Idaho ITS seeks $10 million cyber‑resilience fund, plans agency consolidations and phase‑5 hires

The Joint Finance Preparation Committee heard a full briefing from the Office of Information Technology Services on its consolidation of state IT functions and an administration‑recommended plan to create a dedicated cybersecurity and IT resilience fund seeded with a $10 million general‑fund transfer.

Christopher Lahoset, a budget analyst with the Legislative Services Office, outlined ITS’s multi‑year consolidation timeline and the governor’s recommended changes. He said the governor’s recommendation includes creating the new fund and an initial $10 million cash transfer plus continuous appropriation authority for ITS to use the fund for enterprise cyber and infrastructure needs.

Administrator Alberto Gonzales described the cybersecurity rationale to the committee and cited recent security incident volumes. Gonzales told the committee that legacy hardware and legacy applications create the largest exposure and that state agencies sometimes defer replacements for budgetary reasons, leaving “devices out there that don't have the security patches” and increasing risk. He summarized recent attack numbers for the committee: “our firewall had over 6,000,000 attacks… our users… were attacked over 14,000,000 times… our endpoints… we had over 20,000 attacks,” and said the ITS security team addressed roughly 15,000 security incidents in the last year, of which about 900 were high‑severity.

Plan and requested items: The governor’s recommendation restructured several agency requests and kept a set of decision points for the committee. Items described in testimony include: - A proposed cybersecurity and IT resilience fund with a $10,000,000 initial transfer and continuous appropriation; planned purchases include enterprise security improvements, emergency connectivity/network services, infrastructure investments and hardware replacements. ITS said supporting documentation and vendor quotes are included in its budget submission. - Phase 5 IT modernization: testimony described 22 full‑time positions to support consolidation of Idaho State Police and Department of Juvenile Corrections (timing noted for FY2026/FY2027 in testimony). The package listed $36,900 in one‑time funding and $2,730,800 ongoing for modernization phase 5 in the agency request; the governor’s recommendation reflected negotiated staffing allocations with Idaho State Police. - Facilities, vehicles and software: the request included office move costs to consolidate staff on the Chinden campus (roughly $2,077,800 one‑time and $427,800 ongoing in the agency submission), $132,000 for 11 service vehicle leases, and $24,900 for a ServiceNow IT ticketing tool.

Why it matters: Committee members and co‑chairs emphasized state exposure for citizen data and the risk of deferred hardware replacement. Co‑chair Harmon praised ITS’s progress and asked about preparations for onboarding the Department of Health and Welfare; Gonzales said ITS placed a staffer on long‑term detail 18 months in advance to coordinate that large consolidation.

Oversight and enterprise purchasing: ITS said it is pursuing enterprise agreements to capture buying power for software and hardware (examples cited: Duo, Cisco, Microsoft, VMware) and seeks to shift agencies from individually purchasing infrastructure to centralized, ITS‑managed services.

What’s next: The proposed $10 million transfer and cybersecurity fund would require legislative approval. ITS and the governor’s office requested the committee consider the fund creation, and ITS staff indicated they would provide further documentation, vendor quotes and spending plans as part of the budget deliberations. No formal vote or motion appears in the transcript.