SIMM 55A – IT Cost Report Instructions

Current Version Changes

Section 1: Overview

Each year as instructed by the California Department of Technology (CDT), each Agency/state entity must summarize its actual and projected information technology (IT) costs in a format defined by the CDT (see Government Code Section 11546.2 and the State Administrative Manual (SAM) Section 4903.2) (PDF). IT costs of the Agency/state entity are to be summarized in the IT Cost Report (ITCR) workbook (SIMM 55B) and submitted to CDT annually by February 1, of each year.

Additionally, Government Code Section 11546.2 was amended (Assembly Bill 2623, Gordon; Ch. 389, Stats 2016) to direct each Agency/state entity to submit a summary of its actual and projected information security spend. SIMM 55B contains worksheets to capture IT security costs.
The IT Cost Report data is leveraged to inform CDT on how much the state spends on IT and IT security to provide proper oversight in the management of the state’s valuable IT resources and information assets. Understanding the state’s spending patterns helps CDT identify where departments might be overspending, where additional resources may be needed, and how our investment as a state compares to large companies or other states.

Note: Child entities that submit IT costs under a parent entity do not need to submit a separate IT Cost Report. In lieu of submitting an ITCR, the child entity must send an email to ITpolicy@state.ca.gov to notify CDT which parent entity supports their IT costs.

Section 2: Definitions

Report the requested information according to the definitions below:
A. IT COST DEFINITION

1. Information Technology: Includes, but is not limited to, all electronic technology systems and services, automated information handling, system design and analysis, conversion of data, computer programming, information storage and retrieval, and networking and telecommunications. IT Cost Report information includes project spending. IT Cost Report information also includes any technology costs associated with providing services, whether or not they are incurred by the IT organization within the Agency/state entity.

B. GENERAL CATEGORY DEFINITIONS

1. New: The purchase of a new goods or services in the fiscal year reported. This would include the first year of a multi-year lease that includes maintenance, refresh and upgrades.

2. Renewal/Maintenance: Continuing payment on existing goods or services (i.e., contract) in the fiscal year reported. This would include the second year and thereafter of a multi-year lease that includes maintenance.

Section 3: General Instructions

The ITCR workbook includes eight (8) tabs. The tabs progress from the most detailed (tabs 1-2; tabs 3-4) to the least detailed spend (tabs 5 and 6).

A. IT COST REPORT WORKSHEET INSTRUCTIONS

1. Tab 1 – “1. IT Sec Spend Alloc FY 22-23” worksheet where data is entered.

• • Add security spend line-item detail (Data Source File Name, Funding Source, Best Available Description Detail and Sub-Detail, and FY Actuals $ Year Total) – Column A through Column E, starting on Row A41.
  • A4 through A28, enter each unique name of the data sources used. This will summarize line-item costs per each source. Some agencies may require multiple sources (reports) to represent total security spend.
  • Allocate 100% of each line item across the IT Security Domain area categories in the beige-shaded cells only. Column G through Column N, starting on Row G41.
  • Allocate 100% of each line item across the cost categories in the beige-shaded cells only. Column S through Column AB, starting on Row S41.

Data detail:

• • Data Source File Name (Column starting at A41): Enter each unique name of the data sources used. This will summarize line-item costs per each source. Some agencies may require multiple sources (reports) to represent total security spend.
  • Funding Source (Column starting at B41): Select Budget or Grant from drop-down to describe the line-item funding source.
  • Best Available Description Detail (Optional) (Column starting at C41): Enter/Paste best available line-item detail from data source for reference, allocation, and validation purposes with IT security leadership.
  • Best Available Description Sub-Detail (Optional) (Column starting at D41): Enter/Paste best available line-item sub-detail from data source for reference, allocation, and validation purposes with IT security leadership.
  • FY Actuals $ Year Total (Column starting at E41): Enter/Paste actual line-item cost from data source for reference, allocation, and validation purposes with IT security leadership.

2. Tab 2 – “2. IT Sec Spend Sum FY 22-23” worksheet where data is auto populated.

• • Do not enter data as it auto-populates data from the “1. IT Sec Spend Alloc FY 22-23” worksheet.

3. Tab 3 – “3. IT Sec Spend Alloc FY 23-24” worksheet where data is entered.

• • Add security spend line-item detail (Data Source File Name, Funding Source, Best Available Description Detail and Sub-Detail, and FY Actuals $ Year Total) – Column A through Column E, starting on Row A41.
  • Allocate 100% of each line item across the IT Security Domain area categories in the beige-shaded cells only. Column G through Column N, starting on Row G41.
  • Allocate 100% of each line item across the cost categories in the beige-shaded cells only. Column S through Column AB, starting on Row S41.

4. Tab 4 – “4. IT Sec Spend Sum FY 23-24” worksheet where data is auto populated.

• • Do not enter data as it auto-populates data from the “3. IT Sec Spend Alloc FY 23-24” worksheet.

