[{"_1":2,"_112":-5,"_113":-5},"loaderData",{"_3":4,"_26":27},"root",{"_5":6,"_17":10,"_18":19,"_20":21,"_22":10,"_23":-5,"_24":-5,"_25":10},"user",{"_7":8,"_9":10,"_11":10,"_12":-5,"_13":-5,"_14":15,"_16":-5},"roles",[],"isAuthenticated",false,"isPremium","planName","subscriptionStatus","featureFlags",{},"insightsBudget","isDevelopmentHost","userPreferences",{},"recaptchaSiteKey","6LcvOJcUAAAAAHsB-gPGfGktcRlKpH7OTIU_dMTD","isImpersonating","impersonation","affiliateStatus","isFreedomPortal","routes/v2/article/layout",{"_28":29,"_30":31},"notFound",true,"relatedArticles",[32,76,88,100],{"_33":34,"_35":36,"_37":38,"_39":40,"_41":42,"_43":44,"_45":46,"_47":48,"_49":50,"_51":52,"_53":54,"_55":56,"_57":58,"_59":60,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},"mediaId",6589881,"mediaKeyId","5448031-8040e56da2aef1d6367feb956dc0e5df","parentId",5448031,"title","State cybersecurity office expands enterprise monitoring and security operations; committee holds executive sessions on vulnerabilities","audioSeconds",964,"startMs",14676000,"endMs",15640000,"viewUrl","/Search/View?dp=1&key=5448031-8040e56da2aef1d6367feb956dc0e5df&start=14676&end=15640","thumbnailUrl","https://assets.pipeline.soar.com/5448031-8040e56da2aef1d6367feb956dc0e5df/thumbnail_14676000.jpg","articleUrl","/articles/6589881/Kansas/State-cybersecurity-office-expands-enterprise-monitoring-and-security-operations-committee-holds-executive-sessions-on-vulnerabilities","mediaUrl","https://secure.pipeline.soar.com/6589881-7daa3b3ec43bca6a28a15bf76872eeb9/orig.mp4?Expires=1773567637&Signature=FLW7U-sn4CL7Ip54N8PCm3c2Sk~U9aMgoEONN00jtvBKP0whe2JrXALMrgx7PxJg~jWoUid86m656WypOxyGsFb0JgmHBujW7FuDGEMVzTuofj26AhzIPsFGeDaCQEI3746phDB8V15g~wb~pEgI4WJUwUkgiqWmIg27sF2VoRzfDdY1lfL99~VcHQ7uwoqrggm9FdG5XvP352reXkyfw6UqyFmz4bTwsotnlEKjk9cVc6VX7sBS9fzPBW2OyL4CvIFJGcfiR22a2R8A0dICDz8pUwsLr5w~iQLKDY5m7VIlHR-27l~MLlEtIr3pVYuUWUfZAYX8UsDMRwuJKPBWgA__&Key-Pair-Id=KUT5TJCACFTXG","author","Joint Legislative Post Audit Committee","date","2025-07-22T06:09:22.703Z","article","The Legislative Post Audit Committee received a technical briefing from Office of Information Technology Services (OITS) and the Kansas Information Security Office (KISO) about an expanded statewide cybersecurity service model, the deployment of enterprise monitoring tools and plans to staff a 24/7 Security Operations Center (SOC).

Jeff Maxon, OITS chief information officer, described OITS\u0000service model work to document agreements with individual agencies and to clarify which services OITS provides across diverse agency IT environments. He told the committee OITS is working toward completed written service agreements for each agency by the end of the year to remove uncertainty over responsibilities for account management, desktop support, patching and other operational services.

