management Branch), and appropriate department stakeholders.

      • Replacement of damaged equipment due to negligence.

        • If ITInformation Technology equipment is damaged due to negligence of the division/site to maintain a clean and controlled environment (e.g. water damage from a leaking roof, water damage from pipe bursts, local staff damage due to mishandling, electrical damage to facility wiring, etc.) replacement of the damaged equipment will be the responsibility of the division/site.

• Third parties are responsible for:

  • Procurement of department-approved ITInformation Technology assets and services including initial maintenance and licensing for deployment.

    • Ongoing maintenance and licensing should be included, when possible, for the length of the third-party engagement with CDCRCalifornia Department of Corrections and Rehabilitation.

  • Providing logging data capture and storage for reporting on request.

    • 90 days of logs minimum for third party managed services.

46030.7 Revisions

• The Chief Information Officer (CIO) or designee shall be responsible for ensuring the contents of this Article are kept current and accurate.

References

• (1) SAMState Administrative Manual, § 4989.3.

Revision History

• (1) Revised: October 20, 1994.

• (2) Revised Section 46030.5: January 4, 2010.

• (3) Revised: January 16, 2026.

46040.1 Policy

• The California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation or the department) shall establish a uniform method for recording data pertaining to the repair and maintenance of Information Technology (ITInformation Technology) equipment as required by the State Administrative Manual (SAMState Administrative Manual), section 4989.3 to aid in the tracking of ITInformation Technology equipment and maintenance expenses and costs associated with vendor support.

46040.2 Purpose

• The purpose of this section is to ensure consistency in reporting, in the capture of data at the time of an incident, and in review by appropriate levels of management of reports made. These are all essential to the effective management and control of ITInformation Technology equipment maintenance.

46040.3 Responsibility for IT Equipment Maintenance Records

• Maintenance record keeping for ITInformation Technology equipment is the responsibility of the Information Technology personnel or designee at each user location involved. Maintenance records shall be forwarded no later than April 1 and October 1 of each year to the Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)) Section Chief or designee for review and analysis of information, and shall be retained by the EISEnterprise Information Services (formerly Information Services Division) Deputy Director or designee for as long as the component is in service or there is a possibility of any contractual claim.

46040.4 Documentation of Maintenance for IT Equipment

• The responsible unit or party shall maintain records of ITInformation Technology equipment which contain essential data pertaining to repair and maintenance. Such essential data that are required to resolve disputes between the vendor and the department concerning vendor performance include:

  • Document control number: composed of a two-digit year and a two-digit month, followed by a sequence number starting with “one” at the beginning of each month.

  • Name of originating facility.

  • Name, unit, and phone number of the on-site contact person responsible for taking action to correct a deficiency.

  • Date and time the need for maintenance was first noticed.

  • Name and phone number of vendor that was notified.

  • Date and time vendor was notified of problem.

  • Date and time vendor personnel arrived to repair malfunction.

  • Dateandtime component and system were returned to service.

  • Identification of affected component/system by manufacturer identification or serial number, and by CDCRCalifornia Department of Corrections and Rehabilitation property tag number.

  • Type of service: regularly scheduled preventative maintenance or unscheduled maintenance required to remedy malfunctions or incidents.

  • Justification for any delays in the completion of maintenance.

  • Description of malfunction or incident.

  • Signatures of vendor personnel and a departmental representative.

• A maintenance form is to be initiated whenever a system or any component of a system is inoperative because of the need for equipment repair or maintenance, and is to remain open until the problem has been corrected and the component has been returned to service.

46040.5 Revisions

• The Chief Information Officer (CIO) or designee shall be responsible for ensuring the contents of this Article are kept current and accurate.

46040.6 References

• SAMState Administrative Manual, § 4989.3.

Revision History

• (1) Revised: October 20, 1994.

• (2) Revised Section 46040.5: January 4, 2010.

• (3) Revised: February 3, 2026.

46050.1 Policy

• The California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation or the department) is committed to ensuring that compliance is maintained with the procedures set forth in the State Administrative Manual (SAMState Administrative Manual) sections 5951, 8633, and 8640 – 8642 and Government Code sections (GCs) 14673 – 14675, regarding the disposal of Information Technology (ITInformation Technology) equipment and supplies. CDCRCalifornia Department of Corrections and Rehabilitation shall also act in accordance with Department of General Services (DGSDepartment of General Services) policies, with respect to its oversight responsibilities for the disposal of all state-owned ITInformation Technology equipment and supplies.

46050.2 Purpose

• The purpose of this policy is to ensure the efficient and economical disposal of surplus ITInformation Technology consumable equipment and supplies, while maximizing the salvage value of State-owned ITInformation Technology equipment and supplies in a manner that is in the best interests of the department.

46050.3 Responsibility for Disposal of IT Equipment and Supplies

• It is the responsibility of the local ITInformation Technology personnel or designee to inform the EISEnterprise Information Services (formerly Information Services Division), Operations Manager, of ITInformation Technology equipment or supplies determined to require an exchange, a transfer, a sale, or a disposal.

46050.4 Responsibility for Lost, Damaged, or Misused IT Equipment

• In accordance with SAMState Administrative Manual, sections 8643 and 20080, the department must report losses of state property due to fraud or embezzlement to the Department of Finance’s Office of State Audits and Evaluations and the California State Auditor’s Office.

• The department management must promptly investigate incidents involving loss, damage, or misuse of information assets.

• The department shall immediately notify the California Highway Patrol upon discovery of all ITInformation Technology security incidents and computer-related crimes.

• Employees will be charged with any loss and damages to state property due to their negligence or unauthorized use.

46050.5 Revisions

• The Chief Information Officer (CIO) or designee shall be responsible for ensuring the contents of this Article are kept current and accurate.

46050.6 References

• (1) SAMState Administrative Manual, §§ 5951, 8633, and 8640 – 8642, and 20080.

• (2) GCGovernment Code, §§ 14673, 14674, and 14675.

Revision History

• (1) Revised: October 20, 1994.

• (2) Revised Section 46050.5: January 4, 2010.

• (3) Revised: February 3, 2026.

47010.1 Policy

• The Department shall maintain complete and accurate case records on all prisoners in the custody of the Department as required by PCPenal Code 2081.5. Case records include all information received by the Department from courts, probation departments, sheriff and police departments, DA offices, the State DOJDepartment Of Justice, the FBIFederal Bureau of Investigation, and other pertinent agencies and persons.

• OBISOffender Based Information System was created to provide for automated tracking of all inmates assigned to the Department’s jurisdiction from the time of admission through discharge from prison or parole.

47010.2 Purpose

• The purpose of this policy is to ensure that complete and accurate records are maintained on all prisoners under the jurisdiction of the Department, and to establish and fix responsibility and accountability for the management of OBISOffender Based Information System.

47010.3 Responsibilities

• Overall responsibility (e.g., security, data integrity, QAQuality Assurance, QCQuality Control) for OBISOffender Based Information System resides with the Director and Chief Deputy Director. Delegated responsibility resides with OISBOffender Information Services Branch of the ASDSee Division of Administrative Services (DAS) (see ASB), and with management, supervisory, and end-user personnel involved with OBISOffender Based Information System use. OISBOffender Information Services Branch is responsible for training data input staff and providing QCQuality Control oversight to ensure data integrity in OBISOffender Based Information System.

• As primary users of this system, the case records offices in facilities, parole regions, and headquarters, as well as OISBOffender Information Services Branch, input and update offender information in OBISOffender Based Information System.

• As the custodian of this system, the ISDInformation Services Division (see EIS) is responsible for application, hardware, and software support, and maintenance of OBISOffender Based Information System.

• Parole Violator Work Credit Subsystem

  • The Parole Violator Work Credit Subsystem records paroleeatlarge, parole revocation, and revocation extension information, and applies work credit earned/lost from the inmate work incentive subsystem to calculate violator revocation release dates.

