INFORMATION TECHNOLOGY SERVICES – Amends existing law to revise provisions regarding the powers and duties of the Office of Information Technology Services.

LEGISLATURE
OF
THE
STATE
OF
IDAHO
Sixty-eighth
Legislature
Second
Regular
Session
-
2026
IN
THE
HOUSE
OF
REPRESENTATIVES
HOUSE
BILL
NO.
888
BY
STATE
AFFAIRS
COMMITTEE
AN
ACT
1
RELATING
TO
INFORMATION
TECHNOLOGY;
AMENDING
SECTION
67
-
827A,
IDAHO
CODE,
2
TO
REVISE
PROVISIONS
REGARDING
THE
OFFICE
OF
INFORMATION
TECHNOLOGY
3
SERVICES
AND
TO
MAKE
TECHNICAL
CORRECTIONS;
AND
DECLARING
AN
EMERGENCY
4
AND
PROVIDING
AN
EFFECTIVE
DATE.
5
Be
It
Enacted
by
the
Legislature
of
the
State
of
Idaho:
6
SECTION
1.
That
Section
67
-
827A,
Idaho
Code,
be,
and
the
same
is
hereby
7
amended
to
read
as
follows:
8
67
-
827A.
POWERS
AND
DUTIES.
(1)
The
office
of
information
technology
9
services
is
hereby
authorized
and
directed:
10
(1)
(a)
(i)
To
control
and
approve
the
acquisition
,
purchase,
and
instal
-
1
1
lation
of
all
information
technology
and
telecommunications
equipment
12
and
facilities
for
all
departments
and
institutions
of
state
gov
-
13
ernment,
except
as
provided
in
subparagraphs
(ii),
(iii)
and
(iv)
14
paragraphs
(b),
(c),
and
(d)
of
this
paragraph
subsection
;
15
(ii)
(b)
To
coordinate
the
acquisition
,
purchase,
and
installation
of
16
all
information
technology
and
telecommunications
equipment
and
facil
-
17
ities
for
the
institutions
of
higher
education
and
the
elected
officers
18
in
the
executive
branch;
19
(iii)
(c)
To
coordinate
the
acquisition
,
purchase,
and
installation
of
20
all
information
technology
and
telecommunications
equipment
and
facil
-
21
ities
for
the
legislative
and
judicial
branches;
22
(iv)
(d)
Provided
however,
that
the
acquisition
,
purchase,
and
in
-
23
stallation
of
all
public
safety
and
microwave
equipment
shall
be
under
24
the
control
of
the
military
division.
The
military
division
is
autho
-
25
rized
to
charge
and
receive
payment
for
actual
and
necessary
expenses
26
incurred
in
providing
services
to
any
unit
of
state
government
under
the
27
provisions
of
this
subparagraph.
28
(b)
(2)(a)
In
approving
or
directing
the
acquisition
,
purchase,
or
in
-
29
stallation
of
information
technology
or
telecommunications
equipment
30
or
facilities,
the
office
shall
first
consult
with
and
consider
the
31
recommendations
and
advice
of
the
directors
or
executive
heads
of
the
32
various
departments
or
institutions.
For
each
purchase
of
information
33
technology
or
telecommunications
equipment
or
facilities,
the
office
34
shall
conduct
a
technical
and
financial
analysis
that
best
meets
the
35
needs
of
the
departments
and
institutions
of
state
government.
The
of
-
36
fice,
in
its
discretion,
may
use
a
third
-
party
broker
for
the
technical
37
and
financial
analysis
as
long
as:
38
(i)
The
third
-
party
broker
has
a
fiduciary
duty
to
the
office
for
39
the
analysis
being
performed;
40
(ii)
The
third
-
party
broker
is
not
also
a
direct
vendor
of
the
in
-
41
formation
technology
being
procured;
42

