Int 0540-2024

Be it enacted by the Council as follows: Section 1. Assessment of a cloud computing policy for city agency technological needs. a. Definitions. As used in this section, the following terms have the following meanings: Cloud computing. The term "cloud computing" means the provision of computing services, including data storage, software, applications, and processing power, via the internet. Cloud computing provider. The term "cloud computing provider" means a person that provides cloud computing to any city agency. Department. The term "department" means the department of information technology and telecommunications. Person. The term "person" has the same meaning as set forth in section 1-112 of the administrative code of the city of New York. b. The department shall assess the feasibility of adoption of a policy requiring any city agency, in acquiring or developing any technological tool or system to satisfy an operational or programmatic need of such agency, to consider such a tool or system that uses cloud computing. Such assessment shall include: 1. A description of current usage of cloud computing by city agencies; and 2. An evaluation of the feasibility of expanding the use of cloud computing by city agencies, including for any mobile application or software program, for the storage of data, or for the provision of information technology services. c. No later than November 1, 2026, the department shall submit to the mayor and the speaker of the council a report about the assessment conducted pursuant to subdivision b of this section. Such report shall include, but need not be limited to: 1. An analysis of whether cloud computing would serve any technological need of any city agency; 2. An analysis of whether any barriers in the procurement process prevent the utilization of cloud computing by city agencies; 3. An analysis of any security risks associated with cloud computing; 4. An analysis of any challenges an agency may encounter during any transition from on-premises infrastructure for computing services to cloud computing; 5. A list of cloud computing providers used by the department, including the principal place of business of each such provider; and 6. A description of any requirements that a cloud computing provider shall meet in order to provide cloud computing to a city agency, and any recommendations for any additional requirements to impose on cloud computing providers, including requirements relating to the location and security of any physical data centers utilized by such providers, procedures for reporting security breaches to the city, encryption standards, maintenance of event logs and other records needed to facilitate audits, and indemnification for any losses, damages, or liabilities incurred by the city due to negligence or breach of contract by any such cloud computing provider. � 2. This local law takes effect immediately. Session 13: IB LS 10731 9/2/25 5:20 pm Session 12: IB/BJR LS 10731 9/29/23 2 Session 11 Committee: Technology 1