Office of Information Technology

C.R.S. tit. 24, art. 37.5
in effect

C.R.S. § 24-37.5-101 Legislative declaration - findings

24-37.5-101. Legislative declaration - findings. (1) The general assembly hereby finds and declares that: (a) Communication and information resources in the various agencies of state government are valuable strategic assets belonging to the people of Colorado that must be managed accordingly; (a.5) It is imperative that the long-term sustainability and eventual retirement of information technology systems be considered when initiating a major information technology project and that project plans include the various components that will result in project success; (b) Technological and theoretical advances in the area of communication and information use are recent in origin, immense in scope and complexity, and progressing rapidly; (c) The nature of these advances presents Colorado with the opportunity to provide higher quality, more timely, and more cost-effective governmental services; (d) Agencies independently acquire uncoordinated and duplicative information resource technologies that are more appropriately acquired as part of a coordinated effort for maximum cost effectiveness and use; (e) The sharing of communication and information resource technologies among agencies is often the most cost-effective method of providing the highest quality and most timely governmental services that would otherwise be cost prohibitive; (f) Considerations of both cost and the need for the transfer of information among the various agencies and branches of state government in the most timely and useful form possible require a uniform policy and coordinated system for the use and acquisition of communication and information resource technologies; and (g) It is the policy of this state to coordinate and direct the use of communication and information resources technologies by state agencies and to provide as soon as possible the most cost-effective and useful retrieval and exchange of information both within and among the various state agencies and branches of government and from the state agencies and branches of government to the people of Colorado. To that end, the office of information technology is created.

C.R.S. § 24-37.5-102 Definitions

24-37.5-102. Definitions. As used in this article 37.5, unless the context otherwise requires: (1) "Advisory board" means the government data advisory board created in section 24-37.5-702. (2) "Availability" means the timely and reliable access to and use of information created, generated, collected, or maintained by a public agency. (3) "Chief information officer" means the chief information officer appointed pursuant to section 24-37.5-103. (4) "Confidentiality" means the preservation of authorized restrictions on information access and disclosure, including the means for protecting personal privacy and proprietary information. (5) "Data" means facts that can be collected, analyzed, or used in an effort to gain knowledge or make decisions, and that are represented as texts, numbers, graphics, images, sounds, and videos. (6) "Data management" means development and execution of architectures, policies, practices, and procedures that properly manage the creation, collection, protection, sharing, analysis, transmission, storage, and destruction of data. (7) "Department of higher education" means the Colorado commission on higher education, collegeinvest, the Colorado student loan program, the Colorado college access network, the private occupational school division, and the state historical society. (8) "Disaster recovery" means the provisioning of the office's provided services for operational recovery, readiness, response, and transition of information technology applications, systems, or resources. (9) "Enterprise" means: (a) Information technology services that can be applied across state government; and (b) Support for information technology that can be applied across state government, including: (I) Technical support; (II) Software; (III) Hardware; (IV) People; and (V) Standards. (10) "Information security" means the protection of communication and information resources from unauthorized access, use, disclosure, disruption, modification, or destruction in order to: (a) Protect against theft or misappropriation of information, as well as improper access, modification, degradation, or destruction of information; (b) Preserve authorized restrictions on information access and disclosure; (c) Ensure timely and reliable access to and use of information; and (d) Maintain the confidentiality, integrity, and availability of information. (11) "Information security plan" means the plan developed by a public agency pursuant to section 24-37.5-404. (12) "Information technology" means technology, infrastructure, equipment, systems, software, controlling, displaying, switching, interchanging, transmitting, and receiving data or information, including audio, video, graphics, and text. "Information technology" shall be construed broadly to incorporate future technologies that change or supplant those in effect as of September 7, 2021. (13) "Infrastructure" means data and telecommunications networks, data center services, website hosting and portal services, and shared enterprise services such as email and directory services; except that "infrastructure" does not include the provision of website information architecture and content. (14) "Institution of higher education" means a state-supported institution of higher education. (15) "Integrity" means the prevention of improper information modification or destruction and ensuring information nonrepudiation and authenticity. (16) "Interdepartmental data protocol" means file sharing and governance policies, processes, and procedures that permit the merging of data for the purposes of policy analysis and determination of program effectiveness. (17) "Joint technology committee" means the joint technology committee created in section 2-3-1702. (18) "Local government" means the government of any county, city and county, home rule or statutory city, town, special district, or school district. policies, processes, and procedures that permit the merging of data for the purposes of policy analysis and determination of program effectiveness. (17) "Joint technology committee" means the joint technology committee created in section 2-3-1702. (18) "Local government" means the government of any county, city and county, home rule or statutory city, town, special district, or school district. (19) "Major information technology project" means a project that considers risk, impact on employees and citizens, and budget, and that includes at least one of the following: A complex set of challenges, a specific level of business criticality, a complex group or high number of stakeholders or system end users, a significant financial investment, or security or operational risk. A "major information technology project" includes, without limitation, implementing a new information technology system or maintaining or replacing an existing information technology system. (20) "Nongovernmental organization" means any scientific, research, professional, business, or public-interest organization that is neither affiliated with nor under the direction of the United States government or any state or local government. (21) "Office" means the office of information technology created pursuant to section 24-37.5-103. (22) "Personal identifying information" means any information that alone, or in combination with other information, can be used to identify an individual, including, but not limited to, social security number, driver's license number or other identification number, biometric data, personal health information as defined by the federal "Health Insurance Portability and Accountability Act of 1996", as amended, Pub.L. 104-191, and other information that is considered personal information or personally identifiable information as defined in law. (23) "Political subdivision" means a municipality, county, city and county, town, or school district in this state. (24) "Project management" means the application of knowledge, skills, tools, and techniques to support completing outcomes identified in the work. (25) "Project manager" means a person who is trained in the management of information technology projects and is responsible for organizing and leading the project team that accomplishes all of the project deliverables. (26) "Public agency" means every state office, whether executive or judicial, and all of its respective offices, departments, divisions, commissions, boards, bureaus, and institutions. "Public agency" does not include institutions of higher education or the general assembly. (27) "Security incident" means an accidental or deliberate event that results in or constitutes an imminent threat of the unauthorized access, loss, disclosure, modification, disruption, or destruction of communication and information resources. (28) "State agency" means all of the departments, divisions, commissions, boards, bureaus, and institutions in the executive branch of the state government. "State agency" does not include the legislative or judicial department, the department of education, the department of law, the department of state, the department of the treasury, or state-supported institutions of higher education. (29) "State information technology personnel" means any personnel whose employment is necessary to carry out the purposes of this article 37.5 by the chief information officer and to administer, perform, and enforce the powers, duties, and functions of the office.

C.R.S. § 24-37.5-103 Office of information technology - creation - information technology revolving fund - geographic information system coordination

24-37.5-103. Office of information technology - creation - information technology revolving fund - geographic information system coordination. (1) There is hereby created in the office of the governor an office of information technology, the head of which shall be the chief information officer, who shall be appointed by the governor and who shall serve at the pleasure of the governor. (2) For state fiscal year 2013-14 and for each state fiscal year thereafter, one hundred percent of the money appropriated by the general assembly from the information technology revolving fund established in section 24-37.5-112 (1)(a) shall be used to fund the office. (3) (a) There is hereby established in the state treasury the information technology revolving fund. Money shall be appropriated to the fund each year by the general assembly in the annual general appropriation act for the direct and indirect costs of the office. (b) The office shall develop a method for billing users of the office's services the full cost of the services, including materials, depreciation related to capital costs, labor, and administrative overhead. The billing method shall be fully implemented for all users of the office's services on or before July 1, 2013. (c) All interest earned on the investment of money in the fund shall be credited to the fund. Money in the revolving fund shall be continuously appropriated to the office of information technology to pay the costs of consolidation and information technology maintenance and upgrades. Any money credited to the revolving fund and unexpended and unencumbered at the end of any given fiscal year shall remain in the fund and shall not revert to the general fund. (4) On and after July 1, 2008, all duties and responsibilities for statewide geographic information system coordination shall be transferred from the department of local affairs to the office. The office shall develop a statewide geographic information system plan on or before July 1, 2010, and submit such plan to the governor and to the state, veterans, and military affairs committees of the senate and the house of representatives, or their successor committees.

C.R.S. § 24-37.5-104 Transfer of functions - change of name - continuity of existence - legislative declaration - rules

24-37.5-104. Transfer of functions - change of name - continuity of existence - legislative declaration - rules. (Repealed)

C.R.S. § 24-37.5-105 Office - roles - responsibilities - state search interface - rules - legislative declaration - definitions

