Colorado § 24-37.5-105.4 - Delegation of authority.

§ 24-37.5-105.4. Delegation of authority.

(1) The chief information officer may delegate an information technology function of the office to another state agency by agreement or other means authorized by law; except that the chief information officer shall not delegate a duty, responsibility, or power of the chief information security officer. The chief information officer may delegate an information technology function of the office if in the judgment of the director of the state agency and the chief information officer:

(a) The state agency has requested that the function be delegated;

(b) The state agency has the necessary resources and skills to perform or control the function to be delegated; and

(c) The function to be delegated is a unique or mission-critical function of the state agency.

(2) The chief information officer may delegate a function of the office only when the delegation results in net cost savings or improved service delivery to the state as a whole or to the unique mission critical function of the state agency, or is not otherwise provided in the office's information technology oversight and standards governance developed pursuant to section 24-37.5-105 (4).

(3) For any delegation of authority pursuant to this section, the office shall formalize an agreement with the state agency in which the agency assumes the responsibility for all of the requirements specified in this subsection (3), including acknowledging responsibility for ensuring that the information technology or service maintains ongoing compliance with state information technology policies and standards pursuant to section 24-37.5-105 (4) and applicable federal regulations. The delegation of authority pursuant to this section shall be in writing and shall contain the following:

(a) A precise definition of each function to be delegated;

(b) A clear description of the standards to be met in performing each delegated function;

(c) Designation of the state agency responsible for ensuring operational security and validating compliance to security policies and standards;

(d) A provision for periodic administrative audits by the office;

(e) A date on which the agreement shall terminate if the agreement has not been previously terminated or renewed; and

(f) Designation of the appointing authority responsible for the delegated services to support the function in the state agency and rates to be charged for the staff.

(4) An agreement to delegate functions to a state agency may be terminated by the office if the results of an administrative audit conducted by the office reveals a lack of compliance with the terms of the agreement by the state agency.

Source: L. 2021: Entire section added, (HB 21-1236), ch. 211, p. 1107, § 8, effective September 7. L. 2026: IP(1) amended, (SB 26-185), ch. 314, p. 1842, § 3, effective August 12.