Kansas House Bill HB2271

Kansas 2025-2026 Regular Session

• Introduced: 2/5/25
• Refer: 2/5/25
• Report Pass: 2/18/25
• Engrossed: 2/25/25
• Refer: 2/26/25

Caption

Removing the expiration of provisions relating to moving cybersecurity services under the chief information technology officer of each branch of government.

Summary

HB 2271 is a cybersecurity modernization bill that removes sunset dates from a set of 2024 cybersecurity provisions and makes them permanent. It requires several state offices and branches — including the Department of Insurance, Secretary of State, State Treasurer, Attorney General, Kansas Bureau of Investigation, judicial branch, and legislative branch — to appoint chief information security officers (or equivalent cybersecurity leadership) responsible for setting security standards, developing cybersecurity programs, coordinating audits, and overseeing annual cybersecurity awareness training. The bill also requires those programs to align with the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0 and to progress to higher maturity tiers by 2028 and 2030. The bill further expands statewide cybersecurity coordination by directing the Information Technology Executive Council to develop a plan to integrate executive branch information technology services and certain cybersecurity services, and by requiring reporting on that plan to legislative committees. It also requires state websites to move to a .gov domain, separates information technology and cybersecurity appropriations into distinct line items for legislative review, and establishes a compliance-based budget penalty mechanism beginning in 2028 for agencies found not to be following the act. Several sections are rewritten to expire in 2026, but the bill’s overall purpose is to preserve and extend the cybersecurity governance structure created in prior legislation. The bill’s impact on state law is to entrench a centralized cybersecurity framework across Kansas state government and to formalize the role of branch-level chief information security officers. It changes multiple statutes governing agency staffing and information technology administration, and it repeals a number of existing 2023 and 2024 session-law provisions so the revised framework can operate as the controlling law. It also makes audit results and certain related reports confidential and exempt from disclosure under the Kansas Open Records Act, limiting public access to cybersecurity audit findings. The general sentiment around the bill appears strongly favorable and noncontroversial. The House passed it on emergency final action by a vote of 123-0, indicating broad bipartisan support. No committee transcript was provided, but the unanimous vote suggests the bill was viewed as a technical or administrative cybersecurity update rather than a politically divisive measure. The main points of contention, based on the text, would likely center on the bill’s confidentiality provisions, the mandatory annual audits, and the requirement that employees lose network or hardware access if they fail cybersecurity training. Another possible area of concern is the bill’s centralization of cybersecurity authority and the future budget penalty structure for noncompliance, which could affect agency autonomy and appropriations. However, the available voting history shows no recorded opposition in the House.

Impact

HB 2271 amends and repeals multiple Kansas statutes to make permanent a branch-by-branch cybersecurity governance structure, require NIST CSF 2.0-based cybersecurity programs, mandate annual training and audits, and create reporting and compliance requirements for state agencies. It also affects public records law by making certain audit results confidential and changes budget and IT administration practices by requiring separate IT/cybersecurity line items and future compliance-based funding reductions.

Sentiment

The bill appears to have had overwhelmingly positive reception. The House passed it unanimously on emergency final action, 123-0, suggesting broad agreement that the measure is a routine but important cybersecurity update. No committee discussion was provided, but the vote history indicates little to no visible opposition.

Contention

The most notable potential points of contention are the bill’s confidentiality rules for cybersecurity audits, which limit disclosure under the Open Records Act, and the strong enforcement provisions tied to employee training and agency compliance. Some may also object to the bill’s centralization of cybersecurity authority across branches and the prospect of future budget reductions for agencies found out of compliance. Despite these possible concerns, no recorded opposition appears in the House vote.