47010.4 Overview of OBIS

• OBISOffender Based Information System is a centralized, on-line, mainframe system that links all facilities, parole regions, selected parole field units, and headquarters to the Teale Data Center. OBISOffender Based Information System is the only database which tracks an inmate from initial admission in a state prison through discharge from prison or parole.

• Composition Of OBISOffender Based Information System

  • OBISOffender Based Information System is comprised of the following subsystems: movement, commitment, descriptive, inmate work incentive; and holds, wants, and detainers.

• Movement Subsystem

  • The movement subsystem records each movement and status change of an inmate from the date of reception from the committing court to discharge from CDC jurisdiction.

• Commitment Subsystem

  • The commitment subsystem records the legal commitment received from the California Superior Court that sentenced the offender to the jurisdiction of the Department.

• Descriptive Subsystem

  • The descriptive subsystem records detailed information regarding each offender’s height, weight, hair color, ethnicity, social security number, CII number, FBIFederal Bureau of Investigation number, and date and place of birth.

• Inmate Work Incentive Subsystem

  • The inmate work incentive subsystem is a collection of an offender’s applied credits (including vested credits, administrative time, work and vocational assignments, work credit losses and restorations) that affect the release date of the offender.

• Inmate Time Collection System

  • The Inmate Time Collection System (ITCS) is used to track the hours of inmates participating in the IW/TIP. Inmates who participate in the IW/TIP shall earn work time credit toward the reduction of their sentence.

  • The ITCS introduces a scanning process to the existing time collection system. The scanning system is designed to provide the following:

    • Key data entry workload relief for the facility.

    • A more expedient method of updating OBISOffender Based Information System.

  • The ITCS scanning process uses revisions of the CDC Form 191, Inmate Timecard, the CDC Form 1697, Work Supervisor Log, and a Sentry 4000 scanner. The work supervisor tracks the inmate work time for a 31 day period, using the CDC Form 1697. Information from the CDC Form 1697 is transferred on to the CDC Form 191. The CDC Form 191 is sent to the case records office for scanning and timecard retention. Scanned information is used to update the OBISOffender Based Information System database, and generate error and statistical reports.

• Holds, Wants and Detainer Subsystem

  • The Holds/Wants/Detainer subsystem records holds, wants (warrants), and detainers (HWDHolds/Wants/Detainer) on a particular offender. HWDs are entered on-line immediately after receipt from another agency (e.g., federal, other states) which may have a legal right to hold the offender.

  • Requests for offender information residing on the OBISOffender Based Information System database shall be addressed to the Information System Support and Specialized Reporting Unit, located in OISBOffender Information Services Branch.

47010.5 Revisions

• The Assistant Secretary, EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

47010.6 References

• PCPenal Code § 2081.5.

47020.1 Policy

• The California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation or the Department) Personnel Office shall prepare and release all personnel-and payroll-related data utilizing the State Controller’s Office (SCOState Controller’s Office) Personnel and Payroll Services Division (PPSD) system.

• Authorization and guidelines established under the uniform state payroll system are controlled and defined by the PPSD system within SCOState Controller’s Office.

47020.2 Purpose

• The purpose of utilizing the SCOState Controller’s Office system is to ensure all employee personnel information which is considered sensitive and confidential is recorded and updated, and that all such data be protected under a strictly controlled environment accessed only to inquire and update the following:

  • Current and historical information concerning employee status, payment history, or miscellaneous, fixed and voluntary payroll deductions.

  • An employee’s name, position number, effective date of appointment, salary, range, bargaining unit, probation status, and effective date ending appointment.

  • An employee’s State and federal withholding tax information and home address.

47020.3 Responsibilities

• The delegated responsibility for the security, maintenance, monitoring and integrity of the SCOState Controller’s Office system resides with an authorized department Personnel Officer or human resources personnel at each facility and at headquarters. Major users of the system are department Personnel Specialists who access the system to update all personnel and payroll history on departmental employees. Other users of the system authorized human resources personnel for job-related inquiries basis only.

47020.4 SCO System Security

• Refer to Department Operations Manual (DOMDepartment Operations Manual), Chapter 4, Article 49 regarding guidelines for equipment security.

47020.5 Management Information Retrieval System (MIRS)

• The department uses the MIRSManagement Information Retrieval System to extract personnel and payroll information from the SCOState Controller’s Office and to generate supplemental reports for management.

47020.6 MIRS – Reports

• The department generates the following supplemental reports from the MIRSManagement Information Retrieval System extractions:

  • Accounting/Budget/Payroll Reports.

  • Intermittent Hours Tracking.

  • Equal Employment Opportunity.

  • Leave Accounting Reports.

  • Personnel Reports.

  • Position Inventory Reports.

  • Historical Transaction Data Reports.

47020.7 MIRS – Responsibilities

• The Personnel Officer/Manager will delegate authorized administrative staff access to the SCOState Controller’s Office system to provide MIRSManagement Information Retrieval System reports. For access to the SCOState Controller’s Office system, please see DOMDepartment Operations Manual, Chapter 4, Article 49, section 49060.3, Department Responsibilities.

47020.8 MIRS – Equipment Security

• Refer to DOMDepartment Operations Manual, Chapter 4, Article 49 regarding guidelines for equipment security.

47020.9 Revisions

• The CIO or designee shall be responsible for ensuring the contents of this Article are kept current and accurate.

References

• (1) SCOState Controller’s Office: MIRSManagement Information Retrieval System Manual.

• (2) GCGovernment Code §§ 12470.

• (3) SAMState Administrative Manual §§ 4846.1, 4989.3, 5300, 5305.2, 5305.4.

• (4) SCOState Controller’s Office: Personnel Action Manual.

• (5) DOMDepartment Operations Manual, Chapter 4, Article 49, § 49060.3.

Revision History

• (1) Revised: November 25, 1992.

• (2) Revised Section 47020.9: January 11, 2013.

• (3) Revised Sections 47020.6, 47020.7, 47020.8, and 47020.10: April 16, 1993.

• (4) Revised: December 10, 2025.

47030.1 Policy

• As a part of its continuing support for all California law enforcement agencies, the Department participates in the utilization of the California Law Enforcement Telecommunications System (CLETSCalifornia Law Enforcement Telecommunications System), developed for use by law enforcement agencies. Government Code (GCGovernment Code) 15150 through 15167 require that the California Department of Justice (DOJDepartment Of Justice) maintain such a telecommunication system and provide services to California law enforcement agencies when, at their own expense, they require authorized connection to the system.

47030.2 Purpose

• The purpose of this section is to describe the relationship between the California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation) and the CLETSCalifornia Law Enforcement Telecommunications System and specify the Department’s participation in this system.

• CLETSCalifornia Law Enforcement Telecommunications System accommodates all public law enforcement user agencies with the capability of providing and receiving fast and efficient point-to-point delivery of messages and information contained in federal and State computerized files. Local information reported to DOJDepartment Of Justice may also be accessed.

• CLETSCalifornia Law Enforcement Telecommunications System is a cooperative system whereby the State provides central switching equipment, personnel to staff the switching center, and sufficient circuitry from the switching center to county locations as authorized by law for handling law enforcement message traffic. Department use of the circuitry and terminal equipment extending beyond the CLETSCalifornia Law Enforcement Telecommunications System county termination point is provided by CDCRCalifornia Department of Corrections and Rehabilitation.

47030.3 Responsibility

• Operational responsibility, system supervision, monitoring of traffic for conformity to rules and regulations, and recommendations for corrective actions are under the direction of DOJDepartment Of Justice. System rules are designed to provide the most efficient operating system. Adherence to the rules shall provide the Department the maximum effectiveness with CLETSCalifornia Law Enforcement Telecommunications System. Violations of these rules shall result in investigative and appropriate disciplinary action. The Agency CLETSCalifornia Law Enforcement Telecommunications System Coordinators (ACC) shall direct requests for information concerning the general administration of CLETSCalifornia Law Enforcement Telecommunications System to the CLETSCalifornia Law Enforcement Telecommunications System Executive Secretary, Department of Justice, P.O. Box 903417, Sacramento, California 94203-4170.

• Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)) is responsible for coordinating with DOJDepartment Of Justice on the acquisition, relocation and use of the local CLETSCalifornia Law Enforcement Telecommunications System. The ACC shall direct requests for information concerning changes or additions to CDCRCalifornia Department of Corrections and Rehabilitation’s use of CLETSCalifornia Law Enforcement Telecommunications System to the Chief of Network Engineering, EISEnterprise Information Services (formerly Information Services Division), P.O. Box 942883, Sacramento, California 94283- 0001.

• Local facilities are responsible for the funding and maintenance of their CLETSCalifornia Law Enforcement Telecommunications System equipment.

47030.4 CLETS – Acquisition Process

• The acquisition processing time for CLETSCalifornia Law Enforcement Telecommunications System varies depending upon the location of the requesting facility: Up to six months should be allowed from the date the request is received for processing at EISEnterprise Information Services (formerly Information Services Division).

• It is the local ACC’s responsibility to:

  • Initiate an appropriate request for additions or changes (other than relocation) to CLETSCalifornia Law Enforcement Telecommunications System services at an existing location. The request shall include a cover memo to the Chief of Network Engineering, EISEnterprise Information Services (formerly Information Services Division), indicating justification for a CLETSCalifornia Law Enforcement Telecommunications System addition or change and a completed CDCRCalifornia Department of Corrections and Rehabilitation Form 954, Intraoffice Requisition and Procurement Worksheet.

  • Upon receipt of the approved requisition, order equipment and acquire maintenance with facility funding.

  • Initiate an authorized request for the relocation of CLETSCalifornia Law Enforcement Telecommunications System equipment. The request shall consist of a memorandum with appropriate approval signatures to the Chief of Network Engineering, EISEnterprise Information Services (formerly Information Services Division), justifying the relocation.

• It is the responsibility of the Chief of Network Engineering, EISEnterprise Information Services (formerly Information Services Division), to:

  • Review the request, obtain certification approval, and return the completed package to the ACC for their equipment purchase.

  • Procure approval from DOJDepartment Of Justice and appropriate county sheriff’s offices for CLETSCalifornia Law Enforcement Telecommunications System usage.

  • Coordinate CLETSCalifornia Law Enforcement Telecommunications System installation with DOJDepartment Of Justice, county sheriff’s offices, and the ACC.

  • Notify ACC of approved mnemonic (i.e., “NME”) and originating agency (i.e., “ORI”) numbers.

  • Maintain inventory for departmental CLETSCalifornia Law Enforcement Telecommunications System circuitry.

  • Review requests for and coordinate the relocation of CLETSCalifornia Law Enforcement Telecommunications System equipment.

• Terminals connected directly to CLETSCalifornia Law Enforcement Telecommunications System shall be approved by DOJDepartment Of Justice. A hard copy printer shall be included with each terminal authorized to receive unsolicited or point-to-point, non-data-base traffic. unsolicited or point-to-point, non-data-base traffic.

47030.5 Integrity of CLETS Information

• In order to maintain the integrity of CLETSCalifornia Law Enforcement Telecommunications System and ensure the security of information received and transmitted by use of the system, the following policies shall be adhered to:

  • Reasonable measures shall be taken to protect equipment from vandalism or sabotage and preclude access by other than authorized personnel by locating equipment in a secure area.

  • Mobile digital terminals shall not be allowed to access DOJDepartment Of Justice’s criminal history system.

  • Personnel with access to sensitive or confidential records derived from CLETSCalifornia Law Enforcement Telecommunications System and/or access to offender information within any database are required to complete the CLETSCalifornia Law Enforcement Telecommunications System Employee/Volunteer Statement, accessible through the Learning Management System (LMS).

• Personnel authorized to access CLETSCalifornia Law Enforcement Telecommunications System are either sworn law enforcement personnel or nonsworn law enforcement personnel that have been subject to a character or security clearance. The clearance shall include the following:

  • DMVDepartment of Motor Vehicles: driver’s license check.

  • DOJDepartment Of Justice: fingerprint check.

  • CDCRCalifornia Department of Corrections and Rehabilitation: background investigation. An agency head’s authorization for the employee to operate CLETSCalifornia Law Enforcement Telecommunications System equipment shall be placed in the employee’s personnel file.

• In all matters pertaining to personnel security, the agency head shall be responsible for making the final determination of the individual’s suitability for the job.

• All CLETSCalifornia Law Enforcement Telecommunications System messages are confidential and for official use only. Examples of acceptable messages are:

  • Requests for record validation.

  • Requests for incarcerated person pickup and transportation.

  • Requests for mail-back information from data bases.

  • Information regarding the circumstances surrounding the death of an officer killed in the line of duty.

  • Listings of stolen property when identifiable by serial numbers or unique markings.

• All subpoenas transmitted by CLETSCalifornia Law Enforcement Telecommunications System shall be processed in accordance with Penal Code (PCPenal Code) 1328(b) and 1328(c). A subpoena relative to civil proceedings or any subpoenas which could be delivered in a timely manner by other means are not acceptable for transmission.

• DOJDepartment Of Justice publishes manuals for CLETSCalifornia Law Enforcement Telecommunications System operators containing information for proper system utilization. These manuals shall be obtained and maintained for CLETSCalifornia Law Enforcement Telecommunications System operators.

47030.6 CLETS – Training/Coordinators

• Each facility, parole region, and headquarters’ division shall provide the ACC and the Information Technology Manager II, of Infrastructure Services, with the names and phone numbers of their CLETSCalifornia Law Enforcement Telecommunications System Training Coordinator(s). In addition, facilities with 24-hour shifts shall submit the names and phone numbers of alternate (off-shift) CLETSCalifornia Law Enforcement Telecommunications System coordinators.

• It is the equipment vendor’s responsibility to provide training on the operation of their terminals when initially procured/installed.

• It is the responsibility of State DOJDepartment Of Justice field service/training office to provide training for information access in the:

  • Criminal Justice Information System (CJIS) database.

  • National Crime Information Center (NCICNational Crime Information Center).

  • National Law Enforcement Telecommunications System (NLETS).

  • Department of Motor Vehicles (DMVDepartment of Motor Vehicles).

  • Oregon Law Enforcement Data System (LEDS).

• The Agency CLETSCalifornia Law Enforcement Telecommunications System Coordinator should call the specified telephone number for the name and telephone number of their DOJDepartment Of Justice field service/training representative.

47030.7 Revisions

• The Director of EISEnterprise Information Services (formerly Information Services Division), or designee shall be responsible for ensuring that the contents of this Article are kept current and accurate.

References

• (1) GCGovernment Code §§ 15150 – 15167.

• (2) PCPenal Code §§ 1328(b) and 1328(c).

Revised History

• (1) Revised April 16, 1993.

• (2) Revised January 11, 2013.

• (3) Revised June 13, 2025.

47040.1 Policy

• In order to promote safety and enhance security, the California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation) may use audio, video, or both forms of recording technology within and in proximity to any of its facilities, perimeter fencing, or vehicles. CDCRCalifornia Department of Corrections and Rehabilitation does not intentionally record inside of cells, or bunk areas in dorms with the Audio-Video Surveillance System (AVSS) fixed camera systems, except in case of emergency or investigation as authorized by the Warden or their designee. However, the interior of cells and bunk areas within the dorms may be captured peripherally by AVSS fixed camera systems while covering other areas.

