State IT leaders ask lawmakers for $10 million cybersecurity fund and staffing to finish consolidation

The Joint Finance-Appropriations Committee on Oct. 24 reviewed a multi‑year consolidation plan and a governor’s recommendation that would seed a new cybersecurity and IT resilience fund with a $10 million transfer and give the Office of Information Technology Services (ITS) continuous appropriation authority to spend from the fund.

Christopher LaHosa, a budget and policy analyst with the Legislative Services Office, described the multi‑year consolidation that began after House Bill 607 (2018) and noted ITS has absorbed IT staff from multiple executive agencies. “The first agencies that were brought into ITS were ones that the Department of Administration was already supporting,” he said, summarizing the consolidation timeline and the agency’s growth in personnel and operating costs.

Administrator Alberto Gonzales told the committee the fund would allow ITS to make enterprise investments in security, emergency connectivity and hardware replacement without forcing individual agencies to decide whether to replace insecure legacy equipment. “Number 1 is the humans by far the biggest threat we have,” Gonzales said; he also gave the committee attack metrics to justify the investment: “Our firewall had over a 6,000,000 attacks. Our users … were attacked over 14,000,000 times. Our endpoints … we had over 20,000 attacks,” he reported, and said ITS handled roughly 15,000 security incidents in the most recent six‑month period, about 900 of which required an escalated team response.

Fund mechanics and uses The governor’s recommendation creates a new fund, transfers $10 million from the general fund into it this year, and would allow ITS to submit annual requests and recommended transfers in future budgets. LaHosa described four intended purchases in the current proposal: enterprise security improvements, emergency connectivity network services, investments in IT infrastructure and additional hardware replacement beyond agency requests.

Phase‑5 consolidation and staffing The department’s FY26 enhancement package includes funding for phase‑5 of ITS’s modernization plan, about 22 new full‑time positions tied to bringing the Idaho State Police and Department of Juvenile Corrections onto ITS systems. LaHosa noted differences between the agency’s request and the governor’s recommendation stemmed from negotiated decisions about which staff would remain with certain agencies versus move to ITS.

Other enhancement items explained to the committee included relocation and office setup costs for Chinden campus moves, vehicle leases to replace loaner vehicles used during consolidation, ServiceNow ticketing software funding for workflow and reporting, and a modest supplemental request to cover immediate office equipment purchases for newly onboarded staff.

Why it matters: cross‑agency services and security Committee members asked how ITS plans to ensure services meet agency needs after consolidation, what enterprise procurement would look like, and how ITS would maintain continuity when bringing on large agencies such as Health and Welfare. Gonzales said ITS now uses a playbook and begins agency onboarding up to 18 months in advance for large transfers to minimize disruption. He emphasized the enterprise model can centralize device replacement and security patching so agencies will not defer critical updates for budgetary reasons.

Oversight and follow‑up Members asked whether the proposed $10 million would be one‑time or ongoing; LaHosa said the governor’s package included a one‑time transfer this year but envisioned annual recommendations to sustain the fund. ITS and the governor’s office will provide detailed procurement quotes, contract documents, and a plan to report back to the committee on how the initial funds are spent.

The hearing covered significant cybersecurity detail in open session and included requests from committee members for procurement schedules, staffing lists for phase‑5 positions, and clearer fiscal notes tied to ongoing support costs.