KansasHB 25742025–2026 Regular SessionHouse

Removing the expiration on certain cybersecurity requirements, modifying the duties of chief information security officers and cybersecurity programs, requiring assessment of executive branch agency compliance with cybersecurity requirements, providing for consideration of such compliance by the legislature during the budget process and creating the judicial branch technology oversight council.

Sponsored By: Joint Committee on Information Technology

Signed by Governor

senate committee on government efficiencyhouse committee on legislative modernization

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

10 provisions identified: 5 benefits, 1 costs, 4 mixed.

New technology oversight for courts and lawmakers

The law creates separate technology oversight councils for Kansas courts and the Legislature. The chief justice chooses court council membership, while the Legislative Coordinating Council chooses legislative council membership. Both councils set technology policies, approve plans, oversee projects, and review cybersecurity programs. They also support their branches’ technology and security officers.

Security safeguards for state technology purchases

Executive and court security officers must ensure technology contracts include standard security terms and address product and supply-chain risks. Executive agency heads also need security review before buying cybersecurity products, services, or platforms that may materially affect state systems, data, or cybersecurity risks. They must consult the executive security officer and obtain written certification that the purchase creates no cybersecurity risk.

State agencies keep cybersecurity standards and reporting

Covered executive, court, and legislative agencies must base cybersecurity programs on nationally recognized government standards. The same rule covers the Insurance Department, Secretary of State, Attorney General, and Kansas Bureau of Investigation. For courts, lawmakers, and those four offices, this replaces specific framework tier targets; their duties no longer expire July 1, 2026. Starting in 2027, security officers report program maturity every two years to legislative technology and budget committees. The executive security officer must keep statewide standards current, and executive agency heads must coordinate and keep improving their programs.

State government websites must use .gov

Websites maintained by Kansas government branches or state agencies must use a .gov domain. State educational institutions are excluded. This gives covered state websites a consistent government web address.

State technology merger planning requirement ends

The state technology council no longer must plan to combine executive technology services within the central state technology office. The removed planning duty also covered combining state educational institutions’ cybersecurity services within central technology and security offices. The law removes the related report due before January 15, 2026, without creating a replacement integration plan.

Lawmakers lose required technology contract review

The legislative security officer no longer must review technology contracts for product risks, supply-chain risks, or standard security language. This removes a required security review for legislative technology purchases.

State workers face yearly cybersecurity training

Covered Kansas agency heads and employees must complete cybersecurity awareness training every year. Employees who do not finish lose access to state-issued devices or the state network. These rules continue instead of ending July 1, 2026.

Agency cybersecurity reviews bring possible budget cuts

Executive agencies must receive an initial cybersecurity assessment and periodic reviews by state staff, qualified outside assessors, or both. The security officer issues written findings, recommendations, and any correction deadlines; agencies must maintain action plans with milestones. Starting October 1, 2028, agencies falling behind are reported to legislative committees and must present progress plans to the budget committee. Continued failure triggers reports before the regular session and required budget-committee consideration of funding consequences. Committees must consider canceling appropriated funds or cutting special-fund technology and cybersecurity spending limits by 10%, but cuts are not automatic.

State branches manage their own cybersecurity

Beginning July 1, 2027, each branch’s technology and security officers administer its cybersecurity services. Legislative and executive cybersecurity employees work under their branch’s chief technology officer. The public employee retirement system, KPERS, instead receives cybersecurity direction through the state treasurer’s security officer. KPERS is excluded from requirements tied to the Cybersecurity Act’s executive-agency definition; this does not change retirement benefit eligibility. State educational institutions are excluded from the service-administration section.

State cybersecurity checks change; findings stay confidential

Covered state offices and all three branches replace annual cybersecurity audits with periodic checks, with no fixed yearly schedule. Checks cover cybersecurity programs and compliance with laws, policies, and standards; covered offices’ audit duties continue beyond July 1, 2026. Courts no longer must report audit failures or prepare plans to fix them under the former requirements. Covered audit results remain confidential and unavailable through legal discovery or public-records requests; executive assessment results receive that protection too. These confidentiality rules expire July 1, 2030, unless lawmakers review and renew them.

Sponsors & Cosponsors

Sponsor

Joint Committee on Information Technology
Affiliation unavailable

Cosponsors

There are no cosponsors for this bill.

Roll Call Votes

All Roll Calls

Yes: 318 • No: 6

House vote • 4/23/2026

Yea: 38 Nay: 2

Yes: 38 • No: 2

House vote • 4/23/2026

Yea: 121 Nay: 1

Yes: 121 • No: 1

Senate vote • 3/19/2026

Final Action - Passed