24-37.5-105. Office - roles - responsibilities - state search interface - rules - legislative declaration - definitions. (1) The office may receive and expend gifts, grants, donations, and bequests, specifically including state and federal money and other money available. The office may contract with the United States and any other legal entities with respect to money available through gifts, grants, donations, or bequests. (2) The office may designate to a specific state agency any contribution of advanced information technology, gifts, grants, donations, or bequests from private sources, including but not limited to advanced information technology companies, individuals, and foundations. The office may also determine that such contributions remain nondesignated. (3) The office shall: (a) Deliver innovation and information technology to state agencies to foster collaboration among state agencies, to empower state agencies to provide better service to residents of Colorado, and to maximize the value of taxpayer resources; (b) Coordinate with state agencies to provide assistance, advice, and expertise in connection with business relationships between state agencies and private sector providers of information technology resources. Such assistance shall include efforts that strengthen and create efficiencies in those business relationships. (c) Assist the joint technology committee as necessary to facilitate the committee's oversight of the office; and (d) Establish, maintain, and keep an inventory of information technology owned by or held in trust for every state agency. (3.5) The office shall build, or contract with a third-party vendor to build, the Colorado statewide longitudinal data system, as defined in section 24-37.5-125, that advances technology solutions and improves data connectivity and analysis concerning education and workforce readiness statewide. (4) Governance. The office shall establish, maintain, and enforce information technology oversight and standards and shall support collaborative decision-making. In connection with information technology governance, the office shall: (a) Oversee statewide information technology strategy, rates and services, broadband, security, data, architecture, and information technology standards; (b) Provide assistance and guidance to state agencies in developing individual state agency information technology plans and ensure compliance with the state agency information technology plan; and (c) Provide project governance to all information technology projects, including: (I) Evaluating all information technology projects for alignment with state standards, architecture, and best practices; (II) Ensuring that every project is managed by an assigned project manager and ensuring that the state agency working on an information technology capital project reports to the office based on the governance standards specified in this subsection (4); and (III) Developing standards for project management including risk management and change management; (d) Develop and encourage an internet-based state government and facilitate the dissemination of information onto the internet through web and domain naming standards. In connection with developing an internet-based state government, the office shall: (I) Set standards for, partner in the development of, and encourage a secure, readily accessible, and equitably available digital state government and facilitate the dissemination of information onto the internet; (II) Collaborate with the statewide internet portal authority created in section 24-37.7-102 and other state agencies to create, maintain, and enhance the citizen experience of government; and (III) Ensure all applications comply with the accessibility standards specified in article 85 of this title 24. (5) Budget requests. In consultation with the office of state planning and budgeting, the office shall: borate with the statewide internet portal authority created in section 24-37.7-102 and other state agencies to create, maintain, and enhance the citizen experience of government; and (III) Ensure all applications comply with the accessibility standards specified in article 85 of this title 24. (5) Budget requests. In consultation with the office of state planning and budgeting, the office shall: (a) Review and submit budget requests for all information technology resources to be used by state agencies; and (b) Direct the development of policies and procedures, in consultation with the office of state planning and budgeting, that are integrated into the state's strategic planning and budgeting processes and that state agencies shall follow in developing information technology plans and technology-related budget requests. (6) Technology purchasing for enterprises. The office shall initiate the procurement of information technology resources for state agencies and enter into agreements or contracts on behalf of a state agency, multiple agencies, or the office, or be a party to procurement contracts that are initiated by state agencies. A state agency may initiate solicitations and contracts for information technology resources only with prior approval of the procurement official for the office, and must include provisions allowing the office to enforce technology and security standards or conduct due diligence or audits of the contractors. If the state agency does not receive written approval or disapproval from the procurement official for the office within thirty business days after submitting the procurement request to the office for review, the state agency may assume that it has received the prior approval of the office, as required by this subsection (6), and is authorized to initiate the procurement or solicitation process. In connection with the procurement of information technology resources, the office shall: (a) Ensure information technology purchases adhere to standards for data technology, architecture, and security; (b) Establish special requirements for vendors of information technology services to state agencies and adapt standards as necessary for individual state agencies to comply with federal law; (c) Oversee information technology vendors on behalf of the state and state agencies except when delegated to a state agency pursuant to section 24-37.5-105.4; and (d) If the office does not have oversight of an information technology or services contract, ensure that the state agency with oversight of the contract operates pursuant to section 24-37.5-105.4 regarding the delegation of authority. (7) Information technology personnel. To the extent permitted by applicable personnel laws and rules, the office shall oversee hiring, management, training, and performance of all state information technology personnel except when such duties are delegated pursuant to section 24-37.5-105.4. (8) State applications. The office shall oversee the installation, services, maintenance, and retirement of all state applications except when such duties are delegated pursuant to section 24-37.5-105.4. In connection with such oversight, the office shall: (a) Develop standards for application development and maintenance, including methodology that all state agencies shall use for application development activities; (b) Ensure that cost-effective, efficient, and secure information and communication systems and resources are being used by state agencies to: (I) Reduce data, hardware, and software redundancy; (II) Improve system interoperability and data accessibility between agencies; and (III) Meet the agency's and user's business and service needs. (9) Infrastructure. The office shall oversee the information technology infrastructure and hardware, including: nformation and communication systems and resources are being used by state agencies to: (I) Reduce data, hardware, and software redundancy; (II) Improve system interoperability and data accessibility between agencies; and (III) Meet the agency's and user's business and service needs. (9) Infrastructure. The office shall oversee the information technology infrastructure and hardware, including: (a) Service delivery, installation, maintenance, and retirement of all data center, mainframe, servers, storage and computer resources, email and collaboration, network, telecommunications, and end user support as outlined by services and policies in subsection (3)(f) of this section; and (b) Implementing information technology standards and specifications, characteristics, or performance requirements of infrastructure resources that increase efficiency and improve security and identify opportunities for cost savings based on such standardization. (10) (a) The general assembly hereby: (I) Finds that: (A) Rules adopted by agencies affect many areas of life for Colorado citizens, including water, air, food, energy, mobility, employment, and health care; (B) Maintaining a vibrant business economy in the state is a goal shared by all Coloradans; and (C) Public participation in the rule-making process promotes fairness, acceptability, and public accountability and can help foster greater public trust; (II) Determines that: (A) Engaging the assistance of lawyers, lobbyists, and technical experts should not be required for Coloradans to access the rules that affect their lives and businesses; (B) The general assembly created the online transparency task force in House Bill 20-1039, enacted in 2020, to recommend online transparency improvements to the general assembly; and (C) The task force found that it is unnecessarily burdensome to require both agency and public users to navigate within and between independent departmental resources and reinforced that establishing a clear, centralized agency rule and rule-making resource is necessary; and (III) Declares that this subsection (10) is necessary to improve access to state rules for all Coloradans and to modernize and enhance the search functionality and transparency of existing web platforms, which are spread across multiple agencies, by creating a single, public-facing search interface for accessing agency rules and state rule-making that meets the minimum standards established in this subsection (10). (b) Standards for the search interface must include but are not limited to: (I) A centralized search interface for access to all agency rule-making that is highly visible on the state's main website and that uses search engine optimization to enable it to be located on the internet; (II) An optimized, intuitive, and full-text search engine that is continuously optimized to increase accuracy and search speed and provide robust search results for users; (III) An application programming interface that enables quantifiable research on state rules; (IV) A public comment process that directs users toward the open comment process on the respective agencies' websites when available; (V) An integrated, subscribable calendar of all agencies' rule-making hearings; (VI) A fully responsive design that is compatible with mobile and tablet devices; and (VII) Compliance with section 24-85-103, the federal "Americans Disabilities Act of 1990", 42 U.S.C. sec. 12101 et seq., as amended, and section 508 of the federal "Rehabilitation Act of 1973", 29 U.S.C. sec. 794d, as amended, to make the search interface accessible to people with disabilities. making hearings; (VI) A fully responsive design that is compatible with mobile and tablet devices; and (VII) Compliance with section 24-85-103, the federal "Americans Disabilities Act of 1990", 42 U.S.C. sec. 12101 et seq., as amended, and section 508 of the federal "Rehabilitation Act of 1973", 29 U.S.C. sec. 794d, as amended, to make the search interface accessible to people with disabilities. (c) To facilitate operation of the search interface, the secretary of state shall provide to the office information access to the code of Colorado regulations and Colorado register. To facilitate operation of the search interface, all other agencies shall provide to the office access to their databases and information sources that contain information for rule-making proceedings. The office shall develop the search interface as specified in this subsection (10). The secretary of state shall advise the office in the development of the search interface as necessary and upon request. The office shall make the search interface available for use by June 30, 2022; except that, if an unforeseen technological impediment prevents achievement of this deadline, the office shall: (I) Identify the impediment, identify a proposed solution, and execute necessary steps to resolve the impediment within existing appropriations; (II) Notify the joint technology committee of the general assembly in writing that it will not meet the deadline and include in the notice a description of the impediment, the individual tasks comprising the proposed solution, and the anticipated completion date; and (III) Appear before the joint technology committee at the first practicable opportunity after June 30, 2022, to discuss the implementation of the search interface. (d) The office may seek, accept, and expend gifts, grants, or donations from private or public sources for the purposes of this subsection (10). (e) As used in this subsection (10), "agency" has the meaning established in section 24-4-102 (3).

C.R.S. § 24-37.5-105.2 State agencies - information technology - responsibilities

24-37.5-105.2. State agencies - information technology - responsibilities. (1) In connection with information technology, each state agency shall: (a) Comply with the rules, standards, plans, policies, and directives of the office; (b) Comply with information technology requests of the office, the general assembly, the joint technology committee, and the joint budget committee, and provide evidence of such compliance upon request of the governor, general assembly, the joint technology committee, or the joint budget committee; (c) Participate with and advise the office on the creation of an information technology plan for the state agency as part of the state's planning and budgeting process; and (d) Support effective use of information technology by defining roles and processes to partner with the office. (2) In connection with any major information technology project that a state agency plans to undertake, the state agency shall: (a) Consult with the office on the development of the major information technology project; (b) Before commencing work on the major information technology project, submit the plan to the office and obtain approval from the office; (c) If the state agency plans to make significant changes to the major information technology project or budget, consult with the office regarding the changes and obtain the office's approval of the changes before commencing work on the changes; and (d) Consult with and obtain approval from the office for changes to the funding strategy for the ongoing maintenance and eventual disposal of a major information technology system. (3) State agencies have the responsibility for ensuring program delivery and for creating a business culture that prioritizes maximizing value from technology and information technology projects. State agencies shall: (a) Understand and manage the business criticality of their systems; (b) Improve awareness of how information technology can help them achieve the mission of the state agency; (c) Articulate the outcomes of their information technology products and use processes that effectively prioritize investments and improvements aimed at achieving those outcomes; and (d) Plan for and manage the impacts of changes resulting from information technology projects for staff and constituents to enhance adoption and maximize the value of information technology investments. (4) State agency responsibilities for user access to all state information technology systems, in connection with employees, contractors, subcontractors, and other users include: (a) Ensuring that user access is correct and that all requirements are satisfied; (b) Requesting appropriate access to information technology systems; (c) Periodic auditing of access levels; and (d) Removal of access. (5) For security purposes, a state agency shall include the office as a party to all contracts or agreements for information technology goods, services, or systems. (6) A state agency shall hold authority and be responsible for projects managed by the state agency when the office is involved only as a party to the contract or a party to the agreement with a vendor, contractor, or other party.

C.R.S. § 24-37.5-105.4 Delegation of authority

24-37.5-105.4. Delegation of authority. (1) The chief information officer may delegate an information technology function of the office to another state agency by agreement or other means authorized by law. The chief information officer may delegate an information technology function of the office if in the judgment of the director of the state agency and the chief information officer: (a) The state agency has requested that the function be delegated; (b) The state agency has the necessary resources and skills to perform or control the function to be delegated; and (c) The function to be delegated is a unique or mission-critical function of the state agency. (2) The chief information officer may delegate a function of the office only when the delegation results in net cost savings or improved service delivery to the state as a whole or to the unique mission critical function of the state agency, or is not otherwise provided in the office's information technology oversight and standards governance developed pursuant to section 24-37.5-105 (4). (3) For any delegation of authority pursuant to this section, the office shall formalize an agreement with the state agency in which the agency assumes the responsibility for all of the requirements specified in this subsection (3), including acknowledging responsibility for ensuring that the information technology or service maintains ongoing compliance with state information technology policies and standards pursuant to section 24-37.5-105 (4) and applicable federal regulations. The delegation of authority pursuant to this section shall be in writing and shall contain the following: (a) A precise definition of each function to be delegated; (b) A clear description of the standards to be met in performing each delegated function; (c) Designation of the state agency responsible for ensuring operational security and validating compliance to security policies and standards; (d) A provision for periodic administrative audits by the office; (e) A date on which the agreement shall terminate if the agreement has not been previously terminated or renewed; and (f) Designation of the appointing authority responsible for the delegated services to support the function in the state agency and rates to be charged for the staff. (4) An agreement to delegate functions to a state agency may be terminated by the office if the results of an administrative audit conducted by the office reveals a lack of compliance with the terms of the agreement by the state agency.

C.R.S. § 24-37.5-106 Chief information officer - duties and responsibilities - rules

24-37.5-106. Chief information officer - duties and responsibilities - rules. (1) The position of chief information officer shall be commensurate with the position of head of a principal department and shall be a member of the governor's cabinet. (2) The chief information officer shall: (a) Monitor trends and advances in information technology resources, direct and approve a comprehensive, statewide, planning process, and plan for the acquisition, management, and use of information technology. The statewide information technology plan shall be updated annually and submitted to the governor, the joint technology committee, the speaker of the house of representatives, and the president of the senate. (b) Advise the joint technology committee and the joint budget committee on requested or ongoing information technology projects, including the adherence of the office to the budget, amounts appropriated, and relevant contract deadline dates or schedules for those projects; (c) Supervise the chief information security officer appointed pursuant to section 24-37.5-403 (1); (d) Hire or retain such contractors, subcontractors, advisors, consultants, and agents as the chief information officer may deem advisable or necessary, in accordance with relevant procedures, statutes, and rules and make and enter into contracts necessary or incidental to the exercise of the powers and performance of the duties of the office and the chief information officer; (e) Assist the joint technology committee as necessary to facilitate the committee's oversight of the office; and (f) Appoint a director of the Colorado broadband office created in section 24-37.5-903 (1). (3) The chief information officer may enter into contracts with any local government, state agency, or political subdivision of the state, including the legislative and judicial departments, the department of law, the department of state, the department of treasury, or state-supported institutions of higher education, for the purpose of providing disaster recovery services. (4) The chief information officer may promulgate as rules pursuant to article 4 of this title 24 all of the policies, procedures, standards, specifications, guidelines, or criteria that are developed or approved pursuant to section 24-37.5-105 (4) and rules to establish accessibility standards for individuals with a disability pursuant to section 24-85-103 and to implement the broadband deployment grant program pursuant to section 24-37.5-905.