47040.2 Purpose

• The primary purpose of the AVSS is to enhance public safety and facility security by providing the ability for real-time monitoring and recording in order to conduct investigations and after-the-fact reviews by utilizing audio or video recording technology or both.

47040.3 Responsibility and Roles for Audio‑Video Surveillance Systems

• Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division))

  • For implementations of AVSS, Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)) is responsible for managing the procurement, architecture, data communication network, implementation, access control, ongoing hardware and software support contracts and licensing.  All proposed AVSS shall be evaluated and approved by EISEnterprise Information Services (formerly Information Services Division) to ensure that all hardware, software, and communication platforms comply with CDCRCalifornia Department of Corrections and Rehabilitation standards and guidelines. AVSS shall not be procured or installed without the knowledge and approval of EISEnterprise Information Services (formerly Information Services Division). AVSS or installations by the Office of Internal
    Affairs (OIAOffice of Internal Affairs) for investigative purposes are exempt from this notification requirement, except for those that utilize the CDCRCalifornia Department of Corrections and Rehabilitation network.

  • For repair or replacement of video or audio equipment that was implemented prior to the  AVSS, EISEnterprise Information Services (formerly Information Services Division) will evaluate each request to ensure purchases align with the new statewide standard for equipment and service where possible and feasible.

• Institution Staff

  • The Warden shall designate a local AVSS Coordinator responsible for maintaining a Department Operations Manual (DOMDepartment Operations Manual) Supplement and instructing staff on use of the system. Plant Operations staff are responsible for the removal and replacement of camera(s) for repair.

47040.4 Notification of Recording

• Public notice that recording technology may be in use shall be placed at the gatehouse, front entrance, and vehicle sally ports of all correctional institutions and include the following minimum text: “This area is subject to audio and video surveillance.”

47040.5 Audio‑Video Monitoring Stations

• The AVSS is capable of being monitored from designated areas within the institution as determined by the Hiring Authority. Staff generally monitor the AVSS on a periodic basis or in response to a specific incident. The AVSS may not be monitored continuously. Staff shall utilize their personal alarm device, whistle, telephone, or radio to summon additional staff if assistance is needed.

• Upon notification of potential criminal or improper activity in a particular location, the hiring authority, facility supervisor or manager, Investigative Services Unit (ISUInstitution Services Unit), or other designated staff may review information obtained from the AVSS in conjunction with its review of such activity.

• The viewing of live or review of recorded video shall not be used for routine supervision of staff. For example, audio, video, or both forms of recording technology will not be used to monitor staff’s arrival or departure from the job site. However, if during the review of audio, video, or both forms of recording technology, staff misconduct is identified, the video recording can be used as part of the disciplinary process, inquiries, administrative investigations, or criminal investigations. Stored audio, video, or both forms of recording technology shall not normally be used to identify whether or not previous similar behavior occurred. However, when information is received alleging staff misconduct occurred on prior occasions or over an expressed period of time, the AVSS recordings during the expressed timeframe may also be reviewed.

47040.6 Audio‑Video Recording and Storage

• Any information collected from the AVSS shall be considered CDCRCalifornia Department of Corrections and Rehabilitation property and/or records. Recorded audio, video, or both forms of recording technology is generally used for the safety and security of CDCRCalifornia Department of Corrections and Rehabilitation facilities and review of incidents. AVSS may also be used for corrective action, the disciplinary process, inquiries, administrative investigations, or criminal investigations. Any available audio, video, or both forms of recording technology associated with a specific retention trigger shall be exported and stored on a digital medium according to authorized procedures and policy. The audio, video, or both forms of evidence retained for storage on a digital medium shall be managed by the institution’s ISUInstitution Services Unit or as directed by the hiring authority for a period of not less than 90 days. Data may be preserved for a longer period upon conditions being met pursuant to Section 47040.9. Unauthorized release of any AVSS footage is strictly prohibited.

47040.7 Upgrading or Replacing AVSS Equipment

• Institutions upgrading or replacing their AVSS equipment shall ensure their Labor Relations Analyst invites the local Chapter President of the California Correctional Peace Officer Association or designee to all design and implementation meetings (not including pre-planning discussions) related to the local AVSS system.

47040.8 AVSS Retention Triggers

• The following events shall require staff to preserve the recorded data as potential evidence in an inquiry, investigation, and/or an administrative, civil, or criminal proceeding:

  • Any use of force incident.

  • Riots.

  • Suspected felonious criminal activity.

  • Any incident resulting in serious bodily injury, great bodily injury, or death.

  • Sexual assault allegations.

  • Allegations of inmate misconduct [i.e. serious Rules Violation Reports (RVRs)] by staff.

  • Allegations of staff misconduct by an inmate, employee, visitor, or other person.

  • Incidents that may potentially be referred to the District Attorney’s Office.

  • An employee report to supervisor of on-the-job injury, and;

  • Inmate claims with the Department of General Services, Office of Risk and Insurance Management, or Government Claims Program.

47040.9 Preserving Recorded Data

• When an event occurs that requires staff to preserve recorded data, the following process shall be utilized:

  • During business hours, a telephone call or verbal request will be made to the ISUInstitution Services Unit immediately following an AVSS retention trigger.

  • The Neptune Intelligence Computer Engineering (NICE) Investigate digital evidence management system, where available, is considered the sole source of evidence. Whether or not NICE Investigate is available, staff shall ensure that all relevant camera angles are captured. In addition, footage of the events leading up to the event or subsequent footage following the event shall be reviewed and preserved to the extent that such footage provides a more thorough picture of the entirety of the incident.

  • For institutions that have deployed NICE Investigate, requestors submit the automated CDCRCalifornia Department of Corrections and Rehabilitation Form 1027, Audio/Video Surveillance System Evidence Request (for fixed cameras) or CDCRCalifornia Department of Corrections and Rehabilitation Form 1118, Body-Worn Camera Video Evidence Request (for body-worn cameras) in the NICE Investigate portal.

    • Those who are not authorized to submit automated requests in NICE Investigate should contact their institution’s ISUInstitution Services Unit Lieutenant. The ISUInstitution Services Unit Lieutenant can either grant access to NICE Investigate or ensure requests are submitted on their behalf by the ISUInstitution Services Unit team.

    • ISUInstitution Services Unit shall process the request and make the data available in NICE Investigate to the approved requestor within 24 hours of the occurrence or request.

  • For institutions that have not yet deployed NICE Investigate, following the verbal notification to ISUInstitution Services Unit or if the event occurs after business hours, a CDCRCalifornia Department of Corrections and Rehabilitation Form 1027 or 1118, shall be submitted to ISUInstitution Services Unit for timely processing. ISUInstitution Services Unit shall process the request and capture the requested event on a digital medium within 24 hours of the occurrence or request. This stored event shall be made accessible to the approved requestor. ISUInstitution Services Unit shall save and keep on file a hard copy of the CDCRCalifornia Department of Corrections and Rehabilitation Form 1027 or 1118. ISUInstitution Services Unit shall make a second copy of the event to be stored as evidence in ISUInstitution Services Unit.

• An audio, video, or both forms of recording that becomes evidence in an OIAOffice of Internal Affairs investigation shall be stored until resolution of any investigation and written release by the OIAOffice of Internal Affairs, Office of Legal Affairs (OLAOffice of Legal Affairs), and Office of the Attorney General (OAGOffice of the Attorney General). An audio, video, or both forms of recording that CDCRCalifornia Department of Corrections and Rehabilitation has reason to believe may become evidence in an administrative, civil, or criminal proceeding shall be stored indefinitely unless other direction is given by the OIAOffice of Internal Affairs, OLAOffice of Legal Affairs, or in the event of a criminal proceeding, the Office of the District Attorney. Audio, video, or both forms of recordings must be destroyed in a secure manner consistent with EISEnterprise Information Services (formerly Information Services Division) policy as soon as they are no longer needed for the purpose for which they were retained.