John Godfrey, the state chief information security officer, described KISO operations and ongoing deployments. Godfrey said KISO had grown to 42 FTEs with an approximate annual budget of $11 million (fiscal 2024) including general fund and off-budget appropriations. He summarized core enterprise security services the office now provides at no cost to agencies, including security-awareness training, enterprise log aggregation and monitoring, endpoint detection and response (EDR), endpoint management, fire-wall engineering, network intrusion prevention and incident response coordination. Godfrey said the SOC is being staffed to provide round-the-clock monitoring and incident response, and he provided a sense of the data volume the SOC ingests and monitors: \"We collect and monitor... somewhere between 8 and 14,000,000,000 logs a month,\" he said, underscoring the scale of statewide monitoring.

Godfrey described a shift toward continuous, endpoint-level scanning for vulnerabilities rather than periodic network scans, and he noted KISO depends on agencies to give it the ability to install monitoring agents on agency devices or to allow agencies to operate the tools themselves. The briefing explained the two-part vulnerability process: (1) identification and reporting using KISO-provided or agreed tools, and (2) remediation (patching) which remains primarily an agency IT responsibility. Godfrey said KISO is deploying privileged-access management (PAM) tools, extending EDR coverage (about 20,000 endpoints already) and deploying endpoint management (roughly 17,000 endpoints currently visible) to increase visibility and response speed.

Committee members asked technical and oversight questions. Because the briefing and subsequent discussion covered security-sensitive details, the committee recessed into closed executive session under K.S.A. 75-4319(a) to discuss security posture and audit findings in a manner that would not reveal vulnerabilities publicly. The committee later held additional closed sessions that included security discussions with external agencies (for example, the City of Topeka and a set of state agencies previously audited). After the closed sessions, committee leadership signaled no immediate public action was taken but emphasized continued oversight and follow-up of KISO and OITS work.

The briefing and the executive sessions signaled both expanded statewide investment in cybersecurity and legislative interest in ensuring adequate agency cooperation, data access for monitoring and clear service agreements so the division of technical responsibility is explicit. Auditors and KISO officials said continued attention and follow-up will be needed to validate results of the SOC, vulnerability remediation and agency-level patching and configuration.","mediaType","Video","parentTitle","Legislative Post Audit Committee 07/21/2025","oneSentenceSummary","OITS and the Kansas Information Security Office briefed the panel on expanded enterprise security tools, an emerging 24/7 security operations center and ongoing deployments of endpoint and vulnerability-management tools; because discussion touched on sensitive system details, the committee recessed into executive session.","taxTitle","Legislative Post Audit Committee, Joint, Committees, Legislative, Kansas","taxId",18601,"location","Kansas","headline","","shortSummary",{"_33":77,"_35":36,"_37":38,"_39":78,"_41":79,"_43":80,"_45":81,"_47":82,"_49":83,"_51":84,"_53":85,"_55":56,"_57":58,"_59":86,"_61":62,"_63":64,"_65":87,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6589886,"KDADS splits aging and disability resource center contracts; state cites conflict-of-interest concerns and timeliness problems",633,8537000,9170000,"/Search/View?dp=1&key=5448031-8040e56da2aef1d6367feb956dc0e5df&start=8537&end=9170","https://assets.pipeline.soar.com/5448031-8040e56da2aef1d6367feb956dc0e5df/thumbnail_8537000.jpg","/articles/6589886/Kansas/KDADS-splits-aging-and-disability-resource-center-contracts-state-cites-conflict-of-interest-concerns-and-timeliness-problems","https://secure.pipeline.soar.com/6589886-8799ab6be238456abb00f34073c33f6c/orig.mp4?Expires=1773567637&Signature=QMKWb9MOKsUNIaFcEIBjLfP~pT2XOXKvQPGMGf0buV4I5TMc5IoUxPsnCrerlSVfuru7YIJ7r9EGrB3j5JI65Gl5e6efwy5ahd2DQUChpN-XQPKuYuc5SQpF3rqXdWOb7K4f2gVKWLbJ76TzIZHon5dS1GOYkU6W7mSBomQOeBHZvUjNaScFLXTZhqdFkeDnYdditv0g6lbbs8r~Mvcn8NI8ltkS6MaIQGU6gAx9PP0txEM~aCIYrKymPODggKABpR~NXR2FTHKHOOS~v1XpSeqk0AaekAkvciHEcwlFeSy1vHXGtUwbYvC3EL6hU0rhaE3prY9nadjLVDw6uon9TQ__&Key-Pair-Id=KUT5TJCACFTXG","Kansas Department for Aging and Disability Services officials told the Legislative Post Audit Committee they restructured contracts for Aging and Disability Resource Center (ADRC) services to reduce an appearance of conflict of interest and to address long-standing timeliness problems with Home and Community Based Services (HCBS) waiver assessments.

