Amends existing law to revise provisions regarding the powers and duties of the Office of Information Technology Services.

LEGISLATURE OF THE STATE OF IDAHO Sixty-eighth Legislature Second Regular Session - 2026 IN THE HOUSE OF REPRESENTATIVES HOUSE BILL NO. 888 BY STATE AFFAIRS COMMITTEE AN ACT1 RELATING TO INFORMATION TECHNOLOGY; AMENDING SECTION 67-827A, IDAHO CODE,2 TO REVISE PROVISIONS REGARDING THE OFFICE OF INFORMATION TECHNOLOGY3 SERVICES AND TO MAKE TECHNICAL CORRECTIONS; AND DECLARING AN EMERGENCY4 AND PROVIDING AN EFFECTIVE DATE.5

Be It Enacted by the Legislature of the State of Idaho:6

SECTION 1. That Section 67-827A, Idaho Code, be, and the same is hereby7 amended to read as follows:8 67-827A. POWERS AND DUTIES. (1) The office of information technology9 services is hereby authorized and directed:10 (1)(a)(i) To control and approve the acquisition, purchase, and instal-11 lation of all information technology and telecommunications equipment12 and facilities for all departments and institutions of state gov-13 ernment, except as provided in subparagraphs (ii), (iii) and (iv)14 paragraphs (b), (c), and (d) of this paragraph subsection;15 (ii) (b) To coordinate the acquisition, purchase, and installation of16 all information technology and telecommunications equipment and facil-17 ities for the institutions of higher education and the elected officers18 in the executive branch;19 (iii) (c) To coordinate the acquisition, purchase, and installation of20 all information technology and telecommunications equipment and facil-21 ities for the legislative and judicial branches;22 (iv) (d) Provided however, that the acquisition, purchase, and in-23 stallation of all public safety and microwave equipment shall be under24 the control of the military division. The military division is autho-25 rized to charge and receive payment for actual and necessary expenses26 incurred in providing services to any unit of state government under the27 provisions of this subparagraph.28 (b) (2)(a) In approving or directing the acquisition, purchase, or in-29 stallation of information technology or telecommunications equipment30 or facilities, the office shall first consult with and consider the31 recommendations and advice of the directors or executive heads of the32 various departments or institutions. For each purchase of information33 technology or telecommunications equipment or facilities, the office34 shall conduct a technical and financial analysis that best meets the35 needs of the departments and institutions of state government. The of-36 fice, in its discretion, may use a third-party broker for the technical37 and financial analysis as long as:38 (i) The third-party broker has a fiduciary duty to the office for39 the analysis being performed;40 (ii) The third-party broker is not also a direct vendor of the in-41 formation technology being procured;42

2 (iii) The third-party broker does not accept gifts, gratuities, or1 favors from vendors and is prohibited from unauthorized ex parte2 communications during the analysis;3 (iv) The analysis being conducted is neutral, transparent, and4 documented; and5 (v) Fees are not charged to the office, except that the third-6 party broker may charge a reasonable commission to the vendors en-7 gaged by the office for its services.8 (b) The office, in its discretion, may also use and enter into a9 memorandum of understanding with the division of purchasing in the de-10 partment of administration for procurements. Except when using the11 division of purchasing for procurements, the office's purchase of in-12 formation technology and telecommunications equipment and facilities13 is exempt from the provisions of chapter 92, title 67, Idaho Code. Any14 procurements less than fifteen thousand dollars ($15,000) shall be15 exempt from the provisions of this section and may be purchased di-16 rectly by the departments and institutions of state government. Any17 acquisition, purchase, or installation of any information technology18 or telecommunications equipment or facilities that is contrary to the19 office's direction or is not in harmony with the state's overall plan20 for telecommunications and information sharing shall be reported in21 writing to the governor and the legislature.22 (2) (3) To provide a system of information technology and telecommu-23 nications for all departments and institutions of state government. Funds24 received pursuant to this subsection shall be appropriated for payment of25 any charges related to information technology and telecommunications and26 telephone charges incurred by the various agencies and institutions of state27 government.28 (3) (4) To provide a means whereby political subdivisions of the state29 may use the state telecommunications system, on such terms and under such30 conditions as the office of information technology services may establish.31 (4) (5) To accept federal funds granted by congress or by executive or-32 der for all or any of the purposes of this chapter, as well as gifts and dona-33 tions from individuals and private organizations or foundations.34 (5) (6) To oversee implementation of cybersecurity policies that fos-35 ter risk and cybersecurity management telecommunications and decision-mak-36 ing with both internal and external organizational stakeholders.37 (6) (7) To consult with and direct state agencies and officials regard-38 ing information security needs.39 (7) (8) To direct state agencies and officials on penetration tests and40 vulnerability scans of state technology systems in order to identify steps41 to mitigate identified risks.42 (8) (9) To direct state agencies and officials to ensure that state43 agencies implement mandatory education and training of state employees and44 provide guidance on appropriate levels of training for various classifica-45 tions of state employees.46 (9) (10) To direct appropriate state agencies to create, coordinate,47 publish, routinely update and market a statewide cybersecurity website as48 an information repository for intelligence-sharing and cybersecurity best49 practices.50

3 (10) (11) To ensure that all state agencies implement and maintain cy-1 bersecurity best practices.2 (11) (12) To require all state agencies to implement and use multifac-3 tor identification to access information technology devices or services,4 including but not limited to local and remote network access to any email5 accounts, cloud storage accounts, web applications, networks, databases, or6 servers.7 (12) (13) To coordinate public and private entities to develop, create8 and promote statewide public outreach efforts to protect personal informa-9 tion and sensitive data from cyber threats.10 (11) (14)(a) To obtain a criminal history check on prospective employ-11 ees and contractors with the Idaho office of information technology12 services who provide information technology (IT) services to external13 state agency customers and who work in one (1) or more of the following14 disciplines:15 (i) IT network engineering;16 (ii) IT operations and support;17 (iii) IT software engineering;18 (iv) Geographic information systems;19 (v) IT information management;20 (vi) IT database administration;21 (vii) IT systems and infrastructure engineering;22 (viii) IT information security engineering;23 (ix) IT architecture;24 (x) IT management;25 (xi) Remote sensing analysis; and26 (xii) Data science.27 (b) The criminal history check done pursuant to paragraph (a) of this28 subsection shall be based on a completed ten (10) finger fingerprint29 card or scan and shall include, at a minimum, information from the Idaho30 bureau of criminal identification database and the federal bureau of31 investigation's criminal history database.32 (c) For the purposes of this section, "information technology" shall33 have the same meaning as provided for in section 67-831, Idaho Code.34 (12)(13) (15) To promulgate and adopt reasonable rules, subject to leg-35 islative approval, for effecting the purposes of this act pursuant to the36 provisions of chapter 52, title 67, Idaho Code.37

SECTION 2. An emergency existing therefor, which emergency is hereby38 declared to exist, this act shall be in full force and effect on and after39 July 1, 2026.40