Bill Commons

CO SB 185

enacted

Enhance Security of Office of Information Technology

Colorado · 2026 Regular Session · upper

Follow this bill’s action updates (Atom)

Subscribe in a feed reader. The feed covers recorded actions from the last 30 days; Bill Commons may record an action after it happened at the legislature.

Quick answers

Did CO SB 185 pass?

Yes. CO SB 185 has been enacted into law. Latest recorded action (2026-05-01): Introduced In Senate - Assigned to Business, Labor, & Technology

What is CO SB 185 about?

The act allows the joint technology committee (JTC), within 90 days after the day that the chief information security officer of the office of information technology (security officer) files a written information technology security compliance report (compliance report) with the JTC as required by the act, to vote to request that the legislative audit committee direct the state auditor to conduct a special information technology security audit (IT security audit) of the office of information technology (OIT) if the compliance report indicates that one or more audit recommendations made by the state auditor is unresolved 2 or more years past the implementation date for the audit recommendation or if a material discrepancy exists between a representation in the compliance report and a previous audit finding.     If the JTC votes to request an IT security audit and if the legislative audit committee votes to direct the audit, the act requires:The state auditor to conduct the IT security audit;The state auditor to obtain input from OIT when the state auditor determines the scope and boundaries of the audit;The state auditor to submit the IT security audit report to the legislative audit committee, the JTC, the joint budget committee, and the governor; andOIT to reimburse the state auditor for the auditor's costs incurred in completing the IT security audit.     The act requires OIT to establish, maintain, keep, update, and make available to state agency information technology leadership and the members of the JTC a list of all active information technology vendor contracts for state agencies.     The act specifies that, except in the case of an information technology security emergency, OIT shall not publish or implement a technical information technology standard, and that the standard is void, unless the standard:Was publicly posted; andReceived approval from the security officer if the standard relates to security, access controls, or the handling of data.     The act requires OIT to ensure that, if an information technology contract provides ongoing service and delivery to Coloradans, the contract maintains current architecture diagrams that are updated at least annually.     The act prohibits the chief information officer from delegating a duty, responsibility, or power of the security officer.     The act requires the security officer to submit 2 annual reports to the JTC. The first report is a written compliance report that includes OIT's current compliance status with applicable security standards; all open audit recommendations regarding OIT made by the state auditor and the date on which each recommendation was made; and a timeline for remediation and a mitigation plan or compensation controls for each open audit recommendation made by the state auditor.     The second report is a written statewide information technology security risk report (security risk report) that assesses the overall security risk posture of state agency information technology systems. To support the preparation of the security risk report, the security officer may conduct evaluations of state agency information technology systems, including penetration testing, vulnerability scanning, configuration evaluations, and vendor and system reviews. Each state agency shall provide to the security officer, upon request, the access and information necessary to conduct evaluations of state agency technology systems, including system access, product information, and architecture information.     The act requires the security officer, or the chief information officer if the security officer is unavailable, to perform the duties and uphold the responsibilities assigned to the security officer pursuant to law.(Note: This summary applies to this bill as enacted.)

Who sponsors CO SB 185?