The ADRC program provides centralized information, counseling and access to services that help Kansans who are aging or have disabilities remain in the community. From 2012 until June 2025 the state contracted with the 11 Area Agencies on Aging (AAAs) to provide ADRC functions statewide. KDADS told auditors it split the single AAA contract into two awards in 2024: one contract for HCBS waiver functional assessments (awarded to Maximus US Services) and a separate contract for remaining ADRC services (awarded to Liberty Healthcare Corporation).

KDADS officials said the change had two objectives. First, they said carrying out functional assessments while an entity also provided services could create a perceived or actual conflict of interest (a concern tied to federal CMS policy on self-referral). KDADS told auditors and the committee it wanted to remove any possible appearance that the same entity that assesses a person's eligibility would also provide or profit from recommended services. Second, KDADS said persistent delays in completing waiver assessments had placed the state on a CMS quality improvement plan; the department said a focused contractor for assessments should improve timeliness.

Auditors reported KDADS advised AAAs they could bid on either contract but would not receive both because of the conflict-of-interest concern. AAAs submitted a bid for the HCBS assessment contract but did not win the award; KDADS said technical issues prevented AAAs from submitting a timely bid for the ADRC services contract. Leslie Anderson, executive director of the Kansas Association of Area Agencies on Aging and Disabilities, told the committee that the contract changes threaten service integration and estimated the AAA network would lose about $5 million a year in revenue that funded assessments and options counseling. Anderson said fragmented systems and unreliable management information (she pointed to data reliability problems in the state's case-management systems) risk reduced access and efficiency.

KDADS officials said they encourage AAAs to continue providing other aging services and that the state expects regional staff and in-state contractors to continue face-to-face assessments. The department also said it will monitor performance and that a follow-up audit of HCBS and related processes is planned. KDADS representatives and the new contractors told the committee they expected a transition period and that staff hires and regional service delivery would continue.

Committee members pressed KDADS about how the assessment work will be staffed and whether the state could preserve rural access; KDADS said regional staff would be used for in-person work and that the new contractors will operate with local Kansas-based assessors. Auditors did not conclude whether the change will improve timeliness; they reported reasons declared by KDADS and concerns raised by the AAAs and noted that further monitoring and follow-up will be needed to evaluate whether the split meets its objectives.","KDADS officials told auditors the agency separated ADRC services into two contracts\u0000functional assessments (awarded to Maximus) and other ADRC services (awarded to Liberty) to avoid perceived conflicts of interest and to address long-standing timeliness problems with waiver assessments.",{"_33":89,"_35":36,"_37":38,"_39":90,"_41":91,"_43":92,"_45":93,"_47":94,"_49":95,"_51":96,"_53":97,"_55":56,"_57":58,"_59":98,"_61":62,"_63":64,"_65":99,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6589891,"Audit finds Kansas abuse, neglect and exploitation reporting system fragmented; registries may be incomplete",1263,2434000,3697000,"/Search/View?dp=1&key=5448031-8040e56da2aef1d6367feb956dc0e5df&start=2434&end=3697","https://assets.pipeline.soar.com/5448031-8040e56da2aef1d6367feb956dc0e5df/thumbnail_2434000.jpg","/articles/6589891/Kansas/Audit-finds-Kansas-abuse-neglect-and-exploitation-reporting-system-fragmented-registries-may-be-incomplete","https://secure.pipeline.soar.com/6589891-c7a807054c05924ce7c6c358e3e6f618/orig.mp4?Expires=1773567637&Signature=gUMv19mP-IUSonLS0v0Oyc9kEH-XZ8yCTrgG9WA4OpqErIXyV3OGHOX8vXFsRobDCAKBqaIzk6NnGREdxvvfjkvyi-QJXcL8Zkh6FOwVhcXT7xOpG-~AHuGF~1~4mR1ANnKTD5IzamWUKhBlugR4OxaOVrpM50wW8FDL9tBeT9lrUXtzKFG74BQuWiedKiWNMyarMjHIo0UrUcKpZW5~s-CdJo3wMQY-9dK8Ks5cdpoY89l70wsGgIF6DnsEtFOGLXWAxXlv8Nq~vQEDzPV6esGItzrU-8XTJgvwljXR8TYgkfVU27HQDd2nHi4P5r~5ybZDmtKg9TDbggO5t1RMtA__&Key-Pair-Id=KUT5TJCACFTXG","Legislative auditors told the Legislative Post Audit Committee that the state\u0000system for reporting and registering perpetrators of abuse, neglect and exploitation (A&E) is complex, inconsistently interpreted and may leave gaps that make it hard to determine whether registries are complete.