C.R.S. § 24-37.5-107 Work eligibility verification portal

24-37.5-107. Work eligibility verification portal. (Repealed)

C.R.S. § 24-37.5-108 Statewide communications and information infrastructure - establishment - duties

24-37.5-108. Statewide communications and information infrastructure - establishment - duties. (Repealed)

C.R.S. § 24-37.5-111 Geographic information system - coordinator - statewide plan

24-37.5-111. Geographic information system - coordinator - statewide plan. (Repealed)

C.R.S. § 24-37.5-112 Information technology revolving fund

24-37.5-112. Information technology revolving fund. (Repealed)

C.R.S. § 24-37.5-113 Colorado benefits management system improvement and modernization project - appropriation - reporting - repeal

24-37.5-113. Colorado benefits management system improvement and modernization project - appropriation - reporting - repeal. (Repealed)

C.R.S. § 24-37.5-114 Colorado financial reporting system modernization project - reporting

24-37.5-114. Colorado financial reporting system modernization project - reporting. (Repealed)

C.R.S. § 24-37.5-115 Technology advancement and emergency fund - repeal

24-37.5-115. Technology advancement and emergency fund - repeal. (Repealed)

C.R.S. § 24-37.5-116 Communications and stakeholder management plan

24-37.5-116. Communications and stakeholder management plan. (1) On or before July 1, 2020, the office shall develop and implement a communications and stakeholder management plan for interacting with any department, commission, council, board, bureau, committee, institution of higher education, agency, or other governmental unit of the executive, legislative, or judicial branch of state government that is billed for the use of the services provided by the office. The office shall enlist vendor services in the development of the plan. (2) On or before January 1, 2021, the office shall develop a method to annually solicit feedback from every department, commission, council, board, bureau, committee, institution of higher education, agency, or other governmental unit of the executive, legislative, or judicial branch of state government that is billed for the use of the services provided by the office to determine if the communications and stakeholder management plan developed and implemented pursuant to subsection (1) of this section is increasing the governmental unit's satisfaction with the services provided by the office for which it is billed.

C.R.S. § 24-37.5-117 Use of technology to interact with citizens - working group - strategic plan

24-37.5-117. Use of technology to interact with citizens - working group - strategic plan. (1) The office shall convene a working group of state agencies, as defined in section 24-37.5-102 (28), to develop and implement a strategic plan for how state agencies use technology to provide services, data, and information to citizens and businesses. The office shall implement the plan on or before July 1, 2020. (2) The office shall enlist vendor services in the development of the plan.

C.R.S. § 24-37.5-118 Change of references - director to revisor of statutes

24-37.5-118. Change of references - director to revisor of statutes. The revisor of statutes is hereby authorized to change all references in the Colorado Revised Statutes to the department of personnel and office of the governor as appropriate and with respect to the powers, duties, and functions transferred to the office. In connection with such authority, the revisor of statutes is hereby authorized to amend or delete provisions of the Colorado Revised Statutes so as to make the statutes consistent with the powers, duties, and functions transferred pursuant to this section.

C.R.S. § 24-37.5-119 Broadband service - report - broadband deployment board - broadband administrative fund - creation - rules - legislative declaration - definitions - repeal

24-37.5-119. Broadband service - report - broadband deployment board - broadband administrative fund - creation - rules - legislative declaration - definitions - repeal. (Repealed)

C.R.S. § 24-37.5-120 Technology risk prevention and response fund - creation - definitions

24-37.5-120. Technology risk prevention and response fund - creation - definitions. (1) As used in this section, unless the context otherwise requires: (a) (I) "Information technology emergency" means a situation in which an immediate threat to the public health, welfare, or safety exists, where the situation creates an immediate need for information technology equipment or services, and the lack of information technology or services would threaten: (A) The health or safety of any person or property; (B) The immediate functioning of one or more of the state's essential services; or (C) The security, confidentiality, or integrity of the state's information technology. (II) An information technology emergency does not exist as a result of budget cycles, fiscal year-end requirements, or potential loss of funding. (b) "Technology risk prevention and response fund" or "fund" means the technology risk prevention and response fund created in subsection (2) of this section. (2) The technology risk prevention and response fund is hereby created in the state treasury. The fund consists of money that the general assembly may appropriate or transfer to the fund, money contributed to the fund by the office pursuant to subsection (4)(d) of this section, and money transferred to the fund pursuant to subsection (6) of this section. (3) The state treasurer shall credit all interest and income derived from the deposit and investment of money in the fund to the fund. Any unexpended and unencumbered money remaining in the fund at the end of a fiscal year remains in the fund and does not revert to the general fund. (4) (a) Up to fifty percent of the total balance of the fund at the beginning of each fiscal year is continuously appropriated to the office. The total fund balance shall not exceed fifty million dollars. (b) The office may expend money from the fund to cover one-time costs associated with information technology expenditures as specified in subsection (4)(c) of this section and to provide the office and state agencies a financial mechanism to address costs associated with emergency or at-risk information technology. (c) The office shall use the money in the fund for one-time costs associated with: (I) An information technology emergency; (II) Ensuring compliance with the office's information technology standards and policies; or (III) Preventing risk from information technology that is: (A) Anticipating failure; (B) Nearing or no longer maintained or supported by manufacturers or vendors; (C) Out of security compliance or creating security risk; (D) Part of an outstanding state audit recommendation; or (E) Keeping the state from recognizing efficiencies or advances in information technology or information technology financing. (d) The office may contribute money to the fund from the operations and maintenance fees associated with the billing practices of the office. (5) No later than November 1, 2022, the office shall provide a written report to the joint budget committee and the joint technology committee outlining the expenditures of money from the fund. Notwithstanding section 24-1-136 (11)(a)(I), no later than the twentieth day of every third month thereafter, the office shall submit a written report to the joint budget committee and joint technology committee of all expenditures of funds since the last report. The written report must include, but need not be limited to, the following: (a) A list of each expenditure made from the fund, including the purpose and amount of the expenditure, the date on which the expenditure was made, the state agency or agencies that benefited from the expenditure, and how the expenditure met the criteria set forth in subsection (4) of this section; and ce the last report. The written report must include, but need not be limited to, the following: (a) A list of each expenditure made from the fund, including the purpose and amount of the expenditure, the date on which the expenditure was made, the state agency or agencies that benefited from the expenditure, and how the expenditure met the criteria set forth in subsection (4) of this section; and (b) Financial statements that analyze the demand for funding and the annual fund balance as of the start of each fiscal year. (6) (a) Notwithstanding any provision of law to the contrary, for the 2022-23 state fiscal year and for each state fiscal year thereafter, any money appropriated from the general fund to the office or a state agency for the procurement of information technology resources or projects that is unexpended or unencumbered at the end of the fiscal year as a result of savings achieved in connection with such procurement, shall not revert to the general fund. (b) On July 1, 2023, and on July 1 of each year thereafter, the state treasurer shall transfer from the general fund to the technology risk prevention and response fund an amount equal to the amount of unexpended and unencumbered money described in subsection (6)(a) of this section.

C.R.S. § 24-37.5-121 Digital access to government services - strategic plan - reporting - legislative declaration - definitions

24-37.5-121. Digital access to government services - strategic plan - reporting - legislative declaration - definitions. (1) The general assembly finds and declares that: (a) The COVID-19 pandemic has highlighted the fact that Colorado residents need digital access to government services to allow them to safely access government services while carrying on necessary business and other activities; (b) Even as the COVID-19 pandemic subsides, it remains important to provide digital access to government services to modernize government operations, save taxpayers time and money, and improve accessibility to government services and information throughout the state; and (c) The office is well positioned to advance and innovate the state's adoption of, and increase its offerings for, digital access to government services, which offerings would further maximize the value of the state's investment in broadband deployment. (2) (a) The office shall enter into an enterprise agreement with a third-party vendor to develop and implement a strategic plan to expand and improve digital access to government services through the use of broadband. (b) In developing the strategic plan, the office and the vendor shall consult with stakeholders throughout the state that represent various interested parties including: (I) Residents of the state; (II) Groups representing or advocating for historically marginalized communities or residents of the state; (III) Agencies; (IV) The statewide internet portal authority created pursuant to section 24-37.7-102; and (V) Local and regional government officials. (3) Repealed. (4) As used in this section, unless the context otherwise requires: (a) "Agency" has the meaning set forth in section 24-4-102 (3). (b) "COVID-19" means the coronavirus disease 2019 caused by the severe acute respiratory syndrome coronavirus 2, also known as SARS-CoV-2.

C.R.S. § 24-37.5-122 Study of personally identifiable information - authority of chief information officer - report to joint technology committee - definitions - repeal

24-37.5-122. Study of personally identifiable information - authority of chief information officer - report to joint technology committee - definitions - repeal. (Repealed)

C.R.S. § 24-37.5-123 Colorado operations resource engine upgrade and continuous improvement project - reporting

24-37.5-123. Colorado operations resource engine upgrade and continuous improvement project - reporting. If the executive committee of the legislative council, the joint budget committee, the joint technology committee, or the legislative audit committee deem certain functionality of the Colorado financial reporting system to be of particular importance to the legislative branch, this will be conveyed in writing to the office, the department of personnel, and the governor. The office and the department of personnel must ensure that such functionality is incorporated or must promptly explain why such functionality cannot be incorporated. If the functionality cannot be included because such a change would require additional appropriations, the office and the department of personnel must explain why additional appropriations are necessary. The office and the department of personnel must report to the joint technology committee and the joint budget committee regarding its progress on the project in a format and at time intervals specified by the joint technology committee and the joint budget committee in writing. If a meeting is necessary for any report required by this section, when possible, the meeting may be a joint meeting of the joint technology committee and the joint budget committee.

C.R.S. § 24-37.5-124 Evaluation of department of higher education information technology services - repeal

24-37.5-124. Evaluation of department of higher education information technology services - repeal. (1) By November 1, 2024, the office shall evaluate the information technology functions and services of the department of higher education for the purpose of assessing possibilities for a consolidation of existing information technology functions and services with those information technology functions and services managed by the office. At a minimum, this evaluation must assess the business function, criticality, capacities, complexity, technical debt status, risk, and integration capability in relation to the following functions and services: (a) Asset management; (b) Data; (c) Database services; (d) End-user support services; (e) Identity and access; (f) Network infrastructure and communications; (g) Server and storage infrastructure; (h) Applications and platforms; (i) Security services; (j) Disaster recovery; and (k) Supported sites. (2) The chief information officer may contract with one or more third parties to conduct all or part of the evaluation required by subsection (1) of this section. (3) If the evaluation required by subsection (1) of this section shows that consolidation would be beneficial, the office shall create a proposed plan and accompanying budget for consolidating the information technology functions and services of the department of higher education with those information technology functions and services managed by the office. (4) This section is repealed, effective July 1, 2025.

C.R.S. § 24-37.5-125 Colorado statewide longitudinal data system - education and workforce - postsecondary workforce readiness programs - appropriation - cash fund - report - definitions - repeal

