Text of KS SB 291 (2024)

Session of 2023 SENATE BILL No. 291 By Committee on Federal and State Affairs 3-6 AN ACT concerning environmental, social and governance criteria involving public contracts and investments; enacting the Kansas public investments and contracts protection act; prohibiting the state or a political subdivision from giving preferential treatment to or discriminating against companies based on environmental, social and governance criteria in procuring or letting contracts; requiring fiduciaries of the Kansas public employees retirement system to act solely in the financial interest of participants and beneficiaries of the system; restricting state agencies from adopting environmental, social and governance criteria or requiring any person or business to operate in accordance with such criteria; directing registered investment advisers to provide certain environmental, social and governance criteria notice to clients; requiring the legislative research department to develop and maintain an environmental, social and governance disclosure webpage; providing for enforcement of such act by the attorney general; amending K.S.A. 2022 Supp. 74-4921 and repealing the existing section. Be it enacted by the Legislature of the State of Kansas: New Section 1. (a) The provisions of sections 1 through 5, and amendments thereto, shall be known and may be cited as the Kansas public investments and contracts protection act. (b) As used in this act: (1) "Act" means the Kansas public investments and contracts protection act. (2) "Board" means the board of trustees of the Kansas public employees retirement system. (3) "Company" means any organization, association, corporation, partnership, joint venture, limited partnership, limited liability partnership, limited liability company or other entity of business association, including a wholly owned subsidiary, majority-owned subsidiary, parent company or affiliate of such entities or business associations that exists for the purpose of making a profit. "Company" does not mean a sole proprietorship. (4) "Environmental, social and governance criteria" means any criterion that gives preferential treatment or discriminates based on whether a company meets or fails to meet one or more of the following 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 SB 291 2 criteria: (A) Engaging in the exploration, production, utilization, transportation, sale or manufacturing of: (i) Fossil fuel-based energy; (ii) nuclear energy; or (iii) any other natural resource; (B) engaging in the production of agriculture; (C) engaging in the production of lumber; (D) engaging in mining; (E) emitting greenhouse gases or not disclosing or offsetting such greenhouse gas emissions; (F) engaging in the manufacturing, distribution or sale of firearms, firearms accessories, ammunition or ammunition components; (G) having a governing corporate board or other officers whose race, ethnicity, sex or sexual orientation meets or does not meet any criteria; (H) facilitating or assisting or not facilitating or assisting employees in obtaining abortions or gender reassignment services; and (I) doing business with any company described by subparagraphs (A) through (H). (5) "Fiduciary" means any person acting on behalf of the board or system as an investment manager, proxy advisor or contractor, including the system's board of trustees. (6) "Fiduciary commitment" means any evidence of a fiduciary's purpose in managing assets as a fiduciary, including, but not limited to, any of the following in a fiduciary's capacity as a fiduciary: (A) Advertisements, statements, explanations, reports, communications with portfolio companies, statements of principles or commitments; or (B) participation in, affiliation with or status as a signatory to any coalition, initiative, joint statement of principles or agreement. (7) (A) "Financial" means having been prudently determined by a fiduciary to have a material effect on the financial risk or the financial return of an investment. (B) "Financial" does not include any action taken or factor considered by a fiduciary with any purpose whatsoever to further social, political or ideological interests. (C) A fiduciary may reasonably be determined to have taken an action or considered a factor with a purpose to further social, political or ideological interests based upon evidence indicating such a purpose, including, but not limited to, any fiduciary commitment to further, through portfolio company engagement, board or shareholder votes or otherwise as a fiduciary, any of the following beyond what controlling federal or state law requires: 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 3 (i) Eliminating, reducing, offsetting or disclosing greenhouse gas emissions; (ii) instituting or assessing corporate board, employment, composition, compensation or disclosure criteria that incorporates characteristics protected under state law; (iii) divesting from, limiting investment in or limiting the activities or investments of any company for failing or not committing to meet environmental standards or disclosures; (iv) accessing abortion, sex or gender change or transgender surgery; or (v) divesting from, limiting investment in or limiting the activities or investments of any company that engages in, facilitates or supports the manufacture, import, distribution, marketing, advertising, sale or lawful use of firearms, ammunition or component parts and accessories of firearms or ammunition. (8) "Fossil fuels" means coal, natural gas, petroleum or oil formed by natural processes through decomposition of dead organisms. (9) "Natural resources" means fossil fuels, minerals, metal ores or any other nonrenewable or finite resource that cannot be readily replaced by natural means at the speed at which it is consumed. (10) "System" means the Kansas public employees retirement system. New Sec. 2. (a) The state, any agency of the state, any political subdivision of the state, or any instrumentality thereof, including the pooled money investment board established by K.S.A. 75-4221a, and amendments thereto, when engaged in procuring or letting contracts for any purpose, shall ensure that bidders, offerors, contractors or subcontractors are not given preferential treatment or discriminated against based on any environmental, social and governance criteria. (b) The state, any agency of the state, any political subdivision of the state or any instrumentality thereof, including the pooled money investment board established by K.S.A. 75-4221a, and amendments thereto, shall not adopt any procurement regulation or policy that causes any bidder, offeror, contractor or subcontractor to be given preferential treatment or be subject to discrimination based on any environmental, social and governance criteria, except as otherwise specifically permitted or required by law. New Sec. 3. (a) In making and supervising investments of the system, the system and any investment manager, proxy advisor or contractor thereof shall discharge its duties solely in the financial interest of the participants and beneficiaries for the exclusive purposes of: (1) Providing financial benefits to participants and their beneficiaries; and (2) defraying reasonable expenses of administering the system. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 4 (b) An investment manager, proxy advisor or contractor retained by the system shall be subject to the same fiduciary duties as the system's board of trustees. (c) A fiduciary shall consider only financial factors when discharging such fiduciary's duties with respect to the system. (d) All shares held directly or indirectly by or on behalf of the system or the participants and their beneficiaries shall be voted solely in the financial interest of system participants and their beneficiaries. (e) Unless no economically practicable alternative is available, the system shall not grant proxy voting authority to any person who is not a part of the system, unless such person has a practice of, and in writing commits to, following guidelines that match the system's obligation to act solely upon financial factors. (f) Unless no economically practicable alternative is available, in the selection of any proxy advisor, the system shall give preference to a proxy advisor service that commits in writing to engage in voting shares and making recommendations in a strictly fiduciary manner, and without consideration of policy objectives that are not the express policy objectives of the system. (g) Unless no economically practicable alternative is available, system assets shall not be entrusted to a fiduciary, unless such fiduciary has a practice of, and in writing commits to, following guidelines, when engaging with portfolio companies and voting shares or proxies, that follow the system's obligation to act solely upon financial factors and not upon policy considerations that are not the express policy objectives of the system. (h) Unless no economically practicable alternative is available, an investment manager or contractor shall not, in providing service for the system, follow the recommendations of a proxy advisor or other service provider, unless such advisor or service provider has a practice of, and in writing commits to, following proxy voting guidelines that follow the system's obligation to act solely upon financial factors. (i) All proxy votes shall be tabulated and reported annually to the system's board of trustees and to the legislative coordinating council. For each vote, the report shall contain a vote caption, the system's vote, the recommendation of company management and, if applicable, the proxy advisor's recommendation. Such reports shall be posted on the system's website for review by the public. New Sec. 4. (a) As used in this section, "state agency" means an office, board, commission, department, council, bureau, governmental entity or other agency of state government having authority to adopt or enforce rules and regulations. (b) No state agency shall share or publish information, adopt policies, 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 5 adopt rules and regulations or issue guidelines for purposes of environmental, social and governance criteria that restrict the ability of any industry to offer products or services. No state agency shall require any person or business to adopt or operate in accordance with environmental, social and governance criteria. New Sec. 5. (a) A registered investment adviser, as defined in K.S.A. 17-12a102, and amendments thereto, shall disclose to each new client prior to the investment of any moneys owned by the client, and at least annually to each existing client, the following notice, in writing: "NOTICE: Environmental, social and governance (ESG) investing may limit your return on investment compared to investments that do not use such criteria. You should ask your investment adviser for more specific information on whether there are investment alternatives available with entities that do not use such ESG criteria and that instead rely on ordinary business considerations in making investment decisions. The Kansas legislative research department, with content as approved by the legislative coordinating council, maintains a website link, at www.kslegresearch.org/esgdisclosure that contains information about environmental, social and governance investing and how the utilization of ESG standards, including preferential or discriminatory considerations other than financial risk or financial return, may affect the return on your investments." (b) The legislative research department shall develop and maintain an environmental, social and governance disclosure webpage on the legislative research department's website that contains information about environmental, social and governance investing. Such information shall be approved by the legislative coordinating council. New Sec. 6. (a) This act or any contract subject to this act may be enforced by the attorney general. (b) If the attorney general has reasonable cause to believe that a person has engaged in, is engaging in or is about to engage in a violation of this act, the attorney general may require: (1) Such person to file on such forms as the attorney general may prescribe a statement or report in writing, under oath, as to all the facts and circumstances concerning the violation; and (2) the filing of such other data and information as the attorney general may deem necessary. (c) In addition to any other remedies available at law or equity, an investment manager or contractor of the system that serves as a fiduciary and violates the provisions of section 3, and amendments thereto, shall be obligated to pay damages to the state in an amount equal to three times all moneys paid to the investment manager or contractor by the system for the services of such investment manager or contractor. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 6 Sec. 7. K.S.A. 2022 Supp. 74-4921 is hereby amended to read as follows: 74-4921. (1) There is hereby created in the state treasury the Kansas public employees retirement fund. All employee and employer contributions shall be deposited in the state treasury to be credited to the Kansas public employees retirement fund. The fund is a trust fund and shall be used solely for the exclusive purpose of providing benefits to members and member beneficiaries and defraying reasonable expenses of administering the fund. Investment income of the fund shall be added or credited to the fund as provided by law. All benefits payable under the system, refund of contributions and overpayments, purchases or investments under the law and expenses in connection with the system unless otherwise provided by law shall be paid from the fund. The director of accounts and reports is authorized to draw warrants on the state treasurer and against such fund upon the filing in the director's office of proper vouchers executed by the chairperson or the executive director of the board. As an alternative, payments from the fund may be made by credits to the accounts of recipients of payments in banks, savings and loan associations and credit unions. A payment shall be so made only upon the written authorization and direction of the recipient of payment and upon receipt of such authorization such payments shall be made in accordance therewith. Orders for payment of such claims may be contained on: (a) A letter, memorandum, telegram, computer printout or similar writing,; or (b) any form of communication, other than voice, which is registered upon magnetic tape, disc or any other medium designed to capture and contain in durable form conventional signals used for the electronic communication of messages. (2) The board shall have the responsibility for the management of the fund and shall discharge the board's duties with respect to the fund solely in the interests of the members and beneficiaries of the system for the exclusive purpose of providing benefits to members and such member's beneficiaries and defraying reasonable expenses of administering the fund and shall invest and reinvest moneys in the fund and acquire, retain, manage, including the exercise of any voting rights and disposal of investments of the fund within the limitations and according to the powers, duties and purposes as prescribed by this section. (3) Moneys in the fund shall be invested and reinvested to achieve the investment objective which is preservation of the fund to provide benefits to members and member beneficiaries, as provided by law and accordingly providing that the moneys are as productive as possible, subject to the standards set forth in this act. No moneys in the fund shall be invested or reinvested if the sole or primary any investment objective is for economic development or social purposes or objectives. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 7 (4) In investing and reinvesting moneys in the fund and in acquiring, retaining, managing and disposing of investments of the fund, the board shall exercise the judgment, care, skill, prudence and diligence under the circumstances then prevailing, which persons of prudence, discretion and intelligence acting in a like capacity and familiar with such matters would use in the conduct of an enterprise of like character and with like aims by diversifying the investments of the fund so as to minimize the risk of large losses, unless under the circumstances it is clearly prudent not to do so, and not in regard to speculation but in regard to the permanent disposition of similar funds, considering the probable income as well as the probable safety of their capital. (5) Notwithstanding subsection (4): (a) Total investments in common stock may be made in the amount of up to 60% of the total book value of the fund; (b) the board may invest or reinvest moneys of the fund in alternative investments if the following conditions are satisfied: (i) The total of the annual net commitment to alternative investments does not exceed 5% of the total market value of investment assets of the fund as measured from the end of the preceding calendar year; (ii) if in addition to the system, there are at least two other qualified institutional buyers, as defined by section (a)(1)(i) of rule 144A, securities act of 1933; (iii) the system's share in any individual alternative investment is limited to an investment representing not more than 20% of any such individual alternative investment; (iv) the system has received a favorable and appropriate recommendation from a qualified, independent expert in investment management or analysis in that particular type of alternative investment; (v) the alternative investment is consistent with the system's investment policies and objectives as provided in subsection (6); (vi) the individual alternative investment does not exceed more than 2.5% of the total alternative investments made under this subsection. If the alternative investment is made pursuant to participation by the system in a multi-investor pool, the 2.5% limitation contained in this subsection is applied to the underlying individual assets of such pool and not to investment in the pool itself. The total of such alternative investments made pursuant to participation by the system in any one individual multi- investor pool shall not exceed more than 20% of the total of alternative investments made by the system pursuant to this subsection. Nothing in this subsection requires the board to liquidate or sell the system's holdings in any alternative investments made pursuant to participation by the system in any one individual multi-investor pool held by the system on the effective date of this act, unless such liquidation or sale would be in the 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 8 best interest of the members and beneficiaries of the system and be prudent under the standards contained in this section. The 20% limitation contained in this subsection shall not have been violated if the total of such investment in any one individual multi-investor pool exceeds 20% of the total alternative investments of the fund as a result of market forces acting to increase the value of such a multi-investor pool relative to the rest of the system's alternative investments; however, the board shall not invest or reinvest any moneys of the fund in any such individual multi-investor pool until the value of such individual multi-investor pool is less than 20% of the total alternative investments of the fund; (vii) the board has received and considered the investment manager's due diligence findings submitted to the board as required by subsection (6) (c) (6); (viii) prior to the time the alternative investment is made, the system has in place procedures and systems to ensure that the investment is properly monitored and investment performance is accurately measured; and (ix) the total of alternative investments does not exceed 15% of the total investment assets of the fund. The 15% limitation contained in this subsection shall not have been violated if the total of such alternative investments exceeds 15% of the total investment assets of the fund, based on the fund total market value, as a result of market forces acting to increase the value of such alternative investments relative to the rest of the system's investments. However, the board shall not invest or reinvest any moneys of the fund in alternative investments until the total value of such alternative investments is less than 15% of the total investment assets of the fund based on the market value. If the total value of the alternative investments exceeds 15% of the total investment assets of the fund, the board shall not be required to liquidate or sell the system's holdings in any alternative investment held by the system, unless such liquidation or sale would be in the best interest of the members and beneficiaries of the system and is prudent under the standards contained in this section.; (c) for purposes of this act section, "alternative investment" includes a broad group of investments that are not one of the traditional asset types of public equities, fixed income, cash or real estate. Alternative investments are generally made through limited partnership or similar structures, are not regularly traded on nationally recognized exchanges and thus are relatively illiquid, and exhibit lower correlations with more liquid asset types such as stocks and bonds. Alternative investments generally include, but are not limited to, private equity, private credit, hedge funds, infrastructure, commodities and other investments which that have the characteristics described in this paragraph; and (c)(d) except as otherwise provided, the board may invest or reinvest 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 9 moneys of the fund in real estate investments if the following conditions are satisfied: (i) The system has received a favorable and appropriate recommendation from a qualified, independent expert in investment management or analysis in that particular type of real estate investment; (ii) the real estate investment is consistent with the system's investment policies and objectives as provided in subsection (6); and (iii) the system has received