Summary#

SB 26-185, titled “Enhance Security of Office of Information Technology,” amends Colorado laws governing the existing Office of Information Technology (OIT), its security officer, and legislative oversight. Its stated goal is to strengthen state IT security and oversight. The supplied status says it was signed into law; the text sets an effective date of August 12, 2026, if the Legislature adjourned May 13 and no referendum petition blocks it.

• The Chief Information Security Officer (CISO) must submit annual reports on security compliance and statewide IT security risks, starting November 1, 2027.
• The CISO may evaluate state agency IT systems, including through penetration testing and vulnerability scans. Agencies must provide necessary access and information when asked.
• OIT must keep a quarterly updated list of active state IT vendor contracts, including each vendor’s name, contract value, expiration date, and data-classification and business-criticality tier. The list must be available to state agency IT leaders and the Joint Technology Committee.
• Technical IT standards generally must be posted publicly; standards about security, access controls, or data handling also need CISO approval. A written security-emergency finding allows temporary standards, which must be posted within 72 hours and expire after 90 days unless the regular requirements are met.
• The Joint Technology Committee may call the CISO to testify and may vote to request a special audit. If the Legislative Audit Committee also approves, the State Auditor must conduct it; OIT must reimburse the auditor.
• The CISO’s duties and powers cannot be delegated. If the CISO is unavailable, the Chief Information Officer must perform them. OIT must also ensure that contracts for ongoing services and delivery to Coloradans keep architecture diagrams updated at least annually.

What it means for you#

• State agencies: When the CISO requests it for an evaluation, your agency must provide needed system access and information, including product and architecture information. Agencies independently procuring IT with OIT procurement approval must provide contract details for the OIT list.
• OIT and its security leadership: OIT must prepare the contract list and annual reports. The CISO may decide which system evaluations are needed. The CISO remains accountable for the accuracy of both annual reports, even if other staff help prepare them.
• IT vendors: Contracts for ongoing services and delivery to Coloradans must maintain architecture diagrams updated at least yearly. The bill also requires contract terms that allow OIT to enforce technology and security standards or conduct due diligence or audits when agencies procure IT resources.
• Residents: The bill does not directly change individual rights, benefits, or IT services. The contract list is made available to agency IT leaders and the Joint Technology Committee; the bill does not require that list or the annual reports to be published for the public.
• State oversight: A special audit is not automatic. It requires majority votes in both the Joint Technology Committee and the Legislative Audit Committee, after specified reporting concerns.

Money#

No cost estimate is provided; no publicly available information.

• OIT must submit a one-time budget request to build and implement the contract list. If that budget is approved and OIT later finds it needs more money, it may ask the General Assembly for additional funding from the Technology Risk Prevention and Response Fund.
• OIT must reimburse the State Auditor for a special audit. That reimbursement may come from the same fund. The auditor may hire a qualified outside security firm.
• The bill requires added reporting and possible evaluations, but the supplied material gives no staffing or operating-cost estimate.

What is unclear#

• The full current statutes were not supplied, so I could not verify how these duties compare with all existing law.
• The bill does not set a schedule or limits for CISO evaluations, beyond saying the CISO may conduct them as necessary.
• It does not define “material discrepancy” for triggering a possible special audit, or explain how the audit’s findings will be made public.
• No publicly available information is provided about the expected cost of the contract list, reports, evaluations, or audits.
• The text does not explain how the new contract list will be built, kept secure, or checked for accuracy.

Case for#

• Annual compliance and risk reports could give lawmakers a regular basis to track security issues and unresolved audit recommendations.
• The CISO’s authority to evaluate systems could help identify vulnerabilities before they cause harm.
• A special-audit path could add independent scrutiny when recommendations remain unresolved long past a promised date or reports conflict with prior audit findings.
• Public posting and CISO approval of many technical standards could make the rules more transparent and ensure security expertise is involved.

Case against#

• The bill requires new reports, evaluations, contract tracking, and possible audits but does not estimate their cost or specify the staff needed.
• The CISO may decide which evaluations are necessary, while the bill does not set detailed limits or review procedures for those evaluations.
• The contract list includes contract values and security-related classifications, but the bill does not explain how sensitive information in the list will be protected.
• The audit process depends on votes by two committees, so the bill does not ensure an audit will occur whenever the stated warning signs appear.