Legislative committee reviews OTS report on oldest, costliest state IT systems; members press on procurement and modernization costs

The Joint Legislative Committee on Technology and Cybersecurity on Feb. 25 heard a report from the Division of Administration’s Office of Technology Services on the state’s three oldest and three most expensive information technology systems, as directed by House Concurrent Resolution 135 of the 2024 regular session.

The report — presented by Matthew Vince, interim chief information officer for the state and OTS, and Chase Heimel, chief information security officer for OTS — described the methodology used to estimate maintenance (M&O) and replacement costs, and flagged cybersecurity risk levels for several legacy and high-cost applications.

Why it matters: committee members said the state spends large sums each year to keep core systems running, and they pressed OTS to explain how procurement and contracting practices, vendor change orders and continuing enhancements drive long-term costs.

OTS’s methodology and findings

Matthew Vince said OTS derived replacement and maintenance figures from existing contracts and market research, and by comparing experiences in other states. For Medicaid-related systems, Vince said federal policy is pushing “modularity” — breaking monolithic Medicaid Management Information Systems into separate modules — and that cost estimates for individual modules range widely. “We’ve seen anywhere between 20 to $40,000,000 per module, and so we use that as our estimate,” Vince said.

Vince and Heimel told the committee that the state’s systems are hosted in a mix of locations — two in-state data centers in Baton Rouge, public-cloud and private-cloud vendor environments — and that roughly 40–50% of applications are managed outside the state’s core data centers (estimate provided by OTS).

Cybersecurity and risk scoring

Chase Heimel said OTS uses an industry-standard risk matrix informed by the impact and likelihood of an incident when scoring systems. Heimel said some legacy systems scored as high risk because of their central business function or data sensitivity, even when the likelihood of an external attack is reduced by controls. “There is heavily monitoring. A lot of our cybersecurity defense in-depth strategies do cover application, but simply because it’s not visible as an attack surface to an attacker unless they're already inside the network,” Heimel said about certain internal systems.

Case examples discussed

- Centralized bank-reconciliation system used by the Department of Children and Family Services: Committee members noted the system is about 25 years old and handles very large monthly payments. OTS characterized the application as having very high application risk in business terms while describing the cybersecurity exposure as reduced because it is internal-only.

- Integrated eligibility application (serving both DCFS SNAP and LDH Medicaid functions): OTS told the committee the M&O costs for this system are large and include both ‘‘keeping the lights on’’ operations and ongoing enhancements. Committee members quoted a figure of $150,000,000 per year split between two agencies; OTS representatives confirmed the contract includes operations and substantial enhancement work done primarily by external contractors.

- DMV / Office of Motor Vehicles (OMV): OTS said an interim mainframe replacement is planned to keep current systems supported while modernization proceeds; OTS estimated a mainframe-over-five-years cost “probably $10,000,000” to maintain support while the agency evaluates cloud or vendor-hosted alternatives.

Procurement, vendor risk and proposed changes

Lawmakers repeatedly asked whether procurement methods allow a vendor to win with a low initial bid and later increase contract value through change orders. Vince and others said scope uncertainty and complex business rules drive some of those costs; OTS supports moving toward an invitation-to-negotiate model authorized by House Bill 845 to improve flexibility and vendor negotiation. “RFPs are very restrictive… this will be a little bit more open to very creative responses,” Vince said.

Who decides to modernize

OTS officials said modernization is typically driven by agencies based on business needs and funding; OTS contributes risk assessments, technical alignment and procurement assistance. Vince said OTS works with agencies to prioritize projects but that agencies ultimately request and fund many modernizations.

Staffing, scale and standards

Committee members asked why OTS staffing and maintenance costs appear high compared with other states. OTS answered that Louisiana’s IT is 100% consolidated (no agency IT staff remain), that OTS operates statewide networks and 24/7 help desks and runs two data centers, and that many large contracts (especially federally funded Medicaid systems) require specialized vendor teams. OTS reported around 800 staff and roughly 1,200 applications under statewide oversight. Heimel said OTS’s information security policy is based on NIST SP 800-53 and that vendors are contractually required to meet either the full policy or an agreed subset.

Discussion versus formal decisions

Committee members asked for clearer, system-by-system modernizations and for more transparent cost breakdowns. OTS answered that small systems are often rolled into larger modernization projects and that enhancements (new features required as laws and business rules change) drive ongoing M&O costs.

What’s next

Lawmakers asked OTS to provide more detailed, item-level data on hosting locations, exact counts of cloud vs. state-hosted applications, and historical budget growth for OTS. OTS agreed to follow up with more precise figures and to continue working with the legislature on procurement and funding approaches.

Ending

Committee members framed the report as a starting point for further oversight and for statutory or rule changes to procurement and budgeting for major IT programs.