C.R.S. § 24-37.5-403: Chief information security officer - duties and responsibilities.

(1) The chief information officer shall appoint a chief information security officer who shall serve at the pleasure of the chief information officer. The security officer shall report to and be under the supervision of the chief information officer. The security officer shall exhibit a background and expertise in security and risk management for information technology resources. In the event the security officer is unavailable to perform the duties and responsibilities under this part 4, all powers and authority granted to the security officer must be exercised by the chief information officer.

(2) The chief information security officer shall:

(a) Develop and update information security policies, standards, and guidelines for public agencies;

(b) Promulgate rules pursuant to article 4 of this title containing information security policies, standards, and guidelines;

(c) Ensure the incorporation of and compliance with information security policies, standards, and guidelines in the information security plans developed by public agencies pursuant to section 24-37.5-404;

(d) Direct information security audits and assessments in public agencies in order to ensure program compliance and adjustments;

(e) Establish and direct a risk management process to identify information security risks in public agencies and deploy risk mitigation strategies, processes, and procedures;

(f) Approve or disapprove and review annually the information security plans of public agencies;

(g) Conduct information security awareness and training programs;

(h) In coordination and consultation with the office of state planning and budgeting and the chief information officer, review public agency budget requests related to information security systems and approve such budget requests for state agencies other than the legislative department;

(i) Coordinate with the Colorado commission on higher education to review and comment on information security plans adopted by institutions of higher education that are submitted pursuant to section 24-37.5-404.5 (3);

(j) Submit to the joint technology committee, on or before November 1, 2027, and on or before November 1 of each year thereafter, a written information technology security compliance report that includes the following information:

(I) The office's current compliance status with applicable security standards;

(II) All open audit recommendations made by the office of the state auditor and the date on which each recommendation was made;

(III) A timeline for remediation for each open recommendation made by the office of the state auditor; and

(IV) A mitigation plan or compensating controls for the remediation of each open recommendation made by the office of the state auditor; and

(k) (I) Submit to the joint technology committee, on or before November 1, 2027, and on or before November 1 of each year thereafter, a written statewide information technology security risk report that assesses the overall security risk posture of state agency information technology systems.

(II) To support the preparation of the security risk report required by subsection (2)(k)(I) of this section, the chief information security officer may conduct evaluations of state agency information technology systems as the chief information security officer deems necessary, including penetration testing, vulnerability scanning, configuration evaluations, and vendor and system reviews.

(III) Each state agency shall provide to the chief information security officer, upon request, the access and information necessary to conduct evaluations pursuant to subsection (2)(k)(II) of this section, including system access, product information, and architecture information.

(3) It is the intent of the general assembly that the cost of the services provided by the chief information security officer to a public agency be adequately funded in fiscal years commencing on and after July 1, 2007, through an appropriation to the public agency to pay for such services.

(4) The chief information security officer, or the chief information officer if the security officer is unavailable, shall perform the duties and uphold the responsibilities assigned to the chief information security officer pursuant to this part 4. The chief information officer shall not delegate the duties, responsibilities, or powers of the chief information security officer to any person other than the chief information security officer. Nothing in this section prevents the chief information security officer from directing personnel within the information security office to carry out security functions under the chief information security officer's supervision and accountability. The chief information security officer is responsible for the accuracy of the compliance report required in subsection (2)(j) of this section and the security risk report required in subsection (2)(k) of this section, regardless of which personnel contributed to the preparation of the reports.