State IT office seeks $10 million cybersecurity and resilience fund, warns of legacy hardware risks

The Office of Information Technology Services (ITS) asked the Joint Finance-Preparation Committee to authorize a new cybersecurity and IT resilience fund and an initial $10 million cash transfer to shore up enterprise security, replace legacy hardware and support consolidation of agency IT staff.

Christopher LaHosa, budget and policy analyst with the Legislative Services Office, summarized the agency’s multi-year consolidation of IT staff across executive-branch agencies and then Alberto Gonzales, ITS administrator, described the cybersecurity rationale behind the request.

Why it matters: ITS is centralizing IT operations and security for most state agencies. ITS officials argued that legacy hardware and fragmented purchasing create systemic security risks and that centralized funding will allow state-level prioritization and bulk purchasing to reduce vulnerabilities.

Gonzales outlined three core threats and cited recent incident counts during committee questioning: “our firewall had over a 6,000,000 attacks. Our users ... were attacked over 14,000,000 times. Our endpoints ... we had over 20,000 attacks,” he said, adding the ITS security team has “fought back 15,000 incidents, of which 900 are very serious.” The administrator told lawmakers the fund would let ITS manage and replace hardware across agencies rather than leaving replacement decisions to individual agencies’ budgets.

The governor’s recommendation included creation of the new cybersecurity and IT resilience fund, a $10 million general‑fund cash transfer into the fund for the current year and continuous appropriation authority for ITS to draw on the fund for enterprise security measures, emergency connectivity services, infrastructure investments and hardware replacement beyond agency budgets.

Other ITS requests and details presented to the committee included office-move and furnishing costs tied to Chinden Campus space, procurement of 11 service vehicle leases for on-site technical work, a ServiceNow ticketing implementation for IT case management and a Phase 5 IT modernization request adding staff to onboard Idaho State Police and the Department of Juvenile Corrections. LaHosa noted the governor’s recommended technical adjustments reflecting negotiations between ITS and Idaho State Police over where roles will sit.

Committee members pressed ITS about whether the proposed $10 million is a one-time transfer or an ongoing program. Gonzales said the state will need sustained capacity and oversight: the plan contemplates annual recommendations from ITS and the Idaho Technology Authority with legislative authorization for future transfers. Senator Cook and Co-chair Harmon praised progress made since earlier consolidation phases and asked about readiness for upcoming consolidations, including Health and Welfare in a later phase; Gonzales said ITS is using a playbook and assigned staff in advance for large consolidations.

LaHosa pointed the committee to vendor quotes and procurement documents included in the budget request packet. ITS staff present at the hearing included Deputy Administrator Jason Pierce, Chief Information Security Officer Jared Edgar and Finance Manager Phil Varrick.

Where it stands: The governor’s budget package includes the new fund and a $10 million initial transfer; the committee requested clarifying fiscal notes and expects ITS to return with implementation details and oversight proposals.