The audit reviewed responsibilities and practices across several agencies that handle A&E allegations: Kansas Department for Aging and Disability Services (KDADS), Kansas Department of Health and Environment (KDHE), and the Department for Children and Families (DCF). Auditors concluded statutory language is unclear about whether agencies should maintain inventories of reports (registers of allegations and investigations) or separate lists of substantiated perpetrators (registries). Each agency interpreted its obligations differently, and registries that do exist tend not to overlap, making cross-checking difficult.

Josh Luthai, the audit presenter, summarized the core finding: \"State law is unclear in some respects and agencies understand their responsibilities differently and have different practices,\" and he said that uncertainty and referral practices increase the risk that alleged perpetrators will not be investigated or placed on any state registry if they should be. The audit traced how jurisdictional rules and memoranda of understanding shape who investigates what, and found several specific referral and information flow issues auditors say increase the risk of incomplete registries.

Auditors described four referral-practice issues that increase risk. First, KDHE referred allegations to DCF that DCF then declined to investigate because they fell outside DCF\u0000jurisdiction (for example, allegations arising in hospitals); auditors found many of those referrals did not receive follow-up investigation by any state agency. Second, KDHE sometimes referred allegations only to law enforcement; because law enforcement may not refer outcomes back to state agencies for administrative registries, a criminal investigation might not result in a placing of the perpetrator on a regulatory registry even if A&E occurred. Third, DCF often refers allegations of child abuse by third parties to law enforcement and said it may not learn the outcome of those criminal investigations, creating a gap that can prevent a registry update. Fourth, DCF did not always notify KDADS when a certified nurse aide was found to have perpetrated A&E, and even when DCF notified KDADS, KDADS sometimes said it lacked documentation needed to update the Kansas Nurse Aide Registry.

The audit also reviewed the role of professional licensing boards (for example, the Board of Healing Arts and the Board of Nursing) and found boards routinely publish disciplinary actions but are not charged with keeping registries solely for perpetrators of A&E; board lists may include some perpetrators but are not dedicated registries and do not provide a complete, focused source.

Auditors recommended the Legislature consider clarifying state law to define agency responsibilities, and they recommended that KDHE, KDADS and DCF consult with one another and the Legislature as needed to clarify roles so alleged perpetrators are appropriately investigated or referred and, where appropriate, placed on a registry. Auditors said the agencies generally agreed with the recommendations, though KDHE told auditors it would need legislative changes to implement some steps.

