Joint legislative panels review JITalk off‑session work, flag ERP, procurement and confidentiality risks

Members of the House Energy and Digital Infrastructure and Senate Institutions committees heard a summary of off‑session work by the Joint Information Technology Oversight Committee, known in testimony as JITalk, that focused on a series of large‑scale state IT efforts and procedural questions about legislative oversight.

Rick Segal of the Office of Legislative Council opened the briefing by reading JITalk's statutory charge, saying, "JITalk is created and, to, oversee investments in and use of IT in Vermont and to provide periodic advice on legislative IT issues." He and members emphasized that the committee's statutory role is broad but that it has limited formal authority to act without specific direction from the legislature.

Ralph (chair of JITalk) told members the panel met five times during the off session to review priority projects and said the committee focused on procurement, enterprise resource planning, data governance and cybersecurity. On procurement, the committee heard that the state's BT Buys program had operational problems and was "not functioning the way we wanted," and that vendors in some projects had not been paid for extended periods, prompting in‑depth questioning.

The committee also opened a briefing on the enterprise resource planning (ERP) project, which will replace core functions such as budgeting, payroll and expenses. Testimony identified Workday as the product selected and Guidehouse as the implementing vendor and cited implementation challenges in other states as cautionary examples.

Members received a December briefing from the Agency of Digital Services on strategic direction and a presentation from Josiah Raich, the state's chief data and artificial intelligence officer, on data governance and a proposed data‑lake model. The committee also heard a November overview of cybersecurity capabilities from the National Guard and a legal primer on data‑breach obligations.

Several legislators raised procedural concerns about the committee's draft rules, particularly a proposed executive‑session provision. The chair said he had declined to bring the rules to a vote because members had not had time to vet confidentiality protections and because of unease over how sensitive cybersecurity information would be handled. The chair said that, during an October executive session, the committee discussed cybersecurity issues and that members worried about the risk that sensitive material shared in executive session could be disclosed outside the committee.

Committee members debated JITalk's structure and role going forward. Some urged that JITalk be narrowed and tasked to perform a small number of "deep dives" — for example, sustained summer and fall monitoring of defined projects such as ERP and CCWIS — with a requirement to issue a substantive end‑of‑session report and recommendations to policy committees. "We should be looking at specific projects and doing deep dives," one legislator said, urging focused oversight instead of a broad, catch‑all charge.

The chair also noted the scale of state IT spending: reporting from Agency of Digital Services indicated roughly "700, million dollars" in technology‑related expenditures in the most recent filing, a figure committee members cited to underline why continued oversight is needed.

No formal committee recommendations were adopted during the off session; the chair characterized his presentation as a personal report of JITalk's activities and ideas rather than actions taken by the full committee. Members signalled plans to continue discussions on possible statutory changes, improved resourcing (including additional professional support from the Joint Fiscal Office), and a memorandum of understanding between branches on cross‑branch IT communication expected in February.

The hearing closed with members agreeing to consider whether JITalk's statutory charge should be revised to give the panel clearer duties — including required reporting and potentially narrower, project‑based responsibilities — and to follow up in committee sessions on ERP, procurement issues and confidentiality protections.