and considered the investment manager's due diligence findings. (6) (a) Subject to the objective set forth in subsection (3) and the standards set forth in subsections (4) and (5) the board shall formulate policies and objectives for the investment and reinvestment of moneys in the fund and the acquisition, retention, management and disposition of investments of the fund. Such policies and objectives shall include: (a)(i) Specific asset allocation standards and objectives; (b)(ii) establishment of criteria for evaluating the risk versus the potential return on a particular investment; (c)(iii) a requirement that all investment managers submit such manager's due diligence findings on each investment to the board or investment advisory committee for approval or rejection prior to making any alternative investment; (d)(iv) a requirement that all investment managers shall immediately report all instances of default on investments to the board and provide the board with recommendations and options, including, but not limited to, curing the default or withdrawal from the investment; and (e)(v) establishment of criteria that would be used as a guideline for determining when no additional add-on investments or reinvestments would be made and when the investment would be liquidated. (b) The board shall review such policies and objectives, make changes considered necessary or desirable and readopt such policies and objectives on an annual basis. (7) The board may enter into contracts with one or more persons whom the board determines to be qualified, whereby the persons undertake to perform the functions specified in subsection (2) to the extent provided in the contract. Performance of functions under contract so entered into shall be paid pursuant to rates fixed by the board subject to provisions of appropriation acts and shall be based on specific contractual fee arrangements. The system shall not pay or reimburse any expenses of persons contracted with pursuant to this subsection, except that after approval of the board, the system may pay approved investment related expenses subject to provisions of appropriation acts. The board shall require that a person contracted with to obtain commercial insurance which provides for errors and omissions coverage for such person in an 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 10 amount to be specified by the board, provided that such coverage shall be at least the greater of $500,000 or 1% of the funds entrusted to such person up to a maximum of $10,000,000. The board shall require a person contracted with to give a fidelity bond in a penal sum as may be fixed by law or, if not so fixed, as may be fixed by the board, with corporate surety authorized to do business in this state. Such persons contracted with the board pursuant to this subsection and any persons contracted with such persons to perform the functions specified in subsection (2) shall be deemed to be agents of the board and the system in the performance of contractual obligations. (8) (a) In the acquisition or disposition of securities, the board may rely on the written legal opinion of a reputable bond attorney or attorneys, the written opinion of the attorney of the investment counselor or managers, or the written opinion of the attorney general certifying the legality of the securities. (b) The board shall employ or retain qualified investment counsel or counselors or may negotiate with a trust company to assist and advise in the judicious investment of funds as herein provided. (9) (a) Except as provided in subsection (7) and this subsection, the custody of money and securities of the fund shall remain in the custody of the state treasurer, except that the board may arrange for the custody of such money and securities as it considers advisable with one or more member banks or trust companies of the federal reserve system or with one or more banks in the state of Kansas, or both, to be held in safekeeping by the banks or trust companies for the collection of the principal and interest or other income or of the proceeds of sale. The services provided by the banks or trust companies shall be paid pursuant to rates fixed by the board subject to provisions of appropriation acts. (b) The state treasurer and the board shall collect the principal and interest or other income of investments or the proceeds of sale of securities in the custody of the state treasurer and pay same when so collected into the fund. (c) The principal and interest or other income or the proceeds of sale of securities as provided in clause (a) of this subsection (9) shall be reported to the state treasurer and the board and credited to the fund. (10) The board shall with the advice of the director of accounts and reports establish the requirements and procedure for reporting any and all activity relating to investment functions provided for in this act in order to prepare a record monthly of the investment income and changes made during the preceding month. The record will reflect a detailed summary of investment, reinvestment, purchase, sale and exchange transactions and such other information as the board may consider advisable to reflect a true accounting of the investment activity of the fund. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 SB 291 11 (11) The board shall provide for an examination of the investment program annually. The examination shall include an evaluation of current investment policies and practices and of specific investments of the fund in relation to the objective set forth in subsection (3), the standard set forth in subsection (4) and other criteria as may be appropriate, and recommendations relating to the fund investment policies and practices and to specific investments of the fund as are considered necessary or desirable. The board shall include in its annual report to the governor as provided in K.S.A. 74-4907, and amendments thereto, a report or a summary thereof covering the investments of the fund. (12) (a) Any internal assessment or examination of alternative investments of the system performed by any person or entity employed or retained by the board which evaluates or monitors the performance of alternative investments shall be reported to the legislative post auditor so that such report may be reviewed in accordance with the annual financial- compliance audits conducted pursuant to K.S.A. 74-49,136, and amendments thereto. (b) The board shall prepare and submit an alternative investment report to the joint committee on pensions, investments and benefits prior to January 1, 2016. Such report shall include a review of alternative investments of the system with an emphasis on the effects of changes in law pursuant to this act and includes specific investment cost and market value information of each individual alternative investment. Sec. 8. K.S.A. 2022 Supp. 74-4921 is hereby repealed. Sec. 9. This act shall take effect and be in force from and after its publication in the statute book. 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26

House Substitute for SENATE BILL No. 291 AN ACT concerning information technology; relating to transferring cybersecurity employees under the chief information technology officer of each branch; creating a chief information security officer within the judicial and legislative branches; requiring the attorney general, Kansas bureau of investigation, secretary of state, state treasurer and insurance commissioner to appoint chief information security officers; placing the duty of cybersecurity under the chief information technology officer; requiring state agencies to comply with certain minimum cybersecurity standards; exempting certain audit reports from the open records act and eliminating the five- year review of such exemption; requiring the information technology executive council to develop a plan to integrate all information technology services for the executive branch under the executive chief information technology officer; making and concerning appropriations for the fiscal years ending June 30, 2025, and June 30, 2026, for the judicial branch, the office of information technology, Kansas information security office and the adjutant general; authorizing certain transfers and imposing certain limitations and restrictions and directing or authorizing certain disbursements and procedures for all state agencies; requiring legislative review of state agencies not in compliance with this act; providing for expiration of certain amendments made by this act; amending K.S.A. 40-110, 75-413, 75-623, 75-710, 75- 711, 75-7203 and 75-7203, as amended by section 20 of this act, and K.S.A. 2023 Supp. 45-229, 45-229, as amended by section 10 of this act, 75-7201, 75-7201, as amended by section 16 of this act, 75-7202, 75-7202, as amended by section 18 of this act, 75-7205, 75-7205, as amended by section 22 of this act, 75-7206, 75-7206, as amended by section 24 of this act, 75-7208, 75-7208, as amended by section 26 of this act, 75-7209, 75-7209, as amended by section 28 of this act, 75-7237, 75-7237, as amended by section 30 of this act, 75-7238, 75-7238, as amended by section 32 of this act, 75-7239, 75-7239, as amended by section 34 of this act, 75-7240 and 75- 7240, as amended by section 36 of this act, and repealing the existing sections. Be it enacted by the Legislature of the State of Kansas: New Section 1. (a) On and after July 1, 2027, all cybersecurity services for each branch of state government shall be administered by the chief information technology officer and the chief information security officer of such branch. All cybersecurity employees within the legislative and executive branches of state government shall work at the direction of the chief information technology officer of the branch. (b) Prior to January 1, 2026: (1) The information technology executive council shall develop a plan to integrate all executive branch information technology services into the office of information technology services. The council shall consult with each agency head when developing such plan. (2)  The judicial chief information technology officer shall develop an estimated project cost to provide information technology to judicial agencies and all employees of such agencies, including state and county-funded judicial branch district court employees. Such employees shall be required to use such state-issued information technology hardware. The project cost developed pursuant to this paragraph shall include, in consultation with the executive branch information technology officer, a plan to allow each piece of information technology hardware that is used by a judicial branch employee to access a judicial branch application to have access to the KANWIN network and an estimated project cost to develop a cybersecurity program for all judicial districts that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. (c) The information technology executive council shall report the plan developed pursuant to subsection (b) to the senate standing committee on ways and means and the house standing committee on legislative modernization or its successor committee prior to January 15, 2026. (d) Prior to February 1, 2025, every website that is maintained by a branch of government or state agency shall be moved to a ".gov" domain. (e) On July 1, 2025, and each year thereafter, moneys appropriated from the state general fund to or any special revenue fund of any state agency for information technology and cybersecurity expenditures shall House Substitute for SENATE BILL No. 291—page 2 be appropriated as a separate line item and shall not be merged with other items of appropriation for such state agency to allow for detailed review by the senate committee on ways and means and the house of representatives committee on appropriations during each regular legislative session. (f) The provisions of this section do not apply to state educational institutions as defined in K.S.A. 76-711, and amendments thereto. (g) This section shall expire on July 1, 2026. New Sec. 2. (a) There is hereby established the position of judicial branch chief information security officer. The judicial chief information security officer shall be in the unclassified service under the Kansas civil service act, shall be appointed by the judicial administrator, subject to approval by the chief justice and shall receive compensation determined by the judicial administrator, subject to approval of the chief justice. (b) The judicial chief information security officer shall: (1) Report to the judicial administrator; (2) establish security standards and policies to protect the branch's information technology systems and infrastructure in accordance with subsection (c); (3) ensure the confidentiality, availability and integrity of the information transacted, stored or processed in the branch's information technology systems and infrastructure; (4) develop a centralized cybersecurity protocol for protecting and managing judicial branch information technology assets and infrastructure; (5) detect and respond to security incidents consistent with information security standards and policies; (6) be responsible for the cybersecurity of all judicial branch data and information resources; (7) collaborate with the chief information security officers of the other branches of state government to respond to cybersecurity incidents; (8) ensure that all justices, judges and judicial branch employees complete cybersecurity awareness training annually and if an employee does not complete the required training, such employee's access to any state-issued hardware or the state network is revoked; (9) review all contracts related to information technology entered into by a person or entity within the judicial branch to make efforts to reduce the risk of security vulnerabilities within the supply chain or product and ensure each contract contains standard security language; and (10) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of judicial branch agencies for compliance with applicable state and federal laws, rules and regulations and judicial branch policies and standards. The judicial chief information security officer shall make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit. (c) The judicial chief information security officer shall develop a cybersecurity program of each judicial agency that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The judicial chief information security officer shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030. (d) (1) If an audit conducted pursuant to subsection (b)(10) results in a failure, the judicial chief information security officer shall report such failure to the speaker and minority leader of the house of representatives and the president and minority leader of the senate House Substitute for SENATE BILL No. 291—page 3 within 30 days of receiving notice of such failure. Such report shall contain a plan to mitigate any security risks identified in the audit. The judicial chief information security officer shall coordinate for an additional audit after the mitigation plan is implemented and report the results of such audit to the speaker and minority leader of the house of representatives and the president and minority leader of the senate.   (2) Results of audits conducted pursuant to subsection (b)(10) and the reports described in subsection (d)(1) shall be confidential and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. (e) This section shall expire on July 1, 2026. New Sec. 3. (a) There is hereby established the position of legislative branch chief information security officer. The legislative chief information security officer shall be in the unclassified service under the Kansas civil service act, shall be appointed by the legislative coordinating council and shall receive compensation determined by the legislative coordinating council. (b) The legislative chief information security officer shall: (1) Report to the legislative chief information technology officer; (2) establish security standards and policies to protect the branch's information technology systems and infrastructure in accordance with subsection (c); (3) ensure the confidentiality, availability and integrity of the information transacted, stored or processed in the branch's information technology systems and infrastructure; (4) develop a centralized cybersecurity protocol for protecting and managing legislative branch information technology assets and infrastructure; (5) detect and respond to security incidents consistent with information security standards and policies; (6) be responsible for the cybersecurity of all legislative branch data and information resources and obtain approval from the revisor of statutes prior to taking any action on any matter that involves a legal issue related to the security of information technology; (7) collaborate with the chief information security officers of the other branches of state government to respond to cybersecurity incidents; (8) ensure that all legislators and legislative branch employees complete cybersecurity awareness training annually and if an employee does not complete the required training, such employee's access to any state-issued hardware or the state network is revoked; (9) review all contracts related to information technology entered into by a person or entity within the legislative branch to make efforts to reduce the risk of security vulnerabilities within the supply chain or product and ensure each contract contains standard security language; and (10) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of legislative branch agencies for compliance with applicable state and federal laws, rules and regulations and legislative branch policies and standards. The legislative chief information security officer shall make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit. (c) The legislative chief information security officer shall develop a cybersecurity program of each legislative agency that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The legislative chief information security officer shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July House Substitute for SENATE BILL No. 291—page 4 1, 2030. The agency head of each legislative agency shall coordinate with the legislative chief information security officer to achieve such standards. (d) (1) If an audit conducted pursuant to subsection (b)(10) results in a failure, the legislative chief information security officer shall report such failure to the speaker and minority leader of the house of representatives and the president and minority leader of the senate within 30 days of receiving notice of such failure. Such report shall contain a plan to mitigate any security risks identified in the audit. The legislative chief information security officer shall coordinate for an additional audit after the mitigation plan is implemented and report the results of such audit to the speaker and minority leader of the house of representatives and the president and minority leader of the senate.   (2) Results of audits conducted pursuant to subsection (b)(10) and the reports described in subsection (d)(1) shall be confidential and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. (e) This section shall expire on July 1, 2026. New Sec. 4. (a) On July 1, 2028, and each year thereafter, the director of the budget, in consultation with the legislative, executive and judicial chief information technology officers as appropriate, shall determine if each state agency is in compliance with the provisions of this act for the previous fiscal year. If the director of the budget determines that a state agency is not in compliance with the provisions of this act for such fiscal year, the director shall certify an amount equal to 5% of the amount: (1) Appropriated and reappropriated from the state general fund for such state agency for such fiscal year; and (2) credited to and available in each special revenue fund for such state agency in such fiscal year. If during any fiscal year, a special revenue fund has no expenditure limitation, then an expenditure limitation shall be established for such fiscal year on such special revenue fund by the director of the budget in an amount that is 5% less than the amount of moneys credited to and available in such special revenue fund for such fiscal year. (b) The director of the budget shall submit a detailed written report to the legislature on or before the first day of the regular session of the legislature concerning such compliance determinations, including factors considered by the director when making such determination, and the amounts certified for each state agency for such fiscal year. (c) During the regular session of the legislature, the senate committee on ways and means and the house of representatives committee on appropriations shall consider such compliance determinations and whether to lapse amounts appropriated and reappropriated and decrease the expenditure limitations of special revenue funds for such state agencies during the budget committee hearings for such noncomplying agency. (d) This section shall expire on July 1, 2026. New Sec. 5. JUDICIAL BRANCH (a) There is appropriated for the above agency from the state general fund for the fiscal year ending June 30, 2025, the following: Judiciary operations (677-00-1000-0103)..................................$659,368 New Sec. 6.  KANSAS INFORMATION SECURITY OFFICE (a) There is appropriated for the above agency from the following special revenue fund or funds for the fiscal year ending June 30, 2025, all moneys now or hereafter lawfully credited to and available in such House Substitute for SENATE BILL No. 291—page 5 fund or funds, except that expenditures other than refunds authorized by law shall not exceed the following: Information technology security fund.........................................No limit New Sec. 7.  KANSAS INFORMATION SECURITY OFFICE (a) There is appropriated for the above agency from the state general fund for the fiscal year ending June 30, 2026, the following: Kansas information security office (336-00-1000)...............