KS
Kansas House Bill HB2271

Kansas 2025-2026 Regular Session

Kansas House Bill HB2271 Compare Versions

Only one version of the bill is available at this time.
OldNewDifferences
11 Session of 2025
22 HOUSE BILL No. 2271
33 By Committee on Legislative Modernization
44 Requested by Representative Penn
55 2-5
66 AN ACT concerning cybersecurity; removing the expiration provisions of
77 cybersecurity legislation; consolidating cybersecurity services under
88 the chief information security officer of each branch; amending K.S.A.
99 2024 Supp. 40-110, 75-413, 75-623, 75-710, 75-711, 75-7203, 75-
1010 7206a, 75-7208a, 75-7245 and 75-7246 and repealing the existing
1111 sections; also repealing K.S.A. 2023 Supp. 45-229, as amended by
1212 section 11 of chapter 95 of the 2024 Session Laws of Kansas, 75-7201,
1313 as amended by section 17 of chapter 95 of the 2024 Session Laws of
1414 Kansas, 75-7202, as amended by section 19 of chapter 95 of the 2024
1515 Session Laws of Kansas, 75-7203, as amended by section 21 of chapter
1616 95 of the 2024 Session Laws of Kansas, 75-7205, as amended by
1717 section 23 of chapter 95 of the 2024 Session Laws of Kansas, 75-7206,
1818 as amended by section 25 of chapter 95 of the 2024 Session Laws of
1919 Kansas, 75-7208, as amended by section 27 of chapter 95 of the 2024
2020 Session Laws of Kansas, 75-7209, as amended by section 29 of chapter
2121 95 of the 2024 Session Laws of Kansas, 75-7237, as amended by
2222 section 31 of chapter 95 of the 2024 Session Laws of Kansas, 75-7238,
2323 as amended by section 33 of chapter 95 of the 2024 Session Laws of
2424 Kansas, 75-7239, as amended by section 35 of chapter 95 of the 2024
2525 Session Laws of Kansas, 75-7240, as amended by section 37 of chapter
2626 95 of the 2024 Session Laws of Kansas.
2727 Be it enacted by the Legislature of the State of Kansas:
2828 Section 1. K.S.A. 2024 Supp. 40-110 is hereby amended to read as
2929 follows: 40-110. (a) The commissioner of insurance is hereby authorized
3030 to appoint an assistant commissioner of insurance, actuaries, two special
3131 attorneys who shall have been regularly admitted to practice, an executive
3232 secretary, policy examiners, two field representatives, and a secretary to
3333 the commissioner. Such appointees shall each receive an annual salary to
3434 be determined by the commissioner of insurance, within the limits of
3535 available appropriations. The commissioner is also authorized to appoint,
3636 within the provisions of the civil service law, and available appropriations,
3737 other employees as necessary to administer the provisions of this act. The
3838 field representatives authorized by this section may be empowered to
3939 conduct inquiries, investigations or to receive complaints. Such field
4040 1
4141 2
4242 3
4343 4
4444 5
4545 6
4646 7
4747 8
4848 9
4949 10
5050 11
5151 12
5252 13
5353 14
5454 15
5555 16
5656 17
5757 18
5858 19
5959 20
6060 21
6161 22
6262 23
6363 24
6464 25
6565 26
6666 27
6767 28
6868 29
6969 30
7070 31
7171 32
7272 33
7373 34
7474 35 HB 2271 2
7575 representatives shall not be empowered to make, or direct to be made, an
7676 examination of the affairs and financial condition of any insurance
7777 company in the process of organization, or applying for admission or
7878 doing business in this state.
7979 (b) The appointees authorized by this section shall take the proper
8080 official oath and shall be in no way interested, except as policyholders, in
8181 any insurance company. In the absence of the commissioner of insurance
8282 the assistant commissioner shall perform the duties of the commissioner of
8383 insurance, but shall in all cases execute papers in the name of the
8484 commissioner of insurance, as assistant. The commissioner of insurance
8585 shall be responsible for all acts of an official nature done and performed by
8686 the commissioner's assistant or any person employed in such office. All the
8787 appointees authorized by this section shall hold their office at the will and
8888 pleasure of the commissioner of insurance.
