ITS, under the leadership of CIO and Administrator Alberto Gonzalez, has been working steadily to consolidate IT services for more than 50 agencies. Recent staffing changes within ITS have supported this work.
The consolidation process was initiated through the state Legislature’s passage of House Bill 607 in 2018, which not only established ITS within the Office of the Governor, but called for state agencies’ IT services to be operated under it.
According to Gonzalez, in the past year, six more agencies were consolidated. Only three agencies out of more than 50 remain to be consolidated; he said the state is about two fiscal years away from completing this.
“That process — a lot of organizational change management, understanding the technical debt, standardizing our practices — has been a serious journey,” Gonzalez said.
He explained that although state sizes differ, their change management process is similar when it comes to consolidation. Idaho’s approach, he said, has involved close collaboration with state agencies to understand their unique needs for technology in their work.
Enterprise-level IT will allow the state to advance tech initiatives in other areas, including cybersecurity. For several years, the National Guard has worked with the state of Idaho for Innovative Readiness Training. This involves the National Guard conducting a penetration test in which state cybersecurity staff work to fight threats. Gonzalez said that the first couple of times this test was conducted, there were major gaps that informed the state’s improvement of its cyber posture.
This past year, he said, was the first in which the state was effectively able to push back on vulnerabilities that were exposed in prior years. And notably, while many states do a similar exercise in a test environment, Gonzalez said Idaho uses a true — but safe and controlled — environment.
Gonzalez said he would like to see other states implement a similar cybersecurity test model — and to do so with a real environment, rather than a training environment. He said both state and federal government agencies have expressed interest in Idaho’s approach. Gonzalez credited the work of Idaho CISO Jerred Edgar for successfully developing a replicable cybersecurity program.
“I think my fellow CIOs and CISOs should be following this road map here,” Gonzalez said. The state, he noted, plans to apply the same formula to support local governments in their cybersecurity assessment and remediation planning.
Idaho will leverage grant funding to help its many rural cities and counties receive guidance, support and services from the state’s central IT. This work with localities is not going to rely solely on grants such as the Cybersecurity and Infrastructure Security Agency State and Local Cybersecurity Grant Program, he said, but independently of that, officials have plans to tackle cybersecurity in innovative ways such as interagency and cross-sector collaboration.
“I think there’s a drive here for us to be better in the cybersecurity space and in the IT space, so that [localities] can be innovative and provide better citizen services,” Gonzalez said.
Leaders are also making progress on AI. The state has gradually been creating an AI policy over the past year; and last year, the state Legislature established an AI committee.
A survey revealed that about a quarter of state employees were using AI without proper controls in place, Gonzalez said, a finding that established a sense of urgency in the state. Meetings during the next couple of weeks will help the state shift its approach — because, as he put it, states that are not already creating AI policy or framework or establishing guardrails are falling behind.
“I think there’s an urgency now because it’s being used — whether you like it or not,” Gonzalez said.
He is also eager to see enhanced data governance due to AI’s advancement, he said, indicating effective data and AI governance will allow the state to leverage the efficiencies that AI technologies may bring.
Gonzalez said it will likely be up to ITS to provide an interim AI framework for agencies, something he hopes will be completed within the next couple of months. ITS plans to work with lawmakers for a nonpartisan approach to the resource’s creation.
Idaho made progress last year in citizen engagement as well, Gonzalez said. This improvement was made possible through a change to a decades-old contract with Tyler Technologies. The change allowed the state to move from a centralized payment processing service to a state-controlled version.
While Tyler Technologies is still supporting the state in other ways, ITS is now able to control website management, mobile engagement and improved citizen engagement at large; Gonzalez said the ability to control these things has been a "significant improvement" for the state in the past year. Since the update, several websites have already been converted to state-controlled citizen engagement.