A. Paschal, B. Titone, R. Keltie and 2 others are the primary sponsors of CO SB 185, joined by 7 cosponsors.

Description

The act allows the joint technology committee (JTC), within 90 days after the day that the chief information security officer of the office of information technology (security officer) files a written information technology security compliance report (compliance report) with the JTC as required by the act, to vote to request that the legislative audit committee direct the state auditor to conduct a special information technology security audit (IT security audit) of the office of information technology (OIT) if the compliance report indicates that one or more audit recommendations made by the state auditor is unresolved 2 or more years past the implementation date for the audit recommendation or if a material discrepancy exists between a representation in the compliance report and a previous audit finding.     If the JTC votes to request an IT security audit and if the legislative audit committee votes to direct the audit, the act requires:The state auditor to conduct the IT security audit;The state auditor to obtain input from OIT when the state auditor determines the scope and boundaries of the audit;The state auditor to submit the IT security audit report to the legislative audit committee, the JTC, the joint budget committee, and the governor; andOIT to reimburse the state auditor for the auditor's costs incurred in completing the IT security audit.     The act requires OIT to establish, maintain, keep, update, and make available to state agency information technology leadership and the members of the JTC a list of all active information technology vendor contracts for state agencies.     The act specifies that, except in the case of an information technology security emergency, OIT shall not publish or implement a technical information technology standard, and that the standard is void, unless the standard:Was publicly posted; andReceived approval from the security officer if the standard relates to security, access controls, or the handling of data.     The act requires OIT to ensure that, if an information technology contract provides ongoing service and delivery to Coloradans, the contract maintains current architecture diagrams that are updated at least annually.     The act prohibits the chief information officer from delegating a duty, responsibility, or power of the security officer.     The act requires the security officer to submit 2 annual reports to the JTC. The first report is a written compliance report that includes OIT's current compliance status with applicable security standards; all open audit recommendations regarding OIT made by the state auditor and the date on which each recommendation was made; and a timeline for remediation and a mitigation plan or compensation controls for each open audit recommendation made by the state auditor.     The second report is a written statewide information technology security risk report (security risk report) that assesses the overall security risk posture of state agency information technology systems. To support the preparation of the security risk report, the security officer may conduct evaluations of state agency information technology systems, including penetration testing, vulnerability scanning, configuration evaluations, and vendor and system reviews. Each state agency shall provide to the security officer, upon request, the access and information necessary to conduct evaluations of state agency technology systems, including system access, product information, and architecture information.     The act requires the security officer, or the chief information officer if the security officer is unavailable, to perform the duties and uphold the responsibilities assigned to the security officer pursuant to law.(Note: This summary applies to this bill as enacted.)

Introduced
2026-05-01
Latest action
2026-05-01 — Introduced In Senate - Assigned to Business, Labor, & Technology
Bill type
bill
Last updated
—

Subjects

Sponsors

  • A. Paschalsponsor
  • B. Titonesponsor
  • R. Keltiesponsor
  • J. Marchmansponsor
  • M. Baisleysponsor
  • J. Baconcosponsor
  • M. Rutinelcosponsor
  • J. Colemancosponsor
  • B. Marshallcosponsor
  • J. Jacksoncosponsor
  • C. Cliffordcosponsor
  • M. Cartercosponsor

Committees

Not provided by source.

Action timeline

Newest first

  1. 2026-06-02

    Governor Signed

    executive-signature

  2. 2026-05-22

    Signed by the President of the Senate

    passage

  3. 2026-05-22

    Signed by the Speaker of the House

    passage

  4. 2026-05-22

    Sent to the Governor

    executive-receipt

  5. 2026-05-13

    House Third Reading Passed - No Amendments

    passage,reading-3

  6. 2026-05-12

    House Committee on Appropriations Refer Unamended to House Committee of the Whole

    committee-passage,referral-committee

  7. 2026-05-12

    House Second Reading Special Order - Passed - No Amendments

  8. 2026-05-09

    House Committee on State, Civic, Military, & Veterans Affairs Refer Unamended to Appropriations

    referral-committee

  9. 2026-05-08

    Senate Third Reading Passed - No Amendments

    passage,reading-3

  10. 2026-05-08

    Introduced In House - Assigned to State, Civic, Military, & Veterans Affairs

    introduction

  11. 2026-05-07

    Senate Committee on Appropriations Refer Unamended - Consent Calendar to Senate Committee of the Whole

    committee-passage

  12. 2026-05-07

    Senate Second Reading Special Order - Passed with Amendments - Committee

  13. 2026-05-05

    Senate Committee on Business, Labor, & Technology Refer Amended to Appropriations

    referral-committee

  14. 2026-05-01

    Introduced In Senate - Assigned to Business, Labor, & Technology

    introduction

Versions

Documents

Votes

  • Adopt amendment L.001

    2026-05-05 · pass · 0-0

  • Refer Senate Bill 26-185, as amended, to the Committee on Appropriations.

    2026-05-05 · pass · 0-0

    Member-level votes (5)
    • Marc Catlin: yes
    • Iman Jodeh: yes
    • Larry Liston: yes
    • Nick Hinrichsen: yes
    • Jessie Danielson: yes

  • Refer Senate Bill 26-185 to the Committee of the Whole and with a recommendation that it be placed on the consent calendar.

