How Colorado's CISO is revamping the state's information security -- on a $6,000 budget