Read the full stored bill text
LEGISLATURE
OF
THE
STATE
OF
IDAHO
Sixty-eighth
Legislature
Second
Regular
Session
-
2026
IN
THE
HOUSE
OF
REPRESENTATIVES
HOUSE
BILL
NO.
597
BY
STATE
AFFAIRS
COMMITTEE
AN
ACT
1
RELATING
TO
INFORMATION
TECHNOLOGY;
AMENDING
SECTION
67
-
827A,
IDAHO
CODE,
2
TO
REVISE
PROVISIONS
REGARDING
THE
OFFICE
OF
INFORMATION
TECHNOLOGY
3
SERVICES
AND
TO
MAKE
TECHNICAL
CORRECTIONS;
AND
DECLARING
AN
EMERGENCY
4
AND
PROVIDING
AN
EFFECTIVE
DATE.
5
Be
It
Enacted
by
the
Legislature
of
the
State
of
Idaho:
6
SECTION
1.
That
Section
67
-
827A,
Idaho
Code,
be,
and
the
same
is
hereby
7
amended
to
read
as
follows:
8
67
-
827A.
POWERS
AND
DUTIES.
The
office
of
information
technology
ser
-
9
vices
is
hereby
authorized
and
directed:
10
(1)(a)(i)
To
control
and
approve
the
acquisition
,
purchase,
and
1
1
installation
of
all
information
technology
equipment,
services,
12
software,
and
data
management,
and
telecommunications
equipment
13
and
facilities
for
all
departments
and
institutions
of
state
gov
-
14
ernment,
except
as
provided
in
subparagraphs
(ii),
(iii)
and
(iv)
15
of
this
paragraph;
16
(ii)
To
coordinate
the
acquisition
,
purchase,
and
installation
17
of
all
information
technology
equipment,
services,
software,
and
18
data
management,
and
telecommunications
equipment
and
facilities
19
for
the
institutions
of
higher
education
and
the
elected
officers
20
in
the
executive
branch;
21
(iii)
To
coordinate
the
acquisition
,
purchase,
and
installation
22
of
all
information
technology
equipment,
services,
software,
and
23
data
management,
and
telecommunications
equipment
and
facilities
24
for
the
legislative
and
judicial
branches;
25
(iv)
Provided
however,
that
the
acquisition
,
purchase,
and
in
-
26
stallation
of
all
public
safety
and
microwave
equipment
shall
be
27
under
the
control
of
the
military
division.
The
military
division
28
is
authorized
to
charge
and
receive
payment
for
actual
and
neces
-
29
sary
expenses
incurred
in
providing
services
to
any
unit
of
state
30
government
under
the
provisions
of
this
subparagraph.
31
(b)
In
approving
or
directing
the
acquisition
,
purchase,
or
installa
-
32
tion
of
information
technology
equipment,
services,
software,
or
data
33
management,
or
telecommunications
equipment
or
facilities,
the
office
34
shall
first
consult
with
and
consider
the
recommendations
and
advice
35
of
the
directors
or
executive
heads
of
the
various
departments
or
in
-
36
stitutions.
For
each
purchase,
the
office
shall
conduct
a
technical
37
and
financial
analysis
of
the
information
technology
equipment,
ser
-
38
vices,
software,
or
data
management,
or
telecommunications
equipment
39
or
facilities
that
best
meet
the
needs
of
departments
and
institu
-
40
tions
of
state
government
except
as
provided
in
paragraph
(a)(ii),
41
(iii),
and
(iv)
of
this
subsection.
Such
analysis
may
be
conducted
by
42
2
a
third
-
party
broker
as
long
as
fees
are
not
charged
to
the
office.
The
1
third
-
party
broker
may
charge
a
reasonable
commission
to
the
vendors
2
engaged
by
the
office.
The
office,
in
its
discretion,
may
also
uti
-
3
lize
and
enter
into
a
memorandum
of
understanding
with
the
division
4
of
purchasing
in
the
department
of
administration
for
procurements.
5
Except
when
utilizing
the
division
of
purchasing
for
procurements,
6
the
office's
purchase
of
information
technology
equipment,
services,
7
software,
and
data
management,
and
telecommunications
equipment
and
8
facilities
are
exempt
from
the
provisions
of
chapters
52
and
92,
title
9
67,
Idaho
Code.
Any
procurements
less
than
fifteen
thousand
dollars
10
($15,000)
are
exempt
from
the
provisions
of
this
section
and
may
be
1
1
purchased
directly
by
the
departments
and
institutions
of
state
gov
-
12
ernment
except
as
provided
in
paragraph
(a)(ii),
(iii),
and
(iv)
of
13
this
subsection.