8989 (c) (1) The commissioner shall appoint a chief information security
9090 officer who shall be responsible for establishing security standards and
9191 policies to protect the department's information technology systems and
9292 infrastructure. The chief information security officer shall:
9393 (A)(1) Develop a cybersecurity program for the department that
9494 complies with the national institute of standards and technology
9595 cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The chief
9696 information security officer shall ensure that such programs achieve a CSF
9797 tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030;
9898 (B)(2) ensure that the commissioner and all employees complete
9999 cybersecurity awareness training annually and that if an employee does not
100100 complete the required training, such employee's access to any state-issued
101101 hardware or the state network is revoked; and
102102 (C) (i) (a)(3) (A) (i) coordinate with the United States cybersecurity
103103 and infrastructure security agency to perform annual audits of the
104104 department for compliance with applicable state and federal laws, rules
105105 and regulations and department policies and standards; and
106106 (b)(ii) make an audit request to such agency annually, regardless of
107107 whether or not such agency has the capacity to perform the requested
108108 audit.
109109 (ii)(B) Results of audits conducted pursuant to this paragraph shall be
110110 confidential and shall not be subject to discovery or disclosure pursuant to
111111 the open records act, K.S.A. 45-215 et seq., and amendments thereto.
112112 (2) The provisions of this subsection shall expire on July 1, 2026.
113113 Sec. 2. K.S.A. 2024 Supp. 75-413 is hereby amended to read as
114114 follows: 75-413. (a) The secretary of state may appoint such other
115115 assistants and clerks as may be authorized by law, but the secretary of state
116116 shall be responsible for the proper discharge of the duties of all assistants
117117 and clerks, and they shall hold their offices at the will and pleasure of the
118118 1
119119 2
120120 3
121121 4
122122 5
123123 6
124124 7
125125 8
126126 9
127127 10
128128 11
129129 12
130130 13
131131 14
132132 15
133133 16
134134 17
135135 18
136136 19
137137 20
138138 21
139139 22
140140 23
141141 24
142142 25
143143 26
144144 27
145145 28
146146 29
147147 30
148148 31
149149 32
150150 33
151151 34
152152 35
153153 36
154154 37
155155 38
156156 39
157157 40
158158 41
159159 42
160160 43 HB 2271 3
161161 secretary and shall do and perform such general duties as the secretary
162162 may require.
163163 (b) (1) The secretary of state shall appoint a chief information
164164 security officer who shall be responsible for establishing security standards
165165 and policies to protect the office's information technology systems and
166166 infrastructure. The chief information security officer shall:
167167 (A)(1) Develop a cybersecurity program for the office that complies
168168 with the national institute of standards and technology cybersecurity
169169 framework (CSF) 2.0, as in effect on July 1, 2024. The chief information
170170 security officer shall ensure that such programs achieve a CSF tier of 3.0
171171 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030;
172172 (B)(2) ensure that the secretary of state and all employees complete
173173 cybersecurity awareness training annually and that if an employee does not
174174 complete the required training, such employee's access to any state-issued
175175 hardware or the state network is revoked; and
176176 (C) (i) (a)(3) (A) (i) coordinate with the United States cybersecurity
177177 and infrastructure security agency to perform annual audits of the office
178178 for compliance with applicable state and federal laws, rules and
179179 regulations and office policies and standards; and
180180 (b)(ii) make an audit request to such agency annually, regardless of
181181 whether or not such agency has the capacity to perform the requested
182182 audit.
183183 (ii)(B) Results of audits conducted pursuant to this paragraph shall be
184184 confidential and shall not be subject to discovery or disclosure pursuant to
185185 the open records act, K.S.A. 45-215 et seq., and amendments thereto.
186186 (2) The provisions of this subsection shall expire on July 1, 2026.
187187 Sec. 3. K.S.A. 2024 Supp. 75-623 is hereby amended to read as
188188 follows: 75-623. (a) The treasurer shall appoint such other assistants,
189189 clerks, bookkeepers, accountants and stenographers as may be authorized
190190 by law, each of which persons shall take the oath of office required of
191191 public officers. Such persons shall hold their offices at the will and
192192 pleasure of the state treasurer.
