Colorado's IT Office Fixed 1 in 7 Flagged Cybersecurity Fixes in Three Years. Then It Cut 173 Jobs.
Summary
The Governor's Office of Information Technology runs the systems behind SNAP, Medicaid and unemployment benefits for 31,000 state employees on a $373 million budget. In January 2026 Colorado's state auditor found it had fully completed just 10 of 71 cybersecurity recommendations first flagged in May 2023 — 14 percent. In May, OIT laid off 173 people, 15 percent of its staff, and created 98 new roles in their place.
What the audit found
The January 2026 follow-up audit, report 2551P-IT, went back to the 71 recommendations the state auditor's office had made in two May 2023 reports — one public, one confidential — and tested whether OIT had actually acted on them. As of June 30, 2025, OIT had fully implemented 10 (14 percent), partially implemented 53 (75 percent), and left 8 (11 percent) untouched. The auditors found OIT "did not provide sufficient documentation" that it had coordinated with state agencies on system-criticality classifications, and — despite agreeing to the opposite in 2023 — told auditors it "does not plan to provide training to state agency staff on their security responsibilities," even though OIT's own December 2024 security policy assigns those staff exactly that responsibility.
View data as table
| Fully implemented | 10 | 14% |
|---|---|---|
| Partially implemented | 53 | 75% |
| Not implemented | 8 | 11% |
| Total tested | 71 | from the May 2023 public + confidential audits |
The pattern isn't new. Rep. Brianna Titone, an Arvada Democrat who questioned Edinger repeatedly in Joint Technology Committee hearings, told The Colorado Sun that OIT's internal cash fund — the account it uses to bill other agencies for services — had grown to $36 million, which "indicates they were overcharging divisions for services." An OIT spokesperson said that balance is now being transferred to the state general fund, with one-time credits already issued back to the agencies that were charged.
The restructuring
On May 27, 2026, OIT announced a "large-scale realignment" that eliminated 173 positions — about 15 percent of its 1,150-person workforce — while creating 98 new roles built around a product-delivery model the announcement says has worked "at Google, Amazon, Microsoft and the U.S. Digital Service." Net, OIT shrinks by 75 people. The Colorado Sun reported the change is projected to save $4 million in its first full year and $8 million annually after that. Edinger, on his way out after two and a half years as , told the paper the layoffs were not a response to artificial intelligence or to the state's broader $1.5 billion general-fund budget shortfall — he pointed instead to "heaps of negative feedback from the state auditor, legislative oversight bodies and its agency partners." OIT's own customer-satisfaction survey, he said, had moved from 31 percent to 36 percent on his watch, against a goal of 67 percent — "two out of every three people saying we're a good partner." Sarah Tuneberg, OIT's deputy director, took over as on June 1.
View data as table
| Positions eliminated | 173 | 15% of 1,150 |
|---|---|---|
| New positions created | 98 | new delivery-model roles |
| Net reduction | 75 | 173 − 98 |
The restructuring targets "management layers and internal coordination functions," per OIT's announcement, not the technical staff who build and maintain the systems agencies rely on. Whether cutting management layers moves the needle on the specific failures the state auditor identified — governance coordination and security training, the same two categories called out in January — is a question the audit itself does not answer, and won't be tested again until the next follow-up review.
The takeaway
- The audit trail is long and mostly unresolved. Three years after the state auditor's first cybersecurity report, only 10 of 71 recommendations — 14 percent — were fully implemented as of the January 2026 follow-up.
- The fix that shipped wasn't the one the audit asked for. OIT's response to years of criticism was a workforce restructuring — 173 jobs cut, 98 created — aimed at management structure and customer satisfaction, not directly at the governance and training gaps the auditors flagged.
- The stakes are the everyday systems. OIT runs the technology behind , Medicaid, and unemployment benefits for 31,000 state employees on a $373 million budget — the same office the audit found had not finished training staff on their own security responsibilities.
This piece reports OIT's own restructuring figures as stated by OIT and in The Colorado Sun's on-the-record reporting; it does not independently verify the projected $4M/$8M savings, which have not yet been tested by an actual fiscal year of results.
Sources
- Colorado Office of the State Auditor, IT Performance Audit: Cybersecurity Resiliency, Governor's Office of Information Technology, Report 2551P-IT (January 2026) — the follow-up finding that 10 of 71 prior recommendations (14%) were fully implemented, 53 (75%) partially, and 8 (11%) not implemented, plus the governance and training findings quoted above. content.leg.colorado.gov
- Colorado Office of the State Auditor, Audit of Cybersecurity Resiliency at the Governor's Office of Information Technology, Public Report 2250P-IT (May 2023) — the original public audit whose recommendations, together with a companion May 2023 confidential report, make up the 71 tested in the 2026 follow-up. content.leg.colorado.gov
- Governor's Office of Information Technology, press release, OIT Announces Strategic Realignment to Better Serve Coloradans and Make State Government More Efficient (May 27, 2026) — the 173-position reduction, the February 2026 restructuring start, and David Edinger's $373 million annual budget and $1 billion federal grant spending figures. oit.colorado.gov
- Tamara Chuang, Colorado overhauls state IT office, lays off 173 employees after negative feedback, The Colorado Sun (May 27, 2026) — on-the-record reporting of the 1,150-person workforce baseline, the 15% cut, the $4M/$8M projected savings, the 98 new positions, the 31,000-employee/17-agency service footprint, the 31%-to-36% customer satisfaction figures, the $36 million OIT cash fund, and Edinger's statement disclaiming a link to AI or the state's budget shortfall. coloradosun.com
Comments
Always open. Logged-in readers can annotate paragraphs in place.
Colorado's Governor's Office of Information Technology (OIT) is the state's centralized IT department, built by statute in 2008 to run the systems that 31,000 state employees across 17 agencies use to deliver services — including benefits, Medicaid, unemployment insurance, and driver's license renewals — on a budget that reached $373 million a year and oversaw another $1 billion in federal grant spending under outgoing David Edinger. Twice — in a May 2023 public audit and a companion confidential one — Colorado's Office of the State Auditor, the legislature's independent watchdog, told OIT what to fix about its own cybersecurity. In January 2026 it checked back in. Of the 71 recommendations it could still test, OIT had fully implemented 10 — 14 percent. In May, citing years of complaints rather than the audit itself, OIT eliminated 173 jobs and built 98 new ones in their place.