47040.10 Review Criteria

• Only individuals having a legitimate need to view the live images or recorded media shall be permitted to do so. When an event occurs that requires the preservation of recorded data, managers, supervisors, and the Grievance Coordinators from the Office of Grievances (OOG) shall be responsible for filling out and submitting the CDCRCalifornia Department of Corrections and Rehabilitation Forms 1027 or 1118, either in NICE Investigate or hard copy form submitted electronically (e.g., via electronic mail) for institutions that have not yet deployed NICE Investigate. In the event the AVSS becomes inoperable, staff will notify the AVSS Coordinator, or the Watch Commander if after hours, and submit a service ticket to local Information Technology staff for resolution.

• Criteria for the review or viewing of video shall constitute a legitimate need, which includes:

  • Reviewing the circumstances of a crime or suspected crime.

  • Reviewing the circumstances of an accident or near accident.

  • For routine matters (including use of force incidents pursuant to DOMDepartment Operations Manual Chapter 5, Article 2, Use of Force) that do not involve the criteria in subsections (A) or (B) below, Bargaining Unit (BU) 6 employees shall be granted an opportunity to review audio or video data of an incident they were involved in from their Body-Worn Camera (BWC) or institutional fixed camera(s). The procedures to request to review AVSS data, and the viewing of AVSS data relative to report writing, shall be in accordance with the procedures in the current Memorandum of Understanding (MOUMemorandum Of Understanding) for BU 6, section 9.16, Video Recordings. If staff are denied approval to review institutional fixed camera video by the Incident Commander for any of the reasons noted in subsections (A) or (B) below, they will be provided with either an automated email notification from NICE Investigate, or, for institutions that have not yet deployed NICE Investigate, a CDCRCalifornia Department of Corrections and Rehabilitation Form 1028, Audio/Video Surveillance System Evidence Request Denial signed by the Captain or their designee, denying the request. A copy of the CDCRCalifornia Department of Corrections and Rehabilitation Form 1028 or email denial notification from NICE Investigate will be forwarded by the requestor to the Labor Relations Analyst who will notify the appropriate local BU chapter president. For BWC data reviewing denial process see the California Code of Regulations (CCRCalifornia Code of Regulations), Title 15, section 3270.3.

    • An incident involving allegations of misconduct (defined as situations where the Hiring Authority has determined and initiated the CDCRCalifornia Department of Corrections and Rehabilitation Form 989, Confidential Request for Internal Affairs Investigation/Notification of Direct Adverse Action process) or where administrative action is reviewed: the employee shall be granted an opportunity to review CDCRCalifornia Department of Corrections and Rehabilitation video recording(s) upon approval of the Warden, Chief Deputy Warden, or above. If staff are denied approval to review video data for this reason, no further questions or clarifications may be requested of the employee by the hiring authority.

    • An incident where criminal or deadly force is reviewed: the employee shall only be granted the opportunity to observe CDCRCalifornia Department of Corrections and Rehabilitation video data upon approval of the OIAOffice of Internal Affairs or investigating or prosecuting agency. If staff are denied approval to observe video data during the review process, no further questions or clarifications may be requested of the employee by the hiring authority.

  • The OOG may request to review audio and video recordings when conducting an inquiry as it relates to a submitted incarcerated person grievance or third-party complaint.

  • The Allegation Investigation Unit (AIU) may request to review and be provided access to audio and video recordings when conducting an inquiry or investigation as it relates to allegations involving misconduct towards incarcerated or supervised persons.

  • The author of an RVR may submit the automated CDCRCalifornia Department of Corrections and Rehabilitation Form 1027 or 1118 request in NICE Investigate, or for institutions that have not yet deployed NICE Investigate submit CDCRCalifornia Department of Corrections and Rehabilitation Form 1027 or 1118 to their supervisor to have the video data (with or without audio) captured as related to the circumstances of the RVR. The Senior Hearing Officer during the hearing process will examine video that is submitted with a serious RVR, and ensure the incarcerated person has had an opportunity to examine any audio or video, as appropriate.

47040.11 Public Records Act Requests

• Upon receipt of a Public Records Act (PRAPublic Records Act) request for AVSS footage, institutions or program areas shall contact the Division of Correctional Policy, Research and Internal Oversight, Office of Public Records (OPR) for guidance. Upon receipt of a PRAPublic Records Act request for AVSS footage or audio recordings pursuant to Penal Code 832.7(b), institutions or program areas shall contact the OPR video redaction staff. AVSS footage includes fixed cameras and BWCs.

• Only designated OPR video redaction staff shall redact AVSS footage or audio recordings in response to a PRAPublic Records Act request or a Penal Code section 832.7(b) PRAPublic Records Act request.

• AVSS footage can often require significant staff time to redact. If a request for AVSS footage is vague or covers an overly broad timeframe (a “blanket” request), the assigned OPR video redaction staff shall attempt to clarify the request. The purpose of the clarification process is to assist the requestor in locating the AVSS footage by narrowing the request to a specific person(s) involved, date, time, location (e.g., institution, housing unit, yard, etc.), or event. If attempts to clarify a “blanket” request are unsuccessful, the assigned OPR staff shall submit to have the PRAPublic Records Act request denied by sending the request to the OLAOffice of Legal Affairs PRAPublic Records Act mailbox. Any denials based on a blanket request shall be reviewed and approved by CDCRCalifornia Department of Corrections and Rehabilitation’s General Counsel.

47040.12 Notification, Identification, and Review Process 

• Institutions or program areas shall notify employee(s) in writing prior to the release and disclosure of any AVSS footage or audio recording pursuant to a PRAPublic Records Act request which reasonably or easily identifies the employee.

• To assist in notifying reasonably or easily identifiable employee(s), the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff shall provide the institution or program area a copy of or instructions to access the AVSS footage. The DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff shall determine which employee(s) require notification and provide the institution or program area any information regarding the employee(s) identified in the AVSS footage. The institution or program area shall review the AVSS footage and identify any employees the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff were unable to identify. 

• The notification shall be completed utilizing the CDCRCalifornia Department of Corrections and Rehabilitation Form 1110, Notification of Release and Disclosure of Video Footage, Audio Recording, or Both. The  
  CDCRCalifornia Department of Corrections and Rehabilitation Form 1110 shall be completed prior to the release and disclosure of any AVSS footage or audio recording pursuant to a PRAPublic Records Act request. Institutions shall retain the completed CDCRCalifornia Department of Corrections and Rehabilitation Form 1110 and forward a copy to the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff. The DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff shall retain the CDCRCalifornia Department of Corrections and Rehabilitation Form 1110 copy with the corresponding PRAPublic Records Act request. 

• If a notified employee requests to review the AVSS footage or audio recording, the institution shall accommodate the employee within seven calendar days, barring any facility emergency. An employee’s inability to review the AVSS footage or audio recording shall not delay the release of the PRAPublic Records Act request beyond the allotted seven calendar days. 

• The institution shall document and maintain the employee’s review of the PRAPublic Records Act request to include the following:

  • The employee’s name. 

  • PERNR number.

  • Date. 

  • PRAPublic Records Act request number.

  • The AVSS footage or audio recording(s) being reviewed. 

• If the notified employee has sufficient facts to demonstrate that releasing their identity to the public presents a specific threat to their safety, the employee is directed to immediately notify, in writing, the assigned Litigation Coordinator for their area. The employee’s written statement shall contain any specific, articulable, and particularized facts about how disclosure of the records to the PRAPublic Records Act requester would pose a significant danger to their physical safety or to the physical safety of someone else. The Litigation Coordinator shall forward the information to the Hiring Authority and the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff.  

  • The Hiring Authority shall evaluate the employee’s written statement and make a determination within five business days. 