24-37.5-125. Colorado statewide longitudinal data system - education and workforce - postsecondary workforce readiness programs - appropriation - cash fund - report - definitions - repeal. (1) As used in this section, unless the context otherwise requires: (a) "Colorado statewide longitudinal data system" or "data system" means the Colorado statewide longitudinal data system created in subsection (2)(a) of this section. (b) "Colorado statewide longitudinal data system governing board" or "governing board" means the Colorado statewide longitudinal data system governing board created in subsection (3)(a) of this section. (c) "Contributing agencies" means agencies that contribute data to the office for the Colorado statewide longitudinal data system. Contributing agencies include, but are not limited to, the department of early childhood, the department of education, the department of higher education, the department of labor and employment, and the office of economic development. (d) "Operational tools" means the software and hardware needed to securely and legally connect data across systems and support data analysis. (e) "Postsecondary and workforce readiness programs" means programs for Colorado high school students to develop the knowledge and competencies needed to succeed in postsecondary settings and to advance in career pathways as lifelong learners and contributing citizens. (f) "Statewide longitudinal data system cash fund" or "cash fund" means the statewide longitudinal data system cash fund created in subsection (8) of this section. (g) "Sustainability interagency advisory group" or "sustainability advisory group" means the sustainability interagency advisory group convened pursuant to subsection (4)(n) of this section by the governing board. (h) "Systems build and implementation interagency advisory group" or "systems advisory group" means the systems build and implementation interagency advisory group convened pursuant to subsection (4)(n) of this section by the governing board. (2) (a) The Colorado statewide longitudinal data system is created within the office. The purposes of the data system are to: (I) Establish a consistent, appropriate, secure, and legal means of data sharing focused on education and workforce outcomes and postsecondary and workforce readiness program data; (II) Provide data and data analysis that supports evidence-based decision making for policymakers as the policymakers consider opportunities to improve educational and workforce outcomes and reduce opportunity gaps; (III) Provide information, as appropriate, that supports education and workforce practitioners and supports students and families in making informed decisions regarding students' education; and (IV) Enhance the security of data sharing by minimizing the number of data-sharing agreements between contributing agencies and standardizing data-sharing practices. outcomes and reduce opportunity gaps; (III) Provide information, as appropriate, that supports education and workforce practitioners and supports students and families in making informed decisions regarding students' education; and (IV) Enhance the security of data sharing by minimizing the number of data-sharing agreements between contributing agencies and standardizing data-sharing practices. (b) In creating the data system, the office shall, at a minimum: (I) Consider the recommendations set forth in the reports described in section 23-1-141(7); (II) Adopt a timeline to phase in the data system, including a timeline for the development of analytical tools and operational tools and to offer professional development and technical assistance to contributing agencies that use the data system; (III) Initiate work on the data system; (IV) Ensure protection of individual privacy in accordance with applicable state and federal laws that apply to the data provided by contributing agencies; (V) Focus on the development and implementation of operational tools to meet the purposes outlined in subsection (2)(a) of this section; (VI) Develop and implement communications, professional development, and technical assistance that support the data system's use across contributing agencies and with partner entities; (VII) Align data systems from contributing agencies and partner entities with interoperable standards and common data governance practices to maximize services provided to Coloradans; (VIII) Convene the Colorado statewide longitudinal data system governing board; (IX) Implement the operational decisions of the governing board pursuant to subsection (4) of this section; and (X) Develop a data-request process consistent with the governing board's data-request policy described in subsection (4)(e) of this section. (3) (a) The Colorado statewide longitudinal data system governing board is created in the office. The office shall convene and administer the governing board. The governing board includes the following voting members: (I) The chief information officer or the chief information officer's designee who holds an executive leadership position; (II) The executive director of the department of early childhood or the executive director's designee who holds an executive leadership position; (III) The commissioner of education or the commissioner of education's designee who holds an executive leadership position; (IV) The executive director of the department of higher education or the executive director's designee who holds an executive leadership position; and (V) The executive director of the department of labor and employment or the executive director's designee who holds an executive leadership position. (b) The governing board includes the following nonvoting members: (I) A representative of the governor's office, appointed by the governor; (II) A representative of the office of state planning and budgeting, appointed by the governor; (III) A representative of the office of the attorney general with legal expertise in data privacy and governance, appointed by the attorney general; (IV) An administrator of the federal "Carl D. Perkins Career and Technical Education Improvement Act of 1998", 20 U.S.C. sec. 2301 et seq., as amended, appointed by the state administrator of the state board for community colleges and occupational education in coordination with its career and technical education role; and (V) No more than three members of the public appointed by the governor. (4) At a minimum, the governing board shall: (a) Establish the governance structure necessary to oversee the sharing and connecting of multiple data sets into the data system; (b) Establish the process and procedures for voting and decision-making; education in coordination with its career and technical education role; and (V) No more than three members of the public appointed by the governor. (4) At a minimum, the governing board shall: (a) Establish the governance structure necessary to oversee the sharing and connecting of multiple data sets into the data system; (b) Establish the process and procedures for voting and decision-making; (c) Align existing data-sharing and data governance efforts to minimize the need for new or duplicative data infrastructures and to connect existing data to the data system more efficiently and securely; (d) Review workforce and education data when it is annually available, review the statutory requirements and timelines for reporting data, and consider when data collection and reporting is most valuable; (e) Develop data governance policies for contributing agencies with an emphasis on limiting the number of new data-sharing agreements required to maximize efficiency and to ensure consistent practice. The governance policy must include a data-request policy that is consistent with applicable state and federal laws. (f) Define the data elements necessary to measure the impacts and long-term outcomes of education and workforce programs in accordance with the "Student Data Transparency and Security Act", article 16 of title 22; (g) Ensure the security and data privacy of data system data, including compliance with existing state and federal data privacy and use laws; (h) Determine standard data elements to be included in data-sharing agreements; (i) Determine education and business requirements for the initial data systems build, including ongoing maintenance, scalable infrastructure, and the analytical tools and operational tools necessary to help the public use the education and workforce outcome data, as appropriate; (j) Create a plan that prioritizes and sequences key components needed to enhance and expand the data system and identify the additional data elements and data sources that may be needed for future linkage to the data system; (k) Estimate the ongoing fiscal effect and structure for each contributing agency to contribute to the data system, identify costs and opportunities for efficiencies and cost-savings in sharing, protecting, and reporting data through the data system; (l) Adopt and adjust, as necessary, a data dictionary, data standards, and security protocols to ensure interoperability between the data system, data from other state agencies, and other state data systems using the same data; (m) Ensure the data system serves its intended purposes by seeking input and collecting data, including disaggregated data, from contributing agencies and summarizing the data and providing recommendations to the general assembly, governor, and the state board of education in the interim report and annual report described in subsection (7) of this section in order to adjust the vision, mission, and strategic objectives for the data system; and purposes by seeking input and collecting data, including disaggregated data, from contributing agencies and summarizing the data and providing recommendations to the general assembly, governor, and the state board of education in the interim report and annual report described in subsection (7) of this section in order to adjust the vision, mission, and strategic objectives for the data system; and (n) Convene the systems build and implementation interagency advisory group and the sustainability interagency advisory group. (5) (a) The systems build and implementation interagency advisory group shall, at a minimum, advise the governing board on the technical development and implementation of the data system. The systems advisory group members must have an understanding of each contributing agency's data system, processes, and structures. The systems advisory group shall advise and support the governing board's duties pursuant to subsection (4) of this section. Members of the systems advisory group include a representative of: (I) The office of information technology, appointed by the executive director of the office of information technology; (II) The department of early childhood, appointed by the executive director of the department of early childhood; (III) The department of education, appointed by the commissioner of education; (IV) The department of higher education, appointed by the executive director of the department of higher education; (V) The department of labor and employment, appointed by the executive director of the department of labor and employment; (VI) The governor's office, appointed by the governor; (VII) The office of state planning and budgeting, appointed by the governor; and (VIII) The office of the attorney general, appointed by the attorney general. (b) The sustainability interagency advisory group shall, at a minimum, advise the governing board on the use and function of the data system. The members of the sustainability advisory group shall have an understanding of the programs and data sets included in the data system and how the data system informs decisions within each contributing agency and the contributing agency's stakeholders. The sustainability advisory group shall advise and support the governing board's duties pursuant to subsection (4) of this section. The sustainability advisory group shall include a representative of: (I) The office of information technology, appointed by the executive director of the office of information technology; (II) The department of early childhood, appointed by the executive director of the department of early childhood; (III) The department of education, appointed by the commissioner of education; (IV) The department of higher education, appointed by the executive director of the department of higher education; (V) The department of labor and employment, appointed by the executive director of the department of labor and employment; (VI) The governor's office, appointed by the governor; (VII) The office of state planning and budgeting, appointed by the governor; and (VIII) The office of the attorney general, appointed by the attorney general. (6) (a) For purposes of the data system, the governing board shall: (I) Prioritize the needs of students and families; (II) Comply with state and federal laws to protect individual privacy, including, but not limited to: (A) The federal "Family Educational Rights and Privacy Act of 1974", 20 U.S.C. sec. 1232g, as amended; (B) The federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. sec. 1320d et seq., as amended; and (C) The federal "Higher Education Act of 1965", 20 U.S.C. sec. 1070 et seq., as amended; and (III) Consider stakeholder input. (b) To inform the design of the data system, contributing state agencies shall seek input from relevant stakeholders to determine important measurements of value and outcome metrics. tability and Accountability Act of 1996", 42 U.S.C. sec. 1320d et seq., as amended; and (C) The federal "Higher Education Act of 1965", 20 U.S.C. sec. 1070 et seq., as amended; and (III) Consider stakeholder input. (b) To inform the design of the data system, contributing state agencies shall seek input from relevant stakeholders to determine important measurements of value and outcome metrics. (c) State agencies, in addition to the contributing agencies, may contribute data to the data system, as necessary, for legislative reports, research questions, or other projects that require cross-agency data sharing. (7) (a) On or before January 15, 2025, the office shall submit an interim report on the progress of the data system, the data governance processes and procedures, and recommendations for legislative changes and funding, as necessary, to the education committees of the house of representatives and the senate, or their successor committees, the state board of education, and the governor. (b) (I) Notwithstanding section 24-1-136 (11)(a)(I), beginning April 15, 2026, and each April 15 thereafter, the office shall submit an annual report to the education committees of the house of representatives and the senate, or their successor committees, the state board of education, and the governor. Subject to data availability, the annual report must summarize key findings from education and workforce outcomes and education and workforce readiness, including, at a minimum: (A) Enrollment and outcomes in postsecondary and workforce readiness programs for high school graduates; (B) High school matriculation rates; (C) Postsecondary retention rates; (D) Postsecondary completion rates; and (E) One-, five-, and ten-year wage outcomes. (II) When possible and in alignment with data privacy practices, data must be disaggregated by local education provider, high school, or postsecondary or workforce readiness program participation; race; ethnicity; gender; disability status; and socioeconomic status. (c) The office shall post the interim report and the annual report described in this subsection (7) on the office's website. (8) (a) The statewide longitudinal data system cash fund is created in the state treasury. The cash fund consists of money transferred to the cash fund pursuant to subsection (8)(b) of this section and any other money that the general assembly may appropriate or transfer to the cash fund. The state treasurer shall credit all interest and income derived from the deposit and investment of money in the cash fund to the cash fund. (b) On July 1, 2024, the state treasurer shall transfer five million dollars from the general fund to the cash fund for purposes of this section. (c) Subject to annual appropriation by the general assembly for the 2024-25, 2025-26, and 2026-27 state fiscal years, the office and the department of education may expend money from the cash fund for purposes of this section. (d) Any money appropriated in a state fiscal year pursuant to this section that is unencumbered or unexpended at the end of that state fiscal year remains available for expenditure in the next fiscal year for the same purposes without further appropriation. (e) The state treasurer shall transfer all unexpended and unencumbered money in the cash fund on September 1, 2027, to the general fund. (f) This subsection (8) is repealed, effective October 1, 2027. (9) The office may seek, accept, and expend gifts, grants, or donations from private or public sources for the purposes of this section.

C.R.S. § 24-37.5-126 Promulgation of rules - technology life-cycle management plan

24-37.5-126. Promulgation of rules - technology life-cycle management plan. On or before December 31, 2024, the office shall promulgate rules in accordance with article 4 of this title to establish a technology life-cycle plan. The rules may consider information security risk, infrastructure risk, operating cost misalignment, productivity cost misalignment, or talent depreciation in connection with an information technology system or asset.