193193 (b) (1) The treasurer shall appoint a chief information security officer
194194 who shall be responsible for establishing security standards and policies to
195195 protect the office's information technology systems and infrastructure. The
196196 chief information security officer shall:
197197 (A)(1) Develop a cybersecurity program for the office that complies
198198 with the national institute of standards and technology cybersecurity
199199 framework (CSF) 2.0, as in effect on July 1, 2024. The chief information
200200 security officer shall ensure that such programs achieve a CSF tier of 3.0
201201 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030;
202202 (B)(2) ensure that the treasurer and all employees complete
203203 cybersecurity awareness training annually and that if an employee does not
204204 1
205205 2
206206 3
207207 4
208208 5
209209 6
210210 7
211211 8
212212 9
213213 10
214214 11
215215 12
216216 13
217217 14
218218 15
219219 16
220220 17
221221 18
222222 19
223223 20
224224 21
225225 22
226226 23
227227 24
228228 25
229229 26
230230 27
231231 28
232232 29
233233 30
234234 31
235235 32
236236 33
237237 34
238238 35
239239 36
240240 37
241241 38
242242 39
243243 40
244244 41
245245 42
246246 43 HB 2271 4
247247 complete the required training, such employee's access to any state-issued
248248 hardware or the state network is revoked; and
249249 (C) (i) (a)(3) (A) (i) coordinate with the United States cybersecurity
250250 and infrastructure security agency to perform annual audits of the office
251251 for compliance with applicable state and federal laws, rules and
252252 regulations and office policies and standards; and
253253 (b)(ii) make an audit request to such agency annually, regardless of
254254 whether or not such agency has the capacity to perform the requested
255255 audit.
256256 (ii)(B) Results of audits conducted pursuant to this paragraph shall be
257257 confidential and shall not be subject to discovery or disclosure pursuant to
258258 the open records act, K.S.A. 45-215 et seq., and amendments thereto.
259259 (2) The provisions of this subsection shall expire on July 1, 2026.
260260 Sec. 4. K.S.A. 2024 Supp. 75-710 is hereby amended to read as
261261 follows: 75-710. (a) The attorney general shall appoint such assistants,
262262 clerks, and stenographers as shall be authorized by law, and who shall hold
263263 their office at the will and pleasure of the attorney general. All fees and
264264 allowances earned by said assistants or any of them, or allowed to them by
265265 any statute or order of court in any civil or criminal case whatsoever, shall
266266 be turned into the general revenue fund of the state treasury, and the
267267 vouchers for their monthly salaries shall not be honored by the director of
268268 accounts and reports until a verified account of the fees collected by them,
269269 or either of them, during the preceding month, has been filed in the
270270 director of accounts and reports' office. Assistants appointed by the
271271 attorney general shall perform the duties and exercise the powers as
272272 prescribed by law and shall perform other duties as prescribed by the
273273 attorney general. Assistants shall act for and exercise the power of the
274274 attorney general to the extent the attorney general delegates them the
275275 authority to do so.
276276 (b) (1) The attorney general shall appoint a chief information security
277277 officer who shall be responsible for establishing security standards and
278278 policies to protect the office's information technology systems and
279279 infrastructure. The chief information security officer shall:
280280 (A)(1) Develop a cybersecurity program for the office that complies
281281 with the national institute of standards and technology cybersecurity
282282 framework (CSF) 2.0, as in effect on July 1, 2024. The chief information
283283 security officer shall ensure that such programs achieve a CSF tier of 3.0
284284 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030;
285285 (B)(2) ensure that the attorney general and all employees complete
286286 cybersecurity awareness training annually and that if an employee does not
287287 complete the required training, such employee's access to any state-issued
288288 hardware or the state network is revoked; and
289289 (C) (i) (a)(3) (A) (i) coordinate with the United States cybersecurity
290290 1
291291 2
292292 3
293293 4
294294 5
295295 6
296296 7
297297 8
298298 9
299299 10
300300 11
301301 12
302302 13
303303 14
304304 15
305305 16
306306 17
307307 18
308308 19
309309 20
310310 21
311311 22
312312 23
313313 24
314314 25
315315 26
316316 27
317317 28
318318 29
319319 30
320320 31
321321 32
322322 33
323323 34
324324 35
325325 36
326326 37
327327 38
328328 39
329329 40
330330 41
331331 42
332332 43 HB 2271 5
333333 and infrastructure security agency to perform annual audits of the office
334334 for compliance with applicable state and federal laws, rules and
335335 regulations and office policies and standards; and
336336 (b)(ii) make an audit request to such agency annually, regardless of
337337 whether or not such agency has the capacity to perform the requested
338338 audit.
339339 (ii)(B) Results of audits conducted pursuant to this paragraph shall be
340340 confidential and shall not be subject to discovery or disclosure pursuant to
341341 the open records act, K.S.A. 45-215 et seq., and amendments thereto.
342342 (2) The provisions of this subsection shall expire on July 1, 2026.
