State IT agency seeks $10 million cybersecurity fund and funding to complete agency consolidations

The Joint Finance‑Appropriations Committee reviewed a request from the Office of Information Technology Services (ITS) that includes a proposed $10 million transfer to a newly created cybersecurity and IT resilience fund, additional staff for a consolidation phase and short‑term one‑time spending to cover office moves and equipment.

Christopher LaHozet, budget analyst, Legislative Services Office, summarized ITS's history of consolidation beginning with House Bill 607 (2018) and said that ITS now supports a growing portfolio of executive‑branch IT services. LaHozet warned the committee that the ITS administration and accounting services fund is projected to be fully exhausted at the end of the current and next fiscal years under present plans.

Alberto Gonzales, ITS Administrator, told the committee that the proposed cybersecurity and resilience fund would let ITS centrally manage replacement of aging, insecure hardware and address statewide enterprise security needs without forcing individual agencies to defer critical upgrades. “Number 1 is the humans by far the biggest threat we have,” Gonzales said in describing threats to state systems. He also gave incident counts to illustrate risk: “our firewall had over a 6,000,000 attacks … our endpoints … we had over 20,000 attacks … our security team has fought back 15,000 incidents, of which 900 are very serious,” Gonzales said.

Governor's recommendation and fund mechanics

The governor recommended creation of the cybersecurity and IT resilience fund with a one‑time $10,000,000 cash transfer from the general fund and continuous appropriation authority for ITS. The budget office said the proposed fund would be used for enterprise security improvements, emergency connectivity network services, infrastructure investments, and replacement hardware not covered in individual agency budgets.

Phase 5 consolidation and other requests

ITS requested funding for phase 5 of its IT modernization plan, which would add about 22 FTE tied to the consolidation of Idaho State Police and Juvenile Corrections IT staff. The governor’s recommended numbers reflect negotiated adjustments between ITS and those agencies. ITS also requested one‑time and ongoing funding to cover moving costs to new office space on the Chinden campus, 11 service vehicle leases to support on‑site technical services, and a ServiceNow ticketing/project tool to manage requests and performance metrics.

Why it matters: ITS said the centralized funding model would reduce the chance that individual agencies defer essential security updates, leaving the statewide environment vulnerable. The governor's proposed $10 million transfer would create a dedicated resource ITS can draw from for enterprise‑level purchases and emergency responses, subject to annual review and additional transfers in future budgets.

Follow‑up and implementation notes

LaHozet and Gonzales provided committee members with supporting documents and vendor quotes in the ITS budget submission and said ITS and the Idaho Technology Authority would advise the legislature annually on the state's IT needs. Legislators asked about whether the $10 million was intended as one‑time or ongoing seed funding; committee members and ITS discussed the plan as a start‑up transfer with the potential for future transfers to be authorized through the budget process.

ITS staff present included Jason Pierce (Deputy Administrator), Jared Edgar (Chief Information Security Officer) and Phil Varrick (Finance Manager). The committee moved to the next agenda item after ITS concluded its presentation.