    2026-05-07 · pass · 0-0

    Member-level votes (7)
    • Julie Gonzales: yes
    • Barbara Kirkmeyer: yes
    • Chris Kolker: yes
    • Larry Liston: yes
    • Byron Pelton: yes
    • Jeff Bridges: yes
    • Judy Amabile: yes

  • Refer Senate Bill 26-185 to the Committee on Appropriations.

    2026-05-09 · pass · 0-0

    Member-level votes (11)
    • Brandi Bradley: yes
    • Michael Carter: yes
    • Ken DeGraaf: yes
    • Cecelia Espenoza: yes
    • Lisa Feret: yes
    • Meg Froelich: yes
    • Stephanie Luck: yes
    • Kenny Nguyen: yes
    • Naquetta Ricks: yes
    • Chad Clifford: yes
    • Jenny Willford: yes

  • Refer Senate Bill 26-185 to the Committee of the Whole.

    2026-05-12 · pass · 0-0

    Member-level votes (11)
    • Andrew Boesenecker: yes
    • Scott Bottoms: yes
    • Junie Joseph: yes
    • Karen McCormick: yes
    • Matt Soper: yes
    • Rick Taggart: yes
    • Brianna Titone: yes
    • Elizabeth Velasco: yes
    • Yara Zokaie: excused
    • Emily Sirota: yes
    • Kyle Brown: yes

  • BILL

    2026-05-13 · pass · 0-0

    Member-level votes (65)
    • Bacon: yes
    • Barron: yes
    • Boesenecker: yes
    • Bottoms: yes
    • Bradfield: yes
    • Bradley: yes
    • Brooks: yes
    • Brown: yes
    • Caldwell: yes
    • Camacho: yes
    • Carter: yes
    • Clifford: yes
    • DeGraaf: yes
    • Duran: yes
    • English: yes
    • Espenoza: yes
    • Feret: yes
    • Flanell: yes
    • Froelich: yes
    • Garcia: yes
    • Garcia Sander: yes
    • Gilchrist: yes
    • Goldstein: yes
    • Gonzalez R.: no
    • Hamrick: yes
    • Hartsook: yes
    • Jackson: yes
    • Johnson: yes
    • Joseph: yes
    • Keltie: yes
    • Lieder: yes
    • Lindsay: yes
    • Luck: yes
    • Lukens: yes
    • Mabrey: yes
    • Marshall: yes
    • Martinez: yes
    • Mauro: yes
    • McCormick: yes
    • Nguyen: yes
    • Paschal: yes
    • Phillips: yes
    • Richardson: yes
    • Ricks: yes
    • Rutinel: yes
    • Rydin: yes
    • Sirota: yes
    • Slaugh: yes
    • Smith: yes
    • Soper: yes
    • Stewart K.: yes
    • Stewart R.: yes
    • Story: yes
    • Suckla: yes
    • Taggart: yes
    • Titone: yes
    • Valdez: yes
    • Velasco: yes
    • Weinberg: yes
    • Willford: yes
    • Winter T.: yes
    • Woodrow: yes
    • Woog: yes
    • Zokaie: yes
    • McCluskie: yes

Related bills

No related bills recorded for this bill.

Official source

https://leg.colorado.gov/bills/SB26-185

Attribution

Data from openstates_api_sync, retrieved 2026-08-08T01:57:41.193191Z

Inspect retained evidence for changes recorded after evidence tracking began:

Source and document changesStatus and relationship changes

Session-wide evidence can include changes to other bills:

Bulk imports for this sessionSession dates and activity

Use this data

Every field on this page is available from the free public API — no key or licence required. Fetch this bill as JSON: GET /api/v1/bills?jurisdiction=CO&identifier=SB 185. See the API docs or the MCP server for AI assistants.

Known limitations

  • Sponsor party and chamber affiliation are not yet captured by this API.
  • Committee referrals are not yet captured.
  • Some documents have no extracted text yet, so version comparison may be limited.

See the methodology page for data sources and limitations.