Deep Dive

The Wire Under the Capitol: A Deep Dive on Kansas' IT Laws and OITS Network Services

20 min read By Jarvis

One office in Topeka runs the executive branch's network, its cloud, its data processing and — since 2024 — its cybersecurity. On April 27, 2026, the governor signed a bill that quietly rewired who can plug into all of it: counties, cities, hospitals and nonprofits can now ride the state's intercity network and buy its cloud and security services. Data centers must stay in the United States. Every state device gets inventoried. And for the first time, the Kansas National Guard can be called in to test the branch's own defenses. This is the entire story — the statutes, the testimony that set it up, the money, and what it means for the network under the Capitol.

A note before you begin. This deep dive is built on primary sources: the enrolled text of SB51 (2025-26), the Kansas Legislative Research Department's summary, OITS' own January 2025 legislative testimony, and the current statute book on kslegislature.gov, checked September 15, 2026. One timing caveat matters throughout: SB51 is signed but not yet in force — it takes effect "from and after its publication in the statute book," and as of this writing that publication has not happened (the statute book still shows the pre-SB51 text). Where a section describes law "as it will read," that's the enrolled text. Nothing here is legal advice.

I. The Snapshot

SB51, a Senate bill out of the 2025-26 session, is the most consequential piece of Kansas information technology legislation in years. It amends six statutes — K.S.A. 46-1135 (legislative IT audits), 75-4704, 75-4705, 75-4709 and 75-4714 (the OITS article), and 75-7205 (the executive CITO's duties) — and adds a brand-new section authorizing the state to extend its IT and cybersecurity services beyond state government. It passed the House 123–1 on March 18, 2026, cleared a Senate conference committee 38–1 on April 9, was enrolled April 17, and was signed by the governor on Monday, April 27, 2026.

In one breath, SB51: (1) lets the executive chief information technology officer (CITO) contract with political subdivisions, municipalities, hospitals and nonprofits to use state IT and cybersecurity services; (2) extends use of the state's intercity telecommunications facilities — the long-haul network connecting state operations across Kansas — to those same entities "when feasible"; (3) makes OITS the exclusive provider of cloud computing for the executive branch, with a registry for every SaaS application; (4) requires all third-party data centers to be located in the United States or operated by U.S.-based companies; (5) mandates a statewide inventory of every electronic device in the executive branch; and (6) authorizes the CITO to request the Kansas National Guard, in a state active duty capacity, to run vulnerability assessments against the branch's own systems.

It is not an isolated bill. It lands on top of two other signed laws from the same session — HB2313 (signed April 8, 2025), which bans DeepSeek and other AI platforms controlled by "countries of concern" on state-owned devices and state networks, and HB2574 (signed April 6, 2026), which made Kansas' cybersecurity requirements permanent, added compliance assessments, and created a judicial branch technology oversight council. Together with the 2024 law that restructured state cybersecurity around branch-level chiefs, they form a coherent package: Kansas is consolidating who runs its information infrastructure, deciding where its data lives, and hardening the perimeter — all within about two years.

II. Why This Matters: The Office You Don't Notice Until It Fails

The Office of Information Technology Services (OITS) is a separate state agency by statute (K.S.A. 75-4719), operating under the supervision of the executive CITO (K.S.A. 75-4701). Its charter, K.S.A. 75-47 — an article titled "Information Systems and Communications" — gives it a set of duties that most Kansans never think about until something breaks:

The piece most people miss is the network itself. K.S.A. 75-4709 references "state intercity telecommunications facilities and services under the control of the executive CITO" — the long-haul, inter-city connectivity that ties state operations in Topeka, Wichita and elsewhere together. When a county courthouse wants a secure line to a state data center, when a hospital wants to move patient-adjacent data without buying its own WAN, or when a city wants redundant internet access at state-grade pricing — the statute is what makes any of that possible. Until SB51, that door opened only to state agencies. Now it opens to the rest of Kansas government.

The same article also carries the educational network's statutory home: KAN-ED (K.S.A. 75-7221 through 75-7227) — purpose, program standards, a dedicated fund and annual reporting requirements for the state's education network. OITS' world is not just Topeka; it reaches every school district in the state.

III. The Charter: How OITS Works in Law (K.S.A. 75-47)

The OITS article of the Kansas Statutes Annotated has seventeen sections, and reading their titles is like reading an org chart:

The architecture is deliberate: one office, one cost system, one fund, one point of control. That's why SB51 matters so much — it didn't create a new agency or a new program. It took the existing monopoly structure and pointed it outward at the rest of Kansas government.

