Idaho ITS seeks $10 million cybersecurity and resilience fund, plans ongoing IT consolidation

The Office of Information Technology Services (ITS) told the Joint Finance Preparation Committee on March 12, 2025, that Idaho needs a dedicated cybersecurity and resilience fund and that the agency’s multi‑year IT consolidation work will continue into the 2026 budget cycle.

Budget analyst Christopher LaHosa summarized ITS’s recent growth, noting ITS has absorbed many agency IT staffs since 2019 and that full‑time position counts have climbed accordingly. The agency’s administration and accounting services fund is forecast to be exhausted by the end of this fiscal year without additional action, LaHosa said.

ITS administrator Alberto Gonzales described a multi‑step proposal the governor recommends: create a new cybersecurity and IT resilience fund, authorize a $10,000,000 cash transfer from the general fund into the new fund this year, and give ITS continuous appropriation authority to spend the fund on enterprise security, emergency connectivity, infrastructure investments and hardware replacements. LaHosa emphasized the recommendation follows negotiations and restructuring of some consolidation costs between ITS and other agencies.

Why it matters: ITS argued many state systems run on legacy hardware and applications that are difficult to defend and that consolidation without a centralized funding mechanism can leave agencies underprotected or force uneven prioritization of replacements across agencies.

What ITS proposed

- New cybersecurity and resilience fund: The governor recommends a one‑time $10 million transfer into a new fund with continuous appropriation authority to ITS, to buy enterprise security improvements, emergency connectivity, infrastructure upgrades and hardware replacement that agencies could not otherwise timely afford.

- Continued consolidation and staffing: ITS detailed prior consolidations (House Bill 607 established ITS in 2018 and consolidation began in 2019) and requested resources for the next phase, which includes onboarding Idaho State Police and Department of Juvenile Corrections staff; proposed phase‑5 funding would include roughly 22 new ITS positions tied to that consolidation (the governor’s recommendation adjusted the final position mix after agency negotiations).

- ServiceNow, vehicles and office moves: ITS requested a ServiceNow enterprise ticketing instance to improve help‑desk tracking, 11 service vehicle leases to replace donated/loaned vehicles used for on‑site support and funding to move staff into state buildings; some items are one‑time and some ongoing.

Administrator Gonzales described the security risk in blunt terms: legacy hardware and applications, along with user‑behavior risks, leave state systems vulnerable. He gave recent incident counts to illustrate scale: “our firewall had over a 6,000,000 attacks,” he said, and reported endpoints and user accounts were the target of millions of attacks last year; ITS security staff handled roughly 15,000 incidents in the last six months of the fiscal year with about 900 requiring a larger team response.

Lawmakers’ questions and operational details

Committee members asked whether the $10 million fund was intended as one‑time or ongoing seed funding; LaHosa explained the recommendation included an initial transfer this year with a process for ITS and the Idaho Technology Authority (ITA) to advise future annual transfers as part of budget negotiations. Senators and co‑chairs praised the agency for recent improvements and asked about onboarding the Department of Health and Welfare (planned for a later phase). Gonzales said Health and Welfare consolidation is slated for FY2027 and that ITS has assigned staff to work with the agency well in advance.

Gonzales and ITS deputies also stressed moves toward enterprise contracting (Microsoft, Cisco, VMware, Duo, ServiceNow), better vendor leverage, and centralized replacement schedules to reduce the security exposure that occurs when individual agencies defer replacements.

Ending

Analysts said ITS’s administration and accounting fund is forecast to run short without action and the governor’s package offers a structural solution through the cybersecurity and resilience fund plus continued consolidation funding. ITS officials committed to provide additional details and vendor quotes already included in the budget submission; the committee did not cast votes during the hearing.