C.R.S. § 24-37.5-127 Funding for technology life-cycle costs - information technology annual depreciation-lease equivalent payments - fiscal impact analysis - definitions

24-37.5-127. Funding for technology life-cycle costs - information technology annual depreciation-lease equivalent payments - fiscal impact analysis - definitions. (1) As used in this section, unless the context otherwise requires: (a) "Appropriation" means an appropriation from the information technology capital account in the capital construction fund to any state agency for an information technology capital project in the capital construction section of the annual general appropriation act. (b) "Capital construction fund" means the capital construction fund created in section 24-75-302. (c) "Cash fund" does not include: (I) The lottery fund created in section 44-40-111; (II) The limited gaming fund created in section 44-30-701 (1); (III) Money allocated to the division of parks and wildlife from lottery proceeds as specified in section 3 of article XXVII of the state constitution; (IV) The wildlife cash fund created in section 33-1-112 (1)(a); or (V) The legislative department cash fund created in section 2-2-1601 (1)(a) and the legislative redistricting account created in section 2-2-1601 (2.5). (d) "Depreciation or amortization" means an amount calculated and recorded in accordance with generally accepted accounting principles. (e) "Depreciation or amortization period" means a period determined in fiscal procedures issued by the state controller or the state institution of higher education. (f) "Information technology annual depreciation-lease equivalent payment" means an amount equivalent to the recorded depreciation or amortization of the information technology asset acquired, repaired, improved, replaced, renovated, or constructed with an appropriation from the information technology capital account in the capital construction fund based on the depreciation period, as calculated by the state agency or the state institution of higher education, which calculation a state institution of higher education shall report to the department of higher education. The amount is calculated from the date of acquisition or the date of completion of the repair, improvement, replacement, renovation, or construction to June 30 of the fiscal year of acquisition or completion. The amount continues to be annually calculated on a fiscal year basis until the depreciation for the information technology asset is no longer recorded. (g) "Project cost" means the depreciable components of the total project cost as reflected in the appropriation; except that, if the project is financed, the total project cost does not include any financing costs. (h) "State agency" means any department, commission, council, board, bureau, committee, institution of higher education, agency, or other governmental unit of the executive, legislative, or judicial branch of state government that receives an appropriation or is otherwise included in the annual general appropriation act or the annual legislative appropriation act. (i) "Technology risk prevention and response fund" means the technology risk prevention and response fund created in section 24-37.5-120 (2). (2) For every initial appropriation for an information technology capital project in the capital construction section of the 2025-26 annual general appropriation act and every appropriation for an information technology capital project in the capital construction section of each annual general appropriation act thereafter, additional funding must be set aside as follows: section 24-37.5-120 (2). (2) For every initial appropriation for an information technology capital project in the capital construction section of the 2025-26 annual general appropriation act and every appropriation for an information technology capital project in the capital construction section of each annual general appropriation act thereafter, additional funding must be set aside as follows: (a) If the funding source for the appropriation is from a cash fund, the state agency shall annually calculate an amount equal to the recorded depreciation of the information technology assets acquired, repaired, improved, replaced, renovated, or constructed with the appropriation based on the depreciation period, the general assembly shall include an information technology annual depreciation-lease equivalent payment line item payable from the cash fund in the operating section of the annual general appropriation act for the state agency, and, on July 1 of the state fiscal year to which the act applies, the state controller shall credit such amount from the cash fund that was the source of the funding for the appropriation to an information technology capital reserve account established by the state agency in that cash fund as specified in section 24-75-403 (2.5). (b) If the funding source for the appropriation is from the general fund or the information technology capital account in the capital construction fund, the general assembly shall include an information technology annual depreciation-lease equivalent payment line item payable from the general fund in the operating section of the annual general appropriation act for each state agency, including the department of higher education. On July 1 of the state fiscal year to which the act applies, the state controller shall credit the information technology annual depreciation-lease equivalent payment line item to the information technology capital account; except that, of that payment, an amount equal to one percent of the project cost must be deducted from the payment and credited to the principal of the technology risk prevention and response fund. (c) If the funding source for the appropriation is a financing arrangement, including a financed purchase of an asset or certificate of participation agreement allowed pursuant to section 24-82-801, and the source of the funding for the financing payment is: (I) From a cash fund, then the state agency shall annually calculate an amount equal to one percent of the project cost and the general assembly shall include an information technology annual controlled maintenance line item payable from the cash fund in the operating section of the annual general appropriation act for each state agency equal to such amount. On July 1 of the state fiscal year to which the act applies, the state controller shall credit that amount to an information technology capital reserve account established by the state agency in the cash fund as specified in section 24-75-403 (2.5). (II) From the general fund or the capital construction fund, then the general assembly shall include an information technology annual controlled maintenance line item payable from the general fund in the operating section of the annual general appropriation act for each state agency, including the department of higher education, equal to one percent of the project cost, as calculated by the state agency or the state institution of higher education, which calculation a state institution of higher education shall report to the department of higher education. On July 1 of the state fiscal year to which the act applies, the state controller shall credit such amount to the technology risk prevention and response fund. ucation, equal to one percent of the project cost, as calculated by the state agency or the state institution of higher education, which calculation a state institution of higher education shall report to the department of higher education. On July 1 of the state fiscal year to which the act applies, the state controller shall credit such amount to the technology risk prevention and response fund. (d) If the funding source for the appropriation is a combination of the funding sources described in subsections (2)(a), (2)(b), and (2)(c) of this section, then the annual set aside required pursuant to this subsection (2) must be made in proportion to the funding source. (3) On June 15, 2025, and on each June 15 thereafter, the office shall submit a fiscal impact analysis to the office of state planning and budgeting that must include but need not be limited to the following: (a) The estimated amount of general fund money required to make the information technology annual depreciation-lease equivalent payments for the upcoming fiscal year; and (b) The current information technology assets to which the information technology annual depreciation-lease equivalent payments are being applied.

C.R.S. § 24-37.5-201 Commission on information management - creation - membership

24-37.5-201. Commission on information management - creation - membership. (Repealed)

C.R.S. § 24-37.5-202 Commission's purposes, powers, and duties

24-37.5-202. Commission's purposes, powers, and duties. (Repealed)

C.R.S. § 24-37.5-203 Statewide communications and information infrastructure - establishment - duties

24-37.5-203. Statewide communications and information infrastructure - establishment - duties. (Repealed)

C.R.S. § 24-37.5-203.5 Statewide internet portal - definitions

24-37.5-203.5. Statewide internet portal - definitions. (Repealed)

C.R.S. § 24-37.5-401 Legislative declaration

24-37.5-401. Legislative declaration. (1) The general assembly hereby finds, determines, and declares that: (a) Communication and information resources in the various public agencies of the state are strategic and vital assets belonging to the people of Colorado. Coordinated efforts and a sense of urgency are necessary to protect these assets against unauthorized access, disclosure, use, and modification or destruction, whether accidental or deliberate, as well as to assure the confidentiality, integrity, and availability of information. (b) State government has a duty to Colorado's citizens to ensure that the information the citizens have entrusted to public agencies is safe, secure, and protected from unauthorized access, unauthorized use, or destruction. (c) Securing the state's communication and information resources is a statewide imperative requiring a coordinated and shared effort from all departments, agencies, and political subdivisions of the state and a long term commitment to state funding that ensures the success of such efforts. (d) Risks to communication and information resources must be managed, and the integrity of data and the source, destination, and processes applied to data must be assured. (e) Information security standards, policies, and guidelines must be promulgated and implemented throughout public agencies to ensure the development and maintenance of minimum information security controls to protect communication and information resources that support the operations and assets of those agencies. (f) The extensive information security expertise in Colorado's private sector should be utilized for the long-term benefit of Colorado's citizens and public agencies.

C.R.S. § 24-37.5-403 Chief information security officer - duties and responsibilities

24-37.5-403. Chief information security officer - duties and responsibilities. (1) The chief information officer shall appoint a chief information security officer who shall serve at the pleasure of the chief information officer. The security officer shall report to and be under the supervision of the chief information officer. The security officer shall exhibit a background and expertise in security and risk management for communications and information resources. In the event the security officer is unavailable to perform the duties and responsibilities under this part 4, all powers and authority granted to the security officer may be exercised by the chief information officer. (2) The chief information security officer shall: (a) Develop and update information security policies, standards, and guidelines for public agencies; (b) Promulgate rules pursuant to article 4 of this title containing information security policies, standards, and guidelines; (c) Ensure the incorporation of and compliance with information security policies, standards, and guidelines in the information security plans developed by public agencies pursuant to section 24-37.5-404; (d) Direct information security audits and assessments in public agencies in order to ensure program compliance and adjustments; (e) Establish and direct a risk management process to identify information security risks in public agencies and deploy risk mitigation strategies, processes, and procedures; (f) Approve or disapprove and review annually the information security plans of public agencies; (g) Conduct information security awareness and training programs; (h) In coordination and consultation with the office of state planning and budgeting and the chief information officer, review public agency budget requests related to information security systems and approve such budget requests for state agencies other than the legislative department; and (i) Coordinate with the Colorado commission on higher education for purposes of reviewing and commenting on information security plans adopted by institutions of higher education that are submitted pursuant to section 24-37.5-404.5 (3). (3) It is the intent of the general assembly that the cost of the services provided by the chief information security officer to a public agency be adequately funded in fiscal years commencing on and after July 1, 2007, through an appropriation to the public agency to pay for such services.

C.R.S. § 24-37.5-404 Public agencies - information security plans

24-37.5-404. Public agencies - information security plans. (1) On or before July 1 of each year, in accordance with the rules promulgated by the office in support of this part 4, each public agency shall develop an information security plan utilizing the information security policies, standards, and guidelines developed by the chief information security officer. The information security plan shall provide information security for the communication and information resources that support the operations and assets of the public agency. (2) The information security plan shall include: (a) Periodic assessments of the risk and magnitude of the harm that could result from a security incident; (b) A process for providing adequate information security for the communication and information resources of the public agency; (c) Regularized security awareness training to inform the employees and users of the public agency's communication and information resources about information security risks and the responsibility of employees and users to comply with agency policies, standards, and procedures designed to reduce those risks; (d) Periodic testing and evaluation of the effectiveness of information security for the public agency, which shall be performed not less than annually; (e) A process for detecting, reporting, and responding to security incidents consistent with the information security standards, policies, and guidelines issued by the chief information security officer; and (f) Plans and procedures to ensure the continuity of operations for information resources that support the operations and assets of the public agency in the event of a security incident. (3) On or before July 15 of each year, each public agency shall submit the information security plan developed pursuant to this section to the chief information security officer for approval. (4) In the event that a public agency fails to submit to the chief information security officer an information security plan on or before July 15 of each year or such plan is disapproved by the chief information security officer, the officer shall notify the governor, the chief information officer, and the head of the public agency of noncompliance with this section. If no plan has been approved by September 15 of each year, the chief information security officer shall be authorized to temporarily discontinue or suspend the operation of a public agency's communication and information resources until such plan has been submitted to or is approved by the officer. (5) and (6) (Deleted by amendment, L. 2011, (SB 11-062), ch. 128, p. 430, § 7, effective April 22, 2011.)

C.R.S. § 24-37.5-404.5 Institutions of higher education - information security plans

24-37.5-404.5. Institutions of higher education - information security plans. (1) Each institution of higher education, in coordination with the department of higher education, shall develop an information security program. The information security program shall provide information security for the communication and information resources that support the operations and assets of the institution of higher education. (2) The information security program shall include: (a) Periodic assessments of the risk and magnitude of the harm that could result from a security incident; (b) A process for providing adequate information security for the communication and information resources of the institution of higher education; (c) Information security awareness training to inform the employees, administrators, and users at the institution of higher education about the information security risks and the responsibility of employees, administrators, and users to comply with the institution's information security program and the policies, standards, and procedures designed to reduce the security risks; (d) Periodic testing and evaluation of the effectiveness of information security for the institution of higher education, which shall be performed not less than annually; (e) A process for detecting, reporting, and responding to security incidents consistent with the information security policy of the institution of higher education. The institutions of higher education, the Colorado commission on higher education, and the chief information security officer shall establish the terms and conditions by which the institutions of higher education shall report information security incidents to the chief information security officer. (f) Plans and procedures to ensure the continuity of operations for information resources that support the operations and assets of the institution of higher education in the event of a security incident. (3) (a) Every three years, in accordance with the schedule specified in subsection (3)(b) of this section, each institution of higher education shall submit to the department of higher education a report concerning the development and implementation of the institution's information security program and compliance with the requirements specified in subsection (2) of this section. Upon receipt of the reports, the department of higher education shall review the reports and subsequently submit the reports to the chief information security officer. (b) The department of higher education shall divide the institutions of higher education into three groups. Each institution of higher education shall submit the report required by subsection (3)(a) of this section as follows: (I) The institutions in the first group shall submit the report by July 1, 2020, and by July 1 every three years thereafter; (II) The institutions in the second group shall submit the report by July 1, 2021, and by July 1 every three years thereafter; and (III) The institutions in the third group shall submit the report by July 1, 2022, and by July 1 every three years thereafter. (4) Nothing in this section shall be construed to require any institution of higher education or the department of higher education to adopt policies or standards that conflict with federal law, rules, or regulations or with contractual arrangements governed by federal laws, rules, or regulations. (5) and (6) (Deleted by amendment, L. 2011, (SB 11-062), ch. 128, p. 431, § 8, effective April 22, 2011.) (7) (Deleted by amendment, L. 2011, (HB 11-1301), ch. 297, p. 1422, § 13, effective August 10, 2011.)

