1

Hearings & Rulemaking

In Progress Rulemaking and Hearings

Sign up to receive notifications about OIT rulemaking

Automated note-taking and/or recording bots are not permitted in rulemaking hearings and meetings unless under prior arrangement as a reasonable accommodation for a person with a disability. Note-taking and/or recording bots that show up during an event will be removed. OIT will provide a recording and transcript of the event for all participants. Please contact oit_rules@state.co.us if you would like to request a reasonable accommodation. 

Rules in Support of the Colorado Information Security Act, 8 CCR 1501-5

OIT adopted amendments to the Rules in Support of the Colorado Information Security Act. 

These rules govern the development, maintenance and submission of Cybersecurity Plans for public agencies. Revisions clarify roles and expectations in order to focus on effective and actionable cybersecurity. They emphasize a cooperative approach to build maturity and reduce risks across the state. Key changes include:

  • Streamlined definitions
  • Replace the requirements about the contents of the agency security plans with a cybersecurity review template based on the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF) to make use of an industry standard self-evaluation that many agencies already complete
  • Require discussion between the agencies and State Chief Information Security Officer (CISO) about the agency security plans and risks, providing more clarity for the agencies, more visibility for the CISO, and enabling a holistic security approach
  • Disapproval of an agency security plan is due to not participating in the discussion with CISO
  • Establishment of an extension / exception process

Rulemaking Timeline

October 2025 to March 2026: Regular working group meetings to revise the rules. Composed of OIT and security representatives from the non-consolidated agencies.

April 14, 2026: Public rulemaking hearing

May 11, 2026: Rule amendments adopted

June 30, 2026: Rule amendments effective

Completed Rulemaking and Hearings

OIT repealed 8 CCR 1501-6, Rules in Support of the Office of Information Technology on Thursday, February 19, 2026. 

Current Version of the Rules in Support of the Office of Information Technology

Public Rulemaking Hearing Record and Other Exhibits for 8 CCR 1501-6 (Google Drive)

The Chief Information Officer adopted 8 CCR 1501-6, Rules in Support of the Office of Information Technology in 2009 to govern the purchase of information technology related goods and services in emergency situations and to enable OIT to report to the legislature about emergency IT purchases.

Two developments since their adoption rendered these rules redundant and unnecessary: 

  • In 2018 DPA revised the state fiscal and procurement rules to require OIT’s approval for IT purchases for consolidated agencies. DPA also clarified the narrow emergency situations that enable an agency to make purchases without following the standard approval process.
  • Second, HB21-1236 updated OIT’s statutory authority to: 1) remove the requirement for OIT to report to the general assembly about statewide emergency IT purchases, and 2) mandate OIT’s role in purchasing contracts for IT resources at consolidated agencies.

OIT adopted amendments to the Rules Establishing Technology Accessibility Standards.

The rule amendments emphasize progress over strict technical conformance for technology accessibility and more clearly align with federal laws. Key changes include:

  • Adding and clarifying definitions for key terms.
  • Clarifying which technical standards apply to different technology types (digital content, installed software, closed functionality), with WCAG for digital content and Section 508 standards for others.
  • Providing five options for compliance, including: WCAG compliance, using alternate versions, providing reasonable accommodations or modifications, progressing on accessibility plans, and choosing technology that best meets accessibility standards and business needs.
  • Requiring public entities to tell users how to report accessibility issues in their Technology Accessibility Statements.
  • Defining limited exceptions from technical standards, mirroring existing federal exceptions, to include: content posted by a third party, individualized password-protected documents, pre-existing social media posts, pre-existing documents, technology that provides substantially equivalent access and ease of use, and certain exceptions for self-contained closed products.
  • Providing guidance on conforming alternate versions for different technology types.
  • Aligning "undue burden" and "undue hardship" with federal and state definitions and expectations.

Rulemaking Schedule

March 2025: rule review, early stakeholder input and drafting

April 2025: stakeholder input

May 1, 2025: rulemaking hearing

May 9, 2025: rule amendments adopted

June 30, 2025: rule amendments effective

For future rulemaking efforts, we will send an email to everyone who has signed up on the Accessibility Rulemaking Notification Sign-up form. 

In the fall and winter of 2023-24, OIT created rules regarding accessibility standards for IT systems. These rules establish the accessibility standards for public entities in Colorado, which includes state and local governments, special districts, and any other instrumentality of a state or local government.

Rulemaking Schedule

Oct. 2023: Invitation to comment on potential rule topics (Closed)

Nov. 2023: Invitation to comment on the Draft Technology Accessibility Rules (Google Doc) (Closed)

Dec. 2023: Invitation to comment on proposed rules (Closed)

Jan. 2024: Public rulemaking hearing on proposed rules (Closed)

Feb. 2024: Rules adopted Feb. 23, 2024

April 2024: Technology accessibility rules become effective Apr. 14, 2024

For future rulemaking efforts, we will send an email to everyone who signed up on the Accessibility Rulemaking Notification Sign-up form.

Submit your comments to oit_rules@state.co.us.

General OIT Rules Information

Review the general information about OIT Rules.

Contact

If you have questions, contact us by email at oit_rules@state.co.us.