343343 Sec. 5. K.S.A. 2024 Supp. 75-711 is hereby amended to read as
344344 follows: 75-711. (a) There is hereby established, under the jurisdiction of
345345 the attorney general, a division to be known as the Kansas bureau of
346346 investigation. The director of the bureau shall be appointed by the attorney
347347 general, subject to confirmation by the senate as provided in K.S.A. 75-
348348 4315b, and amendments thereto, and shall have special training and
349349 qualifications for such position. Except as provided by K.S.A. 46-2601,
350350 and amendments thereto, no person appointed as director shall exercise
351351 any power, duty or function as director until confirmed by the senate. In
352352 accordance with appropriation acts, the director shall appoint agents who
353353 shall be trained in the detection and apprehension of criminals. The
354354 director shall appoint an associate director, and any such assistant directors
355355 from within the agency as are necessary for the efficient operation of the
356356 bureau, who shall have the qualifications and employee benefits, including
357357 longevity, of an agent. The director also may appoint a deputy director
358358 and, in accordance with appropriation acts, such administrative employees
359359 as are necessary for the efficient operation of the bureau. No person shall
360360 be appointed to a position within the Kansas bureau of investigation if the
361361 person has been convicted of a felony.
362362 (b) The director, associate director, deputy director, assistant directors
363363 and any assistant attorneys general assigned to the bureau shall be within
364364 the unclassified service under the Kansas civil service act. All other agents
365365 and employees of the bureau shall be in the classified service under the
366366 Kansas civil service act and their compensation shall be determined as
367367 provided in the Kansas civil service act and shall receive actual and
368368 necessary expenses.
369369 (c) Any person who was a member of the bureau at the time of
370370 appointment as director, associate director or assistant director, upon the
371371 expiration of their appointment, shall be returned to an unclassified or
372372 regular classified position under the Kansas civil service act with
373373 compensation comparable to and not lower than compensation being
374374 received at the time of appointment to the unclassified service. If all such
375375 possible positions are filled at that time, a temporary additional position
376376 1
377377 2
378378 3
379379 4
380380 5
381381 6
382382 7
383383 8
384384 9
385385 10
386386 11
387387 12
388388 13
389389 14
390390 15
391391 16
392392 17
393393 18
394394 19
395395 20
396396 21
397397 22
398398 23
399399 24
400400 25
401401 26
402402 27
403403 28
404404 29
405405 30
406406 31
407407 32
408408 33
409409 34
410410 35
411411 36
412412 37
413413 38
414414 39
415415 40
416416 41
417417 42
418418 43 HB 2271 6
419419 shall be created for the person until a vacancy exists in the position. While
420420 serving in the temporary additional position, the person shall continue to
421421 be a contributing member of the retirement system for the agents of the
422422 Kansas bureau of investigation.
423423 (d) Each agent of the bureau shall subscribe to an oath to faithfully
424424 discharge the duties of such agent's office, as is required of other public
425425 officials.
426426 (e) (1) The director shall appoint a chief information security officer
427427 who shall be responsible for establishing security standards and policies to
428428 protect the bureau's information technology systems and infrastructure.
429429 The chief information security officer shall:
430430 (A)(1) Develop a cybersecurity program for the bureau that complies
431431 with the national institute of standards and technology cybersecurity
432432 framework (CSF) 2.0, as in effect on July 1, 2024. The chief information
433433 security officer shall ensure that such programs achieve a CSF tier of 3.0
434434 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030;
435435 (B)(2) ensure that the director and all employees complete
436436 cybersecurity awareness training annually and that if an employee does not
437437 complete the required training, such employee's access to any state-issued
438438 hardware or the state network is revoked; and
439439 (C) (i) (a)(3) (A) (i) coordinate with the United States cybersecurity
440440 and infrastructure security agency to perform annual audits of the
441441 department for compliance with applicable state and federal laws, rules
442442 and regulations and department policies and standards; and
443443 (b)(ii) make an audit request to such agency annually, regardless of
444444 whether or not such agency has the capacity to perform the requested
445445 audit.
446446 (ii)(B) Results of audits conducted pursuant to this paragraph shall be
447447 confidential and shall not be subject to discovery or disclosure pursuant to
448448 the open records act, K.S.A. 45-215 et seq., and amendments thereto.
449449 (2) The provisions of this subsection shall expire on July 1, 2026.
450450 Sec. 6. K.S.A. 75-7203 is hereby amended to read as follows: 75-
451451 7203. (a) The information technology executive council is hereby
452452 authorized to adopt such policies and rules and regulations as necessary to
453453 implement, administer and enforce the provisions of this act.