5. Tab 5 – “5. ITCR FYs 2022-24” worksheet where cost information data for both fiscal years (2022-2023 and 2023-2024) is entered across each line-item and cost categories (blue cells – general IT; orange cells – security IT).

• • Do not enter data in the “Total” fields (Columns F and L) as it is automatically calculated.
  • “Cloud Services” spend should be reported in this category and not reported as a subset of another category.

6. Tab 6 – “6. IT contracts” worksheet where data is entered.

• • Provide information technology services and systems contracts where spend is $500,000 or more annually for FY 2022-2023. To clarify, report PO/contracts (including maintenance contracts) that are $500,000 or more and report any IT spend that is $500,000 or more annually for a particular product/service. For example, if you have one contract for Manufacturer X for $550,000, you report it. In addition, if you have 5 separate POs (each $100K) from different resellers, but all are the same product/service from Manufacturer X, you report those as well.
  • For multi-year contracts, provide the encumbrance amounts by fiscal year and not the full contract amount for the PO/contract.
  • Report costs in actual dollar amounts (do not report in thousands). For example, $600,000 should be reported as $600,000. 

FY 2022-2023

• • • • Brand Name/Manufacturer/Service Provider (Column A): From the dropdown list, select the brand name/manufacturer/service provider for the respective service/product. (i.e., Oracle)
      • Other (Brand Name/Manufacturer/Service Provider) (Column B): If the brand name/manufacturer/service provider is not listed in column A, enter the brand/manufacturer/service provider name in column B.
      • Service/Product Name (Column C): Enter service/product name for contracts where spend is $500,000 or more annually. (i.e., Oracle Database Enterprise Edition – Processor Perpetua)
      • Supplier/Reseller Name (Column D): Enter supplier/reseller name for the respective service/product. (i.e., Mythics, Inc.)
      • Cost (Column E): Enter the cost of the contract in actual dollar amounts.
      • Is this a critical IT service or system? (Column F): From the dropdown list, select “Yes” or “No” if the product/service is a high-risk, critical IT service or system where disclosure of that record would reveal vulnerabilities to, or increase the potential for an attack on, an information technology system of a public agency.
      • IT Services and Systems Categories (Check all that apply): (Columns G-N): For each service/product, check all the categories that apply from the following options: software as a service, infrastructure as a service, platform as a service, on-premises services/systems, IT personal services, IT consulting services, software, or other IT services.

7. Tab 7 – “7. IT Security Spend Glossary” worksheet provides information relevant for all tabs.

8. Tab 8 – “8. Additional Comments” worksheet provides space for any additional justifications, comments, or concerns.

B. IT COST REPORT WORKSHEET CLARIFICATIONS (TAB 5)

1. Report data for two fiscal years, consisting of the Past-Year Actual, and Current-Year Estimated.

2. Report costs in actual dollar amounts. In previous years the costs were reported in thousands, but please enter actual dollar amounts this year. For example, $49,325 should be reported as $49,325.

3. Round personnel years (PYs) to the nearest one-tenth full-time equivalent (FTE).

4. Report the budgeted amount for personnel costs. State personnel costs shall include salary, salary-driven benefits and non-salary-driven benefits. Resource to help calculate salary and wages: PS_Sec_15.pdf (ca.gov). Resource to help calculate benefits: California Department of General Services Control Section 8740.

5. IT security costs are a subset of the overall category spend. For example, if $100 is reported in “1. Software” and $5 is reported in cell D12 Total Software Costs from Tab “2. IT Sec Spend Sum FY 22-23” worksheet, the total for this category is $100. The $100 figure includes IT security costs, the total should NOT equal $105.

6. Use the Comments field on tab “5. ITCR FYs 2022-24” worksheet, (line 46) to clarify any of the figures. For example, if specific assumptions were used in a particular cost category, please notate those in the comments field. Comments are optional. However, if comments are provided, please indicate which cost item(s) are being referenced.

7. Federal Grant Funds – For all individual data items on the “2. IT Sec Spend Sum FY 22-23” and “4. IT Sec Spend Sum FY 23-24”

C. IT COST REPORT DEFINITIONS (TABS 5 AND 6 – GENERAL IT)

The following should be referenced to assist the user in completing the individual data items on the IT Cost Report worksheet.

Note: The item numbers below correspond with item numbers on the worksheets.

1. Software
Report costs associated with computer software that operates on all types of hardware. This includes new software, maintenance, support, rental/lease and subscription services for software hosted on-prem/on-site. Types of software that need to be reported include, but are not limited to: Operating Systems, Productivity Suites, Database, Website Development, Email/Electronic Messaging, Security, Application Development Tools, Middleware, GIS. Software as a Service (SaaS) should be reported under the “Cloud Services” line item of the IT Cost Report.

2. Hardware
Report costs associated with computer hardware and components. This includes new hardware, maintenance, support or repair. The types of hardware that need to be reported include but are not limited to the following: Personal Computer (PC) Desktops, Laptops, and Printer/Scanner/Multi- Function devices, Servers, Storage, Wireless Hot Spots and Jetpacks. Infrastructure as a Service (IaaS) and Platform as a Service (PaaS) should be reported under the “Cloud Services” line item of the IT Cost Report.

3. IT Services/Consulting
Report costs for IT contract services where there is a need for additional knowledge or resources and also includes commercial contracts and independent assessments. Costs should include all External, Internal, and Office of Technology Services (OTech) Data Center services that are not Cloud-based. Cloud services (IaaS, PaaS, and SaaS) should be reported under the “Cloud Services” line item of the IT Cost Report. This includes Cloud services obtained from OTech.

4. Network
Report costs associated with wiring, cabling, equipment, and communication network lines to provide video and data connectivity services across local and large geographical areas. This includes new, maintenance, support, repair, rentals and/or leases for network connectivity. The types of networks that need to be reported include, but are not limited to the following: Network Equipment, Wireless Network Equipment, Switches/Routers, Point-to-Point Data Circuit, etc.

5. Telecommunications
Report costs associated with operating telephone systems within State buildings and offices. This includes new, maintenance, repair and rental fees for telecommunication services. The types of telecommunications that need to be reported include, but are not limited to the following:

Telephone Equipment: Hardware used for telecommunications such as transmission lines, multiplexers, and base transceiver stations.

Telecom Devices: Any equipment, machine, device, or instrument that transmits or receives telephonic, electronic, radio, text, or data communications.

Telecom Services: The exchange of information through electronic means such as phone service, internet, television, and networking.

2-way devices: A communication system that allows nearly instantaneous two-way responses between the sender and receiver. This can include handheld radios, telephones, computer-aided dispatch systems, walkie-talkies, etc.

Public Address Systems: An electronic sound amplification and distribution system with a microphone, amplifier, speakers, and related equipment, used as a communication system to distribute sound.

Closed Circuit Television: A closed system consisting of video cameras, monitors, and wired or wireless data networks that allow images to transfer from video cameras to monitors.

Although mobile phone devices are generally included under Telecommunications, for the IT Cost Report they should be reported under the “Mobile Phones” line item of the IT Cost Report. Note: Wireless Hot Spots and Jetpacks should be reported under the “Hardware” line item of the IT Cost Report.

6. Cloud Services (IaaS, PaaS, SaaS)
Report the cost of shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) where the cost is pay-for-use basis or as a subscription. Including security costs under the Cloud Services section is optional.

7. Personnel Years
Report the budgeted personnel years number and cost for each fiscal year.

8. Mobile Phones
Report the total number and costs associated with mobile phones. A mobile phone (includes both cell phones and smartphones) is a device that can make and receive telephone calls over a cellular network. Mobile phones include smartphone devices which are computing devices that provide advanced computing capability and connectivity and runs a complete operating system and platform for application developers and users to install and run more advanced applications. Smartphones currently include, but are not limited to models using the Android, iOS, Blackberry OS, and Windows Phone operating systems.
Departments should report the total number and costs associated with mobile phones and all costs associated to mobile phones and their respective, data internet and other usage plans. Only mobile phone purchases that access the cellular network for voice and data and comply with the definition of a mobile phone should be added to this line item. Mobile computing devices with the capability to connect to a cellular network, such as Wireless Hot Spots and Jetpacks should be reported under the “Hardware” line item of the IT Cost Report.

9. IT Services and Systems Contracts
Report costs for systems and services contracts including but not limited to, cloud services, including “Software as a Service”, “Infrastructure as a Service”, and “Platform as a Service”, on-premises services and systems, IT personal services, and IT consulting services.

Section 4: Form Submission

The IT Cost Report must be attached to a transmittal document (see SIMM 55C) and MUST be signed by the following (digital signatures are acceptable):

1. The Agency/state entity Chief Information Officer (CIO);
2. The Agency/state entity Budget Officer;
3. The Agency/state entity Director; and
4. The Agency Information Officer (AIO) or designee.

The Information Technology Cost Report Template shall be submitted electronically in an Excel workbook file (2003 or later) with the signed transmittal letter (as a scanned PDF). Please use the following naming convention in saving the file: Org Code_Department Acronym_ITCostReport_FY20xx-xx (e.g. 8860_DOF_ITCostReport_FY20xx-xx.xls).

Information contained in the IT security components of the IT Cost Report (SIMM 55) are confidential. Once signed, securely send the entire form and any attachments to the Office of Information Security (OIS) using the Secure Automated File Exchange (SAFE) system. If your entity is in need of SAFE accounts, please have your entity’s designated Chief Information Officer (CIO) or Information Security Officer (ISO) complete and return the SAFE System Designee Request spreadsheet and return to our office at security@state.ca.gov
Questions related to the transmittal requirements should be directed to OIS at security@state.ca.gov.

Revision History

September 2023