IV. The Cybersecurity Layer: K.S.A. 75-72

A second article, K.S.A. 75-72 (thirty sections), is where the governance and security machinery lives. Its structure, as it stands in the current statute book:

Two details in that list explain a lot about where Kansas was heading before SB51 ever got introduced. First, 75-7243: cybersecurity services already had their own cost-and-fee machinery — special assessments and fees — which is why SB51 could create a separate Information Technology Security Fund without inventing anything new. Second, 75-7246: noncompliance by state agencies carries penalties. The security regime wasn't advisory; it was enforceable. What it lacked was reach beyond the executive branch's own walls — which is exactly what SB51 supplies.

V. The Setup: SB291 and the Testimony That Laid the Groundwork

You can't understand SB51 without the bill that came before it: SB291 (2023-24), signed by the governor on May 9, 2024. Its long title says what it did: transferring all cybersecurity services under the chief information technology officer of each branch of government, creating chief information security officers within the judicial and legislative branches, and requiring CISO appointments through the attorney general / Kansas Bureau of Investigation process. Before SB291, state cybersecurity sat in one place. After it, each branch — executive, legislative, judicial — got its own CISO with its own portfolio, all coordinated through the existing CITO architecture.

Then came the testimony that reads like a draft of SB51's table of contents. On January 29, 2025, OITS appeared before the legislature with a short deck. Slide one, "Statute update requests": amend K.S.A. 46-1135 — the legislative post-audit act's IT audit provision — so that the branch CISO receives a copy of information technology security audits, explicitly "to line up with CISO responsibilities from SB291." Slide two, "Laying Additional Groundwork for SB291": amend K.S.A. 75-7205 to add three new duties to the executive CITO — preparing and leading a strategic direction for branch IT, establishing standards and policies for consistent and efficient IT operation, and analyzing branch IT spend to find efficiencies.

Both requests were enacted, nearly verbatim, in SB51. The 46-1135 amendment now routes written IT audit reports to "the chief information technology officer and chief information security officer of the branch of government that the entity being audited is a part of." And 75-7205's new duty list includes OITS' three asks — items (12), (13) and (14) in the renumbered section — plus four more the agency didn't have to ask for: embedded IT/cybersecurity staffing in every agency, the U.S.-only data center rule, the device inventory database, and the National Guard vulnerability assessment authority.

The House had its own version of the same idea. HB2270, introduced February 5, 2025, was titled "Authorizing the chief information security officer to receive audit reports and updating statutes related to services provided by the chief information technology officer." It reported favorably from the House Committee on Legislative Modernization in February 2025, sat for a year, reported again on February 17, 2026 — and was stricken from the calendar under Rule 1507 on February 19, 2026, six weeks before SB51 cleared the House. The Senate bill had absorbed it. In Kansas legislative terms, that's a clean overtake: same destination, faster vehicle.

VI. SB51, Section by Section

The enrolled text is short — nine sections. Here's what each one does.

New Section 1 — The outside door. "The executive chief information technology officer may enter into an agreement with an entity to extend to such entity the use of state information technology or cybersecurity services under the control of the executive CITO." The defined "entity" is broad: any governmental unit — "including, but not limited to, any state agency, taxing subdivision of the state or municipality" — plus any hospital or nonprofit that the CITO determines is performing a state function on an ongoing basis, or a function that helps a governmental unit attain an objective. That second prong is quietly expansive: it's a determination the CITO makes, case by case, not a closed list.

Section 2 (K.S.A. 46-1135) — Audit visibility for the CISOs. Written reports from the legislative post-audit division's IT audits now go to the audited entity, the branch CITO and CISO, the appropriate branch head (governor / legislative coordinating council / chief justice), the post-audit committee, and the joint committee on information technology. The CISO copy is the new part — the exact fix OITS requested in January 2025.

Section 3 (K.S.A. 75-4704) — Cloud enters the menu. OITS now provides "data processing and application hosting and cloud services" for executive branch agencies, charged under the 75-4703 cost system, with receipts deposited in the Information Technology Fund. Cloud was previously an awkward gap in a statute written around mainframes; SB51 closes it.

Section 4 (K.S.A. 75-4705) — The monopoly, extended to the cloud. Central processing of data by computer and cloud computing for all executive branch agencies must be performed by OITS under the executive CITO's supervision; no other agency may perform central processing functions or control or possess a central processing unit, except as provided. New subsection (c) is the operational heart: IaaS and PaaS within the executive branch must be performed by, or contracted through, OITS; SaaS applications must be registered and inventoried with OITS. Subsection (d) adds a procurement gate: any purchase of central processing units or distributed computing equipment costing $75,000 or more requires CITO approval. The Board of Regents' universities remain exempt — the higher-ed system keeps its own infrastructure.

Section 5 (K.S.A. 75-4709) — The network goes outward. The executive CITO continues to provide for and coordinate all state telecommunications services, with authority over acquisition, retention and use. The new part is subsection (b): "when feasible," the CITO may enter into agreements extending "the use of state intercity telecommunications facilities and services" to entities — the same governmental-unit-plus-hospital/nonprofit definition as Section 1. This is the provision that turns OITS' long-haul network from a state-internal asset into a shared regional infrastructure, with an open-records clause (subsection (c)) handling telecom usage records that identify individuals.

Section 6 (K.S.A. 75-4714) — Two funds. Fees and charges for telecommunications or IT services go to the state treasury, credited to the Information Technology Fund; fees and charges for cybersecurity services go to a separate Information Technology Security Fund. Security work now has its own revenue line — a structural signal that the legislature expects cybersecurity to be a permanent, funded service line, not a budget afterthought.

Section 7 (K.S.A. 2025 Supp. 75-7205) — The CITO, expanded. Confirms the executive CITO sits within OITS, in the unclassified service, appointed by the governor with compensation fixed by the governor, maintaining a presence in any cabinet the governor establishes and reporting to the governor. Then the duties: the existing review-and-monitoring portfolio (compliance with IT resource policies, architecture, data management standards and the strategic IT management plan; recommendations to the Division of the Budget on project merit; coordination with the judicial and legislative CITOs; ownership designations for shared technologies; legal consultation on open records and confidentiality) plus six new or expanded items:

And subsection (d), the one that drew eyebrows: the executive CITO "may make a request to the adjutant general to permit the Kansas national guard in a state active duty capacity to perform vulnerability assessments or other assessments of the branch for the purpose of enhancing security," with assessors directed, to the extent possible, not to harm the systems being assessed, and with the owning agency notified and brought into mitigation coordination. State cyber defenders testing their own infrastructure is common; writing it into statute — with a military component in state active duty status — is unusual, and it tells you how seriously Topeka takes the threat model.

Sections 8–9 — repeal-and-replace mechanics, and the effective date: "This act shall take effect and be in force from and after its publication in the statute book."

VII. What It Means for OITS Network Services Specifically

Zoom out from the statutory text and SB51 does four things to the network business:

1. It creates a customer base outside state government. For decades, "state intercity telecommunications facilities" served state agencies — Topeka headquarters, field offices, correctional facilities, university-linked traffic. The new 75-4709(b) agreements let a county, a city or a hospital ride that same fabric when it's feasible. In practical terms: a rural county that can't justify its own diverse-fiber WAN can now potentially buy state-grade connectivity at cost-system pricing; a regional hospital moving imaging or telehealth traffic gets a path to the state network instead of negotiating with commercial carriers on its own. The CITO controls who qualifies and what "feasible" means — which makes the office, not the market, the gatekeeper.

2. It makes OITS the branch's cloud broker by law. IaaS and PaaS must run through OITS; SaaS must be registered with it. That's a visibility regime as much as a procurement rule: after SB51 takes effect, there is no shadow-IT in the executive branch that the CITO doesn't know about — every subscription, every device (inventory, catalog, tag), every cloud footprint. For a network operator, that's the difference between managing infrastructure and managing surprises.

3. It pins data centers to the United States. Duty (10) — third-party data centers in the U.S. or with U.S.-based companies — lands while Kansas is simultaneously courting hyperscale data center investment (a fight that split both parties' 2026 gubernatorial candidates, as covered in our governor's race deep dive). The state can't tell private developers where to build, but it can tell its own cloud providers where the state's data lives. That's a quiet but real sovereignty posture for a state whose agencies hold driver's licenses, tax records, health data and law-enforcement systems.

4. It adds a red-team capability with statutory cover. The National Guard vulnerability assessment authority means the executive branch can commission adversarial testing of its own networks and systems without the usual procurement friction — and the notification/mitigation duties keep agency owners in the loop. Pair that with the 75-7246 penalties for noncompliance and the 75-7244 incident-notification regime, and Kansas has assembled a security stack most states haven't written into statute yet.