C.R.S. § 24-37.5-404.7 General assembly - information security plans

24-37.5-404.7. General assembly - information security plans. (1) The general assembly shall develop an information security plan. The information security plan shall provide information security for the communication and information resources that support the operations and assets of the general assembly. (2) The information security plan shall include: (a) Periodic assessments of the risk and magnitude of the harm that could result from a security incident; (b) A process for providing adequate information security for the communication and information resources of the general assembly; (c) Information security awareness training for regular employees of the general assembly; (d) Periodic testing and evaluation of the effectiveness of information security for the general assembly, which shall be performed not less than annually; (e) A process for detecting, reporting, and responding to security incidents consistent with the information security policy of the general assembly. The general assembly and the chief information security officer shall establish the terms and conditions by which the general assembly shall report information security incidents to the chief information security officer. (f) Plans and procedures to ensure the continuity of operations for information resources that support the operations and assets of the general assembly in the event of a security incident. (3) The legislative service agency directors shall maintain the information security plan pursuant to this section and keep the joint technology committee advised of the plan. (4) Nothing in this section shall be construed to require the general assembly to adopt policies or standards that conflict with federal law, rules, or regulations or with contractual arrangements governed by federal laws, rules, or regulations. (5) The general assembly shall provide regularized security awareness training to inform the regular legislative employees, administrators, and users about the information security risks and the responsibility of employees, administrators, and users to comply with the general assembly's information security plan and the policies, standards, and procedures designed to reduce those risks.

C.R.S. § 24-37.5-405 Security incidents - authority of chief information security officer

24-37.5-405. Security incidents - authority of chief information security officer. (1) A security incident in a public agency shall be reported to the chief information security officer in accordance with state incident reporting policies, standards, and guidelines. (2) The chief information security officer shall be authorized to temporarily discontinue or suspend the operation of a public agency's communication and information resources in order to isolate the source of a security incident. The officer shall give notice to the governor, or the lieutenant governor in the event the governor is not available, the chief information officer, and the head of the public agency concurrent with such discontinuation or suspension of operations. The officer shall ensure, to the extent possible, the continuity of operations for the communication and information resources that support the operations and assets of the public agency. (3) The chief information security officer may enter into contracts with a private person or entity to assist with resolving a security incident in a public agency. The officer shall establish an approved list of certified private persons and entities that may provide contract services in the event of a security incident. The officer shall establish criteria for the placement of private persons and entities on the list and shall select such persons and entities for placement on the list utilizing a request for proposals containing such criteria. (4) Public agencies shall comply and cooperate with a directive of the chief information security officer pursuant to subsection (2) of this section to temporarily discontinue or suspend the operation of a public agency's communication and information resources.

C.R.S. § 24-37.5-407 Cyber coding cryptology for the transmission and storage of state records - legislative declaration - intent

24-37.5-407. Cyber coding cryptology for the transmission and storage of state records - legislative declaration - intent. (Repealed)

C.R.S. § 24-37.5-701 Legislative declaration - intent

24-37.5-701. Legislative declaration - intent. (1) The general assembly hereby finds and declares that: (a) Each state agency, through the provisions of governmental services, collects a significant amount of data about persons having interactions with the state agency; (b) A unified statewide data governance framework will enhance the effectiveness and efficiency of government services by promoting greater collaboration, innovation, and agility in government operations through data-sharing between state agencies; (c) A robust and consistent program of information sharing across state agencies that prioritizes interoperability and privacy will enable the state to meet its current challenges and to leverage data to improve the health and quality of life for Coloradans; and (d) The privacy of Coloradans must remain a central tenet in the state's information sharing program. With the increase of attacks on sensitive data held by public and private entities, information security is critically important. Fundamental data management principles, such as data minimization, not only protect the privacy of Coloradans, but reduce the state's risk in the event of a security incident. (2) It is the intent of the general assembly to encourage information sharing across state agencies, including the department of law, the department of state, and the department of the treasury, which are principal departments headed by independently elected constitutional officers.

C.R.S. § 24-37.5-702 Government data advisory board - created - duties - definition

24-37.5-702. Government data advisory board - created - duties - definition. (1) (a) There is hereby created in the office the government data advisory board, which consists of the members specified in this subsection (1). (b) The chief information officer, or his or her designee, shall serve as an ex officio member and chair of the advisory board. (c) (I) The remaining membership of the advisory board consists of persons from state agencies who are either experts in data or responsible for diverse aspects of data management within the member's respective department and who are selected by the head of the member's respective department to participate on the advisory board at the invitation of the chief information officer. (II) The chief information officer shall invite the commissioner of the behavioral health administration to select a member to represent the behavioral health administration on the advisory board. (d) Notwithstanding the provisions of subsection (1)(c) of this section, at the invitation of the chief information officer, additional members who meet the qualifications specified in subsection (1)(c) of this section may be selected to participate on the advisory board as follows: (I) The governor, as he or she deems appropriate, may select a member from one or more political subdivisions of the state, including a city, county, city and county, or special purpose authority; (II) The secretary of state, attorney general, and state treasurer may each select a member from his or her department as he or she deems appropriate; (III) The chief justice of the supreme court, as he or she deems appropriate, may select a member from the judicial department; and (IV) The speaker of the house of representatives and the president of the senate may jointly select a member of the joint technology committee created in section 2-3-1702. (2) (a) The chief information officer, or his or her designee, shall schedule the first meeting of the advisory board and schedule succeeding meetings of the advisory board as necessary to complete the advisory board's duties specified in this section. (b) The office shall provide technical assistance and support, to the extent practicable within existing resources, to assist the advisory board in completing the duties specified in subsection (3) of this section. (3) The advisory board shall: (a) Develop and update a standard lexicon for data-sharing and data governance, to ensure data providers and recipients have a clear and consistent understanding of the requirements and expectations related to data-sharing; (b) Collect annual feedback from state agencies to inform any policies, procedures, and technical infrastructure implemented by the office to enable data-sharing between state agencies in accordance with all applicable laws, rules, and regulations; (c) Create and update standard templates for interagency data-sharing and data-access agreements; (d) Identify and document best practices and standards for how state agencies should perform data management; (e) Provide recommendations to address existing barriers to effective data-sharing, subject to all applicable federal and state laws, rules, and regulations; and (f) Identify other potential areas of risk related to data management and sharing and create ways to manage that risk. (4) On or before November 1, 2021, and on or before November 1 each year thereafter, the chief information officer, in partnership with the advisory board, shall submit a yearly report to the joint technology committee of the general assembly established in section 2-3-1702. The report shall: (a) Outline the accomplishments within the advisory board's duties; (b) Provide recommendations for future work; and fore November 1, 2021, and on or before November 1 each year thereafter, the chief information officer, in partnership with the advisory board, shall submit a yearly report to the joint technology committee of the general assembly established in section 2-3-1702. The report shall: (a) Outline the accomplishments within the advisory board's duties; (b) Provide recommendations for future work; and (c) Outline the progress of sharing data among state agencies and entities and with local governments and nongovernmental organizations. (5) For the purposes of this part 7, "state agency" means each principal department of the executive department of state government identified in section 24-1-110, including each board, commission, division, unit, office, or other subdivision within each department, each office, agency, board, or commission within the governor's office, each state-supported institution of higher education, and each local district college.

C.R.S. § 24-37.5-703 Interdepartmental data protocol - contents

24-37.5-703. Interdepartmental data protocol - contents. (1) The chief information officer, or the chief information officer's designee, in coordination with the government data advisory board, must publish on or before November 1, 2022, an interoperability data framework and protocol aimed at promoting interoperability of data models across state agencies, with the goal of minimizing duplication of records, enhancing security, and increasing the state's capability to monitor and audit data-sharing transactions. At a minimum, the interoperability data framework shall: (a) Include the protocol and procedures to be used by state agencies in data management; and (b) Be designed to ensure that data collected by different state agencies can be matched and discrepancies in the data processing are reconciled to accurately identify data pertaining to the same record without allowing any permanent sharing of personal identifying information. (2) The protocol and procedures included in the interdepartmental data protocol by which state agencies may share data and by which a state agency may release data to a political subdivision or to a nongovernmental organization shall prioritize and coordinate data management and protection efforts across state agencies to maximize the privacy and protection of all data and to reduce the risk of public exposure of private or protected data. This includes but is not limited to: (a) Defining processes for managing data throughout the data management lifecycle; (b) Establishing the circumstances under which and the reasons that a state agency may share information with another state agency, a political subdivision, or a nongovernmental organization; (c) Ensuring compliance with all state and federal laws and regulations concerning the privacy of information, including but not limited to the federal "Family Educational Rights and Privacy Act of 1974", 20 U.S.C. sec. 1232g, and the federal "Health Insurance Portability and Accountability Act of 1996", 42 U.S.C. sec. 1320d to 1320d-9; and (d) Establishing a protocol that secures all personal identifying information collected and developing standards to minimize the collection of personal identifying information. (3) Notwithstanding any provision of this section, the interdepartmental data protocol shall not prohibit the release or sharing of data as required by federal or state laws including, but not limited to, the "Colorado Open Records Act", part 2 of article 72 of this title 24 or as required to comply with a court-issued subpoena, warrant, or order. In addition, the interdepartmental data protocol is not intended to prevent the sharing of data as permitted by existing contracts or agreements entered into by state agencies that comply with all applicable laws. Any sharing of data with nongovernmental organizations or individuals that is permitted, but not required, by state or federal laws, must be subject to a written agreement containing sufficient terms to protect against any unauthorized or unlawful access or release of any personal identifying information or to protect the confidentiality of nonpublic information that may be shared with such parties.

C.R.S. § 24-37.5-704 Data-sharing - authorization

24-37.5-704. Data-sharing - authorization. (1) Except as specifically prohibited by state or federal laws, and in accordance with applicable state and federal privacy laws and policies, each state agency is authorized, in accordance with the provisions of the interdepartmental data protocol, to share data collected in the course of performing its powers and duties with the following entities: (a) Other state agencies; (b) The legislative and judicial departments; (c) Political subdivisions; and (d) Nongovernmental organizations and individuals. (2) Except as specifically prohibited by state or federal law, the department of law, and in accordance with applicable state and federal privacy laws and policies, the department of state, and the department of the treasury are authorized, in accordance with either the provisions of their own data-sharing protocol or the interdepartmental data protocol, to share data collected in the course of performing the department's powers and duties with the following entities: (a) Other state agencies; (b) The legislative and judicial departments; (c) Political subdivisions; and (d) Nongovernmental organizations and individuals. (3) In order to further the development and implementation of the interdepartmental data protocol, each state agency shall: (a) Provide input and coordinate with the office and the government data advisory board as necessary to support the development of the necessary data governance framework and protocol described in subsections (1) and (2) of this section; (b) Conduct an inventory of its own data assets, including sensitivity and classification, and provide the inventory to the office; (c) Develop a process for ongoing monitoring of new data acquired by the state agency and establish a data retention policy for all data; and (d) Create a plan and work to implement the interoperability data framework and protocol published by the office for the purpose of minimizing duplication of records, enhancing security, and increasing the state's capability to monitor and audit data-sharing transactions.

C.R.S. § 24-37.5-705 Interdepartmental data protocol cash fund - created - legislative intent - repeal

24-37.5-705. Interdepartmental data protocol cash fund - created - legislative intent - repeal. (Repealed)

C.R.S. § 24-37.5-801 Information technology asset inventory - refresh cycle schedule - report

24-37.5-801. Information technology asset inventory - refresh cycle schedule - report. On or before November 1 each year, the office shall submit a report to the members of the joint budget committee and the joint technology committee of the general assembly regarding the office's information technology asset inventory and the office's refresh cycle schedule, including cost projections. The office shall include in the report operating systems and productivity software, network infrastructure servers, and nonproductivity software.

C.R.S. § 24-37.5-802 Information technology budget requests - working group - report

24-37.5-802. Information technology budget requests - working group - report. (1) The office, in conjunction with the office of state planning and budgeting, shall create a working group to annually evaluate and prioritize all potential information technology-related budget requests from state executive branch agencies for the applicable fiscal year. The working group shall prioritize such requests prior to submitting funding proposals to the joint budget committee on November 1 of each year. The working group shall prioritize information technology-related requests beginning with requests for the 2015-16 fiscal year. (2) On or before November 1, 2014, and on or before November 1 each year thereafter, the office shall submit a report to the joint budget committee and the joint technology committee that provides the prioritized list created pursuant to subsection (1) of this section of all information technology requests that state executive branch agencies submitted for the applicable fiscal year. The report shall include the following: (a) The name of each project for which a request is made and the purpose of the project; (b) The initial and continuing costs associated with each project for which a request is made; and (c) The project's adherence to the standards and policies issued by the office.