2
(iii)
The
third
-
party
broker
does
not
accept
gifts,
gratuities,
or
1
favors
from
vendors
and
is
prohibited
from
unauthorized
ex
parte
2
communications
during
the
analysis;
3
(iv)
The
analysis
being
conducted
is
neutral,
transparent,
and
4
documented;
and
5
(v)
Fees
are
not
charged
to
the
office,
except
that
the
third
-
6
party
broker
may
charge
a
reasonable
commission
to
the
vendors
en
-
7
gaged
by
the
office
for
its
services.
8
(b)
The
office,
in
its
discretion,
may
also
use
and
enter
into
a
9
memorandum
of
understanding
with
the
division
of
purchasing
in
the
de
-
10
partment
of
administration
for
procurements.
Except
when
using
the
1
1
division
of
purchasing
for
procurements,
the
office's
purchase
of
in
-
12
formation
technology
and
telecommunications
equipment
and
facilities
13
is
exempt
from
the
provisions
of
chapter
92,
title
67,
Idaho
Code.
Any
14
procurements
less
than
fifteen
thousand
dollars
($15,000)
shall
be
15
exempt
from
the
provisions
of
this
section
and
may
be
purchased
di
-
16
rectly
by
the
departments
and
institutions
of
state
government.
Any
17
acquisition
,
purchase,
or
installation
of
any
information
technology
18
or
telecommunications
equipment
or
facilities
that
is
contrary
to
the
19
office's
direction
or
is
not
in
harmony
with
the
state's
overall
plan
20
for
telecommunications
and
information
sharing
shall
be
reported
in
21
writing
to
the
governor
and
the
legislature.
22
(2)
(3)
To
provide
a
system
of
information
technology
and
telecommu
-
23
nications
for
all
departments
and
institutions
of
state
government.
Funds
24
received
pursuant
to
this
subsection
shall
be
appropriated
for
payment
of
25
any
charges
related
to
information
technology
and
telecommunications
and
26
telephone
charges
incurred
by
the
various
agencies
and
institutions
of
state
27
government.
28
(3)
(4)
To
provide
a
means
whereby
political
subdivisions
of
the
state
29
may
use
the
state
telecommunications
system,
on
such
terms
and
under
such
30
conditions
as
the
office
of
information
technology
services
may
establish.
31
(4)
(5)
To
accept
federal
funds
granted
by
congress
or
by
executive
or
-
32
der
for
all
or
any
of
the
purposes
of
this
chapter,
as
well
as
gifts
and
dona
-
33
tions
from
individuals
and
private
organizations
or
foundations.
34
(5)
(6)
To
oversee
implementation
of
cybersecurity
policies
that
fos
-
35
ter
risk
and
cybersecurity
management
telecommunications
and
decision
-
mak
-
36
ing
with
both
internal
and
external
organizational
stakeholders.
37
(6)
(7)
To
consult
with
and
direct
state
agencies
and
officials
regard
-
38
ing
information
security
needs.
39
(7)
(8)
To
direct
state
agencies
and
officials
on
penetration
tests
and
40
vulnerability
scans
of
state
technology
systems
in
order
to
identify
steps
41
to
mitigate
identified
risks.
42
(8)
(9)
To
direct
state
agencies
and
officials
to
ensure
that
state
43
agencies
implement
mandatory
education
and
training
of
state
employees
and
44
provide
guidance
on
appropriate
levels
of
training
for
various
classifica
-
45
tions
of
state
employees.
46
(9)
(10)
To
direct
appropriate
state
agencies
to
create,
coordinate,
47
publish,
routinely
update
and
market
a
statewide
cybersecurity
website
as
48
an
information
repository
for
intelligence
-
sharing
and
cybersecurity
best
49
practices.
50

3
(10)
(11)
To
ensure
that
all
state
agencies
implement
and
maintain
cy
-
1
bersecurity
best
practices.
2
(11)
(12)
To
require
all
state
agencies
to
implement
and
use
multifac
-
3
tor
identification
to
access
information
technology
devices
or
services,
4
including
but
not
limited
to
local
and
remote
network
access
to
any
email
5
accounts,
cloud
storage
accounts,
web
applications,
networks,
databases,
or
6
servers.
7
(12)
(13)
To
coordinate
public
and
private
entities
to
develop,
create
8
and
promote
statewide
public
outreach
efforts
to
protect
personal
informa
-
9
tion
and
sensitive
data
from
cyber
threats.
10
(11)
(14)
(a)
To
obtain
a
criminal
history
check
on
prospective
employ
-
1
1
ees
and
contractors
with
the
Idaho
office
of
information
technology
12
services
who
provide
information
technology
(IT)
services
to
external
13
state
agency
customers
and
who
work
in
one
(1)
or
more
of
the
following
14
disciplines:
15
(i)
IT
network
engineering;
16
(ii)
IT
operations
and
support;
17
(iii)
IT
software
engineering;
18
(iv)
Geographic
information
systems;
19
(v)
IT
information
management;
20
(vi)
IT
database
administration;
21
(vii)
IT
systems
and
infrastructure
engineering;
22
(viii)
IT
information
security
engineering;
23
(ix)
IT
architecture;
24
(x)
IT
management;
25
(xi)
Remote
sensing
analysis;
and
26
(xii)
Data
science.
27
(b)
The
criminal
history
check
done
pursuant
to
paragraph
(a)
of
this
28
subsection
shall
be
based
on
a
completed
ten
(10)
finger
fingerprint
29
card
or
scan
and
shall
include,
at
a
minimum,
information
from
the
Idaho
30
bureau
of
criminal
identification
database
and
the
federal
bureau
of
31
investigation's
criminal
history
database.
32
(c)
For
the
purposes
of
this
section,
"information
technology"
shall
33
have
the
same
meaning
as
provided
for
in
section
67
-
831,
Idaho
Code.
34
(12)(13)
(15)
To
promulgate
and
adopt
reasonable
rules,
subject
to
leg
-
35
islative
approval,
for
effecting
the
purposes
of
this
act
pursuant
to
the
36
provisions
of
chapter
52,
title
67,
Idaho
Code.
37
SECTION
2.
An
emergency
existing
therefor,
which
emergency
is
hereby
38
declared
to
exist,
this
act
shall
be
in
full
force
and
effect
on
and
after
39
July
1,
2026.
40