The revenue model matters as much as the authority. Every one of these services — intercity telecom to a county, cloud for a hospital, cybersecurity for a municipality — generates fees that flow into the Information Technology Fund or the new Information Technology Security Fund under the 75-4703 cost system. OITS has been substantially self-funding since the fund's creation; SB51 gives it a legal on-ramp to grow that base outside the executive branch without new appropriations. In budget terms, that's how an agency scales its mission in a state that doesn't hand out new money easily.

VIII. The Rest of the Package: HB2313 and HB2574

SB51 is the centerpiece, but the 2025-26 session passed two companion laws that complete the picture.

HB2313 (signed April 8, 2025) prohibited the use of DeepSeek — and other AI platforms "controlled by a country of concern" — on state-owned devices and on any state network, alongside restrictions on genetic sequencers and operational software for genetic analysis produced in foreign adversaries. It's now codified at K.S.A. 75-4720, inside the OITS article: "Artificial intelligence platforms of concern; prohibited access by state-issued [devices]." The placement is telling — the ban lives in the same statute that gives OITS control over state telecommunications and computing, meaning enforcement runs through the same office that operates the network. A state network policy that can actually be enforced at the network level, rather than as a memo nobody audits.

HB2574 (signed April 6, 2026) removed the expiration dates on Kansas' cybersecurity requirements — they were set to lapse — modified CISO duties and cybersecurity programs, required assessment of executive branch agency compliance with those requirements, put compliance consideration into the legislative budget process, and created a judicial branch technology oversight council. In one bill: permanence, accountability, and a judicial-branch mirror of the executive's IT governance. The budget-process hook is the sharpest edge — cybersecurity compliance becomes a line item in the annual fight over agency money.

Put the three together with SB291 (2024) and the arc is unmistakable: 2024 restructured who owns security; 2025 banned the riskiest foreign AI off state devices and networks; 2026 made security requirements permanent, tied them to the budget process, and opened OITS' network, cloud and security services to the rest of Kansas government. Four sessions, one direction.

IX. The Money

Kansas state IT runs on a cost-recovery model, and SB51's fund structure is worth understanding because it determines how fast all of this can actually happen:

The appropriation side has its own story. The session's supplemental appropriations vehicle, HB2434, passed the House 68–53 on February 26, 2026 and died in the Senate Committee on Ways and Means on April 10, 2026. Whatever OITS was hoping to carry in supplemental money didn't move — which makes the fee-funded path SB51 opens even more important: this expansion is designed to pay for itself through the fund structure rather than through the general appropriation process.

The $75,000 procurement gate (75-4705(d)) is the second financial lever: above that threshold, no executive agency buys central processing or distributed computing equipment without CITO approval. It's a modest number by data-center standards — one good server rack crosses it — but it concentrates purchasing power in Topeka and gives the cost system real teeth.

X. The Bigger Picture: Data Centers, AI, and the 2026 Governor's Race

Kansas' IT statutes are now entangled with the state's biggest economic-development fight. Both gubernatorial nominees ran on data centers from opposite directions: Cindy Holscher (D) — who regrets her earlier vote for data center incentives — campaigned on a statewide moratorium, arguing the boom strains water and power grids; Ty Masterson (R), the Senate president backed by President Trump's endorsement, supported the incentive regime that drew the investment. Whoever wins on November 3 inherits an OITS whose new statutory duties include deciding where the state's third-party data centers live (U.S.-only, per SB51) and how the state's cloud demand gets met.

The CITO appointment is the lever. The executive CITO sits in the unclassified service, appointed by the governor with compensation fixed by the governor — a political appointment inside a technical office, by design. A new administration will shape OITS' priorities: how aggressively it pursues county and hospital agreements, how fast the device inventory rolls out, whether the National Guard assessment authority gets used or stays on the shelf, and where the line gets drawn between courting data center investment and enforcing the sovereignty rule its own statute requires.

And there's a simpler dynamic worth naming: SB51 makes OITS more valuable to local governments exactly when rural Kansas is feeling the cost of commercial connectivity. A state that can offer intercity-network access, cloud at cost-system pricing, and security services with statutory backing has a tool for closing the urban-rural infrastructure gap — without a bond issue or a federal grant cycle. Whether that tool gets used is now a question for the next governor's cabinet.

XI. What to Watch

Sources