$15,000,000 (b) There is appropriated for the above agency from the following special revenue fund or funds for the fiscal year ending June 30, 2026, all moneys now or hereafter lawfully credited to and available in such fund or funds, except that expenditures other than refunds authorized by law shall not exceed the following: Information technology security fund.........................................No limit (c) During fiscal year 2026, the director of the budget, in consultation with the executive branch chief information technology officer and executive branch chief information security officer, shall determine the amount of moneys from the state general fund and each special revenue fund that each executive branch agency has expended during fiscal years 2021 through 2025 for services performed by the Kansas information security office or other cybersecurity services for such state agency: Provided, That the director of the budget shall determine such five-year average of each state agency's expenditures from the state general fund and each special revenue fund: Provided further, That during fiscal year 2026, the director of the budget shall certify the amount so determined to the director of accounts and reports and, at the same time as such certification is transmitted to the director of accounts and reports, shall transmit a copy of such certification to the director of legislative research: And provided further, That upon receipt of each such certification, the director of accounts and reports shall: (1) For the amounts from the state general fund, lapse such funds; and (2) for each special revenue fund, transfer the amount from the special revenue fund of the state agency to the information technology security fund established in K.S.A. 75-7239, and amendments thereto: Provided however, That the provisions of this subsection do not apply to state educational institutions as defined in K.S.A. 76-711, and amendments thereto. New Sec. 8.  ADJUTANT GENERAL (a) There is appropriated for the above agency from the state general fund for the fiscal year ending June 30, 2025, the following: Operating expenditures (034-00-1000-0053).............................$250,000 Provided, That expenditures shall be made by the above agency from such account for two full-time employees in the Kansas intelligence fusion center to assist in monitoring state information technology systems: Provided further, That such employees shall be in the unclassified service of the civil service act and shall be in addition to the positions of the above agency as authorized pursuant to K.S.A. 2023 Supp. 48-3706, and amendments thereto. Sec. 9. K.S.A. 40-110 is hereby amended to read as follows: 40- 110. (a) The commissioner of insurance is hereby authorized to appoint an assistant commissioner of insurance, actuaries, two special attorneys who shall have been regularly admitted to practice, an executive secretary, policy examiners, two field representatives, and a secretary to the commissioner. Such appointees shall each receive an annual salary to be determined by the commissioner of insurance, within the limits of available appropriations. The commissioner is also authorized to appoint, within the provisions of the civil service law, and available appropriations, other employees as necessary to administer the House Substitute for SENATE BILL No. 291—page 6 provisions of this act. The field representatives authorized by this section may be empowered to conduct inquiries, investigations or to receive complaints. Such field representatives shall not be empowered to make, or direct to be made, an examination of the affairs and financial condition of any insurance company in the process of organization, or applying for admission or doing business in this state. (b) The appointees authorized by this section shall take the proper official oath and shall be in no way interested, except as policyholders, in any insurance company. In the absence of the commissioner of insurance the assistant commissioner shall perform the duties of the commissioner of insurance, but shall in all cases execute papers in the name of the commissioner of insurance, as assistant. The commissioner of insurance shall be responsible for all acts of an official nature done and performed by the commissioner's assistant or any person employed in such office. All the appointees authorized by this section shall hold their office at the will and pleasure of the commissioner of insurance. (c) (1) The commissioner shall appoint a chief information security officer who shall be responsible for establishing security standards and policies to protect the department's information technology systems and infrastructure. The chief information security officer shall: (A) Develop a cybersecurity program for the department that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The chief information security officer shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030; (B) ensure that the commissioner and all employees complete cybersecurity awareness training annually and that if an employee does not complete the required training, such employee's access to any state-issued hardware or the state network is revoked; and (C) (i) (a) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of the department for compliance with applicable state and federal laws, rules and regulations and department policies and standards; and (b) make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit. (ii) Results of audits conducted pursuant to this paragraph shall be confidential and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. (2) The provisions of this subsection shall expire on July 1, 2026. Sec. 10. K.S.A. 2023 Supp. 45-229 is hereby amended to read as follows: 45-229. (a) It is the intent of the legislature that exceptions to disclosure under the open records act shall be created or maintained only if: (1) The public record is of a sensitive or personal nature concerning individuals; (2) the public record is necessary for the effective and efficient administration of a governmental program; or (3) the public record affects confidential information. The maintenance or creation of an exception to disclosure must be compelled as measured by these criteria. Further, the legislature finds that the public has a right to have access to public records unless the criteria in this section for restricting such access to a public record are met and the criteria are considered during legislative review in connection with the particular exception to disclosure to be significant enough to override the strong public policy of open government. To House Substitute for SENATE BILL No. 291—page 7 strengthen the policy of open government, the legislature shall consider the criteria in this section before enacting an exception to disclosure. (b) Subject to the provisions of subsections (g) and (h), any new exception to disclosure or substantial amendment of an existing exception shall expire on July 1 of the fifth year after enactment of the new exception or substantial amendment, unless the legislature acts to continue the exception. A law that enacts a new exception or substantially amends an existing exception shall state that the exception expires at the end of five years and that the exception shall be reviewed by the legislature before the scheduled date. (c) For purposes of this section, an exception is substantially amended if the amendment expands the scope of the exception to include more records or information. An exception is not substantially amended if the amendment narrows the scope of the exception. (d) This section is not intended to repeal an exception that has been amended following legislative review before the scheduled repeal of the exception if the exception is not substantially amended as a result of the review. (e) In the year before the expiration of an exception, the revisor of statutes shall certify to the president of the senate and the speaker of the house of representatives, by July 15, the language and statutory citation of each exception that will expire in the following year that meets the criteria of an exception as defined in this section. Any exception that is not identified and certified to the president of the senate and the speaker of the house of representatives is not subject to legislative review and shall not expire. If the revisor of statutes fails to certify an exception that the revisor subsequently determines should have been certified, the revisor shall include the exception in the following year's certification after that determination. (f) "Exception" means any provision of law that creates an exception to disclosure or limits disclosure under the open records act pursuant to K.S.A. 45-221, and amendments thereto, or pursuant to any other provision of law. (g) A provision of law that creates or amends an exception to disclosure under the open records law shall not be subject to review and expiration under this act if such provision: (1) Is required by federal law; (2) applies solely to the legislature or to the state court system; (3) has been reviewed and continued in existence twice by the legislature; or (4) has been reviewed and continued in existence by the legislature during the 2013 legislative session and thereafter; or (5) is a report of the results of an audit conducted by the United States cybersecurity and infrastructure security agency. (h) (1) The legislature shall review the exception before its scheduled expiration and consider as part of the review process the following: (A) What specific records are affected by the exception; (B) whom does the exception uniquely affect, as opposed to the general public; (C) what is the identifiable public purpose or goal of the exception; (D) whether the information contained in the records may be obtained readily by alternative means and how it may be obtained; (2) an exception may be created or maintained only if it serves an identifiable public purpose and may be no broader than is necessary to meet the public purpose it serves. An identifiable public purpose is served if the legislature finds that the purpose is sufficiently compelling to override the strong public policy of open government and cannot be House Substitute for SENATE BILL No. 291—page 8 accomplished without the exception and if the exception: (A) Allows the effective and efficient administration of a governmental program that would be significantly impaired without the exception; (B) protects information of a sensitive personal nature concerning individuals, the release of such information would be defamatory to such individuals or cause unwarranted damage to the good name or reputation of such individuals or would jeopardize the safety of such individuals. Only information that would identify the individuals may be excepted under this paragraph; or (C) protects information of a confidential nature concerning entities, including, but not limited to, a formula, pattern, device, combination of devices, or compilation of information that is used to protect or further a business advantage over those who do not know or use it, if the disclosure of such information would injure the affected entity in the marketplace. (3) Records made before the date of the expiration of an exception shall be subject to disclosure as otherwise provided by law. In deciding whether the records shall be made public, the legislature shall consider whether the damage or loss to persons or entities uniquely affected by the exception of the type specified in paragraph (2)(B) or (2)(C) would occur if the records were made public. (i) (1) Exceptions contained in the following statutes as continued in existence in section 2 of chapter 126 of the 2005 Session Laws of Kansas and that have been reviewed and continued in existence twice by the legislature as provided in subsection (g) are hereby continued in existence: 1-401, 2-1202, 5-512, 9-1137, 9-1712, 9-2217, 10-630, 12- 189, 12-1,108, 12-1694, 12-1698, 12-2819, 12-4516, 16-715, 16a-2- 304, 17-1312e, 17-2227, 17-5832, 17-7511, 17-76,139, 19-4321, 21- 2511, 22-3711, 22-4707, 22-4909, 22a-243, 22a-244, 23-605, 23-9,312, 25-4161, 25-4165, 31-405, 34-251, 38-2212, 39-709b, 39-719e, 39- 934, 39-1434, 39-1704, 40-222, 40-2,156, 40-2c20, 40-2c21, 40-2d20, 40-2d21, 40-409, 40-956, 40-1128, 40-2807, 40-3012, 40-3304, 40- 3308, 40-3403b, 40-3421, 40-3613, 40-3805, 40-4205, 44-510j, 44- 550b, 44-594, 44-635, 44-714, 44-817, 44-1005, 44-1019, 45-221(a)(1) through (43), 46-256, 46-259, 46-2201, 47-839, 47-844, 47-849, 47- 1709, 48-1614, 49-406, 49-427, 55-1,102, 58-4114, 59-2135, 59-2802, 59-2979, 59-29b79, 60-3333, 60-3336, 65-102b, 65-118, 65-119, 65- 153f, 65-170g, 65-177, 65-1,106, 65-1,113, 65-1,116, 65-1,157a, 65- 1,163, 65-1,165, 65-1,168, 65-1,169, 65-1,171, 65-1,172, 65-436, 65- 445, 65-507, 65-525, 65-531, 65-657, 65-1135, 65-1467, 65-1627, 65- 1831, 65-2422d, 65-2438, 65-2836, 65-2839a, 65-2898a, 65-3015, 65- 3447, 65-34,108, 65-34,126, 65-4019, 65-4922, 65-4925, 65-5602, 65- 5603, 65-6002, 65-6003, 65-6004, 65-6010, 65-67a05, 65-6803, 65- 6804, 66-101c, 66-117, 66-151, 66-1,190, 66-1,203, 66-1220a, 66- 2010, 72-2232, 72-3438, 72-6116, 72-6267, 72-9934, 73-1228, 74- 2424, 74-2433f, 74-32,419, 74-4905, 74-4909, 74-50,131, 74-5515, 74- 7308, 74-7338, 74-8104, 74-8307, 74-8705, 74-8804, 74-9805, 75-104, 75-712, 75-7b15, 75-1267, 75-2943, 75-4332, 75-4362, 75-5133, 75- 5266, 75-5665, 75-5666, 75-7310, 76-355, 76-359, 76-493, 76-12b11, 76-12c03, 76-3305, 79-1119, 79-1437f, 79-3234, 79-3395, 79-3420, 79-3499, 79-34,113, 79-3614, 79-3657, 79-4301 and 79-5206. (2) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) and that have been reviewed during the 2015 legislative session and continued in existence by the legislature as provided in subsection (g) are hereby continued in existence: 17-2036, 40-5301, 45-221(a)(45), (46) and (49), 48-16a10, 58-4616, 60-3351, 72-3415, 74-50,217 and 75-53,105. House Substitute for SENATE BILL No. 291—page 9 (j) (1) Exceptions contained in the following statutes as continued in existence in section 1 of chapter 87 of the 2006 Session Laws of Kansas and that have been reviewed and continued in existence twice by the legislature as provided in subsection (g) are hereby continued in existence: 1-501, 9-1303, 12-4516a, 39-970, 65-525, 65-5117, 65-6016, 65-6017 and 74-7508. (2) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) during 2015 and that have been reviewed during the 2016 legislative session are hereby continued in existence: 12-5611, 22-4906, 22-4909, 38-2310, 38-2311, 38-2326, 40-955, 44-1132, 45-221(a)(10)(F) and (a)(50), 60-3333, 65- 4a05, 65-445(g), 65-6154, 71-218, 75-457, 75-712c, 75-723 and 75- 7c06. (k) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) and that have been reviewed during the 2014 legislative session and continued in existence by the legislature as provided in subsection (g) are hereby continued in existence: 1-205, 2-2204, 8-240, 8-247, 8-255c, 8-1324, 8- 1325, 12-17,150, 12-2001, 17-12a607, 38-1008, 38-2209, 40-5006, 40- 5108, 41-2905, 41-2906, 44-706, 44-1518, 45-221(a)(44), (45), (46), (47) and (48), 50-6a11, 65-1,243, 65-16,104, 65-3239, 74-50,184, 74- 8134, 74-99b06, 77-503a and 82a-2210. (l) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) during 2016 and that have been reviewed during the 2017 legislative session are hereby continued in existence: 12-5711, 21-2511, 22-4909, 38-2313, 45-221(a) (51) and (52), 65-516, 65-1505, 74-2012, 74-5607, 74-8745, 74-8752, 74-8772, 75-7d01, 75-7d05, 75-5133, 75-7427 and 79-3234. (m) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) during 2012 and that have been reviewed during the 2013 legislative session and continued in existence by the legislature as provided in subsection (g) are hereby continued in existence: 12-5811, 40-222, 40-223j, 40-5007a, 40-5009a, 40-5012a, 65-1685, 65-1695, 65-2838a, 66-1251, 66-1805, 72-8268, 75-712 and 75-5366. (n) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) and that have been reviewed during the 2018 legislative session are hereby continued in existence: 9-513c(c)(2), 39-709, 45-221(a)(26), (53) and (54), 65- 6832, 65-6834, 75-7c06 and 75-7c20. (o) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) that have been reviewed during the 2019 legislative session are hereby continued in existence: 21-2511(h)(2), 21-5905(a)(7), 22-2302(b) and (c), 22- 2502(d) and (e), 40-222(k)(7), 44-714(e), 45-221(a)(55), 46-1106(g) regarding 46-1106(i), 65-2836(i), 65-2839a(c), 65-2842(d), 65- 28a05(n), article 6(d) of 65-6230, 72-6314(a) and 74-7047(b). (p) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) that have been reviewed during the 2020 legislative session are hereby continued in existence: 38-2310(c), 40-409(j)(2), 40-6007(a), 45-221(a)(52), 46- 1129, 59-29a22(b)(10) and 65-6747. House Substitute for SENATE BILL No. 291—page 10 (q) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) that have been reviewed during the 2021 legislative session are hereby continued in existence: 22-2302(c)(4)(J) and (c)(6)(B), 22-2502(e)(4)(J) and (e)(6) (B) and 65-6111(d)(4). (r) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) that have been reviewed during the 2023 legislative session are hereby continued in existence: 2-3902 and 66-2020. Sec. 11. On and after July 1, 2026, K.S.A. 2023 Supp. 45-229, as amended by section 10 of this act, is hereby amended to read as follows: 45-229. (a) It is the intent of the legislature that exceptions to disclosure under the open records act shall be created or maintained only if: (1) The public record is of a sensitive or personal nature concerning individuals; (2) the public record is necessary for the effective and efficient administration of a governmental program; or (3) the public record affects confidential information. The maintenance or creation of an exception to disclosure must be compelled as measured by these criteria. Further, the legislature finds that the public has a right to have access to public records unless the criteria in this section for restricting such access to a public record are met and the criteria are considered during legislative review in connection with the particular exception to disclosure to be significant enough to override the strong public policy of open government. To strengthen the policy of open government, the legislature shall consider the criteria in this section before enacting an exception to disclosure. (b) Subject to the provisions of subsections (g) and (h), any new exception to disclosure or substantial amendment of an existing exception shall expire on July 1 of the fifth year after enactment of the new exception or substantial amendment, unless the legislature acts to continue the exception. A law that enacts a new exception or substantially amends an existing exception shall state that the exception expires at the end of five years and that the exception shall be reviewed by the legislature before the scheduled date. (c) For purposes of this section, an exception is substantially amended if the amendment expands the scope of the exception to include more records or information. An exception is not substantially amended if the amendment narrows the scope of the exception. (d) This section is not intended to repeal an exception that has been amended following legislative review before the scheduled repeal of the exception if the exception is not substantially amended as a result of the review. (e) In the year before the expiration of an exception, the revisor of statutes shall certify to the president of the senate and the speaker of the house of representatives, by July 15, the language and statutory citation of each exception that will expire in the following year that meets the criteria of an exception as defined in this section. Any exception that is not identified and certified to the president of the senate and the speaker of the house of representatives is not subject to legislative review and shall not expire. If the revisor of statutes fails to certify an exception that the revisor subsequently determines should have been certified, the revisor shall include the exception in the following year's certification after that determination. (f) "Exception" means any provision of law that creates an exception to disclosure or limits disclosure under the open records act House Substitute for SENATE BILL No. 291—page 11 pursuant to K.S.A. 45-221, and amendments thereto, or pursuant to any other provision of law. (g) A provision of law that creates or amends an exception to disclosure under the open records law shall not be subject to review and expiration under this act if such provision: (1) Is required by federal law; (2) applies solely to the legislature or to the state court system; (3) has been reviewed and continued in existence twice by the legislature; or (4) has been reviewed and continued in existence by the legislature during the 2013 legislative session and thereafter; or (5) is a report of the results of an audit conducted by the United States cybersecurity and infrastructure security agency. (h) (1) The legislature shall review the exception before its scheduled expiration and consider as part of the review process the following: (A) What specific records are affected by the exception; (B) whom does the exception uniquely affect, as opposed to the general public; (C) what is the identifiable public purpose or goal of the exception; (D) whether the information contained in the records may be obtained readily by alternative means and how it may be obtained; (2) an exception may be created or maintained only if it serves an identifiable public purpose and may be no broader than is necessary to meet the public purpose it serves. An identifiable public purpose is served if the legislature finds that the purpose is sufficiently compelling to override the strong public policy of open government and cannot be accomplished without the exception and if the exception: (A) Allows the effective and efficient administration of a governmental program that would be significantly impaired without the exception; (B) protects information of a sensitive personal nature concerning individuals, the release of such information would be defamatory to such individuals or cause unwarranted damage to the good name or reputation of such