ITS requests new cybersecurity fund, warns of legacy hardware risks as agency absorbs more state IT staff

The state Office of Information Technology Services (ITS) told the Joint Finance‑Appropriations Committee that it is requesting a new cybersecurity and IT‑resilience fund with an initial $10 million general‑fund transfer and continuous appropriation authority to pay for enterprise security improvements, emergency connectivity, infrastructure investments and hardware replacement.

Christopher Lahoset, a Legislative Services budget analyst, walked the committee through ITS’s recent growth and consolidation plan, noting the agency has absorbed IT staff and budget authority from many executive branch agencies over the past several years. He said ITS projects the administration and accounting services fund will be exhausted without additional action and summarized the governor’s recommendation, which includes the $10 million cash transfer and creation of the new fund to centralize purchases.

Alberto Gonzales, ITS administrator, said the fund is intended to reduce agency‑level hardship that delays necessary hardware replacements and creates security vulnerabilities. “For us … we have three major threats,” Gonzales said, listing human error (users clicking malicious links), legacy hardware and legacy applications as the principal risks. He described the scale of attempted intrusions and incidents: “Our firewall had over 6,000,000 attacks… our users were attacked over 14,000,000 times… endpoints … had over 20,000 attacks,” and ITS has responded to thousands of incidents in recent months.

Gonzales told the committee that bringing hardware replacement and enterprise security to the ITS level helps the state apply consistent standards and avoid situations where an individual agency delays a critical update because of budget timing. He said ITS expects to manage the hardware and infrastructure placed on the statewide network and that the proposed fund would allow ITS to prioritize and coordinate purchases across agencies.

Lahoset described other parts of the governor’s package: one‑time and ongoing funding for office moves and furnishings tied to consolidation, $132,000 for 11 service vehicle leases used for on‑site support, $24,900 for a ServiceNow IT ticketing tool, and funding for phase‑5 IT modernization including 22 positions tied to onboarding the Idaho State Police and Juvenile Corrections IT staff. The governor’s recommendation differed from the agency’s original request in some position counts after negotiations with transferring agencies, the analyst said.

Committee members praised ITS’s recent progress in shoring up security posture and asked about the proposed fund’s duration. Gonzales and committee co‑chairs confirmed the committee would consider whether the transfer and fund should be one‑time or ongoing; Lahoset said the proposal is structured to allow annual transfers and legislative oversight tied to ITA (Idaho Technology Authority) and JFAC review.

ITS officials said they have created onboarding playbooks and are staging advance work with large agencies such as Health and Welfare to make future consolidations smoother. The hearing included no formal votes; ITS and the Legislative Services Office will provide detail on vendor quotes and the planned purchases in the budget request materials.