Commercial cloud assessment

AN ACT Relating to requiring an economic assessment before the 1
purchase of any third-party, commercial cloud computing service; and 2
amending RCW 43.105.375. 3
BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF WASHINGTON:4
Sec. 1. RCW 43.105.375 and 2024 c 54 s 17 are each amended to 5
read as follows: 6
(1) Except as provided by subsection (((2))) (3) of this section, 7
state agencies shall locate all existing and new information or 8
telecommunications investments in the state data center or within 9
third-party, commercial cloud computing services. 10
(2) Prior to locating any information or telecommunications 11
investments within a third-party, commercial cloud computing service, 12
a state agency shall perform an assessment to analyze all computing 13
deployment models including, but not limited to, public cloud, 14
private cloud, hybrid cloud, and on-premises solutions, for the 15
purposes of data hosting, processing, management, networking, 16
computing, and storage.17
(a) This assessment must include, but not be limited to:18
(i) The industry standard, expected life-cycle cost of each 19
solution including, but not limited to, the ongoing maintenance, the 20
operational costs, software updates, data migration costs, including 21
S-4174.1
SENATE BILL 6281
State of Washington 69th Legislature 2026 Regular Session
By Senators Boehnke and Hasegawa
Read first time 01/22/26. Referred to Committee on Environment,
Energy & Technology.
p. 1 SB 6281
any data ingress and egress fees, the cost to reformat data to 1
improve accessibility, costs of security vulnerabilities from 2
advancements in the solution's technology, and the cost of potential, 3
required updates to the solution; 4
(ii) The service level needs and business requirements, including 5
governance requirements, related to privacy and control over data;6
(iii) The rapidity of return to service from any outages and 7
order of return of service compared to other customers with the same 8
provider;9
(iv) The cybersecurity and regulatory compliance for all workload 10
types, including all data categories referenced in the document, 11
published by the agency, entitled, "Washington state cybersecurity 12
program policy," as that document exists on the effective date of 13
this section and any subsequent amendments thereto; and14
(v) The impact and availability of hybrid cloud environments in 15
each respective cloud computing environment.16
(b) The assessment required under this subsection (2) must be 17
conducted prior to the purchase of any third-party, commercial cloud 18
computing service for the state agency's data.19
(c) The assessment required under this subsection (2) must be 20
submitted to the state agency and the office of financial management 21
for review and approval not less than 30 days before procuring any 22
third-party, commercial cloud computing service. The state agency and 23
the office of financial management shall, in approving or not 24
approving the procurement of a third-party, commercial cloud 25
computing service, keep at the forefront of their decision making the 26
best stewardship of the taxpayer dollars that will be used in the 27
purchase and ongoing operating costs of the solution chosen.28
(3) State agencies with a service requirement that precludes them 29
from complying with subsection (1) of this section must receive a 30
waiver from the agency. Waivers must be based upon written 31
justification from the requesting state agency citing specific 32
service or performance requirements for locating servers outside the 33
state's common platform. 34
(((3))) (4) The legislature and the judiciary, which are 35
constitutionally recognized as separate branches of government, may 36
enter into an interagency agreement with the agency to migrate its 37
servers into the state data center or third-party, commercial cloud 38
computing services. 39
p. 2 SB 6281
(((4))) (5) This section does not apply to institutions of higher 1
education. 2
--- END ---
p. 3 SB 6281