State IT office seeks $10 million cyber-resilience fund, plans expansion ahead of agency consolidations

The Joint Finance-Appropriations Committee heard a detailed presentation of the Office of Information Technology Services (ITS) budget request that included a governor-backed plan to create a new cybersecurity and IT resilience fund and continued efforts to consolidate and modernize state IT operations.

The proposal matters because ITS consolidations and cybersecurity investments affect multiple executive-branch agencies’ ability to deliver services and protect sensitive citizen data across the state.

Christopher LaHosa, a Legislative Services Office analyst, summarized ITS’s recent history and said consolidation has shifted dozens of IT positions from separate agencies into ITS. He told the committee the agency’s primary administration and accounting fund is on pace to be exhausted without new funding and that the governor recommended structural changes and a $10 million one-time cash transfer to a new fund with continuous appropriation authority.

Alberto Gonzales, ITS administrator, described cybersecurity risks and explained how the fund would be used to replace legacy hardware, shore up enterprise security, and invest in emergency connectivity and infrastructure that ITS can centrally manage. “The intent of what we're trying to do with the cyber security and resilience fund is to ensure that … agencies are not making choices that leave legacy hardware on our network that are indefensible,” Gonzales said, describing frequent attack activity ITS has blocked.

Gonzales and staff cited recent attack volumes to illustrate risk: last fiscal year the statewide firewall saw millions of attacks and ITS security staff handled thousands of incidents, of which several hundred required escalated response. He said aging devices and legacy applications are common statewide and that centrally funded replacement would reduce the security burden on individual agencies.

The governor’s plan would create the fund, transfer $10 million from the general fund into that new fund this year, and allow ITS with Idaho Technology Authority guidance to request future transfers during the regular budget process. ITS provided detailed vendor quotes and procurement plans in its budget materials, and analysts said some components would be purchased as one-time investments while others would fund ongoing resilience programs.

Other ITS requests included funding for office moves and furnishings tied to consolidations, replacement of service vehicles used for on-site technical work, a ServiceNow implementation for ticketing and service management, and Phase 5 of IT modernization that would add about 22 FTEs associated with onboarding Idaho State Police and Juvenile Corrections IT staff. The governor’s recommended numbers reflected negotiated adjustments after agency-level discussions.

Committee members asked how the fund would be structured (one-time versus ongoing transfers) and sought assurance that ITS can provide operational continuity when larger agencies, such as Department of Health and Welfare, are scheduled for future consolidation. Gonzales said the Health and Welfare consolidation has been planned well in advance and that ITS has used playbooks and long lead assignments to prepare staff and systems for large onboardings.

The committee did not take formal votes; members asked ITS to provide additional documentation and vendor detail as part of the budget review. The larger policy choices — whether to authorize the new fund, how much to transfer and whether recurring funding will be needed — will be considered as JFAC finalizes fiscal-year appropriations.