This bill amends existing law (RCW 43.105.375) to require state agencies to locate all new and existing information and telecommunications investments in the state data center or in third‑party commercial cloud services, except where a waiver is granted. It makes a procedural change by requiring agencies to perform and document an assessment of all computing deployment models (public, private, hybrid cloud, on‑premises) before using any third‑party commercial cloud service. The assessment must address lifecycle costs, service level and governance requirements, outage recovery and ordering, cybersecurity and regulatory compliance as tied to the Washington state cybersecurity program policy, and the impact and availability of hybrid cloud environments. The assessment must be submitted to the agency and the Office of Financial Management for review and approval at least 30 days before procuring any third‑party commercial cloud service. Agencies that cannot comply with the location requirement must obtain a written waiver that justifies, by citing specific service or performance requirements, why servers must be located outside the state's common platform. The legislature and the judiciary may enter an interagency agreement to migrate their servers into the state data center or third‑party commercial cloud services. Institutions of higher education are expressly excluded from this section. Some terms and references are not identified in the provided text: the specific identity of the repeatedly referenced "the agency" is not given, formal definitions for terms like "state data center" and "third‑party, commercial cloud computing services" are not included here, and the effective date of the section is not provided. The text refers to the Washington state cybersecurity program policy as it exists on the effective date of the section, but that effective date is not included in these extracts.

If enacted, most state agencies will need to re-evaluate where they host existing and new information and telecommunications systems, and generally place those systems in the state data center or in approved commercial cloud services unless they get a written waiver. Agencies will have to do and document a pre-procurement assessment of public, private, hybrid, and on-premises options covering costs, service levels, outage recovery, cybersecurity tied to the state policy, and hybrid impacts, and send that assessment to OFM at least 30 days before buying cloud services. That will likely increase agency workload and planning time, create upfront assessment and possibly migration costs, give OFM a new review role, and change procurement timing and options for cloud vendors; institutions of higher education are explicitly excluded and the legislature and judiciary may choose to join an interagency migration agreement. Key implementation details are unclear from the provided text: the specific agency referenced as the approver or policy publisher is not identified, the effective date of the policy is not given, and formal definitions of “state data center” and cloud terms are missing. Those gaps affect who signs off on waivers, how the requirements are applied, and the ultimate costs or savings of consolidating services.