Colorado's IT Office Told Auditors It Won't Fix Security Gaps

The Colorado Office of the State Auditor⧉ released a follow-up performance audit on January 21, 2026 testing whether the Governor's Office of Information Technology⧉ (OIT) -- the agency that runs IT for nearly every executive-branch department in state government -- had fixed the cybersecurity gaps a 2023 audit found.▸ Of the 71 recommendations still open going into this follow-up, auditors found OIT had fully implemented just 10 of them (14%) by June 30, 2025, the date OIT's own Chief Information Officer told auditors, in April 2025, that all 71 would be finished.

The story starts with the May 2023 audit⧉, which found OIT had not clearly defined who -- OIT, the agencies it serves, or outside vendors -- was responsible for which security tasks, had not established minimum security requirements for key activities like audit logging and account reviews, and had not built an effective way to prioritize the more than 200 critical and essential IT systems spread across Colorado's consolidated agencies.▸ That audit made 77 recommendations; OIT agreed with 56 of them, partially agreed with 16, and disagreed with only 5.

OIT did not keep pace with its own agreements.▸ By July 2024, OIT's own status report to the legislature's Joint Legislative Audit Committee showed 71 of the 77 recommendations still not fully implemented. Then, in April 2025 -- partway through the audit that produced this year's report -- OIT's Chief Information Officer told auditors the office planned to finish all 71 by June 30, 2025.

The clearest break from that promise is in security training.▸ In 2023, OIT agreed to build formal, role-based training explaining security responsibilities to the "Business Owners" who run agency systems and to OIT's own IT Directors, with a target date it later moved up to December 2024. By this audit, OIT reported the training still was not built by June 30, 2025 -- and told auditors it does not plan to implement what it originally agreed to.

Auditors responded with a new seven-part recommendation to force the issue.▸ OIT disagreed with six of the seven parts⧉, marking each one's implementation date "Not Applicable" and stating that its new security policy "does not require role-based security training." The auditor's addendum pushes back directly: OIT's own December 2024 policy, in force throughout the audit, does require exactly that training -- for both agency staff and OIT's IT Directors. In the report's other public finding, on IT governance, the auditor's addenda go further still, stating three separate times that it is plainly "unclear what OIT is disagreeing with in the recommendation."

This year's audit issued 85 new recommendations covering both public findings and ten additional findings the state keeps confidential because they describe specific technical vulnerabilities.▸ OIT agreed with 18 of the 85, partially agreed with 30, and disagreed with 37 -- a 43.5% disagreement rate, up from the 6.5% rate (5 of 77) OIT posted on the original 2023 audit. Auditors warn that leaving the underlying gaps unresolved means OIT "may not be able to fully meet its statutory responsibilities to ensure that information Colorado's citizens have entrusted to state agencies is safe, secure and protected from unauthorized access, unauthorized use, or destruction."