Committee members raised several questions about how many individuals appear on various registries and whether criminal findings are propagated back into administrative registries. Josh Luthai told the committee auditors did not find a single consolidated place to count perpetrators and that, as a result, the overall scope of registries could not be determined from agency records alone. Deputy commissioner Frank Harwood and representatives from KDHE and KDADS joined the committee for discussion; KDHE representatives said their role is regulatory oversight and that they often refer allegations to law enforcement or licensing boards, while KDADS representatives described notification practices for guardians and family members in long-term care settings.

The audit emphasizes that inconsistent laws and practices, fragmented registries and gaps in referral and notification processes may limit the state\u0000system\u0000ability to protect vulnerable populations. The report urges legislative clarification and improved interagency processes to reduce the identified risks.","A Legislative Post Audit review concluded that unclear statutes and differing agency practices have produced a fragmented set of registries and referral practices that increase the risk perpetrators of abuse, neglect and exploitation are not consistently identified or placed on a single registry.",{"_33":101,"_35":36,"_37":38,"_39":102,"_41":103,"_43":104,"_45":105,"_47":106,"_49":107,"_51":108,"_53":109,"_55":56,"_57":58,"_59":110,"_61":62,"_63":64,"_65":111,"_67":68,"_69":70,"_71":72,"_73":74,"_75":74},6589896,"Legislative auditors find Kansas at-risk funding may overcount students tied to free lunch program",1202,166000,1368000,"/Search/View?dp=1&key=5448031-8040e56da2aef1d6367feb956dc0e5df&start=166&end=1368","https://assets.pipeline.soar.com/5448031-8040e56da2aef1d6367feb956dc0e5df/thumbnail_166000.jpg","/articles/6589896/Kansas/Legislative-auditors-find-Kansas-at-risk-funding-may-overcount-students-tied-to-free-lunch-program","https://secure.pipeline.soar.com/6589896-39d57c741f7675a90758e836d4b0cf64/orig.mp4?Expires=1773567637&Signature=XY9vsh5MuoGSue6yVorYaG3EPmgmj8vor4aSI0C8O-AAjY~Rs09DuZEngKlYPa-z0LP~VNoMciJ5qOFuqSxi4w1jw4h0IrNah6T1RE6AuQUPhA7zrvDTW5AOCpvvzNICLwrPU9db6hjhyKqnaU63~Y0H4BEAAvAuNHU45XWjxtjmpDbFjus-lZWid6DivNxZ8tEvwnmt7VTfTshM1bwxC1jQPE5hJFtaUxMoQAg~lZ0X47G4yWL-jz8L4jjsvkUJwRLE0M1~JGv7JaD9-HODrNC0jC-cBjYh6s~8t6qlByNVErFYBby8e5tY~SxJHNDrhsyB-1Fl7zxFIRly0qhUig__&Key-Pair-Id=KUT5TJCACFTXG","Heidi, an audit presenter for the Legislative Division of Post Audit, told the Legislative Post Audit Committee that the number of students the state counts for at-risk funding \"appears to be significantly more than the number of students who may be eligible for the free lunch program.\" The audit examined how free-lunch eligibility is determined and how that count is used to allocate state at-risk funding.

The audit matters because Kansas school districts received roughly $563 million in at-risk and high-density at-risk funding in the 2024 school year, and the state allocates much of that money based on counts of students eligible for the National School Lunch Program. The audit found evidence that the state likely overpaid at-risk funding in 2024 and identified limitations that make a full accuracy check difficult.

Legislative auditors reviewed records for a random sample of 769 students who were listed as eligible for free lunches in the 2024 school year and focused verification work on the subset who submitted household income applications. For 122 students whose families submitted National School Lunch Program applications, auditors matched application information to state Department of Revenue tax records or Department of Labor wage data when available. Of the 108 verifiable applications, auditors concluded 68 did not appear to meet the income eligibility thresholds the applications claimed. The report projects that, among students who qualified by application, between roughly 52% and 74% likely were ineligible, and when those sample results are projected to the statewide population auditors estimate the state may have overpaid approximately $38 million to $53 million in at-risk funding for the 2024 school year.

