ColoradoSB26-1852026 Regular SessionSenate

Enhance Security of Office of Information Technology

Sponsored By: Brianna Titone (Democratic), Janice Marchman (Democratic), Mark Baisley (Republican), Rebecca Keltie (Republican)

Signed by Governor

Telecommunications & Information Technology

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

4 provisions identified: 3 benefits, 0 costs, 1 mixed.

Clearer leadership for Colorado cybersecurity checks

Beginning August 12, 2026, Colorado’s chief information security officer must have expertise in technology security and risk management. The law removes communications resources from the stated qualifications. The chief information officer cannot transfer the security officer’s duties to someone else and must cover when that officer is unavailable. The security officer can direct supervised security staff and test agency systems for weaknesses, including reviewing settings and vendors. Agencies must provide requested system access, product details, and system design information. The statewide security risk report is due November 1, 2027, and every November 1 afterward.

Closer tracking of Colorado technology contracts

Beginning August 12, 2026, Colorado’s Office of Information Technology must maintain a list of all active state-agency technology vendor contracts. Updated quarterly, it must show vendor names, contract values, expiration dates, and data-classification or business-importance tiers. State-agency technology leaders and Joint Technology Committee members must have access to the list. Agencies starting technology solicitations or contracts with prior technology-office procurement approval must supply the required details. Contracts delivering ongoing services to Coloradans must also keep current system design diagrams, updated at least annually.

Public safeguards for Colorado technology standards

Beginning August 12, 2026, Colorado’s Office of Information Technology must publicly post technical standards before publishing or using them. Standards covering security, access controls, or data handling also need the chief information security officer’s approval. Immediate use is allowed when that officer documents an imminent or active threat requiring action to prevent or reduce significant harm. That harm must concern state data, systems, or operations. Emergency standards must be posted within 72 hours and expire 90 days after implementation unless ordinary posting and approval requirements are met.

New Colorado security audits and costs

Beginning August 12, 2026, the law establishes a special audit process for Colorado’s Office of Information Technology. Annual security compliance reports start November 1, 2027, listing open audit findings, their dates, repair timelines, and temporary safeguards. Within 90 days after a report is filed, a majority of the Joint Technology Committee can request an audit. Approval requires recommendations still unresolved at least two years past their implementation date, or a material conflict with an earlier State Auditor finding. The Legislative Audit Committee must approve the audit. The State Auditor must seek the technology office’s input on scope and submit the audit report within 12 months. The technology office must reimburse audit costs through the new State Technology Risk Prevention and Response Fund; no fixed amount is specified.

Sponsors & Cosponsors

Cosponsors

Bob Marshall
Democratic • House
Chad Clifford
Democratic • House
Jennifer Bacon
Democratic • House
Jamie Jackson
Democratic • House
Michael Carter
Democratic • House
Manny Rutinel
Democratic • House
James Coleman
Democratic • Senate

Roll Call Votes

All Roll Calls

Yes: 131 • No: 1

House vote • 5/13/2026

Third reading: Bill

Yes: 64 • No: 1

House vote • 5/12/2026

Refer Senate Bill 26-185 to the Committee of the Whole.

Yes: 10 • No: 0

House vote • 5/9/2026

Refer Senate Bill 26-185 to the Committee on Appropriations.

Yes: 11 • No: 0

Senate vote • 5/8/2026

Third reading: Bill

Yes: 34 • No: 0

Senate vote • 5/7/2026

Refer Senate Bill 26-185 to the Committee of the Whole and with a recommendation that it be placed on the consent calendar.

Yes: 7 • No: 0

Senate vote • 5/5/2026

Refer Senate Bill 26-185, as amended, to the Committee on Appropriations.

Yes: 5 • No: 0

Actions Timeline

Governor Signed
6/2/2026House
Signed by the President of the Senate
5/22/2026Senate
Signed by the Speaker of the House
5/22/2026House
Sent to the Governor
5/22/2026House
House Third Reading Passed - No Amendments
5/13/2026House
House Committee on Appropriations Refer Unamended to House Committee of the Whole
5/12/2026House
House Second Reading Special Order - Passed - No Amendments
5/12/2026House
House Committee on State, Civic, Military, & Veterans Affairs Refer Unamended to Appropriations
5/9/2026House
Senate Third Reading Passed - No Amendments
5/8/2026Senate
Introduced In House - Assigned to State, Civic, Military, & Veterans Affairs
5/8/2026House
Senate Committee on Appropriations Refer Unamended - Consent Calendar to Senate Committee of the Whole
5/7/2026Senate
Senate Second Reading Special Order - Passed with Amendments - Committee
5/7/2026Senate
Senate Committee on Business, Labor, & Technology Refer Amended to Appropriations
5/5/2026Senate
Introduced In Senate - Assigned to Business, Labor, & Technology
5/1/2026Senate

Bill Text

Engrossed
PDF
Final Act
PDF
Introduced
PDF
Reengrossed
PDF
Rerevised
PDF
Revised
PDF
Senate Business, Labor, & Technology Preamend
PDF
Signed Act
PDF

Related Bills

Back to State Legislation