    • If the Hiring Authority determines the employee’s written statement contains a  
      non-specific or general in-nature threat, the Hiring Authority shall immediately notify the employee in writing that the threat was evaluated and determined to be invalid. The Hiring Authority shall forward a copy to the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff.

    • If the Hiring Authority determines the employee’s written statement contains a specific, articulable threat, the Hiring Authority shall forward the employee’s written statement to ISUInstitution Services Unit or other appropriate investigatory staff and ensure an investigation is completed. The assigned investigator(s) shall have 14 calendar days to complete the investigation and determine the legitimacy of the threat. The Hiring Authority shall forward the results of the investigation and all supporting documentation to CDCRCalifornia Department of Corrections and Rehabilitation’s General Counsel via the OLAOffice of Legal Affairs PRAPublic Records Act mailbox for final determination and notify the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff of the submission.  

    • If the Hiring Authority determines the employee’s written statement concerns a documented threat, the Hiring Authority shall submit all supporting documentation to CDCRCalifornia Department of Corrections and Rehabilitation’s General Counsel via the OLAOffice of Legal Affairs PRAPublic Records Act mailbox for final determination and notify the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff of the submission.

    • CDCRCalifornia Department of Corrections and Rehabilitation’s General Counsel determination shall be provided to the Hiring Authority and the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff. The Hiring Authority shall immediately provide the decision to the employee. 

•  A PRAPublic Records Act request for AVSS footage depicting a person’s death shall require notification to the Next of Kin (NOK) to allow the NOK an opportunity to review the AVSS footage prior to release. 

  • When the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff receives a PRAPublic Records Act request for AVSS footage depicting a person’s death, the institution shall be notified before the scheduled release. The DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff shall provide the Hiring Authority and PRAPublic Records Act Coordinator access to the redacted AVSS footage.  

  • The institution shall contact the NOK and schedule a review as soon as possible. The NOK shall have seven calendar days to review the AVSS footage. The review may occur at an institution or alternate CDCRCalifornia Department of Corrections and Rehabilitation location as needed due to distance from the NOK or other factors. The NOK may bring two other people to the review for a maximum of three people. Only redacted footage shall be reviewed by, or released to, the NOK. 

  • If the NOK decides not to review the AVSS footage but requests a copy, the institution shall work with the NOK and make a copy available. Once the seven calendar days have elapsed, the AVSS footage shall be deemed ready for release.

  • If contact with the NOK cannot be made within 72 hours of the initial attempt to contact, the Hiring Authority shall notify their respective Associate Director (AD) or Director, and the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff that all reasonable means for obtaining the NOK contact information have been exhausted. The AD or Director shall contact OCSOffice of Correctional Safety for additional assistance locating the NOK. OCSOffice of Correctional Safety shall forward the results of the attempt to the AD or Director. If the attempt was successful, the AD or Director shall communicate the results to the institution or program area for completion per 47040.12(g). If the attempt is unsuccessful, the AD or Director shall communicate the results to the DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff. The DAIDivision of Adult Institutions (formerly Institutions Division) PRAU or OLAOffice of Legal Affairs video redaction staff shall document the results in the Public Records Portal and release the footage to the PRAPublic Records Act requestor.  

47040.13 AVSS License Plate Recognition

• Policy

  • To promote safety and enhance security by enabling thorough, timely, and effective investigations, the CDCRCalifornia Department of Corrections and Rehabilitation utilizes License Plate Reader (LPR) technology that collects and accesses data from internal AVSSs on institutional grounds. LPR is different from subscription-based, Automated LPR (ALPR), which accesses data from external sources. ALPR policies are detailed in DOMDepartment Operations Manual Chapter 5, Article 32.

• Purpose

  • This policy provides guidance regarding the collection, access, use, sharing, storage, and retention of LPR information.

  • CDCRCalifornia Department of Corrections and Rehabilitation manages LPR information to further its mission of ensuring the public safety of California residents by assisting CDCRCalifornia Department of Corrections and Rehabilitation with enforcement of Federal and California laws. LPR information is collected through an LPR system, which consists of fixed cameras that capture images of license plates within their field of view.

  • CDCRCalifornia Department of Corrections and Rehabilitation operates a fixed LPR system.

47040.14 Definitions

• LPR system is a searchable computerized database resulting from the operation of one or more fixed cameras combined with computer algorithms to read and convert images of registration plates and the characters they contain into computer readable data.

• LPR recognition information is information or data collected using an LPR system.

• LPR end-user is a person that accesses or uses an LPR system.

• A public agency is the state, any city, county, or city and county, or any agency or political subdivision of the state or a city, county, or city and county, including, but not limited to, a law enforcement agency. By definition, “public agency” does not include federal law enforcement agencies, out-of-state law enforcement agencies, or private entities.

47040.15 Authorized Uses

• Authorized uses of LPR information shall be in accordance with DOMDepartment Operations Manual section 53060.4.

47040.16 LPR Division Administrator Roles and Responsibilities

• CDCRCalifornia Department of Corrections and Rehabilitation has designated “LPR Division Administrators,” who shall be responsible for ensuring compliance with this policy and Civil Code sections 1798.90.5, et seq.

• The Division of Adult Institutions (DAIDivision of Adult Institutions (formerly Institutions Division)) and Office of Internal Affairs (OIAOffice of Internal Affairs) shall designate, at a minimum, a primary and secondary LPR Division Administrator responsible for supervising the usage of LPR technology. The primary administrator shall be at the rank of Associate Warden, Special Agent-In-Charge, equivalent or above.

• The LPR Division Administrators are responsible for ensuring that LPR technology is utilized in a responsible manner consistent with all applicable policies, laws, and regulations. Division Administrators shall ensure compliance with LPR User Management, Audits, and Administrator Access as identified in DOMDepartment Operations Manual subsections 53060.5(c)(1), (c)(2), and (c)(3).

47040.17 Enterprise Information Services (EIS) Roles and Responsibilities

• For implementations of LPR technology, EISEnterprise Information Services (formerly Information Services Division) is responsible for managing the procurement, architecture, data communication network, implementation, ongoing hardware and software support contracts, and licensing. LPR technology shall not be procured or installed without the knowledge and approval of EISEnterprise Information Services (formerly Information Services Division).

  • EISEnterprise Information Services (formerly Information Services Division) shall designate, at a minimum, a primary and secondary system administrator of LPR technology, who are responsible for overall technical support of the systems and the support of other LPR Division Administrators.

47040.18 CDCR LPR End‑Users Roles and Responsibilities

• Approved CDCRCalifornia Department of Corrections and Rehabilitation staff will be granted general user access to LPR technology to query information based on their job role. The employees designated to access the LPR system and information are:

  • Special Agent series.

  • Investigative Services Unit custody staff.

• LPR end-user requirements are in accordance with DOMDepartment Operations Manual subsection 53060.7(b).

47040.19 Training

• CDCRCalifornia Department of Corrections and Rehabilitation employees who are authorized to access LPR information must undergo training in accordance with DOMDepartment Operations Manual section 53060.8.

47040.20 LPR Data Retention and Accuracy

• LPR data collected by CDCRCalifornia Department of Corrections and Rehabilitation cameras is stored in CDCRCalifornia Department of Corrections and Rehabilitation’s secure video management system.

  • LPR digital snapshot images uploaded to CDCRCalifornia Department of Corrections and Rehabilitation’s system are maintained for a period of 90 days. After 90 days, the information will be overwritten. Text information converted from digital snapshot images shall be retained for a period of five years.

  • Hot lists (i.e., stored lists of vehicles of interest) uploaded to CDCRCalifornia Department of Corrections and Rehabilitation’s LPR system shall be maintained until the conclusion of the investigation and then manually deleted.

  • LPR footage related to an investigation, litigation, or criminal charges shall be retained in accordance with DOMDepartment Operations Manual subsection 47040.9(b).

