{"data":{"id":"us-ky/krs-42.726","jurisdiction":"us-ky","citation":"KRS 42.726","heading":"Roles, duties, and permissible activities for Commonwealth Office of","body":"Technology -- Duties of Archives and Records Commission and Department\nfor Libraries and Archives not affected -- Annual report concerning security\nbreaches.\n(1) The Commonwealth Office of Technology shall be the lead organizational entity\nwithin the executive branch regarding delivery of information technology services,\nincluding application development and delivery, and shall serve as the single\ninformation technology authority for the Commonwealth.\n(2) The roles and duties of the Commonwealth Office of Technology shall include but\nnot be limited to:\n(a) Providing technical support and services to all executive agencies of state\ngovernment in the application of information technology;\n(b) Assuring compatibility and connectivity of Kentucky's information systems;\n(c) Developing strategies and policies to support and promote the effective\napplications of information technology within state government as a means of\nsaving money, increasing employee productivity, and improving state services\nto the public, including electronic public access to information of the\nCommonwealth;\n(d) Developing, implementing, and managing strategic information technology\ndirections, standards , and enterprise architecture, including implementing\nnecessary management processes to ensure full compliance with those\ndirections, standards, and architecture;\n(e) Promoting effective and efficient design and operation of all major\ninformation resources management processes for executive branch agencies,\nincluding improvements to work processes;\n(f) Developing, implementing, and maintaining the technology infrastructure of\nthe Commonwealth and all related support staff, planning, administration,\nasset ma nagement, and procurement for all executive branch cabinets and\nagencies except:\n1. Agencies led by a statewide elected official;\n2. The nine (9) public institutions of postsecondary education;\n3. The Department of Education's services provided to local school\ndistricts;\n4. The Kentucky Retirement Systems, the County Employees Retirement\nSystem, the Kentucky Public Pensions Authority, and the Teachers'\nRetirement System;\n5. The Kentucky Housing Corporation;\n6. The Kentucky Lottery Corporation;\n7. The Kentucky Higher Education Student Loan Corporation; and\n8. The Kentucky Higher Education Assistance Authority;\n(g) Facilitating and fostering applied research in emerging technologies that offer\nthe Commonwealth innovative business solutions;\n(h) Reviewing and overseeing large or complex information technology projects\nand systems for compliance with statewide strategies, policies, and standards,\nincluding alignment with the Commonwealth's business goals,  investment,\nand other risk management policies. The executive director is authorized to\ngrant or withhold approval to initiate these projects;\n(i) Integrating information technology resources to provide effective and\nsupportable information technology applications in the Commonwealth;\n(j) Establishing the central statewide geographic information clearinghouse to\nmaintain map inventories, information on current and planned geographic\ninformation systems applications, information on grants available for the\nacquisition or enhancement of geographic information resources, and a\ndirectory of geographic information resources available within the state or\nfrom the federal government;\n(k) Coordinating multiagency information technology projects, including\noverseeing the development and maintenance of statewide base maps and\ngeographic information systems;\n(l) Providing access to both consulting and technical assistance, and education\nand training, on the application and use of information technologies to state\nand local agencies;\n(m) In cooperation with other agencies, evaluating, participating in pilot studies,\nand making recommendations on information technology hardware and\nsoftware;\n(n) Providing staff support and technical assistance to the Geographic\nInformation Advisory Council and the Kentucky Information Technology\nAdvisory Council;\n(o) Overseeing the development of a statewide geographic information plan with\ninput from the Geographic Information Advisory Council;\n(p) Developing for state executive branch ag encies a coordinated security\nframework and model governance structure relating to the privacy and\nconfidentiality of personal information collected and stored by state executive\nbranch agencies, including but not limited to:\n1. Identification of key infrastructure components and how to secure them;\n2. Establishment of a common benchmark that measures the effectiveness\nof security, including continuous monitoring and automation of\ndefenses;\n3. Implementation of vulnerability scanning and other