individuals or would jeopardize the safety of such individuals. Only information that would identify the individuals may be excepted under this paragraph; or (C) protects information of a confidential nature concerning entities, including, but not limited to, a formula, pattern, device, combination of devices, or compilation of information that is used to protect or further a business advantage over those who do not know or use it, if the disclosure of such information would injure the affected entity in the marketplace. (3) Records made before the date of the expiration of an exception shall be subject to disclosure as otherwise provided by law. In deciding whether the records shall be made public, the legislature shall consider whether the damage or loss to persons or entities uniquely affected by the exception of the type specified in paragraph (2)(B) or (2)(C) would occur if the records were made public. (i) (1) Exceptions contained in the following statutes as continued in existence in section 2 of chapter 126 of the 2005 Session Laws of Kansas and that have been reviewed and continued in existence twice by the legislature as provided in subsection (g) are hereby continued in existence: 1-401, 2-1202, 5-512, 9-1137, 9-1712, 9-2217, 10-630, 12- 189, 12-1,108, 12-1694, 12-1698, 12-2819, 12-4516, 16-715, 16a-2- 304, 17-1312e, 17-2227, 17-5832, 17-7511, 17-76,139, 19-4321, 21- 2511, 22-3711, 22-4707, 22-4909, 22a-243, 22a-244, 23-605, 23-9,312, 25-4161, 25-4165, 31-405, 34-251, 38-2212, 39-709b, 39-719e, 39- House Substitute for SENATE BILL No. 291—page 12 934, 39-1434, 39-1704, 40-222, 40-2,156, 40-2c20, 40-2c21, 40-2d20, 40-2d21, 40-409, 40-956, 40-1128, 40-2807, 40-3012, 40-3304, 40- 3308, 40-3403b, 40-3421, 40-3613, 40-3805, 40-4205, 44-510j, 44- 550b, 44-594, 44-635, 44-714, 44-817, 44-1005, 44-1019, 45-221(a)(1) through (43), 46-256, 46-259, 46-2201, 47-839, 47-844, 47-849, 47- 1709, 48-1614, 49-406, 49-427, 55-1,102, 58-4114, 59-2135, 59-2802, 59-2979, 59-29b79, 60-3333, 60-3336, 65-102b, 65-118, 65-119, 65- 153f, 65-170g, 65-177, 65-1,106, 65-1,113, 65-1,116, 65-1,157a, 65- 1,163, 65-1,165, 65-1,168, 65-1,169, 65-1,171, 65-1,172, 65-436, 65- 445, 65-507, 65-525, 65-531, 65-657, 65-1135, 65-1467, 65-1627, 65- 1831, 65-2422d, 65-2438, 65-2836, 65-2839a, 65-2898a, 65-3015, 65- 3447, 65-34,108, 65-34,126, 65-4019, 65-4922, 65-4925, 65-5602, 65- 5603, 65-6002, 65-6003, 65-6004, 65-6010, 65-67a05, 65-6803, 65- 6804, 66-101c, 66-117, 66-151, 66-1,190, 66-1,203, 66-1220a, 66- 2010, 72-2232, 72-3438, 72-6116, 72-6267, 72-9934, 73-1228, 74- 2424, 74-2433f, 74-32,419, 74-4905, 74-4909, 74-50,131, 74-5515, 74- 7308, 74-7338, 74-8104, 74-8307, 74-8705, 74-8804, 74-9805, 75-104, 75-712, 75-7b15, 75-1267, 75-2943, 75-4332, 75-4362, 75-5133, 75- 5266, 75-5665, 75-5666, 75-7310, 76-355, 76-359, 76-493, 76-12b11, 76-12c03, 76-3305, 79-1119, 79-1437f, 79-3234, 79-3395, 79-3420, 79-3499, 79-34,113, 79-3614, 79-3657, 79-4301 and 79-5206. (2) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) and that have been reviewed during the 2015 legislative session and continued in existence by the legislature as provided in subsection (g) are hereby continued in existence: 17-2036, 40-5301, 45-221(a)(45), (46) and (49), 48-16a10, 58-4616, 60-3351, 72-3415, 74-50,217 and 75-53,105. (j) (1) Exceptions contained in the following statutes as continued in existence in section 1 of chapter 87 of the 2006 Session Laws of Kansas and that have been reviewed and continued in existence twice by the legislature as provided in subsection (g) are hereby continued in existence: 1-501, 9-1303, 12-4516a, 39-970, 65-525, 65-5117, 65-6016, 65-6017 and 74-7508. (2) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) during 2015 and that have been reviewed during the 2016 legislative session are hereby continued in existence: 12-5611, 22-4906, 22-4909, 38-2310, 38-2311, 38-2326, 40-955, 44-1132, 45-221(a)(10)(F) and (a)(50), 60-3333, 65- 4a05, 65-445(g), 65-6154, 71-218, 75-457, 75-712c, 75-723 and 75- 7c06. (k) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) and that have been reviewed during the 2014 legislative session and continued in existence by the legislature as provided in subsection (g) are hereby continued in existence: 1-205, 2-2204, 8-240, 8-247, 8-255c, 8-1324, 8- 1325, 12-17,150, 12-2001, 17-12a607, 38-1008, 38-2209, 40-5006, 40- 5108, 41-2905, 41-2906, 44-706, 44-1518, 45-221(a)(44), (45), (46), (47) and (48), 50-6a11, 65-1,243, 65-16,104, 65-3239, 74-50,184, 74- 8134, 74-99b06, 77-503a and 82a-2210. (l) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) during 2016 and that have been reviewed during the 2017 legislative session are hereby continued in existence: 12-5711, 21-2511, 22-4909, 38-2313, 45-221(a) (51) and (52), 65-516, 65-1505, 74-2012, 74-5607, 74-8745, 74-8752, 74-8772, 75-7d01, 75-7d05, 75-5133, 75-7427 and 79-3234. House Substitute for SENATE BILL No. 291—page 13 (m) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) during 2012 and that have been reviewed during the 2013 legislative session and continued in existence by the legislature as provided in subsection (g) are hereby continued in existence: 12-5811, 40-222, 40-223j, 40-5007a, 40-5009a, 40-5012a, 65-1685, 65-1695, 65-2838a, 66-1251, 66-1805, 72-8268, 75-712 and 75-5366. (n) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) and that have been reviewed during the 2018 legislative session are hereby continued in existence: 9-513c(c)(2), 39-709, 45-221(a)(26), (53) and (54), 65- 6832, 65-6834, 75-7c06 and 75-7c20. (o) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) that have been reviewed during the 2019 legislative session are hereby continued in existence: 21-2511(h)(2), 21-5905(a)(7), 22-2302(b) and (c), 22- 2502(d) and (e), 40-222(k)(7), 44-714(e), 45-221(a)(55), 46-1106(g) regarding 46-1106(i), 65-2836(i), 65-2839a(c), 65-2842(d), 65- 28a05(n), article 6(d) of 65-6230, 72-6314(a) and 74-7047(b). (p) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) that have been reviewed during the 2020 legislative session are hereby continued in existence: 38-2310(c), 40-409(j)(2), 40-6007(a), 45-221(a)(52), 46- 1129, 59-29a22(b)(10) and 65-6747. (q) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) that have been reviewed during the 2021 legislative session are hereby continued in existence: 22-2302(c)(4)(J) and (c)(6)(B), 22-2502(e)(4)(J) and (e)(6) (B) and 65-6111(d)(4). (r) Exceptions contained in the following statutes as certified by the revisor of statutes to the president of the senate and the speaker of the house of representatives pursuant to subsection (e) that have been reviewed during the 2023 legislative session are hereby continued in existence: 2-3902 and 66-2020. Sec. 12. K.S.A. 75-413 is hereby amended to read as follows: 75- 413. (a) The secretary of state may appoint such other assistants and clerks as may be authorized by law;, but the secretary of state shall be responsible for the proper discharge of the duties of all assistants and clerks, and they shall hold their offices at the will and pleasure of the secretary and shall do and perform such general duties as the secretary may require. (b) (1) The secretary of state shall appoint a chief information security officer who shall be responsible for establishing security standards and policies to protect the office's information technology systems and infrastructure. The chief information security officer shall: (A) Develop a cybersecurity program for the office that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The chief information security officer shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030; (B) ensure that the secretary of state and all employees complete cybersecurity awareness training annually and that if an employee does not complete the required training, such employee's access to any House Substitute for SENATE BILL No. 291—page 14 state-issued hardware or the state network is revoked; and (C) (i) (a) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of the office for compliance with applicable state and federal laws, rules and regulations and office policies and standards; and (b) make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit. (ii) Results of audits conducted pursuant to this paragraph shall be confidential and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. (2) The provisions of this subsection shall expire on July 1, 2026. Sec. 13. K.S.A. 75-623 is hereby amended to read as follows: 75- 623. (a) The treasurer shall appoint such other assistants, clerks, bookkeepers, accountants and stenographers as may be authorized by law, each of which persons shall take the oath of office required of public officers. Such persons shall hold their offices at the will and pleasure of the state treasurer. (b) (1) The treasurer shall appoint a chief information security officer who shall be responsible for establishing security standards and policies to protect the office's information technology systems and infrastructure. The chief information security officer shall: (A) Develop a cybersecurity program for the office that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The chief information security officer shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030; (B) ensure that the treasurer and all employees complete cybersecurity awareness training annually and that if an employee does not complete the required training, such employee's access to any state-issued hardware or the state network is revoked; and (C) (i) (a) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of the office for compliance with applicable state and federal laws, rules and regulations and office policies and standards; and (b) make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit. (ii) Results of audits conducted pursuant to this paragraph shall be confidential and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. (2) The provisions of this subsection shall expire on July 1, 2026. Sec. 14. K.S.A. 75-710 is hereby amended to read as follows: 75- 710. (a) The attorney general shall appoint such assistants, clerks, and stenographers as shall be authorized by law, and who shall hold their office at the will and pleasure of the attorney general. All fees and allowances earned by said assistants or any of them, or allowed to them by any statute or order of court in any civil or criminal case whatsoever, shall be turned into the general revenue fund of the state treasury, and the vouchers for their monthly salaries shall not be honored by the director of accounts and reports until a verified account of the fees collected by them, or either of them, during the preceding month, has been filed in the director of accounts and reports' office. Assistants appointed by the attorney general shall perform the duties and exercise the powers as prescribed by law and shall perform other duties as prescribed by the attorney general. Assistants shall act for and exercise House Substitute for SENATE BILL No. 291—page 15 the power of the attorney general to the extent the attorney general delegates them the authority to do so. (b) (1) The attorney general shall appoint a chief information security officer who shall be responsible for establishing security standards and policies to protect the office's information technology systems and infrastructure. The chief information security officer shall: (A) Develop a cybersecurity program for the office that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The chief information security officer shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030; (B) ensure that the attorney general and all employees complete cybersecurity awareness training annually and that if an employee does not complete the required training, such employee's access to any state-issued hardware or the state network is revoked; and (C) (i) (a) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of the office for compliance with applicable state and federal laws, rules and regulations and office policies and standards; and (b) make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit. (ii) Results of audits conducted pursuant to this paragraph shall be confidential and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. (2) The provisions of this subsection shall expire on July 1, 2026. Sec. 15. K.S.A. 75-711 is hereby amended to read as follows: 75- 711. (a) There is hereby established, under the jurisdiction of the attorney general, a division to be known as the Kansas bureau of investigation. The director of the bureau shall be appointed by the attorney general, subject to confirmation by the senate as provided in K.S.A. 75-4315b, and amendments thereto, and shall have special training and qualifications for such position. Except as provided by K.S.A. 46-2601, and amendments thereto, no person appointed as director shall exercise any power, duty or function as director until confirmed by the senate. In accordance with appropriation acts, the director shall appoint agents who shall be trained in the detection and apprehension of criminals. The director shall appoint an associate director, and any such assistant directors from within the agency as are necessary for the efficient operation of the bureau, who shall have the qualifications and employee benefits, including longevity, of an agent. The director also may appoint a deputy director and, in accordance with appropriation acts, such administrative employees as are necessary for the efficient operation of the bureau. No person shall be appointed to a position within the Kansas bureau of investigation if the person has been convicted of a felony. (b) The director, associate director, deputy director, assistant directors and any assistant attorneys general assigned to the bureau shall be within the unclassified service under the Kansas civil service act. All other agents and employees of the bureau shall be in the classified service under the Kansas civil service act and their compensation shall be determined as provided in the Kansas civil service act and shall receive actual and necessary expenses. (c) Any person who was a member of the bureau at the time of appointment as director, associate director or assistant director, upon the expiration of their appointment, shall be returned to an unclassified or regular classified position under the Kansas civil service act with House Substitute for SENATE BILL No. 291—page 16 compensation comparable to and not lower than compensation being received at the time of appointment to the unclassified service. If all such possible positions are filled at that time, a temporary additional position shall be created for the person until a vacancy exists in the position. While serving in the temporary additional position, the person shall continue to be a contributing member of the retirement system for the agents of the Kansas bureau of investigation. (d) Each agent of the bureau shall subscribe to an oath to faithfully discharge the duties of such agent's office, as is required of other public officials. (e) (1) The director shall appoint a chief information security officer who shall be responsible for establishing security standards and policies to protect the bureau's information technology systems and infrastructure. The chief information security officer shall: (A) Develop a cybersecurity program for the bureau that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The chief information security officer shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030; (B) ensure that the director and all employees complete cybersecurity awareness training annually and that if an employee does not complete the required training, such employee's access to any state-issued hardware or the state network is revoked; and (C) (i) (a) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of the department for compliance with applicable state and federal laws, rules and regulations and department policies and standards; and (b) make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit. (ii) Results of audits conducted pursuant to this paragraph shall be confidential and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. (2) The provisions of this subsection shall expire on July 1, 2026. Sec. 16. K.S.A. 2023 Supp. 75-7201 is hereby amended to read as follows: 75-7201. As used in K.S.A. 75-7201 through 75-7212, and amendments thereto: (a) "Business risk" means the overall level of risk determined by a business risk assessment that includes, but is not limited to, cost, information security and other elements as determined by the information technology executive council's policies or policies adopted by the judicial branch or the legislative coordinating council. (b) "Cumulative cost" means the total expenditures, from all sources, for any information technology project by one or more state agencies to meet project objectives from project start to project completion or the date and time the project is terminated if it is not completed. (c) "Executive agency" means any state agency in the executive branch of government, including the judicial council but not the elected office agencies. (d) "Information technology project" means an information technology effort by a state agency of defined and limited duration that implements, effects a change in or presents a risk to processes, services, security, systems, records, data, human resources or architecture. (e) "Information technology project change or overrun" means any change in: (1) Planned expenditures for an information technology project House Substitute for SENATE BILL No. 291—page 17 that would result in the total authorized cost of the project being increased above the currently authorized cost of such project by more than 10% of such currently authorized cost of such project or an established threshold within the information technology executive council's policies or policies adopted by the judicial branch or the legislative coordinating council; (2) the scope or project timeline of an information technology project, as such scope or timeline was presented to and reviewed by the joint committee or the chief information technology officer to whom the project was submitted pursuant to K.S.A. 75-7209, and amendments thereto, that is a change of more than 10% or a change that is significant as determined by the information technology executive council's policies or policies adopted by the judicial branch or the legislative coordinating council; or (3) the proposed use of any new or replacement information technology equipment or in the use of any existing information technology equipment that has been significantly upgraded. (f) "Joint committee" means the joint committee on information technology. (g) "Judicial agency" means any state agency in the judicial branch of government. (h) "Legislative agency" means any state agency in the legislative branch of government. (i) "Project" means a planned series of events or activities that is intended to accomplish a specified outcome in a specified time period, under consistent management direction within a state agency or shared among two or more state agencies, and that has an identifiable budget for anticipated expenses. (j) "Project completion" means the date and time when the head of a state agency having primary responsibility for an information technology project certifies that the improvement being produced or altered under the project is ready for operational use. (k) "Project start" means the date and time when a state agency begins a formal study of a business process or technology concept to assess the needs of the state agency, determines project feasibility or prepares an information technology project budget estimate under K.S.A. 75-7209, and amendments thereto. (l) "State agency" means any state office or officer, department, board, commission, institution or bureau, or any agency, division or unit thereof. Sec. 17. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7201, as amended by section 16 of this act, is hereby amended to read as follows: 75-7201. As used in K.S.A. 75-7201 through 75-7212, and amendments thereto: (a) "Business risk" means the overall level of risk determined by a business risk assessment that includes, but is not limited to, cost, information security and other elements as determined by the information technology executive council's policies or policies adopted by the judicial branch or the legislative coordinating council. (b) "Cumulative cost" means the total expenditures, from all sources, for any information technology project by one or more state agencies to meet project objectives from project start to project completion or the date and time the project is terminated if it is not completed. (c) "Executive agency" means any state agency in the executive branch of government, including the judicial council but not the elected office agencies. (d) "Information technology project" means an information technology effort by a state agency of defined and limited duration that House Substitute for SENATE BILL No. 291—page 18 implements, effects a change in or presents a risk to processes, services, security, systems, records, data, human resources or architecture. (e) "Information technology project change or overrun" means any change in: (1) Planned expenditures for an information technology project that would result in the total authorized cost of the project being increased above the currently authorized cost of such project by more than 10% of such currently authorized cost of such project or an established threshold within the information technology executive council's policies or policies adopted by the judicial branch or the legislative coordinating council; (2) the scope or project timeline of an information technology project, as such scope or timeline was presented to and reviewed by the joint committee or the chief information technology officer to whom the project was submitted pursuant to K.S.A. 75-7209, and amendments thereto, that is a change of more than 10% or a change that is significant as determined by the information technology executive council's policies or policies adopted by the judicial branch or the legislative coordinating council; or (3) the proposed use of any new or replacement information technology equipment or in the use of any existing information technology equipment that has been significantly upgraded. (f) "Joint committee" means the joint committee on information technology. (g) "Judicial agency" means any state agency in the judicial branch of government. (h) "Legislative agency" means any state agency in the legislative branch of government. (i) "Project" means a planned series of events or activities that is intended to accomplish a specified outcome in a specified time period, under consistent management direction within a state agency or shared among two or more state agencies, and that has an identifiable budget for anticipated expenses. (j) "Project completion" means the date and time when the head of a state agency having primary responsibility for an information technology project certifies that the improvement being produced or altered under the project is ready for operational use. (k) "Project start" means the date and time when a state agency begins a formal study of a business process or technology concept to assess the needs of the state agency, determines project feasibility or prepares an information technology project budget estimate under K.S.A. 75-7209, and amendments thereto. (l) "State agency" means any state office or officer, department, board, commission, institution or bureau, or any agency, division or unit thereof. Sec. 18. K.S.A. 2023 Supp. 75-7202 is hereby amended to read as follows: 75-7202. (a) There is hereby established the information technology executive council which shall be attached to the office of information technology services for purposes of administrative functions. (b) (1) The council shall be composed of 17 13 voting members as follows: (A) Two cabinet agency heads or such persons' designees; (B) two noncabinet agency heads or such persons' designees; (C) the executive chief information technology officer; (D) the legislative chief information technology officer; (E) the judicial chief information technology officer; (F) the chief executive officer of the state board of regents or such person's designee; House Substitute for SENATE BILL No. 291—page 19 (G)(E) one representative of cities; (H)(F) one representative of counties; the network manager of the information network of Kansas (INK); (I)(G) one representative with background and knowledge in technology and cybersecurity from the private sector, except that such representative or such representative's employer shall not be an information technology or cybersecurity vendor that does business with the state of Kansas; (J)(H) one representative appointed by the Kansas criminal justice information system committee; and (K) one member of the senate appointed by the president of the senate or such member's designee; (L) one member of the senate appointed by the minority leader of the senate or such member's designee; (M) one member of the house of representatives appointed by the speaker of the house of representatives or such member's designee; and (N) one member of the house of representatives appointed by the minority leader of the house of representatives or such member's designee(I) two information technology employees from state board of regents institutions appointed by the board of regents. (2) The chief information technology architect, the legislative chief information technology officer, the judicial chief information technology officer, one member of the senate appointed by the president of the senate, one member of the senate appointed by the minority leader of the senate, one member of the house of representatives appointed by the speaker of the house of representatives and one member of the house of representatives appointed by the minority leader of the house of representatives shall be a nonvoting member nonvoting members of the council. (3) The cabinet agency heads, the noncabinet agency heads, the representative of cities, the representative of counties and the representative from the private sector shall be appointed by the governor for a term not to exceed 18 months. Upon expiration of an appointed member's term, the member shall continue to hold office until the appointment of a successor. Legislative members shall remain members of the legislature in order to retain membership on the council and shall serve until replaced pursuant to this section. Vacancies of members during a term shall be filled in the same manner as the original appointment only for the unexpired part of the term. The appointing authority for a member may remove the member, reappoint the member or substitute another appointee for the member at any time. Nonappointed members shall serve ex officio. (c) The chairperson of the council shall be drawn from the chief information technology officers, with each chief information technology officer serving a one-year term. The term of chairperson shall rotate among the chief information technology officers on an annual basis the executive chief information technology officer. (d) The council shall hold quarterly monthly meetings and hearings in the city of Topeka or at such other places as the council designates, on call of the executive chief information technology officer or on request of four or more members. A quorum of the council shall be nine seven members. All actions of the council shall be taken by a majority of all of the members of the council. (e) Except for members specified as a designee in subsection (b), members of the council may not appoint an individual to represent them on the council and only members of the council may vote. (f) Members of the council shall receive mileage, tolls and parking as provided in K.S.A. 75-3223, and amendments thereto, for attendance at any meeting of the council or any subcommittee meeting authorized House Substitute for SENATE BILL No. 291—page 20 by the council. Sec. 19. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7202, as amended by section 18 of this act, is hereby amended to read as follows: 75-7202. (a) There is hereby established the information technology executive council which shall be attached to the office of information technology services for purposes of administrative functions. (b) (1) The council shall be composed of 13 17 voting members as follows: (A) Two cabinet agency heads or such persons' designees; (B) two noncabinet agency heads or such persons' designees; (C) the executive chief information technology officer; (D) the legislative chief information technology officer; (E) the judicial chief information technology officer; (F) the chief executive officer of the state board of regents or such person's designee; (E)(G) one representative of cities; (F)(H) one representative of counties; the network manager of the information network of Kansas (INK); (G)(I) one representative with background and knowledge in technology and cybersecurity from the private sector, except that such representative or such representative's employer shall not be an information technology or cybersecurity vendor that does business with the state of Kansas; (H)(J) one representative appointed by the Kansas criminal justice information system committee; and (I) two information technology employees from state board of regents institutions appointed by the board of regents(K) one member of the senate appointed by the president of the senate or such member's designee; (L) one member of the senate appointed by the minority leader of the senate or such member's designee; (M) one member of the house of representatives appointed by the speaker of the house of representatives or such member's designee; and (N) one member of the house of representatives appointed by the minority leader of the house of representatives or such member's designee. (2) The chief information technology architect, the legislative chief information technology officer, the judicial chief information technology officer, one member of the senate appointed by the president of the senate, one member of the senate appointed by the minority leader of the senate, one member of the house of representatives appointed by the speaker of the house of representatives and one member of the house of representatives appointed by the minority leader of the house of representatives shall be a nonvoting members member of the council. (3) The cabinet agency heads, the noncabinet agency heads, the representative of cities, the representative of counties and the representative from the private sector shall be appointed by the governor for a term not to exceed 18 months. Upon expiration of an appointed member's term, the member shall continue to hold office until the appointment of a successor. Legislative members shall remain members of the legislature in order to retain membership on the council and shall serve until replaced pursuant to this section. Vacancies of members during a term shall be filled in the same manner as the original appointment only for the unexpired part of the term. The appointing authority for a member may remove the member, reappoint the member or substitute another appointee for the member at any time. Nonappointed members shall serve ex officio. House Substitute for SENATE BILL No. 291—page 21 (c) The chairperson of the council shall be the executive chief information technology officer drawn from the chief information technology officers, with each chief information technology officer serving a one-year term. The term of chairperson shall rotate among the chief information technology officers on an annual basis. (d) The council shall hold monthly quarterly meetings and hearings in the city of Topeka or at such other places as the council designates, on call of the executive chief information technology officer or on request of four or more members. A quorum of the council shall be seven nine members. All actions of the council shall be taken by a majority of all of the members of the council. (e) Except for members specified as a designee in subsection (b), members of the council may not appoint an individual to represent them on the council and only members of the council may vote. (f) Members of the council shall receive mileage, tolls and parking as provided in K.S.A. 75-3223, and amendments thereto, for attendance at any meeting of the council or any subcommittee meeting authorized by the council. Sec. 20. K.S.A. 75-7203 is hereby amended to read as follows: 75- 7203. (a) The information technology executive council is hereby authorized to adopt such policies and rules and regulations as necessary to implement, administer and enforce the provisions of this act. (b) The council shall: (1) Adopt: (A) Information technology resource policies and procedures and project management methodologies for all state executive branch agencies; (B) an information technology architecture, including telecommunications systems, networks and equipment, that covers all state agencies; (C) standards for data management for all state executive branch agencies; and (D) a strategic information technology management plan for the state executive branch; (2) provide direction and coordination for the application of the state's executive branch's information technology resources; (3) designate the ownership of information resource processes and the lead executive branch agency for implementation of new technologies and networks shared by multiple agencies in different branches within the executive branch of state government; and (4) develop a plan to integrate all information technology services for the executive branch into the office of information technology services and all cybersecurity services for state educational institutions as defined in K.S.A. 76-711, and amendments thereto, into the office of information technology services and the Kansas information security office; and  (5) perform such other functions and duties as necessary to carry out the provisions of this act. (c) The information technology executive council shall report the plan developed under subsection (b)(4) to the senate standing committee on ways and means and the house standing committee on legislative modernization or its successor committee prior to January 15, 2026, in accordance with section 1, and amendments thereto. Sec. 21. On and after July 1, 2026, K.S.A. 75-7203, as amended by section 20 of this act, is hereby amended to read as follows: 75- 7203. (a) The information technology executive council is hereby authorized to adopt such policies and rules and regulations as necessary to implement, administer and enforce the provisions of this act. (b) The council shall: House Substitute for SENATE BILL No. 291—page 22 (1) Adopt: (A) Information technology resource policies and procedures and project management methodologies for all executive branch state agencies; (B) an information technology architecture, including telecommunications systems, networks and equipment, that covers all state agencies; (C) standards for data management for all executive branch state agencies; and (D) a strategic information technology management plan for the executive branch state; (2) provide direction and coordination for the application of the executive branch's state's information technology resources; (3) designate the ownership of information resource processes and the lead executive branch state agency for implementation of new technologies and networks shared by multiple agencies within the executive branch in different branches of state government; (4) develop a plan to integrate all information technology services for the executive branch into the office of information technology services and all cybersecurity services for state educational institutions as defined in K.S.A. 76-711, and amendments thereto, into the office of information technology services and the Kansas information security office; and  (5)(4) perform such other functions and duties as necessary to carry out the provisions of this act. (c) The information technology executive council shall report the plan developed under subsection (b)(4) to the senate standing committee on ways and means and the house standing committee on legislative modernization or its successor committee prior to January 15, 2026, in accordance with section 1, and amendments thereto. Sec. 22. K.S.A. 2023 Supp. 75-7205 is hereby amended to read as follows: 75-7205. (a) There is hereby established within and as a part of the office of information technology services the position of executive chief information technology officer. The executive chief information technology officer shall be in the unclassified service under the Kansas civil service act, shall be appointed by the governor, and shall receive compensation in an amount fixed by the governor. The executive chief information technology officer shall maintain a presence in any cabinet established by the governor and shall report to the governor. (b) The executive chief information technology officer shall: (1) Review and consult with each executive agency regarding information technology plans, deviations from the state information technology architecture, information technology project estimates and information technology project changes and overruns submitted by such agency pursuant to K.S.A. 75-7209, and amendments thereto, to determine whether the agency has complied with: (A) The information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (B) the information technology architecture adopted by the information technology executive council; (C) the standards for data management adopted by the information technology executive council; and (D) the strategic information technology management plan adopted by the information technology executive council; (2) report to the chief information technology architect all deviations from the state information architecture that are reported to the executive information technology officer by executive agencies; (3) submit recommendations to the division of the budget as to the House Substitute for SENATE BILL No. 291—page 23 technical and management merit of information technology projects and information technology project changes and overruns submitted by executive agencies that are reportable pursuant to K.S.A. 75-7209, and amendments thereto; (4) monitor executive agencies' compliance with: (A) The information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (B) the information technology architecture adopted by the information technology executive council; (C) the standards for data management adopted by the information technology executive council; and (D) the strategic information technology management plan adopted by the information technology executive council; (5) coordinate implementation of new information technology among executive agencies and with the judicial and legislative chief information technology officers; (6) designate the ownership of information resource processes and the lead agency for implementation of new technologies and networks shared by multiple agencies within the executive branch of state government; and (7) perform such other functions and duties as provided by law or as directed by the governor; (8) consult with the appropriate legal counsel on topics related to confidentiality of information, the open records act, K.S.A. 45-215 et seq., and amendments thereto, the open meetings act, K.S.A. 75-4317 et seq., and amendments thereto, and any other legal matter related to information technology; (9) ensure that each executive agency has the necessary information technology and cybersecurity staff imbedded within the agency to accomplish the agency's duties; (10) maintain all third-party data centers at locations within the United States or with companies that are based in the United States; and (11) create a database of all electronic devices within the branch and ensure that each device is inventoried, cataloged and tagged within an inventory device. (c) An employee of the office of information technology services shall not disclose confidential information of an executive agency. (d) The executive chief information technology officer may make a request to the adjutant general to permit the Kansas national guard in a state active duty capacity to perform vulnerability assessments or other assessments of the branch for the purpose of enhancing security. During such vulnerability assessments, members performing the assessment shall, to the extent possible, ensure that no harm is done to the systems being assessed. The executive chief information technology officer shall notify the executive agency that owns the information systems being assessed about such assessment and coordinate to mitigate the security risk. Sec. 23. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7205, as amended by section 22 of this act, is hereby amended to read as follows: 75-7205. (a) There is hereby established within and as a part of the office of information technology services the position of executive chief information technology officer. The executive chief information technology officer shall be in the unclassified service under the Kansas civil service act, shall be appointed by the governor, and shall receive compensation in an amount fixed by the governor. The executive chief information technology officer shall maintain a presence in any cabinet established by the governor and shall report to the governor. House Substitute for SENATE BILL No. 291—page 24 (b) The executive chief information technology officer shall: (1) Review and consult with each executive agency regarding information technology plans, deviations from the state information technology architecture, information technology project estimates and information technology project changes and overruns submitted by such agency pursuant to K.S.A. 75-7209, and amendments thereto, to determine whether the agency has complied with: (A) The information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (B) the information technology architecture adopted by the information technology executive council; (C) the standards for data management adopted by the information technology executive council; and (D) the strategic information technology management plan adopted by the information technology executive council; (2) report to the chief information technology architect all deviations from the state information architecture that are reported to the executive information technology officer by executive agencies; (3) submit recommendations to the division of the budget as to the technical and management merit of information technology projects and information technology project changes and overruns submitted by executive agencies that are reportable pursuant to K.S.A. 75-7209, and amendments thereto; (4) monitor executive agencies' compliance with: (A) The information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (B) the information technology architecture adopted by the information technology executive council; (C) the standards for data management adopted by the information technology executive council; and (D) the strategic information technology management plan adopted by the information technology executive council; (5) coordinate implementation of new information technology among executive agencies and with the judicial and legislative chief information technology officers; (6) designate the ownership of information resource processes and the lead agency for implementation of new technologies and networks shared by multiple agencies within the executive branch of state government; and (7) perform such other functions and duties as provided by law or as directed by the governor; (8) consult with the appropriate legal counsel on topics related to confidentiality of information, the open records act, K.S.A. 45-215 et seq., and amendments thereto, the open meetings act, K.S.A. 75-4317 et seq., and amendments thereto, and any other legal matter related to information technology; (9) ensure that each executive agency has the necessary information technology and cybersecurity staff imbedded within the agency to accomplish the agency's duties; (10) maintain all third-party data centers at locations within the United States or with companies that are based in the United States; and (11) create a database of all electronic devices within the branch and ensure that each device is inventoried, cataloged and tagged within an inventory device. (c) An employee of the office of information technology services shall not disclose confidential information of an executive agency. House Substitute for SENATE BILL No. 291—page 25 (d) The executive chief information technology officer may make a request to the adjutant general to permit the Kansas national guard in a state active duty capacity to perform vulnerability assessments or other assessments of the branch for the purpose of enhancing security. During such vulnerability assessments, members performing the assessment shall, to the extent possible, ensure that no harm is done to the systems being assessed. The executive chief information technology officer shall notify the executive agency that owns the information systems being assessed about such assessment and coordinate to mitigate the security risk. Sec. 24. K.S.A. 2023 Supp. 75-7206 is hereby amended to read as follows: 75-7206. (a) There is hereby established within and as a part of the office of the state judicial administrator the position of judicial chief information technology officer. The judicial chief information technology officer shall be appointed by the judicial administrator, subject to approval of the chief justice, and shall receive compensation determined by the judicial administrator, subject to approval of the chief justice. (b) The judicial chief information technology officer shall: (1) Review and consult with each judicial agency regarding information technology plans, deviations from the state information technology architecture, information technology project estimates and information technology project changes and overruns submitted by such agency pursuant to K.S.A. 75-7209, and amendments thereto, to determine whether the agency has complied with: (A) The information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (B) the information technology architecture adopted by the information technology executive council; (C) the standards for data management adopted by the information technology executive council; and (D) the strategic information technology management plan adopted by the information technology executive council policies and procedures adopted by the judicial branch; (2) report to the chief information technology architect all deviations from the state information architecture that are reported to the judicial information technology officer by judicial agencies; (3) submit recommendations to the judicial administrator as to the technical and management merit of information technology projects and information technology project changes and overruns submitted by judicial agencies that are reportable pursuant to K.S.A. 75-7209, and amendments thereto; (4) monitor judicial agencies' compliance with: (A) The information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (B) the information technology architecture adopted by the information technology executive council; (C) the standards for data management adopted by the information technology executive council; and (D) the strategic information technology management plan adopted by the information technology executive council; (5)(4) coordinate implementation of new information technology among judicial agencies and with the executive and legislative chief information technology officers; (6)(5) designate the ownership of information resource processes and the lead agency for implementation of new technologies and networks shared by multiple agencies within the judicial branch of state House Substitute for SENATE BILL No. 291—page 26 government; and (7)(6) perform such other functions and duties as provided by law or as directed by the judicial administrator; (7) ensure that each judicial agency has the necessary information technology and cybersecurity staff imbedded within the agency to accomplish the agency's duties; (8) maintain all third-party data centers at locations within the United States or with companies that are based in the United States; and (9) create a database of all electronic devices within the branch and ensure that each device is inventoried, cataloged and tagged with an inventory device. (c) An employee of the office of the state judicial administrator shall not disclose confidential information of a judicial agency. (d) The judicial chief information technology officer may make a request to the adjutant general to permit the Kansas national guard in a state active duty capacity to perform vulnerability assessments or other assessments of the branch for the purpose of enhancing security. During such vulnerability assessments, members performing the assessment shall, to the extent possible, ensure that no harm is done to the systems being assessed. The judicial chief information technology officer shall notify the judicial agency that owns the information systems being assessed about such assessment and coordinate to mitigate the security risk. Sec. 25. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7206, as amended by section 24 of this act, is hereby amended to read as follows: 75-7206. (a) There is hereby established within and as a part of the office of the state judicial administrator the position of judicial chief information technology officer. The judicial chief information technology officer shall be appointed by the judicial administrator, subject to approval of the chief justice, and shall receive compensation determined by the judicial administrator, subject to approval of the chief justice. (b) The judicial chief information technology officer shall: (1) Review and consult with each judicial agency regarding information technology plans, deviations from the state information technology architecture, information technology project estimates and information technology project changes and overruns submitted by such agency pursuant to K.S.A. 75-7209, and amendments thereto, to determine whether the agency has complied with policies and procedures adopted by the judicial branch: (A) The information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (B) the information technology architecture adopted by the information technology executive council; (C) the standards for data management adopted by the information technology executive council; and (D) the strategic information technology management plan adopted by the information technology executive council; (2) report to the chief information technology architect all deviations from the state information architecture that are reported to the judicial information technology officer by judicial agencies; (3) submit recommendations to the judicial administrator as to the technical and management merit of information technology projects and information technology project changes and overruns submitted by judicial agencies that are reportable pursuant to K.S.A. 75-7209, and amendments thereto; (4) monitor judicial agencies' compliance with: House Substitute for SENATE BILL No. 291—page 27 (A) The information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (B) the information technology architecture adopted by the information technology executive council; (C) the standards for data management adopted by the information technology executive council; and (D) the strategic information technology management plan adopted by the information technology executive council; (5) coordinate implementation of new information technology among judicial agencies and with the executive and legislative chief information technology officers; (5)(6) designate the ownership of information resource processes and the lead agency for implementation of new technologies and networks shared by multiple agencies within the judicial branch of state government; and (6)(7) perform such other functions and duties as provided by law or as directed by the judicial administrator; (7) ensure that each judicial agency has the necessary information technology and cybersecurity staff imbedded within the agency to accomplish the agency's duties; (8) maintain all third-party data centers at locations within the United States or with companies that are based in the United States; and (9) create a database of all electronic devices within the branch and ensure that each device is inventoried, cataloged and tagged with an inventory device. (c) An employee of the office of the state judicial administrator shall not disclose confidential information of a judicial agency. (d) The judicial chief information technology officer may make a request to the adjutant general to permit the Kansas national guard in a state active duty capacity to perform vulnerability assessments or other assessments of the branch for the purpose of enhancing security. During such vulnerability assessments, members performing the assessment shall, to the extent possible, ensure that no harm is done to the systems being assessed. The judicial chief information technology officer shall notify the judicial agency that owns the information systems being assessed about such assessment and coordinate to mitigate the security risk. Sec. 26. K.S.A. 2023 Supp. 75-7208 is hereby amended to read as follows: 75-7208. (a) The legislative chief information technology officer shall: (a)(1) Review and consult with each legislative agency regarding information technology plans, deviations from the state information technology architecture, information technology project estimates and information technology project changes and overruns submitted by such agency pursuant to K.S.A. 75-7209, and amendments thereto, to determine whether the agency has complied with the: (1) Information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (2) information technology architecture adopted by the information technology executive council; (3) standards for data management adopted by the information technology executive council; and (4) strategic information technology management plan adopted by the information technology executive council policies and procedures adopted by the legislative coordinating council; (b)(2) report to the chief information technology architect all House Substitute for SENATE BILL No. 291—page 28 deviations from the state information architecture that are reported to the legislative information technology officer by legislative agencies; (c)(3) submit recommendations to the legislative coordinating council as to the technical and management merit of information technology projects and information technology project changes and overruns submitted by legislative agencies that are reportable pursuant to K.S.A. 75-7209, and amendments thereto; (d) monitor legislative agencies' compliance with the: (1) Information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (2) information technology architecture adopted by the information technology executive council; (3) standards for data management adopted by the information technology executive council; and (4) strategic information technology management plan adopted by the information technology executive council; (e)(4) coordinate implementation of new information technology among legislative agencies and with the executive and judicial chief information technology officers; (f)(5) designate the ownership of information resource processes and the lead agency for implementation of new technologies and networks shared by multiple agencies within the legislative branch of state government; (g)(6) serve as staff of the joint committee; and (h)(7) perform such other functions and duties as provided by law or as directed by the legislative coordinating council or the joint committee; (8) consult and obtain approval from the revisor of statutes prior to taking action on topics related to confidentiality of information, the open records act, K.S.A. 45-215 et seq., and amendments thereto, the open meetings act, K.S.A. 75-4317 et seq., and amendments thereto, and any other legal matter related to information technology; (9) ensure that each legislative agency has the necessary information technology and cybersecurity staff imbedded within the agency to accomplish the agency's duties; (10) maintain all third-party data centers at locations within the United States or with companies that are based in the United States; and (11) create a database of all electronic devices within the branch and ensure that each device is inventoried, cataloged and tagged with an inventory device. (b) An employee of the Kansas legislative office of information services or the division of legislative administrative services shall not disclose confidential information of a legislative agency. (c) The legislative chief information technology officer may make a request to the adjutant general to permit the Kansas national guard in a state active duty capacity to perform vulnerability assessments or other assessments of the branch for the purpose of enhancing security. During such vulnerability assessments, members performing the assessment shall, to the extent possible, ensure that no harm is done to the systems being assessed. The legislative chief information technology officer shall notify the legislative agency that owns the information systems being assessed about such assessement and coordinate to mitigate the security risk. Sec. 27. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7208, as amended by section 26 of this act, is hereby amended to read as follows: 75-7208. (a) The legislative chief information technology officer shall: House Substitute for SENATE BILL No. 291—page 29 (1)(a) Review and consult with each legislative agency regarding information technology plans, deviations from the state information technology architecture, information technology project estimates and information technology project changes and overruns submitted by such agency pursuant to K.S.A. 75-7209, and amendments thereto, to determine whether the agency has complied with the policies and procedures adopted by the legislative coordinating council: (1) Information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (2) information technology architecture adopted by the information technology executive council; (3) standards for data management adopted by the information technology executive council; and (4) strategic information technology management plan adopted by the information technology executive council; (2)(b) report to the chief information technology architect all deviations from the state information architecture that are reported to the legislative information technology officer by legislative agencies; (3)(c) submit recommendations to the legislative coordinating council as to the technical and management merit of information technology projects and information technology project changes and overruns submitted by the legislative agencies that are reportable pursuant to K.S.A. 75-7209, and amendments thereto; (d) monitor legislative agencies' compliance with the: (1) Information technology resource policies and procedures and project management methodologies adopted by the information technology executive council; (2) information technology architecture adopted by the information technology executive council; (3) standards for data management adopted by the information technology executive council; and (4) strategic information technology management plan adopted by the information technology executive council; (4)(e) coordinate implementation of new information technology among legislative agencies and with the executive and judicial chief information technology officers; (5)(f) designate the ownership of information resource processes and the lead agency for implementation of new technologies and networks shared by multiple agencies within the legislative branch of state government; (6)(g) serve as staff of the joint committee; and (7)(h) perform such other functions and duties as provided by law or as directed by the legislative coordinating council or the joint committee; (8) consult and obtain approval from the revisor of statutes prior to taking action on topics related to confidentiality of information, the open records act, K.S.A. 45-215 et seq., and amendments thereto, the open meetings act, K.S.A. 75-4317 et seq., and amendments thereto, and any other legal matter related to information technology; (9) ensure that each legislative agency has the necessary information technology and cybersecurity staff imbedded within the agency to accomplish the agency's duties; (10) maintain all third-party data centers at locations within the United States or with companies that are based in the United States; and (11) create a database of all electronic devices within the branch and ensure that each device is inventoried, cataloged and tagged with an inventory device. House Substitute for SENATE BILL No. 291—page 30 (b) An employee of the Kansas legislative office of information services or the division of legislative administrative services shall not disclose confidential information of a legislative agency. (c) The legislative chief information technology officer may make a request to the adjutant general to permit the Kansas national guard in a state active duty capacity to perform vulnerability assessments or other assessments of the branch for the purpose of enhancing security. During such vulnerability assessments, members performing the assessment shall, to the extent possible, ensure that no harm is done to the systems being assessed. The legislative chief information technology officer shall notify the legislative agency that owns the information systems being assessed about such assessement and coordinate to mitigate the security risk. Sec. 28. K.S.A. 2023 Supp. 75-7209 is hereby amended to read as follows: 75-7209. (a) (1) Whenever an agency proposes an information technology project, such agency shall prepare and submit information technology project documentation to the chief information technology officer of the branch of state government of which the agency is a part. Such information technology project documentation shall: (A) Include a financial plan showing the proposed source of funding and categorized expenditures for each phase of the project and cost estimates for any needs analyses or other investigations, consulting or other professional services, computer programs, data, equipment, buildings or major repairs or improvements to buildings and other items or services necessary for the project; and (B) be consistent with: (i) Information technology resource policies and procedures and project management methodologies for all state agencies; (ii) an information technology architecture, including telecommunications systems, networks and equipment, that covers all state agencies; (iii) standards for data management for all state agencies; and (iv) a strategic information technology management plan for the state. (2) Any information technology project with significant business risk, as determined pursuant to the information technology executive council's policies or policies adopted by the judicial branch or the legislative coordinating council, shall be presented to the joint committee on information technology by such branch chief information technology officer. (b) (1) Prior to the release of any request for proposal for an information technology project with significant business risk: (A) Specifications for bids or proposals for such project shall be submitted to the chief information technology officer of the branch of state government of which the agency or agencies are a part. Information technology projects requiring chief information technology officer approval shall also require the chief information technology officer's written approval on specifications for bids or proposals; and (B) (i) The chief information technology officer of the appropriate branch over the state agency or agencies that are involved in such project shall submit the project, the project plan, including the architecture, and the cost-benefit analysis to the joint committee on information technology to advise and consult on the project. Such chief information technology officer shall submit such information to each member of the joint committee and to the director of the legislative research department. Each such project plan summary shall include a notice specifying the date the summary was mailed or emailed. After receiving any such project plan summary, each member shall review the information and may submit questions, requests for additional House Substitute for SENATE BILL No. 291—page 31 information or request a presentation and review of the proposed project at a meeting of the joint committee. If two or more members of the joint committee contact the director of the legislative research department within seven business days of the date specified in the summary description and request that the joint committee schedule a meeting for such presentation and review, then the director of the legislative research department shall notify the chief information technology officer of the appropriate branch, the head of such agency and the chairperson of the joint committee that a meeting has been requested for such presentation and review on the next business day following the members' contact with the director of the legislative research department. Upon receiving such notification, the chairperson shall call a meeting of the joint committee as soon as practicable for the purpose of such presentation and review and shall furnish the chief information technology officer of the appropriate branch and the head of such agency with notice of the time, date and place of the meeting. Except as provided in subsection (b)(1)(B)(ii), the state agency shall not authorize or approve the release of any request for proposal or other bid event for an information technology project without having first advised and consulted with the joint committee at a meeting. (ii) The state agency or agencies shall be deemed to have advised and consulted with the joint committee about such proposed release of any request for proposal or other bid event for an information technology project and may authorize or approve such proposed release of any request for proposal or other bid event for an information technology project if: (a) Fewer than two members of the joint committee contact the director of the legislative research department within seven business days of the date the project plan summary was mailed and request a committee meeting for a presentation and review of any such proposed request for proposal or other bid event for an information technology project; or (b) a committee meeting is requested by at least two members of the joint committee pursuant to this paragraph, but such meeting does not occur within two calendar weeks of the chairperson receiving the notification from the director of the legislative research department of a request for such meeting. (2) (A) Agencies are prohibited from contracting with a vendor to implement the project if that vendor prepared or assisted in the preparation of the program statement, the project planning documents or any other project plans prepared prior to the project being approved by the chief information technology officer as required by this section. (B) Information technology projects with an estimated cumulative cost of less than $5,000,000 are exempted from the provisions of subparagraph (A). (C) The provisions of subparagraph (A) may be waived with prior written permission from the chief information technology officer. (c) Annually at the time specified by the chief information technology officer of the branch of state government of which the agency is a part, each agency shall submit to such officer: (1) A copy of a three-year strategic information technology plan that sets forth the agency's current and future information technology needs and utilization plans for the next three ensuing fiscal years, in such form and containing such additional information as prescribed by the chief information technology officer; and (2) any deviations from the state information technology architecture adopted by the information technology executive council. (d) The provisions of this section shall not apply to the information network of Kansas (INK). House Substitute for SENATE BILL No. 291—page 32 Sec. 29. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7209, as amended by section 28 of this act, is hereby amended to read as follows: 75-7209. (a) (1) Whenever an agency proposes an information technology project, such agency shall prepare and submit information technology project documentation to the chief information technology officer of the branch of state government of which the agency is a part. Such information technology project documentation shall: (A) Include a financial plan showing the proposed source of funding and categorized expenditures for each phase of the project and cost estimates for any needs analyses or other investigations, consulting or other professional services, computer programs, data, equipment, buildings or major repairs or improvements to buildings and other items or services necessary for the project; and (B) be consistent with: (i) Information technology resource policies and procedures and project management methodologies for all state agencies; (ii) an information technology architecture, including telecommunications systems, networks and equipment, that covers all state agencies; (iii) standards for data management for all state agencies; and (iv) a strategic information technology management plan for the state. (2) Any information technology project with significant business risk, as determined pursuant to the information technology executive council's policies or policies adopted by the judicial branch or the legislative coordinating council, shall be presented to the joint committee on information technology by such branch chief information technology officer. (b) (1) Prior to the release of any request for proposal for an information technology project with significant business risk: (A) Specifications for bids or proposals for such project shall be submitted to the chief information technology officer of the branch of state government of which the agency or agencies are a part. Information technology projects requiring chief information technology officer approval shall also require the chief information technology officer's written approval on specifications for bids or proposals; and (B) (i) The chief information technology officer of the appropriate branch over the state agency or agencies that are involved in such project shall submit the project, the project plan, including the architecture, and the cost-benefit analysis to the joint committee on information technology to advise and consult on the project. Such chief information technology officer shall submit such information to each member of the joint committee and to the director of the legislative research department. Each such project plan summary shall include a notice specifying the date the summary was mailed or emailed. After receiving any such project plan summary, each member shall review the information and may submit questions, requests for additional information or request a presentation and review of the proposed project at a meeting of the joint committee. If two or more members of the joint committee contact the director of the legislative research department within seven business days of the date specified in the summary description and request that the joint committee schedule a meeting for such presentation and review, then the director of the legislative research department shall notify the chief information technology officer of the appropriate branch, the head of such agency and the chairperson of the joint committee that a meeting has been requested for such presentation and review on the next business day following the members' contact with the director of the legislative research department. Upon receiving such notification, the chairperson House Substitute for SENATE BILL No. 291—page 33 shall call a meeting of the joint committee as soon as practicable for the purpose of such presentation and review and shall furnish the chief information technology officer of the appropriate branch and the head of such agency with notice of the time, date and place of the meeting. Except as provided in subsection (b)(1)(B)(ii), the state agency shall not authorize or approve the release of any request for proposal or other bid event for an information technology project without having first advised and consulted with the joint committee at a meeting. (ii) The state agency or agencies shall be deemed to have advised and consulted with the joint committee about such proposed release of any request for proposal or other bid event for an information technology project and may authorize or approve such proposed release of any request for proposal or other bid event for an information technology project if: (a) Fewer than two members of the joint committee contact the director of the legislative research department within seven business days of the date the project plan summary was mailed and request a committee meeting for a presentation and review of any such proposed request for proposal or other bid event for an information technology project; or (b) a committee meeting is requested by at least two members of the joint committee pursuant to this paragraph, but such meeting does not occur within two calendar weeks of the chairperson receiving the notification from the director of the legislative research department of a request for such meeting. (2) (A) Agencies are prohibited from contracting with a vendor to implement the project if that vendor prepared or assisted in the preparation of the program statement, the project planning documents or any other project plans prepared prior to the project being approved by the chief information technology officer as required by this section. (B) Information technology projects with an estimated cumulative cost of less than $5,000,000 are exempted from the provisions of subparagraph (A). (C) The provisions of subparagraph (A) may be waived with prior written permission from the chief information technology officer. (c) Annually at the time specified by the chief information technology officer of the branch of state government of which the agency is a part, each agency shall submit to such officer: (1) A copy of a three-year strategic information technology plan that sets forth the agency's current and future information technology needs and utilization plans for the next three ensuing fiscal years, in such form and containing such additional information as prescribed by the chief information technology officer; and (2) any deviations from the state information technology architecture adopted by the information technology executive council. (d) The provisions of this section shall not apply to the information network of Kansas (INK). Sec. 30. K.S.A. 2023 Supp. 75-7237 is hereby amended to read as follows: 75-7237. As used in K.S.A. 75-7236 through 75-7243, and amendments thereto: (a) "Act" means the Kansas cybersecurity act. (b) "Breach" or "breach of security" means unauthorized access of data in electronic form containing personal information. Good faith access of personal information by an employee or agent of an executive branch agency does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use. (c) "CISO" means the executive branch chief information security officer. House Substitute for SENATE BILL No. 291—page 34 (d) "Cybersecurity" is means the body of information technologies, processes and practices designed to protect networks, computers, programs and data from attack, damage or unauthorized access. (e) "Cybersecurity positions" do not include information technology positions within executive branch agencies. (f) "Data in electronic form" means any data stored electronically or digitally on any computer system or other database and includes recordable tapes and other mass storage devices. (g) "Executive branch agency" means any agency in the executive branch of the state of Kansas, including the judicial council but does not include the elected office agencies, the adjutant general's department, the Kansas public employees retirement system, regents' institutions, or the board of regents. (h) "KISO" means the Kansas information security office. (i) (1) "Personal information" means: (A) An individual's first name or first initial and last name, in combination with at least one of the following data elements for that individual: (i) Social security number; (ii) driver's license or identification card number, passport number, military identification number or other similar number issued on a government document used to verify identity; (iii) financial account number or credit or debit card number, in combination with any security code, access code or password that is necessary to permit access to an individual's financial account; (iv) any information regarding an individual's medical history, mental or physical condition or medical treatment or diagnosis by a healthcare professional; or (v) an individual's health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual; or (B) a user name or email address, in combination with a password or security question and answer that would permit access to an online account. (2) "Personal information" does not include information: (A) About an individual that has been made publicly available by a federal agency, state agency or municipality; or (B) that is encrypted, secured or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable. (j) "State agency" means the same as defined in K.S.A. 75-7201, and amendments thereto. Sec. 31. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7237, as amended by section 30 of this act, is hereby amended to read as follows: 75-7237. As used in K.S.A. 75-7236 through 75-7243, and amendments thereto: (a) "Act" means the Kansas cybersecurity act. (b) "Breach" or "breach of security" means unauthorized access of data in electronic form containing personal information. Good faith access of personal information by an employee or agent of an executive branch agency does not constitute a breach of security, provided that the information is not used for a purpose unrelated to the business or subject to further unauthorized use. (c) "CISO" means the executive branch chief information security officer. (d) "Cybersecurity" means the body of information technologies, processes and practices designed to protect networks, computers, programs and data from attack, damage or unauthorized access. House Substitute for SENATE BILL No. 291—page 35 (e) "Cybersecurity positions" do not include information technology positions within executive branch agencies. (f) "Data in electronic form" means any data stored electronically or digitally on any computer system or other database and includes recordable tapes and other mass storage devices. (g) "Executive branch agency" means any agency in the executive branch of the state of Kansas, including the judicial council but does not include the elected office agencies, the adjutant general's department, the Kansas public employees retirement system, regents' institutions, or the board of regents. (h) "KISO" means the Kansas information security office. (i) (1) "Personal information" means: (A) An individual's first name or first initial and last name, in combination with at least one of the following data elements for that individual: (i) Social security number; (ii) driver's license or identification card number, passport number, military identification number or other similar number issued on a government document used to verify identity; (iii) financial account number or credit or debit card number, in combination with any security code, access code or password that is necessary to permit access to an individual's financial account; (iv) any information regarding an individual's medical history, mental or physical condition or medical treatment or diagnosis by a healthcare professional; or (v) an individual's health insurance policy number or subscriber identification number and any unique identifier used by a health insurer to identify the individual; or (B) a user name or email address, in combination with a password or security question and answer that would permit access to an online account. (2) "Personal information" does not include information: (A) About an individual that has been made publicly available by a federal agency, state agency or municipality; or (B) that is encrypted, secured or modified by any other method or technology that removes elements that personally identify an individual or that otherwise renders the information unusable. (j) "State agency" means the same as defined in K.S.A. 75-7201, and amendments thereto. Sec. 32. K.S.A. 2023 Supp. 75-7238 is hereby amended to read as follows: 75-7238. (a) There is hereby established the position of executive branch chief information security officer (CISO). The executive CISO shall be in the unclassified service under the Kansas civil service act, shall be appointed by the governor and shall receive compensation in an amount fixed by the governor. (b) The executive CISO shall: (1) Report to the executive branch chief information technology officer; (2) serve as the state's CISO; (3) serve as the executive branch chief cybersecurity strategist and authority on policies, compliance, procedures, guidance and technologies impacting executive branch cybersecurity programs; (4) ensure Kansas information security office resources assigned or provided to executive branch agencies are in compliance with applicable laws and rules and regulations; (5) coordinate cybersecurity efforts between executive branch agencies; (6) provide guidance to executive branch agencies when compromise of personal information or computer resources has House Substitute for SENATE BILL No. 291—page 36 occurred or is likely to occur as the result of an identified high-risk vulnerability or threat; (7) set cybersecurity policy and standards for executive branch agencies; and (8) perform such other functions and duties as provided by law and as directed by the executive chief information technology officerestablish security standards and policies to protect the branch's information technology systems and infrastructure in accordance with subsection (c); (3) ensure the confidentiality, availability and integrity of the information transacted, stored or processed in the branch's information technology systems and infrastructure; (4) develop a centralized cybersecurity protocol for protecting and managing executive branch information technology assets and infrastructure; (5) detect and respond to security incidents consistent with information security standards and policies; (6) be responsible for the cybersecurity of all executive branch data and information resources; (7) collaborate with the chief information security officers of the other branches of state government to respond to cybersecurity incidents; (8) ensure that the governor and all executive branch employees complete cybersecurity awareness training annually and that if an employee does not complete the required training such employee's access to any state-issued hardware or the state network is revoked; and (9) review all contracts related to information technology entered into by a person or entity within the executive branch to make efforts to reduce the risk of security vulnerabilities within the supply chain or product and ensure each contract contains standard security language. (c) The executive CISO shall develop a cybersecurity program for each executive branch agency that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The executive CISO shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030. The agency head of each executive branch agency shall coordinate with the executive CISO to achieve such standards. Sec. 33. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7238, as amended by section 32 of this act, is hereby amended to read as follows: 75-7238. (a) There is hereby established the position of executive branch chief information security officer (CISO). The executive CISO shall be in the unclassified service under the Kansas civil service act, shall be appointed by the governor and shall receive compensation in an amount fixed by the governor. (b) The executive CISO shall: (1) Report to the executive branch chief information technology officer; (2) establish security standards and policies to protect the branch's information technology systems and infrastructure in accordance with subsection (c); (3) ensure the confidentiality, availability and integrity of the information transacted, stored or processed in the branch's information technology systems and infrastructure; (4) develop a centralized cybersecurity protocol for protecting and managing executive branch information technology assets and infrastructure; (5) detect and respond to security incidents consistent with House Substitute for SENATE BILL No. 291—page 37 information security standards and policies; (6) be responsible for the cybersecurity of all executive branch data and information resources; (7) collaborate with the chief information security officers of the other branches of state government to respond to cybersecurity incidents; (8) ensure that the governor and all executive branch employees complete cybersecurity awareness training annually and that if an employee does not complete the required training such employee's access to any state-issued hardware or the state network is revoked; and (9) review all contracts related to information technology entered into by a person or entity within the executive branch to make efforts to reduce the risk of security vulnerabilities within the supply chain or product and ensure each contract contains standard security language. (c) The executive CISO shall develop a cybersecurity program for each executive branch agency that complies with the national institute of standards and technology cybersecurity framework (CSF) 2.0, as in effect on July 1, 2024. The executive CISO shall ensure that such programs achieve a CSF tier of 3.0 prior to July 1, 2028, and a CSF tier of 4.0 prior to July 1, 2030. The agency head of each executive branch agency shall coordinate with the executive CISO to achieve such standardsserve as the state's CISO; (3) serve as the executive branch chief cybersecurity strategist and authority on policies, compliance, procedures, guidance and technologies impacting executive branch cybersecurity programs; (4) ensure Kansas information security office resources assigned or provided to executive branch agencies are in compliance with applicable laws and rules and regulations; (5) coordinate cybersecurity efforts between executive branch agencies; (6) provide guidance to executive branch agencies when compromise of personal information or computer resources has occurred or is likely to occur as the result of an identified high-risk vulnerability or threat; (7) set cybersecurity policy and standards for executive branch agencies; and (8) perform such other functions and duties as provided by law and as directed by the executive chief information technology officer. Sec. 34. K.S.A. 2023 Supp. 75-7239 is hereby amended to read as follows: 75-7239. (a) There is hereby established within and as a part of the office of information technology services the Kansas information security office. The Kansas information security office shall be administered by the executive CISO and be staffed appropriately to effect the provisions of the Kansas cybersecurity act. (b) For the purpose of preparing the governor's budget report and related legislative measures submitted to the legislature, the Kansas information security office, established in this section, shall be considered a separate state agency and shall be titled for such purpose as the "Kansas information security office." The budget estimates and requests of such office shall be presented as from a state agency separate from the office of information technology services, and such separation shall be maintained in the budget documents and reports prepared by the director of the budget and the governor, or either of them, including all related legislative reports and measures submitted to the legislature. (c) Under direction of the executive CISO, the KISO