SAM 4983.1 cloud computing (web)
Citation
California Department of General Services (DGS). State Administrative Manual (SAM) section 4983.1, “Cloud Computing Policy.” Revised August 2025. https://www.dgs.ca.gov/Resources/SAM/TOC/4900/4983-1. Copy: raw/web/2026-11-09 SAM 4983.1 cloud computing.md (original: .html beside it). Read 2026-11-09.
Bottom line
- SAM 4983.1 is the state’s cloud computing policy for executive branch entities. Entities must use cloud services through the California Department of Technology (CDT) or buy them through DGS, unless they get an exemption.
- It sets rules for data classification, security, data location in the United States, an exit strategy, IT staff and total cost of ownership.
Background
The State Administrative Manual holds the state’s administrative policy, and DGS publishes it. Section 4983.1 has 15 numbered parts, from scope to the request process. The revision of August 2025 replaces versions of October 2023, August 2020 and August 2017. CDT Technology Letter 25-01 (web) says that all new GenAI must follow this policy (SAM 4986.5).
Key claims
- “It applies to all Agencies/state entities employees, contractors, and authorized users who access, use, or manage cloud services on behalf of their organization.” (Purpose)
- “Must consider IaaS and PaaS as an alternative solution for new, expansion, or refresh initiatives.” (part 4.1)
- “Ensure that the physical location of the data center, where the data is stored, is within the Continental United States or Hawaii, and remote access to data from work sites outside the Continental United States and Hawaii is prohibited unless approved in advance by the State Chief Information Security Officer” (part 8.7)
- “Enrollment in CDT’s Security Operations Center (SOC) monitoring services for all IaaS and PaaS cloud services is required unless the entity has an approved CDT SOC exemption.” (part 8.11)
- “The exit strategy must include the Agency’s/state entity’s ability to export data in pre-defined formats and maintain, when needed, a current backup of the data in the Agency/state entity’s designated Tier III- equivalent data center facility.” (part 9.2)
- “Determine if contract personnel will be needed to augment state staff. Utilize the Government Code (GC) 19130 Personal Services request process if required.” (part 10.3)
- “If it is determined the use of a CDT managed or approved cloud service offering is not feasible, a cloud computing exemption must be obtained.” (part 13.2)
Evidence and method
An administrative policy text. It states requirements and points to other SAM sections, the State Information Management Manual (SIMM) and federal standards such as NIST SP 800-171 and FedRAMP. It gives no data.
Limits
The policy is for state agencies and entities. It does not say whether it applies to the University of California. It does not name high-performance or research computing, and it lists cost items for total cost of ownership but no figures.