No. 36699 (Amendment): Rule R895-3. Computer Software Licensing, Copyright, Control, Retention, and Transfer

(Amendment)

DAR File No.: 36699
Filed: 08/29/2012 08:57:42 AM

RULE ANALYSIS

Purpose of the rule or reason for the change:

Section 63F-1-206 grants the Chief Information Officer the authority to grant rules relating to technology, including the authority establish standards for when an agency must obtain approval before obtaining items listed in Subsection 63F-1-205(1); and Subsection 63F-1-206(1)(a)(iv) provides for the acquisition, licensing, and sale of computer software. The standards for computer software licensing, copyright, control, retention, and transfer have changed since the establishment of Rule R895-3. Thus, the CIO has recommended changes to Rule R895-3 to be more in line with the current standards.

Summary of the rule or change:

The purpose of this rule is to establish the State of Utah's position and its intent to: 1) comply with computer software licensing agreements and applicable federal laws, including copyright and patent laws; 2) define the methods by which the State of Utah (State) will control and protect computer software; and 3) establish the State's right, title and interest in state-developed computer software, including the sale and transfer of such software under certain conditions.

State statutory or constitutional authorization for this rule:

• Section 63F-1-206
• Section 63G-3-201

Anticipated cost or savings to:

the state budget:

The state budget will not be affected by this change as this amendment moves the software coordinator responsibility to the Department of Technology Services from the state agencies. There is no additional cost or savings included in this change.

local governments:

Local government will not be affected by this change as this amendment moves the software coordinator responsibility to the Department of Technology Services from the state agencies. There is no additional cost or savings included in this change.

small businesses:

Small businesses will not be affected by this change as this amendment moves the software coordinator responsibility to the Department of Technology Services from the state agencies. There is no additional cost or savings included in this change.

persons other than small businesses, businesses, or local governmental entities:

Persons other than small businesses, businesses, or local government entities will not be affected by this change as this amendment moves the software coordinator responsibility to the Department of Technology Services from the state agencies. There is no additional cost or savings included in this change.

Compliance costs for affected persons:

There will be no compliance costs for affected persons as this amendment moves the software coordinator responsibility to the Department of Technology Services from the state agencies. There is no additional cost or savings included in this change.

Comments by the department head on the fiscal impact the rule may have on businesses:

There will be no fiscal impact on businesses due to the change in this rule.

Mark VanOrden, Chief Information Officer

The full text of this rule may be inspected, during regular business hours, at the Division of Administrative Rules, or at:

Technology Services
Administration
Room 6000 STATE OFFICE BUILDING
450 N STATE ST
SALT LAKE CITY, UT 84114

Direct questions regarding this rule to:

• Stephanie Weiss at the above address, by phone at 801-538-3284, by FAX at 801-538-3622, or by Internet E-mail at [e-mail]

Interested persons may present their views on this rule by submitting written comments to the address above no later than 5:00 p.m. on:

10/15/2012

This rule may become effective on:

10/22/2012

Authorized by:

Mark VanOrden, Acting Executive Director

RULE TEXT

R895. Technology Services, Administration.

R895-3. Computer Software Licensing, Copyright, Control, Retention, and Transfer.

R895-3-5. Compliance and Responsibilities: Software Licensing.

(1) Each state agency and its employees shall comply with computer software licensing agreements, state laws, federal contracts, federal funding agreements, and federal laws, including copyright and patent laws.

(2) All management personnel will discourage software piracy and take appropriate personnel action up to and including dismissal, against any employee who has been found to be in violation of software license agreements. Personnel action shall be in full accordance with the Department of Human Resource Management Rule R477-11-1 et seq., Utah Administrative Code.

(3) Each state agency shall:

(a) establish a software [controller]coordinating function that [has the]will work with the DTS software coordinator to provide responsibility and authority to manage software licenses, software licensing agreements, software inventory[, and the oversight of and reporting on spot audits];

[(b) coordinate training to employees who are assigned to, as part of their job responsibilities, the software controller function;

(c) provide training to other employees appropriate to their responsibilities including those who install, transfer and dispose of software;

(d) provide to employees notices of the state agency's software use policy at appropriate locations. Appropriate locations may include computing facilities, offices, lunchrooms or websites.

(e) keep and maintain an inventory of all state-owned computer software and software licensing agreements by:.

(i) establishing accurate software inventories and maintaining them;

(ii) establishing a baseline inventory of software already purchased;

(iii) maintaining this inventory through annual inventory reviews that reconcile purchases against inventory;

(iv) acquiring and using auditing tools to assist in establishing the inventory baseline and performing the ongoing reconciliation;

(f) dispose of software in accordance with the software license agreement.