454454 (b) The council shall:
455455 (1) Adopt:
456456 (A) Information technology resource policies and procedures and
457457 project management methodologies for all executive branch agencies;
458458 (B) an information technology architecture, including
459459 telecommunications systems, networks and equipment, that covers all state
460460 agencies;
461461 (C) standards for data management for all executive branch agencies;
462462 1
463463 2
464464 3
465465 4
466466 5
467467 6
468468 7
469469 8
470470 9
471471 10
472472 11
473473 12
474474 13
475475 14
476476 15
477477 16
478478 17
479479 18
480480 19
481481 20
482482 21
483483 22
484484 23
485485 24
486486 25
487487 26
488488 27
489489 28
490490 29
491491 30
492492 31
493493 32
494494 33
495495 34
496496 35
497497 36
498498 37
499499 38
500500 39
501501 40
502502 41
503503 42
504504 43 HB 2271 7
505505 and
506506 (D) a strategic information technology management plan for the
507507 executive branch;
508508 (2) provide direction and coordination for the application of the
509509 executive branch's information technology resources;
510510 (3) designate the ownership of information resource processes and the
511511 lead executive branch agency for implementation of new technologies and
512512 networks shared by multiple agencies within the executive branch of state
513513 government;
514514 (4) develop a plan to integrate all information technology services for
515515 the executive branch into the office of information technology services and
516516 all cybersecurity services for state educational institutions as defined in
517517 K.S.A. 76-711, and amendments thereto, into the office of information
518518 technology services and the Kansas information security office; and 
519519 (5) perform such other functions and duties as necessary to carry out
520520 the provisions of this act.
521521 (c) The information technology executive council shall report the
522522 plan developed under subsection (b)(4) to the senate standing committee
523523 on ways and means and, the house standing committee on legislative
524524 modernization or its successor committee and the joint committee on
525525 information technology prior to January 15, 2026, in accordance with
526526 K.S.A. 2024 Supp. 75-7245, and amendments thereto.
527527 Sec. 7. K.S.A. 2024 Supp. 75-7206a is hereby amended to read as
528528 follows: 75-7206a. (a) There is hereby established the position of judicial
529529 branch chief information security officer. The judicial chief information
530530 security officer shall be in the unclassified service under the Kansas civil
531531 service act, shall be appointed by the judicial administrator, subject to
532532 approval by the chief justice and shall receive compensation determined
533533 by the judicial administrator, subject to approval of the chief justice.
534534 (b) The judicial chief information security officer shall:
535535 (1) Report to the judicial administrator;
536536 (2) establish security standards and policies to protect the branch's
537537 information technology systems and infrastructure in accordance with
538538 subsection (c);
539539 (3) ensure the confidentiality, availability and integrity of the
540540 information transacted, stored or processed in the branch's information
541541 technology systems and infrastructure;
542542 (4) develop a centralized cybersecurity protocol for protecting and
543543 managing judicial branch information technology assets and infrastructure;
544544 (5) detect and respond to security incidents consistent with
545545 information security standards and policies;
546546 (6) be responsible for the cybersecurity of all judicial branch data and
547547 information resources;
548548 1
549549 2
550550 3
551551 4
552552 5
553553 6
554554 7
555555 8
556556 9
557557 10
558558 11
559559 12
560560 13
561561 14
562562 15
563563 16
564564 17
565565 18
566566 19
567567 20
568568 21
569569 22
570570 23
571571 24
572572 25
573573 26
574574 27
575575 28
576576 29
577577 30
578578 31
579579 32
580580 33
581581 34
582582 35
583583 36
584584 37
585585 38
586586 39
587587 40
588588 41
589589 42
590590 43 HB 2271 8
591591 (7) collaborate with the chief information security officers of the
592592 other branches of state government to respond to cybersecurity incidents;
593593 (8) ensure that all justices, judges and judicial branch employees
594594 complete cybersecurity awareness training annually and if an employee
595595 does not complete the required training, such employee's access to any
596596 state-issued hardware or the state network is revoked;
597597 (9) review all contracts related to information technology entered into
598598 by a person or entity within the judicial branch to make efforts to reduce
599599 the risk of security vulnerabilities within the supply chain or product and
600600 ensure each contract contains standard security language; and
601601 (10) coordinate with the United States cybersecurity and
602602 infrastructure security agency to perform annual audits of judicial branch
603603 agencies for compliance with applicable state and federal laws, rules and
604604 regulations and judicial branch policies and standards. The judicial chief
605605 information security officer shall make an audit request to such agency
606606 annually, regardless of whether or not such agency has the capacity to
607607 perform the requested audit.