The report includes careful caveats. Auditors stressed the application is a snapshot in time while tax returns report annual income, and auditors said they could not always verify household size from outside records, both of which could cause mismatches between what an application showed and what tax or wage records later reflected. Audit staff also noted that the sample-based projection applies only to students who qualified by submitting an application, which auditors estimate represented about 16% of the free-lunch population in 2024.

The audit highlights three ways students become eligible for free lunch: direct certification (automatic eligibility through programs such as SNAP, TANF or certain Medicaid benefits, foster care, homelessness, migrant/runaway status), submission of a household income application, and schools participating in the USDA Community Eligibility Provision (which provides free lunch to all students at participating schools). Auditors observed that direct certification grew from about 46% of free-lunch students in school year 2021 to nearly 80% in 2024, leaving the majority of eligibility determinations in the hands of other state agencies that auditors could not fully verify.

Heidi told the committee that auditors could not verify the accuracy of direct certifications because those determinations rely on benefit eligibility decisions by agencies such as the Department for Children and Families (DCF) and the Kansas Department of Health and Environment (KDHE). \"For 80% of the students who receive free lunch in 2024, we don't know if they were approved accurately or not,\" she said, noting that verifying those decisions was outside the scope of the audit. Auditors also described federal rules that limit districts' ability to verify National School Lunch applications: USDA rules generally require districts to verify only a small percentage of applications (3% of approvals or 3,000 applications, whichever is less), and state auditors said KSDE lacks authority and access to independently verify household incomes reported on applications.

The auditors reviewed household economic surveys that some students at Community Eligibility Provision schools submit for at-risk counts and found that those surveys accounted for only a small share of free-lunch students (about 4%). Of the 32 household economic surveys in the sample, auditors could verify only 16 with tax or wage records and concluded nine of the 16 did not appear to meet income eligibility for free lunch by income; however, because Community Eligibility schools provide free lunch to all students regardless of income, those students still receive free meals even if they are not counted for at-risk funding.

Auditors recommended the legislature consider whether basing at-risk funding on the free-lunch count remains appropriate, given program changes that have expanded the routes to free-lunch eligibility and the audit's evidence that many students counted by application may not have met the income thresholds used for at-risk funding. The audit noted that free-lunch eligibility was originally correlated with student poverty and academic risk but that changes such as expanded direct certification and community eligibility have broadened the population receiving free lunch.

Committee members asked several follow-up questions. Senators and representatives pressed audit staff about the limits of verification and whether KDHE or DCF could provide better data; Deputy Commissioner Frank Harwood of the Department of Education agreed to supply additional information about district verification results when available. Committee members also questioned whether USDA rules or state data-sharing restrictions (for example, Department of Revenue confidentiality) prevented more thorough verification outside the narrow frequency USDA permits.

The audit does not conclude that districts intentionally miscounted students nor that specific agencies committed errors; instead, it documents how the combination of federal program design, state agency processes and a large increase in direct certification make it difficult to judge the accuracy of the statewide free-lunch count and thus the at-risk funding allocation. The audit presentation and accompanying report are intended to inform legislative policy discussions about whether the at-risk funding formula should be revised or whether the state should seek ways to improve verification and interagency data sharing to reduce potential overpayments.","A Legislative Post Audit review found that the number of students used to allocate Kansas\u0000at-risk education funding likely exceeded the number who met income-based eligibility, projecting tens of millions in possible overpayments while noting limits that prevent a complete verification.","actionData","errors"]

Article not found

State cybersecurity office expands enterprise monitoring and security operations; committee holds executive sessions on vulnerabilities

KDADS splits aging and disability resource center contracts; state cites conflict-of-interest concerns and timeliness problems

Audit finds Kansas abuse, neglect and exploitation reporting system fragmented; registries may be incomplete

Legislative auditors find Kansas at-risk funding may overcount students tied to free lunch program