security\nassessments;\n4. Provision of training, orientation programs, and other communications\nthat increase awareness of the importance of security among agency\nemployees responsible for personal information; and\n5. Development of and making available a cyber security incident response\nplan and procedure;\n(q) Establishing, publishing, maintaining, and implementing comprehensive\npolicy standards and procedures for the responsible, ethical, and transparent\nuse of generative artificial intelligence systems and high -risk a rtificial\nintelligence systems by departments, agencies, and administrative bodies,\nincluding but not limited to policy standards and procedures that:\n1. Govern their procurement, implementation, and ongoing assessment;\n2. Address and provide resources for security of data and privacy; and\n3. Create guidelines for acceptable use policies for integrating high -risk\nartificial intelligence systems;\n(r) Preparing proposed legislation and funding proposals for the General\nAssembly that will further solidify coor dination and expedite implementation\nof information technology systems; and\n(s) Carrying out the functions and respo nsibilities of the Kentucky\nCommunications Network Authority established in KRS 154.15-020.\n(3) The Commonwealth Office of Technology may:\n(a) Provide general consulting services, technical training, and support for\ngeneric software applications, upon requ est from a local government, if the\nexecutive director finds that the requested services can be rendered within the\nestablished terms of the federally approved cost allocation plan;\n(b) Promulgate administrative regulations in accordance with KRS Chapter 1 3A\nnecessary for the implementation of KRS 42.720 to 42.742, 45.253, 171.420,\n186A.040, and 186A.285;\n(c) Solicit, receive, and consider proposals from any state agency, federal agency,\nlocal government, university, nonprofit organization, private person, or\ncorporation;\n(d) Solicit and accept money by grant, gift, donation, bequest, legislative\nappropriation, or other conveyance to be held, used, and applied in accordance\nwith KRS 42.720 to 42.742, 45.253, 171.420, 186A.040, and 186A.285;\n(e) Make and ente r into memoranda of agreement and contracts necessary or\nincidental to the performance of duties and execution of its powers, including\nbut not limited to agreements or contracts with the United States, other state\nagencies, and any governmental subdivision of the Commonwealth;\n(f) Accept grants from the United States government and its agencies and\ninstrumentalities, and from any source, other than any person, firm, or\ncorporation, or any director, officer, or agent thereof that manufactures or\nsells infor mation resources technology equipment, goods, or services. To\nthese ends, the Commonwealth Office of Technology shall have the power to\ncomply with those conditions and execute those agreements that are\nnecessary, convenient, or desirable; and\n(g) Purchase interest in contractual services, rentals of all types, supplies,\nmaterials, equipment, and other services to be used in the research and\ndevelopment of beneficial applications of information resources technologies.\nCompetitive bids may not be required for:\n1. New and emerging technologies as approved by the executive director\nor her or his designee; or\n2. Related professional, technical, or scientific services, but contracts shall\nbe submitted in accordance with KRS 45A.690 to 45A.725.\n(4) Nothing in this section shall be construed to alter or diminish the provisions of KRS\n171.410 to 171.740 or the authority conveyed by these statutes to the Archives and\nRecords Commission and the Department for Libraries and Archives.\n(5) The Commonwealth Office of Techn ology shall, on or before October 1 of each\nyear, submit to the Legislative Research Commission a report in accordance with\nKRS 57.390 detailing:\n(a) Any security breaches that occurred within organizational units of the\nexecutive branch of state government during the prior fiscal year that required\nnotification to the Commonwealth Office of Technology under KRS 61.932;\n(b) Actions taken to resolve the security breach, and to prevent additional security\nbreaches in the future;\n(c) A general description of what actions are taken as a matter of course to protect\npersonal data from security breaches; and\n(d) Any quantifiable financial impact to the agency reporting a security breach.","path":["KRS Chapter 42"],"source_url":"https://apps.legislature.ky.gov/law/statutes/statute.aspx?id=56752","current_through":"Includes enactments through the 2026 Regular Session","vintage":"09/05/2026","retrieved_at":"2026-09-05T20:49:03Z","sha256":"937653e0a05959b5f94a0c943b3cd71fa656b8d41c6e2e2cf4d4c6cffaa2b14d","source_id":"us-ky","stale":false,"prev":"us-ky/krs-42.724","next":"us-ky/krs-42.728"},"notice":"GroundRules: Original legal text. Not legal advice."}