C.R.S. § 24-37.5-803 State information technology resources - independent evaluation and recommendations - report - repeal

24-37.5-803. State information technology resources - independent evaluation and recommendations - report - repeal. (Repealed)

C.R.S. § 24-37.5-804 Transfer of information technology infrastructure ownership - working group - report

24-37.5-804. Transfer of information technology infrastructure ownership - working group - report. (Repealed)

C.R.S. § 24-37.5-805 Technical debt environment - annual report

24-37.5-805. Technical debt environment - annual report. On or before November 1, 2025, and on or before November 1 of each year thereafter, the office shall submit a report to the joint budget committee and the joint technology committee that provides an estimate of the state's technical debt environment.

C.R.S. § 24-37.5-901 Legislative declaration

24-37.5-901. Legislative declaration. (1) The general assembly hereby finds and determines that: (a) The development of fast, affordable, and accessible broadband internet service throughout the state will: (I) Drive job creation; (II) Promote innovation; (III) Improve the economic vitality of various industries throughout the state and the state as a whole; and (IV) Expand markets for Colorado businesses; (b) Improved broadband access will help serve the ongoing and growing needs of Colorado's education, health-care, and public safety systems; industries; businesses; governmental operations; and citizens; and (c) Communities in unserved areas of the state need access to broadband to help overcome economic, health-care, education, and government-access inequities arising from their diminished ability to access broadband. (2) The general assembly declares that it is important to create the Colorado broadband office to serve as a central governmental entity to plan and coordinate with other state, public, and private entities and citizens throughout the state to develop and implement statewide broadband deployment and access strategies and programs that seek to advance the goals listed in subsection (1) of this section.

C.R.S. § 24-37.5-902 Definitions

24-37.5-902. Definitions. As used in this part 9, unless the context otherwise requires: (1) "Colorado broadband office" or "broadband office" means the Colorado broadband office created in section 24-37.5-903 (1). (2) "Community anchor institution" means a: (a) School; (b) Library; (c) Hospital or other health-care facility licensed or certified pursuant to section 25-1.5-103; (d) Law enforcement, emergency medical service provider, or other public safety agency; or (e) Community support organization, agency, or local government facility that provides outreach, access, equipment, or support services to facilitate greater use of broadband throughout the community, especially greater use by vulnerable populations within the community, such as low-income, unemployed, and senior populations. (3) "Device" means an electronic device that enables access to or use of the internet. (4) "Digital inclusion grant program" or "grant program" means the digital inclusion grant program created in section 24-37.5-904 (1). (5) "Digital inclusion grant program fund" or "fund" means the fund created in section 24-37.5-904 (2) for use by the broadband office for implementing the grant program. (6) "Digital literacy" means the ability to use technologies to find, evaluate, analyze, create, and communicate information. (7) "Last-mile broadband infrastructure" means broadband infrastructure that delivers an internet connection to an end user. (8) "Local government" means a statutory or home rule municipality, county, city and county, council of governments, or metropolitan district that lies wholly within the unincorporated part of a county. (9) "Metropolitan district" has the meaning set forth in section 32-1-103 (10). (10) "School" means a state institution of higher education as defined in section 23-1-108 (7)(g)(II) including the Auraria higher education center governed pursuant to article 70 of title 23, a school district created pursuant to article 30 of title 22, a charter school authorized pursuant to part 1 of article 30.5 of title 22, the state charter school institute established in section 22-30.5-503, an institute charter school authorized pursuant to part 5 of article 30.5 of title 22, a board of cooperative services created pursuant to article 5 of title 22, an adult education provider as defined in section 22-10-103 (1.5) but excluding a private provider, or an Indian tribe or nation that operates a public school in Colorado. (11) "Telehealth" has the meaning set forth in section 10-16-123 (4)(e). (12) "Unserved area" has the meaning set forth in section 40-15-102 (32).

C.R.S. § 24-37.5-903 Colorado broadband office - creation - responsibilities - gifts, grants, or donations

24-37.5-903. Colorado broadband office - creation - responsibilities - gifts, grants, or donations. (1) The Colorado broadband office is hereby created in the office. The Colorado broadband office is a type 1 entity and exercises its powers and performs its duties and functions under the office. (2) (a) The chief information officer shall appoint the director of the broadband office. The director may employ staff as necessary to carry out the powers and duties of the broadband office, subject to the availability of appropriations to the office for use by the broadband office. (b) The broadband office shall provide technical assistance to applicants seeking grant awards from the grant program or other state or federal grant opportunities offered for deploying broadband service. (c) In carrying out its powers and duties, the broadband office may collaborate with other state agencies, local governments, broadband experts, and other interested parties. (3) The broadband office shall: (a) Encourage, foster, develop, and strive to improve the availability of affordable, quality broadband within the state; (b) Serve as the central broadband policy coordination body for the state; (c) Coordinate with other state agencies, local governments, the federal government, Indian tribes and nations, other relevant broadband partners, and consumers throughout the state to develop strategies and plans for promoting the deployment of broadband infrastructure and greater broadband access; (d) Review existing state broadband initiatives, policies, and deployment by public or private entities in order to prioritize investment; (e) Develop and implement a statewide plan to encourage cost-effective broadband access and increased broadband usage, particularly in rural unserved areas and other unserved areas of the state. The broadband office shall submit the statewide plan, and any updated versions of the statewide plan, to the chief information officer, the governor, and the joint technology committee and shall post the statewide plan on its public website. In developing a statewide plan and any other strategies for broadband deployment, the broadband office shall consider: (I) Partnerships between communities; Indian tribes and nations; nonprofit organizations; local governments; electric utilities as defined in section 40-2-202 (1), cooperative electric associations as defined in section 40-9.5-102, municipally owned utilities, and nonprofit generation and transmission electric corporations or associations; rural telecommunications providers as defined in section 40-15-102 (24.5); and public and private entities; (II) Funding opportunities that allow for the coordination of public funding sources, including local governments, state government, and the federal government, and private funding sources for the purpose of deploying broadband into rural unserved areas and other unserved areas of the state; (III) Barriers to the deployment, adoption, and utilization of broadband, including a consideration of the affordability of broadband; and (IV) Statewide broadband goals and whether statutory definitions for broadband in unserved areas need to be updated in response to advances made in broadband technology. (f) Collect broadband data to create and update maps that measure the progress of broadband deployment in the state; (g) Encourage public-private partnerships to increase deployment of broadband throughout the state; and d; and (IV) Statewide broadband goals and whether statutory definitions for broadband in unserved areas need to be updated in response to advances made in broadband technology. (f) Collect broadband data to create and update maps that measure the progress of broadband deployment in the state; (g) Encourage public-private partnerships to increase deployment of broadband throughout the state; and (h) In furtherance of the purposes set forth in this part 9, seek or apply for, accept, and expend: (I) Gifts, grants, or donations from public or private sources; and (II) Money from the federal government for broadband deployment. The broadband office may seek and apply for all federal funds for which the broadband office is eligible to receive. (4) (a) Subject to the requirement set forth in subsection (4)(b)(II) of this section, the broadband office may receive consumer complaints regarding broadband service. (b) (I) The chief information officer may seek, accept, and expend gifts, grants, or donations from public and private sources for the purpose of implementing this subsection (4). The chief information officer shall transmit any gifts, grants, or donations received pursuant to this subsection (4) to the state treasurer who shall credit the money to the digital inclusion grant program fund. (II) The broadband office shall not implement this subsection (4) until sufficient funding is received from gifts, grants, or donations to implement this subsection (4). (5) In addition to the powers and functions set forth in subsections (3) and (4) of this section, the broadband office shall implement the digital inclusion grant program.

C.R.S. § 24-37.5-904 Digital inclusion grant program - income-eligible household reimbursement program - creation - award criteria - digital inclusion grant program fund - definition - reporting - repeal