shall: (1) Administer the Kansas cybersecurity act; (2) assist the executive branch in developing, implementing and monitoringdevelop, implement and monitor strategic and House Substitute for SENATE BILL No. 291—page 38 comprehensive information security risk-management programs; (3) facilitate executive branch information security governance, including the consistent application of information security programs, plans and procedures; (4) using standards adopted by the information technology executive council, create and manage a unified and flexible control framework to integrate and normalize requirements resulting from applicable state and federal laws, and rules and regulations; (5) facilitate a metrics, logging and reporting framework to measure the efficiency and effectiveness of state information security programs; (6)(4) provide the executive branch strategic risk guidance for information technology projects, including the evaluation and recommendation of technical controls; (7) assist in the development of executive branch agency cybersecurity programs to ensure compliance with applicable state and federal laws, rules and regulations, executive branch policies and standards and policies and standards adopted by the information technology executive council; (8)(5) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of executive branch agencies for compliance with applicable state and federal laws, rules and regulations, and executive branch policies and standards and policies and standards adopted by the information technology executive council. The executive CISO shall make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit; (6) perform audits of executive branch agencies for compliance with applicable state and federal laws, rules and regulations, executive branch policies and standards and policies and standards adopted by the information technology executive council; (9)(7) coordinate the use of external resources involved in information security programs, including, but not limited to, interviewing and negotiating contracts and fees; (10)(8) liaise with external agencies, such as law enforcement and other advisory bodies as necessary, to ensure a strong security posture; (11)(9) assist in the development of plans and procedures to manage and recover business-critical services in the event of a cyberattack or other disaster; (12) assist executive branch agencies to create a framework for roles and responsibilities relating to information ownership, classification, accountability and protection; (13)(10) coordinate with executive branch agencies to provide cybersecurity staff to such agencies as necessary; (11) ensure a cybersecurity awareness training program is made available to all branches of state government; and (14)(12) perform such other functions and duties as provided by law and as directed by the CISO. (d) (1) If an audit conducted pursuant to subsection (c)(5) results in a failure, the executive CISO shall report such failure to the speaker and minority leader of the house of representatives and the president and minority leader of the senate within 30 days of receiving notice of such failure. Such report shall contain a plan to mitigate any security risks identified in the audit. The executive CISO shall coordinate for an additional audit after the mitigation plan is implemented and report the results of such audit to the speaker and minority leader of the house of representatives and the president and minority leader of the senate.  (2) Results of audits conducted pursuant to subsection (c)(8) (c) (5) and the reports described in subsection (d)(1) shall be confidential House Substitute for SENATE BILL No. 291—page 39 and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. The provisions of this subsection shall expire on July 1, 2028, unless the legislature reviews and acts to continue such provision pursuant to K.S.A. 45-229, and amendments thereto, prior to July 1, 2028. (e) There is hereby created in the state treasury the information technology security fund. All expenditures from such fund shall be made in accordance with appropriation acts upon warrants of the director of accounts and reports issued pursuant to vouchers approved by the executive CISO or by a person designated by the executive CISO. Sec. 35. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7239, as amended by section 34 of this act, is hereby amended to read as follows: 75-7239. (a) There is hereby established within and as a part of the office of information technology services the Kansas information security office. The Kansas information security office shall be administered by the executive CISO and be staffed appropriately to effect the provisions of the Kansas cybersecurity act. (b) For the purpose of preparing the governor's budget report and related legislative measures submitted to the legislature, the Kansas information security office, established in this section, shall be considered a separate state agency and shall be titled for such purpose as the "Kansas information security office." The budget estimates and requests of such office shall be presented as from a state agency separate from the office of information technology services, and such separation shall be maintained in the budget documents and reports prepared by the director of the budget and the governor, or either of them, including all related legislative reports and measures submitted to the legislature. (c) Under direction of the executive CISO, the KISO shall: (1) Administer the Kansas cybersecurity act; (2) develop, implement and monitorassist the executive branch in developing, implementing and monitoring strategic and comprehensive information security risk-management programs; (3) facilitate executive branch information security governance, including the consistent application of information security programs, plans and procedures; (4) using standards adopted by the information technology executive council, create and manage a unified and flexible control framework to integrate and normalize requirements resulting from applicable state and federal laws and rules and regulations; (5) facilitate a metrics, logging and reporting framework to measure the efficiency and effectiveness of state information security programs; (4)(6) provide the executive branch strategic risk guidance for information technology projects, including the evaluation and recommendation of technical controls; (5)(7) assist in the development of executive branch agency cybersecurity programs to ensure compliance with applicable state and federal laws, rules and regulations, executive branch policies and standards and policies and standards adopted by the information technology executive council; (8) coordinate with the United States cybersecurity and infrastructure security agency to perform annual audits of executive branch agencies for compliance with applicable state and federal laws, rules and regulations and, executive branch policies and standards. The executive CISO shall make an audit request to such agency annually, regardless of whether or not such agency has the capacity to perform the requested audit; House Substitute for SENATE BILL No. 291—page 40 (6) perform audits of executive branch agencies for compliance with applicable state and federal laws, rules and regulations, executive branch policies and standards and policies and standards adopted by the information technology executive council; (7)(9) coordinate the use of external resources involved in information security programs, including, but not limited to, interviewing and negotiating contracts and fees; (8)(10) liaise with external agencies, such as law enforcement and other advisory bodies as necessary, to ensure a strong security posture; (9)(11) assist in the development of plans and procedures to manage and recover business-critical services in the event of a cyberattack or other disaster; (10) coordinate with executive branch agencies to provide cybersecurity staff to such agencies as necessary; (11)(12) assist executive branch agencies to create a framework for roles and responsibilities relating to information ownership, classification, accountability and protection;  (13) ensure a cybersecurity awareness training program is made available to all branches of state government; and (12)(14) perform such other functions and duties as provided by law and as directed by the CISO. (d) (1) If an audit conducted pursuant to subsection (c)(5) results in a failure, the executive CISO shall report such failure to the speaker and minority leader of the house of representatives and the president and minority leader of the senate within 30 days of receiving notice of such failure. Such report shall contain a plan to mitigate any security risks identified in the audit. The executive CISO shall coordinate for an additional audit after the mitigation plan is implemented and report the results of such audit to the speaker and minority leader of the house of representatives and the president and minority leader of the senate.  (2) Results of audits conducted pursuant to subsection (c)(5) and the reports described in subsection (d)(1) (c)(8) shall be confidential and shall not be subject to discovery or disclosure pursuant to the open records act, K.S.A. 45-215 et seq., and amendments thereto. The provisions of this subsection shall expire on July 1, 2028, unless the legislature reviews and acts to continue such provision pursuant to K.S.A. 45-229, and amendments thereto, prior to July 1, 2028. (e) There is hereby created in the state treasury the information technology security fund. All expenditures from such fund shall be made in accordance with appropriation acts upon warrants of the director of accounts and reports issued pursuant to vouchers approved by the executive CISO or by a person designated by the executive CISO. Sec. 36. K.S.A. 2023 Supp. 75-7240 is hereby amended to read as follows: 75-7240. (a) The executive branch agency heads shall: (1) Be solely responsible for security of all data and information technology resources under such agency's purview, irrespective of the location of the data or resources. Locations of data may include: (A) Agency sites; (B) agency real property; (C) infrastructure in state data centers; (D) third-party locations; and (E) in transit between locations; (2) ensure that an agency-wide information security program is in place; (3)(2) designate an information security officer to administer the agency's information security program that reports directly to executive leadership; (4)(3) participate in CISO-sponsored statewide cybersecurity House Substitute for SENATE BILL No. 291—page 41 program initiatives and services; (5) implement policies and standards to ensure that all the agency's data and information technology resources are maintained in compliance with applicable state and federal laws and rules and regulations; (6) implement appropriate cost-effective safeguards to reduce, eliminate or recover from identified threats to data and information technology resources; (7) include all appropriate cybersecurity requirements in the agency's request for proposal specifications for procuring data and information technology systems and services; (8) (A) submit a cybersecurity self-assessment report to the CISO by October 16 of each even-numbered year, including an executive summary of the findings, that assesses the extent to which the agency is vulnerable to unauthorized access or harm, including the extent to which the agency's or contractor's electronically stored information is vulnerable to alteration, damage, erasure or inappropriate use; (B) ensure that the agency conducts annual internal assessments of its security program. Internal assessment results shall be considered confidential and shall not be subject to discovery by or release to any person or agency, outside of the KISO or CISO, without authorization from the executive branch agency director or head; and (C) prepare or have prepared a financial summary identifying cybersecurity expenditures addressing the findings of the cybersecurity self-assessment report required in subparagraph (A), excluding information that might put the data or information resources of the agency or its contractors at risk and submit such report to the house of representatives committee on appropriations and the senate committee on ways and means; and (9)(4) ensure that if an agency owns, licenses or maintains computerized data that includes personal information, confidential information or information, the disclosure of which is regulated by law, such agency shall, in the event of a breach or suspected breach of system security or an unauthorized exposure of that information: (A) Comply with the notification requirements set out in K.S.A. 2023 Supp. 50-7a01 et seq., and amendments thereto, and applicable federal laws and rules and regulations, to the same extent as a person who conducts business in this state; and (B) not later than 48 12 hours after the discovery of the breach, suspected breach or unauthorized exposure, notify: (i) The CISO; and (ii) if the breach, suspected breach or unauthorized exposure involves election data, the secretary of state. (b) The director or head of each state agency shall: (1) Participate in annual agency leadership training to ensure understanding of: (A) The potential impact of common types of cyberattacks and data breaches on the agency's operations and assets; (B) how cyberattacks and data breaches on the agency's operations and assets may impact the operations and assets of other governmental entities on the state enterprise network; (C) how cyberattacks and data breaches occur; and (D) steps to be undertaken by the executive director or agency head and agency employees to protect their information and information systems; and (2) ensure that all information technology login credentials are disabled the same day that any employee ends their employment with the state; and (3) require that all employees with access to information House Substitute for SENATE BILL No. 291—page 42 technology receive a minimum of one hour of information technology security training per yearcoordinate with the executive CISO to implement the security standard described in K.S.A. 75-7238, and amendments thereto. (c) (1) The CISO, with input from the joint committee on information technology and the joint committee on Kansas security, shall develop a self-assessment report template for use under subsection (a)(8)(A). The most recent version of such template shall be made available to state agencies prior to July 1 of each even-numbered year. The CISO shall aggregate data from the self-assessments received under subsection (a)(8)(A) and provide a summary of such data to the joint committee on information technology and the joint committee on Kansas security. (2) Self-assessment reports made to the CISO pursuant to subsection (a)(8)(A) shall be confidential and shall not be subject to the provisions of the Kansas open records act, K.S.A. 45-215 et seq., and amendments thereto. The provisions of this paragraph shall expire on July 1, 2028, unless the legislature reviews and reenacts this provision pursuant to K.S.A. 45-229, and amendments thereto, prior to July 1, 2028. Sec. 37. On and after July 1, 2026, K.S.A. 2023 Supp. 75-7240, as amended by section 36 of this act, is hereby amended to read as follows: 75-7240. (a) The executive branch agency heads shall: (1) Be solely responsible for security of all data and information technology resources under such agency's purview, irrespective of the location of the data or resources. Locations of data may include: (A) Agency sites; (B) agency real property; (C) infrastructure in state data centers; (D) third-party locations; and (E) in transit between locations; (2) ensure that an agency-wide information security program is in place; (2)(3) designate an information security officer to administer the agency's information security program that reports directly to executive leadership; (3)(4) participate in CISO-sponsored statewide cybersecurity program initiatives and services; (5) implement policies and standards to ensure that all the agency's data and information technology resources are maintained in compliance with applicable state and federal laws and rules and regulations; (6) implement appropriate cost-effective safeguards to reduce, eliminate or recover from identified threats to data and information technology resources; (7) include all appropriate cybersecurity requirements in the agency's request for proposal specifications for procuring data and information technology systems and services; (8) (A) submit a cybersecurity self-assessment report to the CISO by October 16 of each even-numbered year, including an executive summary of the findings, that assesses the extent to which the agency is vulnerable to unauthorized access or harm, including the extent to which the agency's or contractor's electronically stored information is vulnerable to alteration, damage, erasure or inappropriate use; (B) ensure that the agency conducts annual internal assessments of its security program. Internal assessment results shall be considered confidential and shall not be subject to discovery by or release to any person or agency, outside of the KISO or CISO, without authorization from the executive branch agency director or head; and House Substitute for SENATE BILL No. 291—page 43 (C) prepare or have prepared a financial summary identifying cybersecurity expenditures addressing the findings of the cybersecurity self-assessment report required in subparagraph (A), excluding information that might put the data or information resources of the agency or its contractors at risk and submit such report to the house of representatives committee on appropriations and the senate committee on ways and means; and (4)(9) ensure that if an agency owns, licenses or maintains computerized data that includes personal information, confidential information or information, the disclosure of which is regulated by law, such agency shall, in the event of a breach or suspected breach of system security or an unauthorized exposure of that information: (A) Comply with the notification requirements set out in K.S.A. 2023 Supp. 50-7a01 et seq., and amendments thereto, and applicable federal laws and rules and regulations, to the same extent as a person who conducts business in this state; and (B) not later than 12 48 hours after the discovery of the breach, suspected breach or unauthorized exposure, notify: (i) The CISO; and (ii) if the breach, suspected breach or unauthorized exposure involves election data, the secretary of state. (b) The director or head of each state agency shall: (1) Participate in annual agency leadership training to ensure understanding of: (A) The potential impact of common types of cyberattacks and data breaches on the agency's operations and assets; (B) how cyberattacks and data breaches on the agency's operations and assets may impact the operations and assets of other governmental entities on the state enterprise network; (C) how cyberattacks and data breaches occur; and (D) steps to be undertaken by the executive director or agency head and agency employees to protect their information and information systems; and (2) coordinate with the executive CISO to implement the security standard described in K.S.A. 75-7238, and amendments theretoensure that all information technology login credentials are disabled the same day that any employee ends their employment with the state; and (3) require that all employees with access to information technology receive a minimum of one hour of information technology security training per year. (c) (1) The CISO, with input from the joint committee on information technology and the joint committee on Kansas security, shall develop a self-assessment report template for use under subsection (a)(8)(A). The most recent version of such template shall be made available to state agencies prior to July 1 of each even-numbered year. The CISO shall aggregate data from the self-assessments received under subsection (a)(8)(A) and provide a summary of such data to the joint committee on information technology and the joint committee on Kansas security. (2) Self-assessment reports made to the CISO pursuant to subsection (a)(8)(A) shall be confidential and shall not be subject to the provisions of the open records act, K.S.A. 45-215 et seq., and amendments thereto. The provisions of this paragraph shall expire on July 1, 2028, unless the legislature reviews and reenacts this provision pursuant to K.S.A. 45-229, and amendments thereto, prior to July 1, 2028. Sec. 38. K.S.A. 40-110, 75-413, 75-623, 75-710, 75-711 and 75- 7203 and K.S.A. 2023 Supp. 45-229, 75-7201, 75-7202, 75-7205, 75- 7206, 75-7208, 75-7209, 75-7237, 75-7238, 75-7239 and 75-7240 are House Substitute for SENATE BILL No. 291—page 44 hereby repealed. Sec. 39. On and after July 1, 2026, K.S.A. 75-7203, as amended by section 20 of this act, and K.S.A. 2023 Supp. 45-229, as amended by section 10 of this act, 75-7201, as amended by section 16 of this act, 75-7202, as amended by section 18 of this act, 75-7205, as amended by section 22 of this act, 75-7206, as amended by section 24 of this act, 75-7208, as amended by section 26 of this act, 75-7209, as amended by section 28 of this act, 75-7237, as amended by section 30 of this act, 75-7238, as amended by section 32 of this act, 75-7239, as amended by section 34 of this act, and 75-7240, as amended by section 36 of this act, are hereby repealed. Sec. 40. This act shall take effect and be in force from and after its publication in the statute book. I hereby certify that the above BILL originated in the SENATE, and passed that body __________________________ SENATE adopted Conference Committee Report ________________ _________________________ President of the Senate. _________________________ Secretary of the Senate. Passed the HOUSE as amended _________________________ HOUSE adopted Conference Committee Report ________________ _________________________ Speaker of the House. _________________________ Chief Clerk of the House. APPROVED _____________________________ _________________________ Governor.