State IT agency seeks $10 million cybersecurity fund and new staff as consolidation continues

Christopher LaHozet, a budget and policy analyst with the Legislative Services Office, briefed the committee on the Office of Information Technology Services (ITS), describing a multiyear consolidation of state IT staff and a governor’s recommendation to create a new cybersecurity and IT resilience fund with a $10 million initial cash transfer.

LaHozet said ITS was created by House Bill 607 (2018) and has absorbed IT personnel from multiple agencies over several phases; phase 5 would add the Department of Juvenile Corrections and Idaho State Police, and the Department of Health and Welfare is scheduled to move in a later phase.

Administrator Alberto Gonzales, who joined ITS leadership at the hearing, said the proposed cybersecurity and IT resilience fund is intended to centralize replacement of legacy hardware and enterprise security investments so agencies do not defer critical infrastructure work. “A lot of this hardware on our network … is indefensible,” Gonzales told the committee, saying that central management would reduce systemic risk.

LaHozet outlined the governor’s package that accompanies ITS’s request: office move and furnishings for Chinden campus space (about $2,077,800 one‑time and $427,800 ongoing), $132,000 for 11 service vehicle leases, $24,900 for a ServiceNow ticketing tool, and a phase‑5 modernization request that the analyst quantified as $36,900 one‑time and $2,730,800 ongoing to add about 22 FTE associated with onboarding agencies.

On the cybersecurity fund, LaHozet described a legislative path that would (1) create the fund, (2) transfer $10 million from the general fund into it this year, and (3) authorize ITS to request future transfers annually with JFAC approval. The analyst said the governor’s recommendation included the $10 million one‑time transfer and continuous appropriation authority for ITS to spend the fund on enterprise security improvements, emergency connectivity network services, infrastructure investments, and additional hardware replacements.

Gonzales and his staff described the security rationale in operational terms. ITS chief information security officer Jared Edgar and the administrator provided attack metrics the team used to justify investment: Gonzales said endpoints and firewalls experienced millions of attacks in the last year and that ITS security staff had responded to thousands of security incidents. “Our firewall had over a 6,000,000 attacks,” the administrator said; he and staff described roughly 15,000 incidents investigated in recent months with about 900 classified as serious and requiring broader team response.

Committee members asked about whether the proposed cybersecurity fund is intended as ongoing or one‑time; LaHozet and Gonzales characterized it as a fund intended for continuing, planned transfers with annual legislative consideration for future deposits. Lawmakers also asked about ITS’s experience onboarding agencies; Gonzales said earlier phases were challenging but that the agency has developed a playbook and advance staffing plans to smooth later consolidations, and that Health and Welfare preparation includes a staff assignment more than a year in advance.

ITS staff highlighted procurement and enterprise contracting strategies intended to reduce overall state costs for software and hardware by leveraging enterprise agreements and the statewide cost allocation plan. The agency also described a ServiceNow implementation to improve help‑desk ticketing and performance metrics reporting.

The request was presented as part of the governor’s budget package; the committee did not record a formal appropriation vote during the hearing. Staff and ITS agreed to provide supporting vendor quotes, contract documents and further detail on transition staffing and cost allocations as follow‑up materials for JFAC consideration.