Colorado Revised Statutes Title 24. Government State § 24-37.5-404.5. Institutions of higher education--information security plans

(a) Periodic assessments of the risk and magnitude of the harm that could result from a security incident;

(b) A process for providing adequate information security for the communication and information resources of the institution of higher education;

(c) Information security awareness training to inform the employees, administrators, and users at the institution of higher education about the information security risks and the responsibility of employees, administrators, and users to comply with the institution's information security program and the policies, standards, and procedures designed to reduce the security risks;

(d) Periodic testing and evaluation of the effectiveness of information security for the institution of higher education, which shall be performed not less than annually;

(e) A process for detecting, reporting, and responding to security incidents consistent with the information security policy of the institution of higher education. The institutions of higher education, the Colorado commission on higher education, and the chief information security officer shall establish the terms and conditions by which the institutions of higher education shall report information security incidents to the chief information security officer.

(f) Plans and procedures to ensure the continuity of operations for information resources that support the operations and assets of the institution of higher education in the event of a security incident.

(3)(a) Every three years, in accordance with the schedule specified in subsection (3)(b) of this section, each institution of higher education shall submit to the department of higher education a report concerning the development and implementation of the institution's information security program and compliance with the requirements specified in subsection (2) of this section. Upon receipt of the reports, the department of higher education shall review the reports and subsequently submit the reports to the chief information security officer.

(b) The department of higher education shall divide the institutions of higher education into three groups. Each institution of higher education shall submit the report required by subsection (3)(a) of this section as follows: