House panel pauses cybersecurity fund after questions about continuous appropriation and fiscal note

Representative Wendy Horman introduced House Bill 168, saying the bill would create a Cybersecurity and Resiliency Fund to pay future IT expenses and help protect state infrastructure and citizen data.

"We have consolidated a lot of IT functionality at the Office of Information Technology Services," Representative Wendy Horman said. "We would like to create this fund and then draw from it in future years for IT expenses."

Nut graf: The bill seeks recurring resources for replacement of critical hardware and related software—firewalls, routers, switches, wireless access points, servers, endpoint devices and selected software—managed by ITS and overseen through existing governance. Members pressed staff on how a continuously appropriated fund would interact with agency budgets, whether the Legislature would retain annual oversight, and why the request was set at $10 million.

Alberto Gonzales, Director of ITS, described the threat environment and the items the fund would cover. "The intent of the fund is really to make sure ... we are addressing critical hardware replacement and all of the associated software that is needed to protect that equipment and our network and our citizen data," Gonzales said. He told the committee ITS had recorded large volumes of attempted network attacks in recent months and that legacy hardware and unpatched devices had created serious vulnerabilities.

Budget staff and ITS officials said the $10 million figure is a planning level to cover critical needs not requested by agencies this year and to begin lifecycle planning. "If we really did the 5-year annual replacement cycle, the cost of this fund would be double what we're asking for," Director Gonzales said. ITS staff told members a typical hardware lifecycle is about five years, and in practice some equipment has functioned longer when patched.

Committee members repeatedly asked how the Legislature would see and approve projects paid from the fund. Lori Wolfe (budget staff) said the process is intended to mirror the Permanent Building Fund: the fund would be continuously appropriated, ITS would prepare an annual prioritized list of projects that goes to the Idaho Technology Authority and would be presented to JFAC and this committee for visibility. Wolfe said the intention is to provide transparency and an annual prioritization report.

Representative Petzke and others said they were uncomfortable with continuous appropriation language because it can reduce the Legislature's year-by-year appropriation control. Petzke said she would support cybersecurity funding without continuous-appropriation authority but would not support the bill as written. Representative Petzke said, "that line of continuous appropriation is just throwing me for a loop on this one... it makes me nervous."

Members also flagged a fiscal-note drafting issue: Representative Horman acknowledged the fiscal note was written as a one-time transfer and said she would correct it to reflect the sponsor's intent that the amount be built into the base. "That's my fault ... I originally thought this was a one-time transfer," Horman said.

After extended questioning from committee members about scope, amounts and oversight, Representative Tanner moved the bill to the floor with a due-pass recommendation. Representative Manwaring offered an amended motion to hold the bill in committee for one week (to March 5) to allow staff to provide additional numbers and clarifications; that motion carried.

Ending: The committee voted to hold House Bill 168 for one week for additional information on inventory, prior agency requests, and the fiscal note mechanics. ITS and budget staff told members they will provide a prioritized inventory, a gap analysis between ITS recommendations and agency requests, and a clarified fiscal note describing whether the funding will be built into the base or handled as an annual cash transfer.