Lawmakers review House substitute for SB 291 to centralize cybersecurity, set NIST targets and new reporting rules

The Legislative Modernization Committee heard a detailed overview on Jan. 29 of the House substitute for Senate Bill 291, a bill that would consolidate many state cybersecurity functions and set new standards and reporting requirements across Kansas government.

Natalie, Reviser of Statutes, told the committee the measure transfers cybersecurity services to the chief information technology officer (CTO) for each branch, creates chief information security officers (CSOs) in the judicial and legislative branches, and requires CSOs in several constitutional offices to implement minimum cybersecurity standards tied to the National Institute of Standards and Technology Cybersecurity Framework (NIST CSF). "If an audit results in a failure to meet those standards, then the CSO has to report that failure to the speaker of the house, the president of the Senate, and then the minority leaders," Natalie said, adding that those audit…