State IT agency seeks $10 million cybersecurity/resilience fund and continues consolidation of agency IT

The Office of Information Technology Services (ITS) presented its fiscal plan to the Joint Finance-Appropriations Committee, outlining ongoing agency consolidations, a proposed $10 million cybersecurity and IT resilience fund, and requested staffing and one-time expenditures to support phase-5 onboarding of executive-branch agencies.

Christopher LaHozet, budget analyst (Legislative Services Office), and ITS Administrator Alberto Gonzales described the agency’s multi-year consolidation, which has moved IT staff from multiple executive agencies into ITS and will continue with the Idaho State Police, Department of Juvenile Corrections and, later, the Department of Health and Welfare.

ITS requested a governor-recommended cash transfer of $10 million from the general fund into a new continuously appropriated cybersecurity and IT resilience fund. ITS said the fund would be used for enterprise security improvements, emergency connectivity, infrastructure investments and hardware replacements that individual agencies may lack budget authority to finance. Administrator Gonzales told the committee the intent is to centralize replacement and security purchases that reduce statewide cyber risk and to prevent agencies from deferring critical hardware refreshes that leave the enterprise vulnerable.

Gonzales said current defenses confront large volumes of malicious activity: he reported roughly 6 million firewall attacks, 14 million user-targeted attacks and more than 20,000 endpoint attacks over the prior year. ITS said its security team handled some 15,000 security incidents in the same period, 900 of which required escalated team responses.

The ITS budget request also included:

- Phase 5 IT modernization funding to onboard additional agency staff and convert personnel costs at consolidated agencies into ITS operating budgets; that phase includes about 22 new ITS positions tied to onboarding needs (governor’s recommendation adjusted those counts after negotiation with agencies).

- One-time and ongoing funding for office moves, vehicle leases to replace loaned fleet vehicles used for on-site support, a ServiceNow ticketing and workflow system, and other operating needs.

LaHozet told the committee the administration and accounting services fund has been sufficient during the transition but projected to be exhausted without additional resources; the cybersecurity fund proposal was the governor’s chosen solution. ITS said the requested centralized funding would allow the state to replace legacy hardware and invest in enterprise security rather than leaving those decisions to individual agencies.

Committee members asked whether the $10 million transfer was one-time or intended to seed an ongoing fund. LaHozet and Gonzales said the plan is to authorize the fund with an initial cash transfer and to return annually with recommended transfers and spending to address evolving priorities; whether transfers continue will be determined in future budget cycles.

Ending

The committee requested additional detail on the governor’s recommended fund structure, the split between one-time and ongoing components, and the specific purchases planned from the cybersecurity fund. ITS and legislative staff said they would provide documented vendor quotes and a prioritized list of purchases for committee review.