(g) remove from the storage media before disposing of a computer, all private, protected or controlled data as defined by the Government Records Access and Management Act, UCA 63G-2-101 et seq.

(h) Understand the conditions of computer software licensing agreements before purchasing computer software, and inform State employees, whose responsibility it is to monitor the State's compliance with computer software licensing agreements, of these conditions.

(i)](b) Inform employees that are engaged in developing or controlling the distribution of software for the State, that any state-developed software is an asset owned by the State and controlled according to the terms of this rule.

(4) A state software controller function is established within the Department of Technology Services with the following responsibilities:

(a) coordinate all centralized software purchases;

(b) manage software licenses, software licensing agreements and software inventory for centralized software purchases;

(c) coordinate and provide information to employees who are responsible for the software controller function within each state agency;

[(d) coordinate statewide audits or spot audits as needed. In determining when to conduct a spot audit personnel performing this function will take into consideration factors including but not limited to:

(i) an unusual organizational activity such as high employee turnover;

(ii) large development projects or recent large scale changes in computer software.](d) provide to employees notices of the state agency's software use policy at appropriate locations. Appropriate locations may include computing facilities, offices, lunchrooms or websites.

(e) keep and maintain an inventory of all state-owned computer software and software licensing agreements tracked by agency by:

(i) establishing accurate software inventories and maintaining them;

(ii) establishing a baseline inventory of software already purchased;

(iii) maintaining this inventory through annual inventory reviews that reconcile purchases against inventory;

(iv) acquiring and using auditing tools to assist in establishing the inventory baseline and performing the ongoing reconciliation;

(f) coordinate with DTS technical personnel to:

(i) dispose of software in accordance with the software license agreement;

(ii) remove from the storage media before disposing of a computer, all private, protected or controlled data as defined by the Government Records Access and Management Act, UCA 63G-2-101 et seq.

(g) Understand the conditions of computer software licensing agreements before purchasing computer software, and inform State employees, whose responsibility it is to monitor the State's compliance with computer software licensing agreements, of these conditions.

(h) coordinate statewide audits or spot audits as needed.

 

R895-3-6. Compliance and Responsibilities: Retention and Transfer of State-Developed Computer Software.

(1) Unless otherwise prohibited by federal law, regulation, contract or funding agreement, [a state agency]the State of Utah may retain the right, title and interest in any state-developed computer software. To do so, the agency shall:

(a) clearly define in all contracts that it controls the ownership rights for computer software development and related documentation; and

(b) mark all computer software and related documentation developed by employees of the State with the copyright symbol and year, and label "Utah State Government" on all media on which the computer software or documentation is stored and at the beginning of the computer software execution.

(2) [A state agency]The State of Utah may sell or otherwise transfer the right, title and interest in any state-developed computer software. In order to carry this out, [the]state agency must do the following:

(a) Submit a request to the state software controller and obtain approval from the Chief Information Officer prior to the sale or transfer of state-developed computer software. The agency's request shall include a copy of the transfer agreement and any other contractual information. A summary report of these requests will be provided to the Information Technology Policy and Strategy Committee. An example of a model transfer or sale of state-developed software agreement may be obtained from the Chief Information Officer.

(b) Clearly specify within the transfer documents whether the costs of development will be recovered from the receiver.

(c) Clearly specify within the transfer documents whether the costs associated with copying and sending the state-developed computer software will be recovered from the receiver.

(d) Clearly specify within the transfer documents that the receiver is responsible for acquiring any commercial computer software upon which the state-developed computer software may be dependent.

(e) Clearly specify within the transfer documents that no additional services, such as installation, training, or maintenance, will be provided unless the parties have agreed otherwise.

(f) Clearly specify within the transfer documents that the state-developed computer software is being transferred in "as is" condition, and that the State will not be held liable for any incidental or consequential damages under any circumstances.

(g) Retain a record of the transfer, and process it in accordance with the Government Records Access and Management Act, Section 63G-2-101 et seq., Utah Code Annotated.

(3) In accordance with the requirements of (2), [a]the state [agency] may initiate an agreement to transfer state-developed computer software when reasons exist to share such software with another state or entity.

(4) The Chief Information Officer may measure compliance of a state agency and its employees with this rule by conducting periodic audits in accordance with Section 63F-1-206, Utah Code Annotated. In performing audits, the Chief Information Officer may utilize external auditors and an agency's internal auditor(s) when such resources are available and the use of such resources is appropriate.

 

KEY: computer software, licensing, copyright, transfer

Date of Enactment or Last Substantive Amendment: [December 17, 2002]2012

Notice of Continuation: August 31, 2012

Authorizing, and Implemented or Interpreted Law: 63F-1-206; 63G-3-201; 34-39-1 et seq.; 63G-2-101 et seq.

 

---