608608 (c) The judicial chief information security officer shall develop a
609609 cybersecurity program of each judicial agency that complies with the
610610 national institute of standards and technology cybersecurity framework
611611 (CSF) 2.0, as in effect on July 1, 2024. The judicial chief information
612612 security officer shall ensure that such programs achieve a CSF tier of 3.0
613613 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030.
614614 (d) (1) If an audit conducted pursuant to subsection (b)(10) results in
615615 a failure, the judicial chief information security officer shall report such
616616 failure to the speaker and minority leader of the house of representatives
617617 and the president and minority leader of the senate within 30 days of
618618 receiving notice of such failure. Such report shall contain a plan to
619619 mitigate any security risks identified in the audit. The judicial chief
620620 information security officer shall coordinate for an additional audit after
621621 the mitigation plan is implemented and report the results of such audit to
622622 the speaker and minority leader of the house of representatives and the
623623 president and minority leader of the senate.
624624 (2) Results of audits conducted pursuant to subsection (b)(10) and the
625625 reports described in subsection (d)(1) shall be confidential and shall not be
626626 subject to discovery or disclosure pursuant to the open records act, K.S.A.
627627 45-215 et seq., and amendments thereto.
628628 (e) This section shall expire on July 1, 2026.
629629 Sec. 8. K.S.A. 2024 Supp. 75-7208a is hereby amended to read as
630630 follows: 75-7208a. (a) There is hereby established the position of
631631 legislative branch chief information security officer. The legislative chief
632632 information security officer shall be in the unclassified service under the
633633 Kansas civil service act, shall be appointed by the legislative coordinating
634634 1
635635 2
636636 3
637637 4
638638 5
639639 6
640640 7
641641 8
642642 9
643643 10
644644 11
645645 12
646646 13
647647 14
648648 15
649649 16
650650 17
651651 18
652652 19
653653 20
654654 21
655655 22
656656 23
657657 24
658658 25
659659 26
660660 27
661661 28
662662 29
663663 30
664664 31
665665 32
666666 33
667667 34
668668 35
669669 36
670670 37
671671 38
672672 39
673673 40
674674 41
675675 42
676676 43 HB 2271 9
677677 council and shall receive compensation determined by the legislative
678678 coordinating council.
679679 (b) The legislative chief information security officer shall:
680680 (1) Report to the legislative chief information technology officer;
681681 (2) establish security standards and policies to protect the branch's
682682 information technology systems and infrastructure in accordance with
683683 subsection (c);
684684 (3) ensure the confidentiality, availability and integrity of the
685685 information transacted, stored or processed in the branch's information
686686 technology systems and infrastructure;
687687 (4) develop a centralized cybersecurity protocol for protecting and
688688 managing legislative branch information technology assets and
689689 infrastructure;
690690 (5) detect and respond to security incidents consistent with
691691 information security standards and policies;
692692 (6) be responsible for the cybersecurity of all legislative branch data
693693 and information resources and obtain approval from the revisor of statutes
694694 prior to taking any action on any matter that involves a legal issue related
695695 to the security of information technology;
696696 (7) collaborate with the chief information security officers of the
697697 other branches of state government to respond to cybersecurity incidents;
698698 (8) ensure that all legislators and legislative branch employees
699699 complete cybersecurity awareness training annually and if an employee
700700 does not complete the required training, such employee's access to any
701701 state-issued hardware or the state network is revoked;
702702 (9) review all contracts related to information technology entered into
703703 by a person or entity within the legislative branch to make efforts to reduce
704704 the risk of security vulnerabilities within the supply chain or product and
705705 ensure each contract contains standard security language; and
706706 (10) coordinate with the United States cybersecurity and
707707 infrastructure security agency to perform annual audits of legislative
708708 branch agencies for compliance with applicable state and federal laws,
709709 rules and regulations and legislative branch policies and standards. The
710710 legislative chief information security officer shall make an audit request to
711711 such agency annually, regardless of whether or not such agency has the
712712 capacity to perform the requested audit.
