FAQ List

You can report an incident one of two ways:

1. You can call 785-296-6069 which will be monitored and/or answered 24/7.
2. Complete the report form, above

You will need to provide:

• Status of the incident
• A point of contact for the entity experiencing the incident
• Where the incident occurred and time it was discovered.
• Additional information about how the incident was detected, if it has been resolved, and who all has been notified.
• The impact of the incident, criticality of the incident, and actions that have been taken.
• Finally, if you are needing assistance with containment, mitigation, investigation, or remediation.

Gartner is currently executing Phases 0 to 4 related to this program. This is a culmination effort of discovery that will span approximately nine months. The Gartner team is responsible for documenting the current state across Kansas, especially as it relates to the technology environments, and providing an accurate assessment report to OITS and other leadership on integration feasibility and the recommended approach.

Additional information related to Gartner and the phase timelines can be found in the Gartner Services – Kansas IT Integration Assessment Kick-Off Presentation.

No, if the incident is on KCJIS equipment you will follow the same reporting process that you have always had, and the Kansas Bureau of Investigation (KBI) will make the necessary notification to the KISO within the prescribed timeframe.

Yes, if the incident involves the election equipment or systems you will report it to the KISO and to the Kansas Secretary of State’s Office within the prescribed time frames.

Yes, the reported incident will only be shared internally to those needing to assist in handling of the incident and the incident is protected from the open records act. The only reporting on state incidents that will be done is anonymized in aggregate reporting.

Yes, this is State Law, insurance policies cannot violate state law. If your policy includes language to this effect, please contact your insurance company and make sure they are aware of the State Law and if necessary, amend the language in your policy.

• Any public entity shall report within 12 hours after the discovery of the incident.
• Any government contractor that has a significant cybersecurity incident must report within:
  • 72 hrs. after the government contractor reasonably believes a significant cybersecurity incident has occurred; or
  • 12 hrs. if a determination is made during the investigation that such information, network or systems operated by or on behalf of the State were directly impacted.

A cybersecurity incident that results in or is likely to result in financial loss or demonstrable harm to public confidence or public health and safety in the State of Kansas. Any event or combination that threatens, without lawful authority the confidentiality, integrity or availability of information or information systems and that requires an entity to initiate a response or recovery. Examples include but are not limited to malware, ransomware, denial of service, man in the middle and other such attacks by bad actors.

What to report:

• Denial of service attack that lasted over an hour
• Discovery of ransomware note
• Multiple anti-virus or endpoint detection and response alerts resulting in a need to contain or shutdown systems

Things not to report:

• Individual phishing message
• Single anti-virus alerts

The OITS IT Assessment is a response to Senate Bill 291 which, among other things, instructs OITS to investigate and perform a technical consolidation of certain information technology services, especially cyber security controls/responsibilities, under the Executive Chief Information Technology Officer. This initiative is anticipated to impact the majority of state agencies and their technological ecosystems.

For more context, please see:

• The official bill summary
• The full text of the bill

• Any public entity that experiences a significant cybersecurity incident.
• Any government contractor that has a significant cybersecurity incident.

The Kansas Information Security Office has been designated by the Kansas Legislature as the point of contact for reporting and/or coordination of assistance for any incidents that could potentially threaten state systems. The KISO is also committed to assisting public entities and providing resources to assist with handling the incident.