State IT office asks for cybersecurity fund and staffing as agencies consolidate onto central platform

Christopher LaHosa, a budget and policy analyst with the Legislative Services Office, briefed the committee on the Office of Information Technology Services (ITS), summarizing recent consolidation phases and the agency’s budget request. ITS is the state’s centralized IT management agency and has absorbed IT staff from numerous executive branch agencies as part of a multi‑year consolidation program.

Why it matters: The consolidation shifts personnel and operating costs into ITS and creates large ongoing demands for infrastructure, enterprise licensing, cyber security, and hardware replacement. LaHosa told the committee that cash projections show the agency’s primary fund will be exhausted by the end of the current fiscal year without additional resources.

Administrator Alberto Gonzales said the governor’s recommendation includes the creation of a new cybersecurity and IT resilience fund and a proposed $10 million general‑fund cash transfer into the new fund. Gonzales explained the intent: to centralize replacement of legacy hardware and improve statewide defenses against cyber intrusions that target agencies’ aging devices. “The intent of what we're trying to do with the cyber security and resilience fund is to ensure that…a lot of this hardware on our network and in our environments that's indefensible…isn’t putting us at great risk,” Gonzales said.

Gonzales and ITS staff described the security environment and the operational rationale for a central fund: ITS reported millions of automated attacks against infrastructure and endpoints in the prior year and told the committee their security team handled thousands of incidents, some requiring multi‑team responses. Gonzales provided incident figures during questioning: “Our firewall had over 6,000,000 attacks…our individual users were attacked over 14,000,000 times…our endpoints…we had over 20,000 attacks,” he said, and added the security team “has fought back 15,000 incidents, of which 900 are very serious.”

Modernization and consolidation costs. The ITS request and the governor’s recommendation differ in some structural details, but both envision continued onboarding of agency IT staff (phase 5 would include 22 positions in ITS) and additional one‑time and ongoing costs for modernization, ServiceNow ticketing, vehicle leases, office moves, and hardware replacement. LaHosa explained the governor’s package shifts some items into a centrally managed fund and recommends that the Idaho Technology Authority and ITS advise the legislature annually on priorities and transfers to the fund.

Onboarding major agencies. Committee members asked how ITS prepares to onboard large agencies such as the Department of Health and Welfare, and Gonzales said the agency assigns staff — sometimes more than a year in advance — to work with those agencies and build a playbook for migration. He said the goal is to meet or exceed each agency’s prior service level on day one of consolidation.

Enterprise purchasing and oversight. Members asked how ITS will leverage enterprise agreements for software and services. Gonzales said ITS is pursuing enterprise contracts (for example, Duo, ServiceNow, Microsoft, Cisco) to gain purchasing leverage and reduce duplicated procurements across agencies.

What’s next: The committee will consider the proposed $10 million transfer and the structural approach to a cybersecurity and IT resilience fund. Members asked ITS to provide further details on what the proposed fund would buy first and how ongoing transfers would be requested and justified in subsequent budgets.