The civic record
Read. Follow. Verify.Idaho House Bill 597 Expands Powers and Cybersecurity Oversight of the Office of Information Technology Services
Last action · February 6, 2026: Reported Printed and Referred to State Affairs
Track this bill to get notified when it advances a stage. One tap to stop, anytime.
What This Bill Proposed
Idaho House Bill 597 revises the powers and duties of the Office of Information Technology Services, granting it authority to oversee statewide cybersecurity policies, mandate multifactor authentication across all state agencies, and require criminal history checks for certain IT employees and contractors starting July 1, 2026.
State agencies and public employees face mandatory cybersecurity compliance standards, required employee training, and new background check protocols for specific IT personnel.
- The Office of Information Technology Services functions as the central technology agency for Idaho state government operations. context
- House Bill 597 was introduced during the Sixty-eighth Idaho Legislature Second Regular Session by the State Affairs Committee. context
Who It Would Have Affected
Groups the bill's text would have affected, as described in the record. Being affected is not a position for or against it.
State Agencies and Institutions
State agencies must comply with IT acquisition controls, mandatory employee cybersecurity training, and universal multifactor authentication requirements.
Military Division
The division retains control over the acquisition, purchase, and installation of all public safety and microwave equipment.
Prospective IT Employees and Contractors
Individuals applying for specific IT roles within the office must submit to fingerprint-based criminal history checks.
Key Facts
- The Office of Information Technology Services controls and approves the acquisition, purchase, and installation of all IT equipment, services, software, data management, and telecommunications for all state departments and institutions.
- Higher education institutions and elected officers in the executive branch coordinate their IT acquisitions through the office, while public safety and microwave equipment remain under the control of the Military Division.
- IT procurements under $15,000 are exempt from the office's direct approval requirements and may be purchased directly by departments and institutions.
- The office is authorized to oversee the implementation of cybersecurity policies, direct state agencies on information security, and require penetration tests and vulnerability scans.
Show all 9 facts
- All state agencies are required to implement and use multifactor identification to access information technology devices, services, email accounts, cloud storage, web applications, networks, databases, and servers.
- The office must obtain a criminal history check based on a ten-finger fingerprint card or scan for prospective employees and contractors providing IT services to external state agency customers across twelve specified disciplines.
- Procurements made by the office (except when utilizing the division of purchasing) are exempt from chapters 52 and 92, title 67, Idaho Code.
- Any IT acquisition or purchase contrary to the office's direction must be reported in writing to the governor and the legislature.
- The act declares an emergency and sets the effective date as July 1, 2026.
Frequently Asked Questions
What authority does the Office of Information Technology Services have over state IT purchases?
Are small IT purchases exempt from the office's requirements?
What cybersecurity measures are mandatory for state agencies under this bill?
Who must undergo a criminal history check?
What else do you want to know?
News Coverage
Follow the record
Votes, people, money & the original sourceWhere This Stands
This bill did not become law - Died at adjournment · in House committee.
Procedural history
2 actions- Feb 6, 2026CommitteeReported Printed and Referred to State Affairs
- Feb 5, 2026IntroducedIntroduced, read first time, referred to JRA for Printing
Version history
Only one version on file - nothing to compare yet. As later stages (committee substitute, engrossed, enrolled) are captured, the redline appears here.
View official text →Lobbying Activity
No state lobbying filings in our records match this bill. Federal lobbying reports (LDA) cover Congress, so they are not listed on state bills.
Full breakdown
Who this bill affects and the strongest case for and against it, written only from the bill’s own text.
Discoveries
Patterns POLISCOPE noticed across the record. These are observations to investigate, not conclusions.
Centralization of State Cybersecurity Oversight
The legislation formally expands the Office of Information Technology Services' mandate from general procurement to active cybersecurity enforcement, requiring multifactor authentication and mandatory employee training across all state agencies.
Connected Entities
Sources
legislature.idaho.gov
Analysis Score
0–100- Significance20Lowered because this bill did not pass (its text scored 75)
- Controversy15Intensity of disagreement among stakeholders
- Entertainment5Compellingness for a non-policy-wonk reader
- Buzz25Current news / social attention level
Publisher tools