Any
acquisition
,
purchase,
or
installation
of
any
14
information
technology
equipment,
services,
software,
or
data
manage
-
15
ment,
or
telecommunications
equipment
or
facilities
that
is
contrary
16
to
the
office's
direction
or
is
not
in
harmony
with
the
state's
overall
17
plan
for
telecommunications
and
information
sharing
shall
be
reported
18
in
writing
to
the
governor
and
the
legislature.
19
(2)
To
provide
a
system
of
information
technology
and
telecommunica
-
20
tions
for
all
departments
and
institutions
of
state
government.
Funds
re
-
21
ceived
pursuant
to
this
subsection
shall
be
appropriated
for
payment
of
any
22
charges
related
to
information
technology
equipment,
services,
software,
23
and
data
management,
and
any
telecommunications
and
telephone
charges
in
-
24
curred
by
the
various
agencies
and
institutions
of
state
government.
25
(3)
To
provide
a
means
whereby
political
subdivisions
of
the
state
may
26
use
the
state
telecommunications
system,
on
such
terms
and
under
such
condi
-
27
tions
as
the
office
of
information
technology
services
may
establish.
28
(4)
To
accept
federal
funds
granted
by
congress
or
by
executive
order
29
for
all
or
any
of
the
purposes
of
this
chapter,
as
well
as
gifts
and
donations
30
from
individuals
and
private
organizations
or
foundations.
31
(5)
To
oversee
implementation
of
cybersecurity
policies
that
foster
32
risk
and
cybersecurity
management
telecommunications
and
decision
-
making
33
with
both
internal
and
external
organizational
stakeholders.
34
(6)
To
consult
with
and
direct
state
agencies
and
officials
regarding
35
information
security
needs.
36
(7)
To
direct
state
agencies
and
officials
on
penetration
tests
and
37
vulnerability
scans
of
state
technology
systems
in
order
to
identify
steps
38
to
mitigate
identified
risks.
39
(8)
To
direct
state
agencies
and
officials
to
ensure
that
state
agen
-
40
cies
implement
mandatory
education
and
training
of
state
employees
and
pro
-
41
vide
guidance
on
appropriate
levels
of
training
for
various
classifications
42
of
state
employees.
43
(9)
To
direct
appropriate
state
agencies
to
create,
coordinate,
pub
-
44
lish,
routinely
update
and
market
a
statewide
cybersecurity
website
as
an
45
information
repository
for
intelligence
-
sharing
and
cybersecurity
best
46
practices.
47
(10)
To
ensure
that
all
state
agencies
implement
and
maintain
cyberse
-
48
curity
best
practices.
49
3
(11)
To
require
all
state
agencies
to
implement
and
use
multifactor
1
identification
to
access
information
technology
devices
or
services,
in
-
2
cluding
but
not
limited
to
local
and
remote
network
access
to
any
email
3
accounts,
cloud
storage
accounts,
web
applications,
networks,
databases,
or
4
servers.
5
(12)
To
coordinate
public
and
private
entities
to
develop,
create
and
6
promote
statewide
public
outreach
efforts
to
protect
personal
information
7
and
sensitive
data
from
cyber
threats.
8
(11)
(13)
(a)
To
obtain
a
criminal
history
check
on
prospective
employ
-
9
ees
and
contractors
with
the
Idaho
office
of
information
technology
10
services
who
provide
information
technology
(IT)
services
to
external
1
1
state
agency
customers
and
who
work
in
one
(1)
or
more
of
the
following
12
disciplines:
13
(i)
IT
network
engineering;
14
(ii)
IT
operations
and
support;
15
(iii)
IT
software
engineering;
16
(iv)
Geographic
information
systems;
17
(v)
IT
information
management;
18
(vi)
IT
database
administration;
19
(vii)
IT
systems
and
infrastructure
engineering;
20
(viii)
IT
information
security
engineering;
21
(ix)
IT
architecture;
22
(x)
IT
management;
23
(xi)
Remote
sensing
analysis;
and
24
(xii)
Data
science.
25
(b)
The
criminal
history
check
done
pursuant
to
paragraph
(a)
of
this
26
subsection
shall
be
based
on
a
completed
ten
(10)
finger
fingerprint
27
card
or
scan
and
shall
include,
at
a
minimum,
information
from
the
Idaho
28
bureau
of
criminal
identification
database
and
the
federal
bureau
of
29
investigation's
criminal
history
database.
30
(c)
For
the
purposes
of
this
section,
"information
technology"
shall
31
have
the
same
meaning
as
provided
for
in
section
67
-
831,
Idaho
Code.
32
(12)(13)
(14)
To
promulgate
and
adopt
reasonable
rules,
subject
to
leg
-
33
islative
approval,
for
effecting
the
purposes
of
this
act
pursuant
to
the
34
provisions
of
chapter
52,
title
67,
Idaho
Code.
35
SECTION
2.
An
emergency
existing
therefor,
which
emergency
is
hereby
36
declared
to
exist,
this
act
shall
be
in
full
force
and
effect
on
and
after
37
July
1,
2026.
38