Amends existing law to revise provisions regarding the powers and duties of the Office of Information Technology Services.

LEGISLATURE OF THE STATE OF IDAHO Sixty-eighth Legislature Second Regular Session - 2026 IN THE HOUSE OF REPRESENTATIVES HOUSE BILL NO. 597 BY STATE AFFAIRS COMMITTEE AN ACT1 RELATING TO INFORMATION TECHNOLOGY; AMENDING SECTION 67-827A, IDAHO CODE,2 TO REVISE PROVISIONS REGARDING THE OFFICE OF INFORMATION TECHNOLOGY3 SERVICES AND TO MAKE TECHNICAL CORRECTIONS; AND DECLARING AN EMERGENCY4 AND PROVIDING AN EFFECTIVE DATE.5

Be It Enacted by the Legislature of the State of Idaho:6

SECTION 1. That Section 67-827A, Idaho Code, be, and the same is hereby7 amended to read as follows:8 67-827A. POWERS AND DUTIES. The office of information technology ser-9 vices is hereby authorized and directed:10 (1)(a)(i) To control and approve the acquisition, purchase, and11 installation of all information technology equipment, services,12 software, and data management, and telecommunications equipment13 and facilities for all departments and institutions of state gov-14 ernment, except as provided in subparagraphs (ii), (iii) and (iv)15 of this paragraph;16 (ii) To coordinate the acquisition, purchase, and installation17 of all information technology equipment, services, software, and18 data management, and telecommunications equipment and facilities19 for the institutions of higher education and the elected officers20 in the executive branch;21 (iii) To coordinate the acquisition, purchase, and installation22 of all information technology equipment, services, software, and23 data management, and telecommunications equipment and facilities24 for the legislative and judicial branches;25 (iv) Provided however, that the acquisition, purchase, and in-26 stallation of all public safety and microwave equipment shall be27 under the control of the military division. The military division28 is authorized to charge and receive payment for actual and neces-29 sary expenses incurred in providing services to any unit of state30 government under the provisions of this subparagraph.31 (b) In approving or directing the acquisition, purchase, or installa-32 tion of information technology equipment, services, software, or data33 management, or telecommunications equipment or facilities, the office34 shall first consult with and consider the recommendations and advice35 of the directors or executive heads of the various departments or in-36 stitutions. For each purchase, the office shall conduct a technical37 and financial analysis of the information technology equipment, ser-38 vices, software, or data management, or telecommunications equipment39 or facilities that best meet the needs of departments and institu-40 tions of state government except as provided in paragraph (a)(ii),41 (iii), and (iv) of this subsection. Such analysis may be conducted by42

2 a third-party broker as long as fees are not charged to the office. The1 third-party broker may charge a reasonable commission to the vendors2 engaged by the office. The office, in its discretion, may also uti-3 lize and enter into a memorandum of understanding with the division4 of purchasing in the department of administration for procurements.5 Except when utilizing the division of purchasing for procurements,6 the office's purchase of information technology equipment, services,7 software, and data management, and telecommunications equipment and8 facilities are exempt from the provisions of chapters 52 and 92, title9 67, Idaho Code. Any procurements less than fifteen thousand dollars10 ($15,000) are exempt from the provisions of this section and may be11 purchased directly by the departments and institutions of state gov-12 ernment except as provided in paragraph (a)(ii), (iii), and (iv) of13 this subsection. Any acquisition, purchase, or installation of any14 information technology equipment, services, software, or data manage-15 ment, or telecommunications equipment or facilities that is contrary16 to the office's direction or is not in harmony with the state's overall17 plan for telecommunications and information sharing shall be reported18 in writing to the governor and the legislature.19 (2) To provide a system of information technology and telecommunica-20 tions for all departments and institutions of state government. Funds re-21 ceived pursuant to this subsection shall be appropriated for payment of any22 charges related to information technology equipment, services, software,23 and data management, and any telecommunications and telephone charges in-24 curred by the various agencies and institutions of state government.25 (3) To provide a means whereby political subdivisions of the state may26 use the state telecommunications system, on such terms and under such condi-27 tions as the office of information technology services may establish.28 (4) To accept federal funds granted by congress or by executive order29 for all or any of the purposes of this chapter, as well as gifts and donations30 from individuals and private organizations or foundations.31 (5) To oversee implementation of cybersecurity policies that foster32 risk and cybersecurity management telecommunications and decision-making33 with both internal and external organizational stakeholders.34 (6) To consult with and direct state agencies and officials regarding35 information security needs.36 (7) To direct state agencies and officials on penetration tests and37 vulnerability scans of state technology systems in order to identify steps38 to mitigate identified risks.39 (8) To direct state agencies and officials to ensure that state agen-40 cies implement mandatory education and training of state employees and pro-41 vide guidance on appropriate levels of training for various classifications42 of state employees.43 (9) To direct appropriate state agencies to create, coordinate, pub-44 lish, routinely update and market a statewide cybersecurity website as an45 information repository for intelligence-sharing and cybersecurity best46 practices.47 (10) To ensure that all state agencies implement and maintain cyberse-48 curity best practices.49

3 (11) To require all state agencies to implement and use multifactor1 identification to access information technology devices or services, in-2 cluding but not limited to local and remote network access to any email3 accounts, cloud storage accounts, web applications, networks, databases, or4 servers.5 (12) To coordinate public and private entities to develop, create and6 promote statewide public outreach efforts to protect personal information7 and sensitive data from cyber threats.8 (11) (13)(a) To obtain a criminal history check on prospective employ-9 ees and contractors with the Idaho office of information technology10 services who provide information technology (IT) services to external11 state agency customers and who work in one (1) or more of the following12 disciplines:13 (i) IT network engineering;14 (ii) IT operations and support;15 (iii) IT software engineering;16 (iv) Geographic information systems;17 (v) IT information management;18 (vi) IT database administration;19 (vii) IT systems and infrastructure engineering;20 (viii) IT information security engineering;21 (ix) IT architecture;22 (x) IT management;23 (xi) Remote sensing analysis; and24 (xii) Data science.25 (b) The criminal history check done pursuant to paragraph (a) of this26 subsection shall be based on a completed ten (10) finger fingerprint27 card or scan and shall include, at a minimum, information from the Idaho28 bureau of criminal identification database and the federal bureau of29 investigation's criminal history database.30 (c) For the purposes of this section, "information technology" shall31 have the same meaning as provided for in section 67-831, Idaho Code.32 (12)(13) (14) To promulgate and adopt reasonable rules, subject to leg-33 islative approval, for effecting the purposes of this act pursuant to the34 provisions of chapter 52, title 67, Idaho Code.35

SECTION 2. An emergency existing therefor, which emergency is hereby36 declared to exist, this act shall be in full force and effect on and after37 July 1, 2026.38