Idaho proposes $10M cybersecurity and IT‑resilience fund as ITS consolidates agency IT operations

The Joint Finance-Appropriations Committee heard from Legislative Services Office analyst Christopher LaHosa and Office of Information Technology Services Administrator Alberto Gonzales on an ITS budget package that includes a proposed $10 million general‑fund transfer to create a new cybersecurity and IT resilience fund, ongoing authority to spend those monies and personnel and equipment needed to complete the next phase of consolidation.

LaHosa told the committee the governor recommended a new continuous appropriation fund and a one‑time $10 million transfer to support enterprise security improvements, emergency connectivity services and infrastructure replacement items that individual agencies have not been able to budget. “The governor recommends the creation of a new cybersecurity and IT resilience fund,” LaHosa said, outlining a multi‑step plan for the fund and annual transfers tied to legislative authorization.

Administrator Alberto Gonzales described the threat environment and why a centralized fund and replacement plan are necessary. “Number 1 is the humans by far the biggest threat . . . People clicking on things they shouldn't be on,” Gonzales said, and then gave the committee the state’s recent incident counts: he reported the state’s firewall experienced “over 6,000,000 attacks,” users were attacked “over 14,000,000 times,” endpoints saw “over 20,000 attacks,” the security team has responded to about 15,000 incidents and roughly 900 incidents were “very serious and required more of a larger team response.” He said the fund would let ITS purchase and centrally manage hardware and enterprise security tools so agencies are not left running indefensible legacy equipment on the statewide network.

Why it matters: ITS currently recovers costs from other agencies and is absorbing many agency IT staffs under a multi‑year consolidation, creating a single point for enterprise security and bargaining leverage on software/hardware purchases. ITS officials told the committee that without a centralized fund, agencies may defer needed replacements and uneven patching leaves the whole state at risk.

Budget and program details

- Cybersecurity and IT resilience fund: The governor’s package would create a dedicated fund with a $10 million initial cash transfer and continuous appropriation authority for ITS. LaHosa said the funding would be used for enterprise security improvements, emergency network connectivity and additional infrastructure/hardware replacements for agencies that did not secure replacement funding in their own budgets. The package calls for annual legislative review and possible future transfers tied to the ITS plan and Idaho Technology Authority recommendations.

- Phase 5 consolidation and staffing: ITS requested funding for phase 5 of its IT modernization, which includes adding about 22 full‑time positions to support the onboarding of agencies such as the Idaho State Police and the Department of Juvenile Corrections. LaHosa noted the governor’s recommendation adjusted the number and cost in negotiation with individual agencies.

- Tools and operating items: ITS asked for funds to purchase ServiceNow (an enterprise IT ticketing and case management tool) to document requests and produce performance metrics, vehicle leases to replace vehicles previously borrowed from other agencies and continued funding for enterprise contracts and replacements.

Financial position and risk

LaHosa warned the agency’s primary administration and accounting services fund is projected to be exhausted by the end of the current fiscal year without additional transfers or restructuring; the $10 million transfer is intended to address near‑term cybersecurity and resilience needs. Gonzales stressed that legacy hardware and applications across agencies are the principal technical risks and that enterprise replacement is critical to reduce statewide exposure.

Committee reaction and follow‑up

Committee members thanked ITS for recent progress and asked for additional detail on whether the fund is one‑time or ongoing; LaHosa and Gonzales clarified the governor’s package proposed an initial $10 million transfer and the legal mechanism for ongoing funding would be annual legislative authorization and transfers tied to ITS and ITA recommendations. Members also asked about the timeline and preparations for upcoming consolidations, including the Department of Health and Welfare, which ITS staff said they are preparing for well in advance with embedded staff and playbooks to minimize operational disruption.

There were no formal votes at the hearing. ITS and LSO agreed to provide follow‑up documentation on proposed purchases, staffing detail for the phase‑5 positions and the agency’s projected funding needs to complete scheduled consolidations.