2021 Oregon Revised Statutes
Chapter 276A - Information Technology
Section 276A.223 - Requirement that state agency or public corporation obtain quality management services when implementing information technology initiative; reports; exceptions.

(a)(A) "Information technology initiative" means a project to develop or provide, with a state contracting agency’s or public corporation’s own personnel and resources, or to obtain by means of a procurement or set of related procurements:
(i) New hardware, software or services for data processing, office automation or telecommunications;
(ii) An overhaul, upgrade or replacement of a substantial portion of the hardware or software in an existing data processing, office automation or telecommunications system; or
(iii) A substantial expansion of existing data processing, office automation or telecommunications services.
(B) "Information technology initiative" does not include:
(i) A procurement for preliminary quality assurance services or quality management services;
(ii) A routine update to or purchase of hardware or software within an existing data processing, office automation or telecommunications system;
(iii) A renewal of an existing contract for data processing, office automation or telecommunications services under terms and conditions that are substantially the same as in the existing contract; or
(iv) A replacement of a component of an existing data processing, office automation or telecommunications system that is not essential for the system to function as designed or that occurs at the end of the component’s anticipated life cycle.
(b) "Preliminary quality assurance services" means a set of services in which a contractor provides an independent and objective review of a state contracting agency’s or a public corporation’s plans, specifications, estimates, documentation, available resources and overall purpose for an information technology initiative, including services in which the contractor evaluates a proposed information technology initiative against applicable quality standards and best practices from private industry and other sources.
(c) "Procurement" has the meaning given that term in ORS 279A.010.
(d)(A) "Public corporation" means a corporation:
(i) The operations of which are subject to control by this state or by an agency or instrumentality of this state, or by officers of this state or of an agency or instrumentality of this state;
(ii) That is organized, at least in part, to serve a public purpose; and
(iii) That receives public funds or other support from an entity described in sub-subparagraph (i) of this subparagraph.
(B) "Public corporation" does not include:
(i) A person or entity described in ORS 174.108 (3);
(ii) A city, county, local service district, school district, education service district, community college district or community college service district or a public university listed in ORS 352.002; or
(iii) An administrative subdivision of an entity described in sub-subparagraph (ii) of this subparagraph.
(e) "Quality management services" means a set of services in which a contractor provides an independent and objective review and evaluation of a state contracting agency’s, a public corporation’s or another contractor’s performance with respect to an information technology initiative, such as services in which the contractor:
(A) Identifies quality standards that apply or should apply to the information technology initiative;
(B) Suggests methods and means by which the state contracting agency, the public corporation or the other contractor may meet quality standards identified in subparagraph (A) of this paragraph;
(C) Reviews and evaluates the state contracting agency’s, the public corporation’s or the other contractor’s performance regularly as the information technology initiative progresses from start to finish;
(D) Identifies omissions or gaps in the state contracting agency’s, the public corporation’s or the other contractor’s planning, execution, control, methodology, communication or reporting as the information technology initiative progresses from start to finish;
(E) Identifies risks in the state contracting agency’s, the public corporation’s or the other contractor’s plans or approach to designing, developing or implementing the information technology initiative and suggests methods to reduce, mitigate or eliminate the risks;
(F) Assists the state contracting agency or the public corporation in testing or otherwise evaluating the hardware, software or services that are developed, provided or obtained as part of an information technology initiative to determine whether the hardware, software or services conform with the quality standards identified in subparagraph (A) of this paragraph;
(G) Advises the State Chief Information Officer, the state contracting agency or the public corporation as to whether the hardware, software or services that are developed, provided or obtained as part of an information technology initiative meet the contracting agency’s or the public corporation’s needs, specifications or expectations and otherwise enable the state contracting agency or the public corporation to achieve the objectives for the information technology initiative; or
(H) Identifies unsatisfactory performance and suggests methods the State Chief Information Officer, the state contracting agency, the public corporation or the other contractor might use to eliminate the causes of unsatisfactory performance.
(f) "State contracting agency" has the meaning given that term in ORS 279A.010.
(2)(a) A state contracting agency or a public corporation that implements an information technology initiative shall obtain quality management services from a qualified contractor if the value of the information technology initiative exceeds $5 million, unless the State Chief Information Officer determines that the quality management services are not necessary. The State Chief Information Officer may require quality management services for an information technology initiative the value of which does not exceed $5 million if the information technology initiative meets criteria or standards that the State Chief Information Officer specifies in rule or policy. The State Chief Information Officer not later than December 31 of each year shall submit to the Legislative Fiscal Officer a report that identifies information technology initiatives for which:
(A) The value exceeds $5 million; and
(B) The State Chief Information Officer determines that quality management services are not necessary.
(b) A state contracting agency or public corporation may, subject to ORS 279B.040, procure preliminary quality assurance services from a contractor if the information technology initiative meets the criteria set forth in paragraph (a) of this subsection or if the state contracting agency or public corporation otherwise believes that the preliminary quality assurance services will enable the contracting agency or public corporation to implement an information technology initiative successfully.
(3) A state contracting agency or public corporation may not artificially divide or fragment an information technology initiative so as to avoid the application of this section.
(4) Notwithstanding any procurement authority that a state contracting agency or a public corporation has that is not subject to the authority of the Director of the Oregon Department of Administrative Services or the State Chief Information Officer under ORS 279A.050 (2) or (7), the state contracting agency or public corporation is subject to the provisions of subsection (2) of this section and shall consult with and follow the rules, policies and procedures of the State Chief Information Officer in determining the extent of preliminary quality assurance services or quality management services that the state contracting agency or public corporation will require for an information technology initiative.
(5)(a) If a state contracting agency or a public corporation awards a contract for preliminary quality assurance services or quality management services, the contract must provide that at the same time a contractor provides a preliminary or final report to the contract administrator, the contractor shall also provide a copy of the report to:
(A) The State Chief Information Officer;
(B) The Director of the Oregon Department of Administrative Services;
(C) The Legislative Fiscal Officer; and
(D) As appropriate for the specific information technology initiative, to:
(i) The director of the state contracting agency or, if a board or commission sets policy for the state contracting agency, to the board or commission; or
(ii) The governing body of the public corporation.
(b) The state contracting agency or public corporation shall provide the contractor with names, addresses and other contact information the contractor needs to comply with paragraph (a) of this subsection.
(6) This section does not apply to the Secretary of State or the State Treasurer. [Formerly 291.035]

Structure 2021 Oregon Revised Statutes