Bill Analyses and Ratings
Bill Information: H0597 – IT Services Procurement & Cybersecurity Expansion
Bill Summary
House Bill 597 amends Idaho Code Section 67-827A to expand the Office of Information Technology Services’ authority beyond telecommunications to include all information technology equipment, services, software, and data management. The bill requires the office to conduct technical and financial analyses for each purchase, either internally or through third-party brokers who may charge commissions to vendors. It exempts the office’s IT procurements from standard state purchasing regulations in chapters 52 and 92 of Title 67, except when using the Division of Purchasing, and allows departments to make direct purchases under $15,000.
The legislation adds comprehensive cybersecurity mandates, directing the office to oversee cybersecurity policies, conduct penetration testing and vulnerability scans, require mandatory employee training, maintain a statewide cybersecurity website, and ensure all agencies implement cybersecurity best practices. It also mandates multifactor authentication for all state employees accessing IT devices or services, including email, cloud storage, and network access. The bill renumbers existing provisions for criminal background checks on IT employees and contractors, requiring ten-finger fingerprint checks through both state and FBI databases.
Overall Assessment
This bill centralizes IT procurement authority in the Office of Information Technology Services while exempting most purchases from standard state purchasing oversight. The legislation imposes new cybersecurity requirements across all state agencies, including mandatory multifactor authentication and employee training programs. The procurement changes allow third-party brokers to charge vendor commissions and create a $15,000 threshold below which agencies can bypass centralized review.
Rating Breakdown
ARTICLE I. RESPONSIBILITY IN GOVERNMENT (0)
The bill modifies internal state government IT procurement procedures and adds cybersecurity oversight duties. While it centralizes purchasing authority and creates exemptions from chapters 52 and 92 purchasing regulations, these are administrative changes to how state government operates internally rather than substantive policy changes affecting government accountability, spending transparency, or program review.
ARTICLE II. CITIZEN INVOLVEMENT IN GOVERNMENT (0)
The bill addresses state government IT procurement and cybersecurity management. It contains no provisions related to elections, voting procedures, citizen participation in government processes, or transparency in political activities.
ARTICLE III. EDUCATION (0)
While subsection (1)(a)(ii) mentions coordinating IT acquisitions for institutions of higher education, this concerns procurement procedures rather than educational policy, curriculum, parental rights, or school choice. The bill does not address educational content or governance.
ARTICLE IV. AGRICULTURE (0)
The bill focuses exclusively on state government IT procurement and cybersecurity. It contains no provisions related to agriculture, farming, ranching, agricultural education, or water rights for agricultural use.
ARTICLE V. WATER (0)
The bill addresses IT equipment and services procurement. It contains no provisions related to water rights, water management, inter-basin transfers, or any water policy matters.
ARTICLE VI. NATURAL RESOURCES AND ENVIRONMENT (0)
The bill concerns state government technology infrastructure and cybersecurity. It contains no provisions related to natural resources, environmental policy, federal lands, or resource management.
ARTICLE VII. ENERGY (0)
The bill addresses IT procurement and cybersecurity for state agencies. It contains no provisions related to energy independence, energy resources, hydroelectric power, or energy policy.
ARTICLE VIII. IDAHO NATIONAL LABORATORIES (0)
The bill focuses on state government IT services and does not address Idaho National Laboratory, nuclear research, technology transfer, or any INL-related matters.
ARTICLE IX. PRIVATE PROPERTY RIGHTS (0)
The bill addresses state government procurement procedures and cybersecurity requirements. It contains no provisions related to private property rights, eminent domain, regulatory takings, or property development regulations.
ARTICLE X. STATE AND FEDERAL LANDS (0)
The bill concerns IT procurement and cybersecurity for state agencies. It contains no provisions related to federal land management, state administration of federal lands, or land ownership issues.
ARTICLE XI. WILDLIFE MANAGEMENT (0)
The bill addresses state government technology services. It contains no provisions related to wildlife management, Fish and Game, hunting, fishing, or predator control.
ARTICLE XII. ECONOMY (0)
The bill modifies state government procurement processes, including exemptions from chapters 52 and 92 and allowing third-party broker commissions. While these changes affect how the state purchases IT services, they concern internal government operations rather than private sector commerce, small business regulations, or economic development policies.
ARTICLE XIII. HEALTH AND WELFARE (0)
The bill addresses IT procurement and cybersecurity for state agencies. It contains no provisions related to healthcare delivery, health insurance, patient rights, medical decisions, or welfare programs.
ARTICLE XIV. AMERICAN FAMILY (0)
The bill concerns state government technology infrastructure. It contains no provisions related to family values, parental authority, marriage, right to life, or children's welfare.
ARTICLE XV. OLDER AMERICANS (0)
The bill addresses IT procurement and cybersecurity for state government. It contains no provisions related to older Americans, retirement, or policies affecting seniors.
ARTICLE XVI. LAW AND ORDER WITH JUSTICE (0)
Subsection (13) requires criminal background checks for IT employees and contractors, but this provision is being renumbered from existing subsection (11) rather than newly added. The bill does not address criminal justice policy, law enforcement, or judicial procedures.
ARTICLE XVII. NATIONAL DEFENSE – SECURING THE BORDER (0)
The bill addresses state government IT services. While subsection (1)(a)(iv) mentions the military division's control over public safety and microwave equipment, this is existing language that remains unchanged. The bill contains no new provisions related to national defense, veterans, or border security.
ARTICLE XVIII. ELECTION OF JUDGES AND IDAHO SUPREME COURT JUSTICES (0)
The bill addresses IT procurement and cybersecurity. It contains no provisions related to judicial elections, judicial selection, or constitutional interpretation.
ARTICLE XIX. RELIGIOUS LIBERTY (0)
The bill concerns state government technology services and procurement. It contains no provisions related to religious freedom, free exercise of religion, or the Religious Freedom Restoration Act.