1

Hearings & Rulemaking

In Progress Rulemaking and Hearings

Sign up to receive notifications about OIT rulemaking

Automated note-taking and/or recording bots are not permitted in rulemaking hearings and meetings unless under prior arrangement as a reasonable accommodation for a person with a disability. Note-taking and/or recording bots that show up during an event will be removed. OIT will provide a recording and transcript of the event for all participants. Please contact oit_rules@state.co.us if you would like to request a reasonable accommodation. 

Rules in Support of the Colorado Information Security Act, 8 CCR 1501-5

Current Version of the Rules in Support of the Colorado Information Security Act

These rules govern the development, maintenance and distribution of Cybersecurity Plans for public agencies. Revisions will clarify roles and expectations in order to focus on effective and actionable cybersecurity.

Tentative schedule:

  • Engage with both consolidated and non-consolidated agencies in rule development through the winter of 2025-26.
  • Public hearing and revised rule adoption in spring 2026.

Completed Rulemaking and Hearings

OIT adopted amendments to the Rules Establishing Technology Accessibility Standards.

The rule amendments emphasize progress over strict technical conformance for technology accessibility and more clearly align with federal laws. Key changes include:

  • Adding and clarifying definitions for key terms.
  • Clarifying which technical standards apply to different technology types (digital content, installed software, closed functionality), with WCAG for digital content and Section 508 standards for others.
  • Providing five options for compliance, including: WCAG compliance, using alternate versions, providing reasonable accommodations or modifications, progressing on accessibility plans, and choosing technology that best meets accessibility standards and business needs.
  • Requiring public entities to tell users how to report accessibility issues in their Technology Accessibility Statements.
  • Defining limited exceptions from technical standards, mirroring existing federal exceptions, to include: content posted by a third party, individualized password-protected documents, pre-existing social media posts, pre-existing documents, technology that provides substantially equivalent access and ease of use, and certain exceptions for self-contained closed products.
  • Providing guidance on conforming alternate versions for different technology types.
  • Aligning "undue burden" and "undue hardship" with federal and state definitions and expectations.

Rulemaking Schedule

March 2025: rule review, early stakeholder input and drafting

April 2025: stakeholder input

May 1, 2025: rulemaking hearing

May 9, 2025: rule amendments adopted

June 30, 2025: rule amendments effective

For future rulemaking efforts, we will send an email to everyone who has signed up on the Accessibility Rulemaking Notification Sign-up form. 

In the fall and winter of 2023-24, OIT created rules regarding accessibility standards for IT systems. These rules establish the accessibility standards for public entities in Colorado, which includes state and local governments, special districts, and any other instrumentality of a state or local government.

Rulemaking Schedule

Oct. 2023: Invitation to comment on potential rule topics (Closed)

Nov. 2023: Invitation to comment on the Draft Technology Accessibility Rules (Google Doc) (Closed)

Dec. 2023: Invitation to comment on proposed rules (Closed)

Jan. 2024: Public rulemaking hearing on proposed rules (Closed)

Feb. 2024: Rules adopted Feb. 23, 2024

April 2024: Technology accessibility rules become effective Apr. 14, 2024

For future rulemaking efforts, we will send an email to everyone who signed up on the Accessibility Rulemaking Notification Sign-up form.

Submit your comments to oit_rules@state.co.us.

General OIT Rules Information

Review the general information about OIT Rules.

Contact

If you have questions, contact us by email at oit_rules@state.co.us.