713713 (c) The legislative chief information security officer shall develop a
714714 cybersecurity program of each legislative agency that complies with the
715715 national institute of standards and technology cybersecurity framework
716716 (CSF) 2.0, as in effect on July 1, 2024. The legislative chief information
717717 security officer shall ensure that such programs achieve a CSF tier of 3.0
718718 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030. The
719719 agency head of each legislative agency shall coordinate with the legislative
720720 1
721721 2
722722 3
723723 4
724724 5
725725 6
726726 7
727727 8
728728 9
729729 10
730730 11
731731 12
732732 13
733733 14
734734 15
735735 16
736736 17
737737 18
738738 19
739739 20
740740 21
741741 22
742742 23
743743 24
744744 25
745745 26
746746 27
747747 28
748748 29
749749 30
750750 31
751751 32
752752 33
753753 34
754754 35
755755 36
756756 37
757757 38
758758 39
759759 40
760760 41
761761 42
762762 43 HB 2271 10
763763 chief information security officer to achieve such standards.
764764 (d) (1) If an audit conducted pursuant to subsection (b)(10) results in
765765 a failure, the legislative chief information security officer shall report such
766766 failure to the speaker and minority leader of the house of representatives
767767 and the president and minority leader of the senate within 30 days of
768768 receiving notice of such failure. Such report shall contain a plan to
769769 mitigate any security risks identified in the audit. The legislative chief
770770 information security officer shall coordinate for an additional audit after
771771 the mitigation plan is implemented and report the results of such audit to
772772 the speaker and minority leader of the house of representatives and the
773773 president and minority leader of the senate.
774774 (2) Results of audits conducted pursuant to subsection (b)(10) and the
775775 reports described in subsection (d)(1) shall be confidential and shall not be
776776 subject to discovery or disclosure pursuant to the open records act, K.S.A.
777777 45-215 et seq., and amendments thereto.
778778 (e) This section shall expire on July 1, 2026.
779779 Sec. 9. K.S.A. 2024 Supp. 75-7245 is hereby amended to read as
780780 follows: 75-7245. (a) On and after July 1, 2027, all cybersecurity services
781781 for each branch of state government shall be administered by the chief
782782 information technology officer and the chief information security officer of
783783 such branch. All cybersecurity employees within the legislative and
784784 executive branches of state government shall work at the direction of the
785785 chief information technology officer of the branch.
786786 (b) Prior to January 1, 2026:
787787 (1) The information technology executive council shall develop a
788788 plan to integrate all executive branch information technology services into
789789 the office of information technology services. The council shall consult
790790 with each agency head when developing such plan.
791791 (2) The judicial chief information technology officer shall develop an
792792 estimated project cost to provide information technology to judicial
793793 agencies and all employees of such agencies, including state and county-
794794 funded judicial branch district court employees. Such employees shall be
795795 required to use such state-issued information technology hardware. The
796796 project cost developed pursuant to this paragraph shall include, in
797797 consultation with the executive branch information technology officer, a
798798 plan to allow each piece of information technology hardware that is used
799799 by a judicial branch employee to access a judicial branch application to
800800 have access to the KANWIN network and an estimated project cost to
801801 develop a cybersecurity program for all judicial districts that complies
802802 with the national institute of standards and technology cybersecurity
803803 framework (CSF) 2.0, as in effect on July 1, 2024.
804804 (c) The information technology executive council shall report the
805805 plan developed pursuant to subsection (b) to the senate standing committee
806806 1
807807 2
808808 3
809809 4
810810 5
811811 6
812812 7
813813 8
814814 9
815815 10
816816 11
817817 12
818818 13
819819 14
820820 15
821821 16
822822 17
823823 18
824824 19
825825 20
826826 21
827827 22
828828 23
829829 24
830830 25
831831 26
832832 27
833833 28
834834 29
835835 30
836836 31
837837 32
838838 33
839839 34
840840 35
841841 36
842842 37
843843 38
844844 39
845845 40
846846 41
847847 42
848848 43 HB 2271 11
849849 on ways and means and, the house standing committee on legislative
850850 modernization or its successor committee and the joint committee on
851851 information technology, prior to January 15, 2026.
852852 (d) Prior to February 1, 2025, every website that is maintained by a
853853 branch of government or state agency shall be moved to a ".gov" domain.
854854 (e) On July 1, 2025, and each year thereafter, moneys appropriated
855855 from the state general fund to or any special revenue fund of any state
856856 agency for information technology and cybersecurity expenditures shall be
857857 appropriated as a separate line item and shall not be merged with other
858858 items of appropriation for such state agency to allow for detailed review
859859 by the senate committee on ways and means and the house of
860860 representatives committee on appropriations during each regular
861861 legislative session.