• LPR information can only be accessed and downloaded by authorized users with CDCRCalifornia Department of Corrections and Rehabilitation AVSS workstations.

  • Any LPR information downloaded or accessed must be maintained in a secure location.

  • LPR information may be exported for use in an ongoing investigation or as evidence.

  • Any LPR information downloaded or otherwise shared or printed must be destroyed in accordance with current data retention policies found in DOMDepartment Operations Manual Chapter 1, Article 23.

• Records shall be kept of any access given to LPR information; this record must include, at a minimum, the following:

  • The date and time the information is accessed.

  • The license plate number or other data elements used to query the LPR system.

  • The username of the person who accesses the information.

  • The purpose for accessing the information.

• Verification of LPR data accuracy shall be in accordance with this policy.

  • End-users shall attempt to verify LPR matches by visual confirmation using the photo associated with the match event. If the visual confirmation discovers the LPR match was invalid, the end-user shall report the error to the LPR Division Administrator.

  • If feasible, the user should verify an LPR response through the California Law Enforcement Telecommunications System (CLETSCalifornia Law Enforcement Telecommunications System) before taking enforcement action that is based solely on an LPR alert.

47040.21 LPR Data Sharing and Access

• CDCRCalifornia Department of Corrections and Rehabilitation does not allow other public agencies or private entities to access CDCRCalifornia Department of Corrections and Rehabilitation’s LPR systems.

• CDCRCalifornia Department of Corrections and Rehabilitation shall not sell, share, or transfer LPR information, except to another public agency (as defined in DOMDepartment Operations Manual section 47040.14), and only as permitted by law.

47040.22 Revisions

• The Director of Division of Adult Institutions, or designee, shall be responsible for ensuring the contents of this Article are kept current and accurate.

References

• CCRCalifornia Code of Regulations, § (15) 3084.7, 3270.2, 3270.3, 3288, 3314, and 3315.

• GCGovernment Code, § 7284 et seq. (California Values Act), and § 7922.000.

• PCPenal Code Sections 832.7(b) and 13778.2.

• MOUMemorandum Of Understanding for BU 6.

• CACorrectional Administrators Civil Code, Title 1.81.23., Collective of License Plate Information [1798.90.5 – 1798.90-55].

Revision History

• New November 4, 2020.

• Revised June 2, 2021.

• Established Section 47040.12 and revised Sections 47040.11 and 47040.13: September 28, 2023.

• Revised Section 47040.10: October 3, 2025.

• Revised: March 2, 2026.

47050.1 Policy

• The California Department of Corrections and Rehabilitation (CDCRCalifornia Department of Corrections and Rehabilitation) requires that in the institutional setting two-way radios shall be used to communicate information necessary for the effective custody and control of wards, inmates, and parolees. Radios shall be issued to personnel operating where fixed communication devices (telephones and intercoms) are not available, practical, or will not meet critical institutional communications needs. In the field setting two-way radios shall be issued to departmental peace officers and will be used as necessary to communicate with departmental personnel and other law enforcement agencies as needed to meet parole supervision and other field operational needs. Where appropriate and necessary, field units may utilize/communicate via Federal Communication Commissions (FCCFederal Communications Commission) approved local law enforcement telecommunications systems and utilize FCCFederal Communications Commission approved local law enforcement radios.

47050.2 Purpose

• This Article is the official departmental policy on public safety radio communications, not withstanding any program’s procedures. This Article ensures that the design, procurement, deployment, maintenance, and use of State-issued radio communications equipment within the CDCRCalifornia Department of Corrections and Rehabilitation institutions and field units are appropriate to meet departmental radio communications needs.

47050.3 Usage

• Acceptable Use

  • Departmental radio communications shall:

    • Be conducted using CDCRCalifornia Department of Corrections and Rehabilitation-owned, leased, and managed radios and peripheral radio equipment. Exceptions may be made during emergencies, when conducting tactical operations, or when a law enforcement agency agrees to provide radio equipment that conforms to FCCFederal Communications Commission Rules and Regulations.

    • Operate on radio frequencies licensed for departmental use. The use of radios and frequencies provided by another public safety entity for events including but not limited to tactical exercises, mutual aid, or dispatch services shall be pre-approved by the Radio Communications Unit (RCU). The locally approved temporary use of another public safety agency’s FCCFederal Communications Commission approved radio frequencies is authorized when necessary during an emergency or to protect public safety.

    • Be used in conformance with the FCCFederal Communications Commission Rules and Regulations.

    • Be used for the express purpose of communicating Department information to authorized personnel.

• Unacceptable Use

  • The use of non-approved two-way radio equipment is prohibited and shall be considered contraband.

  • The use of, or possession on institutional grounds of non-approved two-way radio equipment by an employee of the Department shall be subject to progressive discipline up to and including possible adverse action consistent with Department Operations Manual (DOMDepartment Operations Manual) Chapter 3, Article 22, Employee Discipline.

  • The use of non-standard equipment, such as Family Radio Service (FRS) and radio scanners, is prohibited. Possession of such devices on institutional grounds is strictly forbidden.

  • Inmates, wards, and parolees shall not be allowed to use CDCRCalifornia Department of Corrections and Rehabilitation radio equipment described in this Article or have access to the radio communications equipment for personal monitoring, except as authorized below:

    • Inmates assigned to fire camps may be authorized to use a departmental radio as long as it is restricted to accessing mutual aid or fire channels; no access shall be permitted to the trunked radio communications system at any institution, with the exception of the Fire Talk Group. Inmates who are assigned to the institutional fire departments have access to the Fire Talk Group on the trunked radio system, which resides on the Control Station (staff/inmate dispatch console at the fire department) and in the fire vehicles. Inmates shall not have access to the fire department’s hand held portable radios which are programmed with other institutional operational talk groups.

    • In the event an employee is incapacitated, an inmate or a parolee may use the radio to call for emergency assistance.

47050.4 Responsibilities

47050.4.1 Radio Communications Unit (RCU)

• The Enterprise Information Services (EISEnterprise Information Services (formerly Information Services Division)), Infrastructure Services (ISInformation Systems), RCU is responsible for all departmentally-owned radio communications systems utilized within CDCRCalifornia Department of Corrections and Rehabilitation. This includes the responsibility and authority for oversight of the policy and procedures related to the use of radio communications within the Department.

• Funding for institution and division radio program needs shall be directed through the RCU. This does not preclude a division from purchasing RCU-approved radio equipment to meet its operational needs when the funding is not available through the RCU.

• The RCU is responsible for review and approval of all public safety radio equipment purchases, including systems, subsystems, and end-user equipment.

• The RCU shall maintain site-specific radio matrices that reflect the application of the radio assignment policy.

• Departmental program areas shall contact the RCU to arrange for the use of another agency’s radio frequency. Other agencies that wish to use a CDCRCalifornia Department of Corrections and Rehabilitation-owned frequency shall make such request to the RCU.

• The RCU is responsible for chairing a multi-discipline “Operable/Interoperable Communications Committee” (Committee) composed of departmental radio communications stakeholders. The purpose of this Committee is to address all issues related to emergency and non-emergency communications and the operable/interoperable needs of CDCRCalifornia Department of Corrections and Rehabilitation. RCU will schedule an annual meeting of the Committee and other meetings, as needed.

• The RCU will process service requests and/or incident tickets submitted by radio liaisons on the Department’s web-based automated ITInformation Technology ticket system. The RCU will contact and coordinate with Office of the State Chief Information Officer, Public Safety Communications Division, as necessary. In some instances, non-functioning equipment cannot be repaired in the field and must be removed from service for repair. The RCU shall determine whether available spare equipment is appropriate for use to replace the non-operative equipment in order to keep the system including but not limited to portable or mobile radios in service or whether new equipment is required.

