SB 17-304

Abstract

Joint Technology Committee. The bill adds definitions of 'cybersecurity' and 'data privacy' for the purposes of the joint technology committee (committee). In addition, the bill modifies the definition of 'oversee' for the purposes of the committee to be consistent with other statutory provisions. The bill adds to the powers and duties of the committee the authority to request information and presentations regarding data privacy and cybersecurity within state agencies and the authority to coordinate with the Colorado cybersecurity council created in the department of public safety. In addition, the committee may consider: Whether state agencies are collecting or retaining data that exceeds what is necessary and appropriate for such agencies to perform their functions; Who has access to data, the extent of such access, and appropriate mechanisms to protect sensitive data; and Measures to protect data against unauthorized access, disclosure, use, modification, or destruction. Currently, the committee is required to review and may make recommendations to other legislative committees on any legislative measure that the speaker of the house of representatives or the president of the senate determines to be dealing with information technology. The bill specifies that this requirement includes data privacy and cybersecurity. The bill also specifies that the committee may request to review and make recommendations to other legislative committees on any legislative measure that the committee determines to be dealing with information technology, data privacy, or cybersecurity. Pursuant to current law, the committee will repeal on July 1, 2018. The bill eliminates the repeal of the committee. The bill requires the office of state planning and budgeting to design and prepare, in coordination with the staff of the committee, the forms and instructions to be used in preparation of all budget requests and supplemental budget requests submitted to the committee. The forms and instructions must require that budget requests submitted to the committee include: Information from a request for information or other formal market research regarding the information technology budget request; A defined scope of work and information regarding whether a vendor or consultant assisted in preparing the specifications or statement of work included in the information technology budget request; A range of options for completing the project, including the estimated costs for such options; and Any other available and relevant information obtained from the market research related to the information technology budget request.(Note: This summary applies to the reengrossed version of this bill as introduced in the second house.)