862862 (f) The provisions of this section do not apply to state educational
863863 institutions as defined in K.S.A. 76-711, and amendments thereto.
864864 (g) This section shall expire on July 1, 2026.
865865 Sec. 10. K.S.A. 2024 Supp. 75-7246 is hereby amended to read as
866866 follows: 75-7246. (a) On July 1, 2028, and each year thereafter, the
867867 director of the budget, in consultation with the legislative, executive and
868868 judicial chief information technology officers as appropriate, shall
869869 determine if each state agency is in compliance with the provisions of this
870870 act* for the previous fiscal year. If the director of the budget determines
871871 that a state agency is not in compliance with the provisions of this act for
872872 such fiscal year, the director shall certify an amount equal to 5% of the
873873 amount:
874874 (1) Appropriated and reappropriated from the state general fund for
875875 such state agency for such fiscal year; and
876876 (2) credited to and available in each special revenue fund for such
877877 state agency in such fiscal year. If during any fiscal year, a special revenue
878878 fund has no expenditure limitation, then an expenditure limitation shall be
879879 established for such fiscal year on such special revenue fund by the
880880 director of the budget in an amount that is 5% less than the amount of
881881 moneys credited to and available in such special revenue fund for such
882882 fiscal year.
883883 (b) The director of the budget shall submit a detailed written report to
884884 the legislature on or before the first day of the regular session of the
885885 legislature concerning such compliance determinations, including factors
886886 considered by the director when making such determination, and the
887887 amounts certified for each state agency for such fiscal year.
888888 (c) During the regular session of the legislature, the senate committee
889889 on ways and means and the house of representatives committee on
890890 appropriations shall consider such compliance determinations and whether
891891 to lapse amounts appropriated and reappropriated and decrease the
892892 1
893893 2
894894 3
895895 4
896896 5
897897 6
898898 7
899899 8
900900 9
901901 10
902902 11
903903 12
904904 13
905905 14
906906 15
907907 16
908908 17
909909 18
910910 19
911911 20
912912 21
913913 22
914914 23
915915 24
916916 25
917917 26
918918 27
919919 28
920920 29
921921 30
922922 31
923923 32
924924 33
925925 34
926926 35
927927 36
928928 37
929929 38
930930 39
931931 40
932932 41
933933 42
934934 43 HB 2271 12
935935 expenditure limitations of special revenue funds for such state agencies
936936 during the budget committee hearings for such noncomplying agency.
937937 (d) This section shall expire on July 1, 2026.
938938 Sec. 11. K.S.A. 2024 Supp. 40-110, 45-229, as amended by section
939939 11 of chapter 95 of the 2024 Session Laws of Kansas, 75-413, 75-623, 75-
940940 710, 75-711, 75-7201, as amended by section 17 of chapter 95 of the 2024
941941 Session Laws of Kansas, 75-7202, as amended by section 19 of chapter 95
942942 of the 2024 Session Laws of Kansas, 75-7203, 75-7203, as amended by
943943 section 21 of chapter 95 of the 2024 Session Laws of Kansas, 75-7205, as
944944 amended by section 23 of chapter 95 of the 2024 Session Laws of Kansas,
945945 75-7206, as amended by section 25 of chapter 95 of the 2024 Session
946946 Laws of Kansas, 75-7206a, 75-7208, as amended by section 27 of chapter
947947 95 of the 2024 Session Laws of Kansas, 75-7208a, 75-7209, as amended
948948 by section 29 of chapter 95 of the 2024 Session Laws of Kansas, 75-7237,
949949 as amended by section 31 of chapter 95 of the 2024 Session Laws of
950950 Kansas, 75-7238, as amended by section 33 of chapter 95 of the 2024
951951 Session Laws of Kansas, 75-7239, as amended by section 35 of chapter 95
952952 of the 2024 Session Laws of Kansas, 75-7240, as amended by section 37
953953 of chapter 95 of the 2024 Session Laws of Kansas, 75-7245 and 75-7246
954954 are hereby repealed.
955955 Sec. 12. This act shall take effect and be in force from and after its
956956 publication in the statute book.
957957 1
958958 2
959959 3
960960 4
961961 5
962962 6
963963 7
964964 8
965965 9
966966 10
967967 11
968968 12
969969 13
970970 14
971971 15
972972 16
973973 17
974974 18
975975 19
976976 20
977977 21
978978 22