47050.4.2 Radio Liaison

• Each CDCRCalifornia Department of Corrections and Rehabilitation division will establish a radio liaison. The division radio liaison will facilitate communication between the division and the RCU. Each Adult Institution, Juvenile Justice Facility, Conservation Camp, Parole Region (adult and juvenile), the Office of Correctional Safety, Statewide Transportation Unit, and the Office of Internal Affairs shall designate a radio liaison.

  • The division radio liaison is a single point of contact between each division and the RCU to ensure that the regional communications issues or needs are forwarded to the Committee.

  • The radio liaison shall notify RCU to have all radio communications equipment including but not limited to mobile radio, antenna, and speakers removed from vehicles designated to be surveyed.

  • The program area/institution/facility radio liaison may communicate directly with the RCU to address locally specific needs such as radio equipment failures.

47050.4.3 Office of the Chief Information Officer – Public Safety Communications Division (OCIO‑PSCD)

• The OCIO-PSCD:

  • Is responsible for maintaining the CDCRCalifornia Department of Corrections and Rehabilitation’s public safety radio communications systems and subsystem equipment.

  • Is responsible for ensuring proper radio system design and assists with frequency acquisition and utilization.

  • Employs local radio technicians who are responsible for removing and replacing defective equipment as arranged by the RCU. Defective portable radios or accessories shall be delivered to the RCU or directly to the OCIO-PSCD as directed by the RCU.

47050.5 Radio Communications Systems – Standard Design

• The RCU shall identify and establish technical standards for radio communications equipment consistent with the Public Safety Communications Act of 2002, Government Code Section 8592, et seq. Equipment standards shall be published in the CDCRCalifornia Department of Corrections and Rehabilitation Enterprise Architecture Decision Framework. Requests to purchase or utilize technology not identified as General ITInformation Technology Standards must be accompanied by an exemption request detailing the specific reason identified technologies are not fit for use. The RCU may issue a waiver from the published standard if no available standard technology is suitable to the particular need.

47050.6 Regional Radio Communications System Access

• Regional radio communications system access refers to contracts for radio system access where there are fees to the CDCRCalifornia Department of Corrections and Rehabilitation by the host public safety agency for primary use on their radio communications system. With exception of contracts that were already in place prior to the implementation of this Article, regional radio communications system access contracts shall be reviewed and approved by the RCU prior to contract execution. Refer to the Radio Communications Policy and Procedures Handbook.

• The CDCRCalifornia Department of Corrections and Rehabilitation shall operate its radio communications equipment utilizing FCCFederal Communications Commission assigned frequencies in accordance with FCCFederal Communications Commission Rules and Regulations. Departmental transmissions are prohibited on any FCCFederal Communications Commission-managed frequency unless CDCRCalifornia Department of Corrections and Rehabilitation has written authorization via a formal radio frequency use agreement (TD-400) that must be kept on file with the RCU and the OCIO-PSCD, or has authorization to operate on a local public safety agency’s regional radio communications system. The CDCRCalifornia Department of Corrections and Rehabilitation relies on the resources of other emergency services providers; therefore, cooperation and coordination with other agencies, organizations, and private enterprises shall be extended when practical in order to serve and protect the public. Divisions within the Department, including fire departments, may request utilization of other public safety radio systems. With the exception of existing utilization agreements that predate the implementation of this Article, such requests shall be submitted to the RCU for negotiation with the public safety agency’s radio system operator. Approved requests must be accompanied by a “Letter of Authorization to Transmit” from the licensee on its letterhead, along with a copy of its FCCFederal Communications Commission Station and Mobile license.

47050.7 Mutual Aid Frequency Use Agreement:

• A mutual aid frequency use agreement is required for each instance of shared frequency use. The agreement must include the type of frequency that the public safety agency is authorizing CDCRCalifornia Department of Corrections and Rehabilitation to use, and must be without cost to the Department. These types of agreements are not considered Memorandum of Understanding (MOUMemorandum Of Understanding) and are not subject to CDCRCalifornia Department of Corrections and Rehabilitation’s MOUMemorandum Of Understanding procedures. Refer to the Radio Communications Policy and Procedures Handbook.

• CDCRCalifornia Department of Corrections and Rehabilitation-owned radio equipment shall be maintained and repaired by OCIO-PSCD staff or locally approved radio technicians; frequency use agreements may not contain provisions that allow non-OCIO-PSCD approved maintenance or repair CDCRCalifornia Department of Corrections and Rehabilitation-owned telecommunications equipment. Agreements containing maintenance and/or repair provisions will not be approved.

47050.8 Radio Assignments and Use

• For institutional and juvenile justice facility radio assignments, refer to Restricted DOMDepartment Operations Manual, Chapter 5, Section 55000.

47050.8.1 Conservation Camps

• Camp staff shall be capable of communicating critical information to departmental institutions, facilities, local and/or other public safety agencies, and to agencies that contract for inmate services. Each CDCRCalifornia Department of Corrections and Rehabilitation camp vehicle shall be equipped, at a minimum, with one mobile radio.

47050.8.2 Outside Transportation Unit Vehicles and Institution/Facility Transportation Vehicles

• Refer to Restricted DOMDepartment Operations Manual, Chapter 5, Section 55060.

47050.8.3 Office of Correctional Safety

• Agents assigned to the Office of Correctional Safety shall be capable of routine and emergency communications with all departmental institutions/facilities and field offices as well as local and/or other public safety agencies. Vehicles assigned to these agents shall be equipped with mobile radios designated for undercover use. Additionally, each field agent shall be assigned a two-way, portable radio.

47050.8.4 Office of Internal Affairs

• Agents assigned to the Office of Internal Affairs shall be capable of routine and emergency communications with all departmental institutions/facilities and field offices as well as local and/or other public safety agencies. Vehicles assigned to these agents shall be equipped with mobile radios designated for undercover use. Additionally, each field agent shall be assigned a two-way, portable radio.

47050.8.5 Division of Adult/Juvenile Parole Operations

• Division of Adult/Juvenile Parole Operations staff, including case-carrying agents, transportation staff, and appropriate community correctional facility staff, must be capable of routine and emergency communications with field offices and local and state public safety agencies. Each Field agent shall be assigned a two-way portable radio, and/or a vehicle mounted radio as dictated by local needs.

47050.9 Telecommunications Equipment Management – General

• All CDCRCalifornia Department of Corrections and Rehabilitation facilities and vehicles equipped with radio communications equipment shall inventory such equipment annually pursuant to DOMDepartment Operations Manual Section 22030.12.6.

47050.10 Radio Communications Equipment in Surveyed or Disabled Vehicles

• The RCU will coordinate with the OCIO-PSCD to determine whether the equipment shall be repaired, replaced, or surveyed from service.

47050.11 Sensitive Property and Physical Inventory

• Consistent with DOMDepartment Operations Manual Chapter 2, Subsection 22030.12.1, all portable and mobile radio equipment shall be considered sensitive property as well as safety equipment. While on duty, radios shall be easily accessible by the assigned staff and shall be turned on. When a radio is issued to a staff member for on-going use, the staff member shall be responsible for maintaining the radio with a charged battery and shall be responsible for immediately notifying their supervisor if the radio or related equipment has been lost, stolen, or damaged. The employee’s supervisor shall be responsible to notify the radio liaison of the lost or damaged equipment. Portable radios shall not be left in clearly visible areas of unattended vehicles, or accessible to inmates, wards, or parolees. If the equipment is lost, stolen, or damaged due to negligence or culpability, the employee may be subject to actions in accordance with DOMDepartment Operations Manual, Section 85050.5.

• Each institution and juvenile justice facility housing public safety radio communications equipment shall ensure the communications vault is alarm controlled and monitored.

• Each division operating approved CDCRCalifornia Department of Corrections and Rehabilitation radio equipment shall develop an inventory plan that shall include an annual physical inventory conducted on all portable, mobile, and fixed radio equipment and reconciled with the RCU.