ITS seeks $10 million cybersecurity fund, describes consolidation and rising attack activity

The Joint Finance Preparation Committee heard the Office of Information Technology Services (ITS) outline a multi-year consolidation plan and a proposed cybersecurity and IT resilience fund with a $10 million general-fund transfer recommended by the governor.

Christopher LaHosa, budget and policy analyst for Legislative Services, reviewed ITS’s recent consolidation history and explained the governor’s recommendation for a $10,000,000 one-time cash transfer to create a continuous-appropriation cybersecurity and IT resilience fund to be managed by ITS. LaHosa said that the fund would be used for enterprise security improvements, emergency connectivity network services, infrastructure investments and hardware replacement items that agencies otherwise might delay because of constrained replenishment cycles.

Administrator Alberto Gonzales of ITS described the practical cybersecurity risks driving the request and the agency’s operational plan. Gonzales said legacy hardware and applications across agencies create “indefensible” attack surfaces and argued a centralized fund and replacement plan would allow ITS to standardize and secure devices placed on the statewide network. He described three broad threats: user behavior (phishing/clicking), legacy hardware and legacy applications.

Why this matters: ITS argued that disparate agency purchases of hardware and staggered replacement cycles leave the state vulnerable and complicate response. A centralized fund allows ITS to prioritize and execute enterprise-wide upgrades and to reduce individual agencies’ ad hoc buying decisions.

What the committee heard

- The governor’s recommendation: creation of a cybersecurity and IT resilience fund and an accompanying $10,000,000 cash transfer from the general fund with continuous appropriation authority for ITS; Legislative Services noted the program would include annual decisions and potential future transfers as part of the budget process.

- Consolidation timeline and staffing: ITS has been consolidating IT personnel from agencies since House Bill 607 (2018). Phase 5 of ITS’s modernization includes 22 new full-time positions and ongoing costs to support onboarding of additional agencies (Idaho State Police, Department of Juvenile Corrections, and, in a later phase, Department of Health and Welfare).

- Attack and incident data shared with the committee: Alberto Gonzales reported high volumes of malicious activity in the prior year: "our firewall had over 6,000,000 attacks... our users were attacked over 14,000,000 times... our endpoints... had over 20,000 attacks," and that ITS responded to roughly 15,000 security incidents with about 900 judged serious enough to require larger team responses.

- Other requests and governor adjustments: ITS requested various space, vehicle and software items (including ServiceNow for IT ticketing), an $81,700 supplemental for current-year office equipment tied to onboarding staff, and phase-5 funding for consolidation. LaHosa and Gonzalez said the governor’s recommendation modified some agency requests after negotiation with impacted agencies.

Selected direct quotes

- Alberto Gonzales, ITS Administrator: "The intent of what we're trying to do with the cyber security and resilience fund is to ensure that... we're not putting agencies in a position where they're making choices because of the swing in their cost recovery... a lot of this hardware... is indefensible."

- Christopher LaHosa, Legislative Services Office: "The governor recommends the creation of a new cybersecurity and IT resilience fund. An accompanying cash transfer of $10,000,000 from the general fund to the new fund. And continuous appropriation authority for ITS on the fund."

Committee discussion and concerns

Members expressed support for improved protections and asked whether the transfer and fund authority would be ongoing. ITS said the proposal starts with a one-time transfer this year and would anticipate future annual decisions through the budget process; some members signaled they understood the security sensitivity and welcomed ongoing oversight. Several members praised ITS for improvements since early consolidation phases and asked about plans and readiness for onboarding Health and Welfare and other large agencies.

Ending

ITS said it will provide additional materials and vendor quotes already included in budget submissions; the committee did not vote at the hearing but acknowledged the cybersecurity fund as a major decision point for the legislature.