24-37.5-904. Digital inclusion grant program - income-eligible household reimbursement program - creation - award criteria - digital inclusion grant program fund - definition - reporting - repeal. (1) (a) The digital inclusion grant program is created for the purpose of advancing the state's digital inclusion priorities, which priorities include: (I) Increasing broadband usage and access to broadband throughout the state; (II) Improving the reliability and availability of broadband on tribal lands; (III) Enhancing digital literacy; and (IV) Making access to broadband more affordable. (b) The Colorado broadband office shall implement the grant program. During the 2020-21 state fiscal year, the broadband office shall award: (I) Grants totaling up to twenty million dollars to one or more Indian tribes or nations for the purpose of deploying additional infrastructure on tribal lands and providing devices to Indian tribes or nations; and (II) Grants totaling up to ten million dollars to one or more providers of telehealth services; except that, if pursuant to subsection (1.5)(e) of this section, the broadband office does not implement the reimbursement program created in subsection (1.5) of this section, the broadband office shall award grants totaling up to fifteen million dollars to one or more providers of telehealth services. (c) In reviewing grant applications and awarding grants pursuant to this section, the broadband office is encouraged to consult with the Colorado office of economic development created in section 24-48.5-101 (1), the department of local affairs, the department of regulatory agencies, the department of transportation, and any other agencies, organizations, or individuals with broadband expertise. (d) A grant award recipient other than an Indian tribe or nation shall not use the grant money for the deployment of last-mile broadband infrastructure. (e) With respect to grants awarded pursuant to subsection (1)(b)(I) of this section and from money transferred to the digital inclusion grant program fund from the economic recovery and relief cash fund created in section 24-75-228 (2)(a), grants may only be awarded for broadband projects that, pursuant to treasury department interim regulations implementing the federal "American Rescue Plan Act of 2021", Pub.L. 117-2, provide broadband infrastructure that is designed to provide service to unserved or underserved households and businesses and that is designed to, upon completion: (I) Reliably meet or exceed symmetrical one hundred megabits per second download and upload speeds; or (II) In cases where it is not practicable, because of the excessive cost of the project or geography or topography of the area to be served by the project, provide service meeting the standards set forth in subsection (1)(e)(I) of this section that: (A) Reliably meets or exceeds one hundred megabits per second download speed and is between at least twenty megabits per second and one hundred megabits per second upload speed; and (B) Is scalable to a minimum of one hundred megabits per second download speed and one hundred megabits per second upload speed. (f) If the treasury department modifies its interim regulations implementing the federal "American Rescue Plan Act of 2021", Pub.L. 117-2, grants awarded pursuant to subsection (1)(e) of this section may only be awarded for broadband projects that comply with the modified federal regulations. nimum of one hundred megabits per second download speed and one hundred megabits per second upload speed. (f) If the treasury department modifies its interim regulations implementing the federal "American Rescue Plan Act of 2021", Pub.L. 117-2, grants awarded pursuant to subsection (1)(e) of this section may only be awarded for broadband projects that comply with the modified federal regulations. (g) As used in subsection (1)(e) of this section, "unserved or underserved households and businesses" means one or more households or businesses that are not currently served by a wireline connection that reliably delivers at least twenty-five megabits per second downstream and three megabits per second upstream. (1.5) (a) On or before January 1, 2022, and subject to subsections (1.5)(d) and (1.5)(e) of this section, the broadband office shall contract with a nonprofit organization, preferably a nonprofit organization that has an existing platform or system for administering grant money, has experience in administering income-qualified utility assistance programs, and has experience in verifying income for statewide assistance programs, to develop a program, referred to in this subsection (1.5) as the "program", to make access to broadband service more affordable by reimbursing Colorado subscribers for costs incurred in accessing broadband service. In choosing a nonprofit organization with which to contract, the broadband office need not comply with the "Procurement Code", articles 101 to 112 of this title 24. Households that are income eligible to participate in the program are those households that: (I) Have a household income that does not exceed the higher of two hundred percent of the federal poverty level or eighty percent of the area median income; or (II) Are located in critically unserved areas of the state. A household is eligible for reimbursement under this subsection (1.5)(a)(II) only: (A) For broadband service provided by a satellite provider; and (B) With respect to the household's primary residence. (b) A household meeting the criteria set forth in subsection (1.5)(a) of this section may apply to the program annually in the form and manner determined by the broadband office to request reimbursement to cover up to one-half of the cost of broadband service, not to exceed a total reimbursement of six hundred dollars per year. A household that receives reimbursement pursuant to this subsection (1.5)(b) must demonstrate that it still meets the criteria set forth in subsection (1.5)(a) of this section to receive reimbursement in a subsequent year. (c) With regard to the nonprofit organization with which the broadband office contracts to administer the program, the broadband office shall direct that the nonprofit organization: (I) Use a portion of the money transmitted to the nonprofit organization for implementing the program to cover its direct and indirect costs in administering the program; and (II) Periodically report to the broadband office, in a form and manner determined by the broadband office, regarding its administration of the program. (d) The broadband office, in consultation with the nonprofit organization with which it contracts to implement the program, may explore alternative mechanisms for payment assistance for income-eligible households if the broadband office determines that a reimbursement program is not cost-effective. If the broadband office adopts an alternative mechanism for providing payment assistance under this subsection (1.5)(d), the broadband office shall include a description of the mechanism chosen as part of its reporting requirements under subsection (1.5)(g) of this section. istance for income-eligible households if the broadband office determines that a reimbursement program is not cost-effective. If the broadband office adopts an alternative mechanism for providing payment assistance under this subsection (1.5)(d), the broadband office shall include a description of the mechanism chosen as part of its reporting requirements under subsection (1.5)(g) of this section. (e) If the broadband office does not find a nonprofit organization with which to contract to implement the program, the program shall not be implemented and the broadband office shall use the money allocated for implementation of the program to award additional grants for telehealth services under subsection (1)(b)(II) of this section. (f) (I) The broadband office and the nonprofit with which it contracts may use up to five million dollars of the money transferred pursuant to subsection (1)(e) of this section to the digital inclusion grant program fund from the economic recovery and relief cash fund created in section 24-75-228 (2)(a) to implement the program, including the money required to cover the broadband office's and the nonprofit organization's administrative costs incurred in implementing the program. The broadband office and the nonprofit organization may use up to five hundred thousand dollars per year to cover their direct and indirect costs in administering the program. (II) All money used for implementation of the program must be obligated and spent in accordance with section 24-75-226 (4)(d). (g) On or before February 1, 2022, and on or before February 1 each year thereafter, the broadband office shall submit a written report to the governor and the general assembly's joint budget committee and joint technology committee regarding the broadband office's implementation of the program. Reports submitted pursuant to this subsection (1.5)(g) must include: (I) The number of households receiving assistance under the program in the previous calendar year; and (II) Recommendations on how to make the program more successful, including any legislative changes needed to improve the success of the program. (h) This subsection (1.5) is repealed, effective September 1, 2026. (2) (a) The digital inclusion grant program fund is hereby created in the state treasury and consists of money the state received from the federal coronavirus state fiscal recovery fund created in the federal "American Rescue Plan Act of 2021", Pub.L. 117-2; money transferred to the fund from the ARPA refinance state money cash fund pursuant to section 24-75-226.5; and any money that the general assembly may appropriate to the fund. Within three days after June 28, 2021, the state treasurer shall transfer thirty-five million dollars from the economic recovery and relief cash fund created in section 24-75-228 (2)(a) to the fund for use by the broadband office for the purpose of reviewing and awarding grants under the grant program. The money in the fund is subject to appropriation by the general assembly. (b) On June 1, 2023, the state treasurer shall transfer eight million dollars from the digital inclusion grant program fund to the revenue loss restoration cash fund created in section 24-75-227. (3) (a) On or before January 1, 2022, and notwithstanding section 24-1-136 (11)(a)(I), the Colorado broadband office shall submit a written report to the governor and the general assembly's joint budget committee and joint technology committee regarding the broadband office's implementation of the grant program. After submitting the initial report, the broadband office shall submit subsequent reports regarding the grant program to the same parties within six months after the end of any state fiscal year in which the broadband office awards one or more grants from the fund. assembly's joint budget committee and joint technology committee regarding the broadband office's implementation of the grant program. After submitting the initial report, the broadband office shall submit subsequent reports regarding the grant program to the same parties within six months after the end of any state fiscal year in which the broadband office awards one or more grants from the fund. (b) Reports submitted pursuant to this subsection (3) must include: (I) For each project awarded grant money under the grant program: (A) A description of the project; (B) A summary of the progress made on the project; (C) The estimated completion date for the project or, if already completed, the date of completion; (D) A map of the area to be served or already served by the project; (E) The percentage of customers who activated broadband through the broadband network provided by the project after a broadband connection was created under the project to their home or entity and the measurable speeds made available to them; (F) The type of technology deployed or used for broadband provided through the project; and (G) The number of households, community anchor institutions, municipalities, and counties served by the project; (II) The number of applicants to the grant program, the amounts of grant money requested by each applicant, the number of grants awarded under the grant program, and the amounts of grant money awarded to each applicant under the grant program; and (III) The amount of money expended from the fund versus the amount of money obligated but not yet expended from the fund.

C.R.S. § 24-37.5-905 Broadband deployment - grant program - high cost support mechanism money - broadband office administrative fund - creation - criteria - rules - reports - definitions - repeal

24-37.5-905. Broadband deployment - grant program - high cost support mechanism money - broadband office administrative fund - creation - criteria - rules - reports - definitions - repeal. (1) As used in this section, unless the context otherwise requires: (a) "Broadband" has the meaning set forth in section 40-15-102. (b) "Broadband network" has the meaning set forth in section 40-15-102. (c) "Commission" means the public utilities commission created in section 40-2-101. (d) "HCSM" means the high cost support mechanism created pursuant to section 40-15-208. (e) "Incumbent provider" has the meaning set forth in section 40-15-102 (9.5). (f) "Middle mile infrastructure" has the meaning set forth in 47 U.S.C. sec. 1741 (a)(9), as amended. (2) (a) The broadband office shall administer a broadband deployment grant program in accordance with this section. The broadband office shall direct the commission to authorize a third-party contractor of the HCSM to disburse money from the HCSM for broadband deployment grants approved by the broadband office. The commission shall authorize disbursements of money from the HCSM for broadband deployment grants only as directed by the broadband office. (b) (I) The broadband office may allocate money from the HCSM for the deployment of broadband in unserved and underserved areas of the state pursuant to this section and section 40-15-208 through the use of the HCSM surcharge and surcharge rate in effect on January 1, 2018. In determining the definition of unserved and underserved areas, the standards used by the broadband office must be consistent with broadband benchmark standards and any revisions to the standards, as determined by the federal communications commission and the national telecommunications and information administration in the United States department of commerce. Pursuant to sections 40-15-207 and 40-15-208, the commission shall determine the funds available for broadband deployment from the HCSM money. The HCSM third-party contractor shall maintain and hold the money available for broadband deployment in a separate account from the money used for basic voice service. Money held for broadband deployment must not be disbursed for basic voice service, and money held for basic voice service must not be disbursed for broadband deployment. (II) To maximize the efficacy of the grant program, the broadband office may use HCSM money allocated for broadband deployment pursuant to this subsection (2) and section 40-15-208 in order to conduct, or cause to be conducted, studies to assess broadband needs in the state. (3) (a) Up to five percent of the money allocated from the HCSM for broadband deployment may be used to cover the broadband office's direct and indirect costs to administer the grant program, including to cover staffing costs for the grant program. Money that is allocated for such purposes is credited to the broadband office administrative fund, which fund is created in the state treasury. The fund consists of all money allocated from the HCSM for the broadband office's administration of the grant program and all money that the general assembly may appropriate or transfer to the fund. The money in the fund is continuously appropriated for the purposes set forth in this section. All interest earned from the investment of money in the fund is credited to the fund. All money not expended at the end of a state fiscal year remains in the fund and does not revert to the general fund or any other fund. (b) Except as required to comply with subsections (2)(b)(II) and (3)(a) of this section, the broadband office shall not award itself money from the HCSM. forth in this section. All interest earned from the investment of money in the fund is credited to the fund. All money not expended at the end of a state fiscal year remains in the fund and does not revert to the general fund or any other fund. (b) Except as required to comply with subsections (2)(b)(II) and (3)(a) of this section, the broadband office shall not award itself money from the HCSM. (c) The broadband office shall prohibit grant recipients from using grant money to subsidize expenses associated with telecommunications operational expenses, with the exception of a one-time technology and innovation expense and regulatory compliance. (4) On or before December 31, 2024, the broadband office shall establish grant program criteria and guidelines for awarding HCSM money for new projects to expand broadband access and to increase broadband affordability in the state, which criteria and guidelines must include: (a) The establishment of a two-tiered grant program that prioritizes funding as follows: (I) Up to sixty percent of available grant money must be used to finance tier one projects for middle mile infrastructure; and (II) Up to forty percent of available grant money must be used to finance tier two projects and otherwise underfunded broadband needs, including, but not limited to: (A) Pole replacements and attachments, line extensions, long drops, network upgrades that strengthen cybersecurity, and network infrastructure, including wireline and wireless facilities such as towers and satellite infrastructure; and (B) Digital equity initiatives to help close the digital divide in the state, including initiatives for basic internet access, computer and device distribution, digital literacy training, and broadband workforce development training; (b) The following minimum requirements for projects that are awarded grant money: (I) Support for broadband deployment in unserved or underserved areas; (II) Speed requirements; (III) Matching funding requirements; (IV) Applicant eligibility requirements; (V) Generally accepted industry reliability and performance standards; (VI) Timelines for completion of a project; (VII) Reasonable cost requirements for a project; (VIII) Compliance standards; and (IX) Reporting and accountability requirements; and (c) The following criteria for reviewing and prioritizing applicants' proposed projects: (I) The purpose and project impacts; (II) The geographic distribution of broadband deployment; (III) Broadband network redundancy, diversity, and latency; (IV) Broadband network speeds; (V) The amount of matching money available; (VI) The cost-effectiveness of the project; (VII) The amount of support the project would provide for low-income households; and (VIII) The extent to which the project would support critically unserved areas. (5) In establishing the grant program, the broadband office shall: (a) Solicit input from the general public and various stakeholders, including at least the following groups of stakeholders: (I) Industry associations; (II) Local governments; (III) Tribal governments; (IV) Other state agencies; (V) Federal agencies; (VI) Broadband consumers; and (VII) Other key stakeholders that the broadband office identifies; (b) Create a work group, including the external stakeholders identified in subsection (5)(a) of this section, to help review grant applications and recommend projects for grant awards; (c) Establish a formal appeals process for grant applications that are not awarded grants. The sole remedy for an applicant that prevails on appeal is the financing of the applicant's proposed project in the current or next fiscal year, subject to the availability of money in the HCSM. in subsection (5)(a) of this section, to help review grant applications and recommend projects for grant awards; (c) Establish a formal appeals process for grant applications that are not awarded grants. The sole remedy for an applicant that prevails on appeal is the financing of the applicant's proposed project in the current or next fiscal year, subject to the availability of money in the HCSM. (d) As part of a grant application that an applicant files or as part of an appeal of a grant decision that an appellant files, require that the applicant or appellant include a speed test performed: (I) On an incumbent provider's broadband network; and (II) In accordance with industry-standard speed-test protocols identified by the federal communications commission; (e) Include a formal process by which the broadband office, eligible applicants, and incumbent providers may challenge or appeal an applicant's data included in the application to prevent the financing of projects that would cause overbuild or duplication of federal or other state funding; and (f) Establish a process for ensuring that projects that are awarded grants comply with all state and federal broadband deployment reporting obligations. (6) Pursuant to section 24-37.5-106 (4), the chief information officer may promulgate rules to implement this section and shall specifically consider promulgating rules to implement subsections (2), (4), and (5) of this section. (7) The broadband office may contract with a third party to perform administrative functions related to administering the grant program. (8) Notwithstanding section 24-1-136 (11)(a)(I), on or before January 1, 2025, and on or before January 1 of each year thereafter, the broadband office shall submit an annual report to the joint budget committee and the joint technology committee, or their successor committees, summarizing for the previous calendar year: (a) The broadband office's grant activities; and (b) HCSM expenditures made for broadband deployment. (9) This section is repealed, effective September 1, 2030. Before the repeal, this section is scheduled for review in accordance with section 24-34-104.
Source: Open US Law by Vaquill AI (CC BY 4.0)URL: https://leg.colorado.gov/sites/default/files/images/olls/crs2024-title-24.docxFetched: 10/6/2026