State technology office reports security risks and posts standards

The chief information security officer must send two yearly reports to the Joint Technology Committee. The reports cover the Office of Information Technology's security compliance and the overall risks of state agency technology systems. The compliance report covers the office's status under security standards and open State Auditor recommendations, including dates, repair timelines, and plans to limit harm while issues remain open. The risk report assesses security risks across state agency technology systems. The officer may evaluate systems to prepare it, and agencies must provide requested access and information. Both reports are due by November 1, 2027, and by November 1 each year after that.

The Office of Information Technology must keep a quarterly updated list of active state agency technology vendor contracts. The list covers active technology vendor contracts for state agencies, including agency contracts initiated with prior office approval. The list must show each vendor's name, contract value, expiration date, and data classification and business criticality tier. The office must submit a one-time budget request to build the list. If approved funding is not enough to implement and maintain it, the office may ask the General Assembly for more money. The office must update the list every three months.

The Office of Information Technology must publicly post technical technology standards before publishing or using them. These rules cover technical information technology standards established by the office. The chief information security officer must also approve a standard about security, access controls, or handling data. For an imminent or active threat requiring immediate action to prevent or reduce significant harm, the officer may determine in writing that a security emergency exists. The office may then use a standard before meeting the usual requirements, but must post it within 72 hours; it expires after 90 days unless the usual requirements are met first. An emergency standard expires 90 days after implementation unless the office meets the usual requirements before then.

The Joint Technology Committee may request a special security audit, and the State Auditor must conduct it if the Legislative Audit Committee approves. The possible audit examines the Office of Information Technology's security. The Joint Technology Committee may request an audit only if a compliance report shows an audit recommendation remains unresolved two or more years past its promised implementation date, or a material discrepancy exists between the report and an earlier State Auditor finding. A majority of each committee must approve. The Office of Information Technology must reimburse the State Auditor; that payment may come from the Technology Risk Prevention and Response Fund. The State Auditor must produce the report within 12 months after the Legislative Audit Committee approves the audit.