The civic record
Read. Follow. Verify.Idaho updates Office of Information Technology Services powers, procurement rules, and cybersecurity mandates
Last action · March 31, 2026: Read third time in full – Recommitted to State Affairs
Track this bill to get notified when it advances a stage. One tap to stop, anytime.
What This Bill Would Do
Idaho House Bill 888 revises the powers and duties of the Office of Information Technology Services, allowing the use of third-party brokers for IT analysis under specific conditions, setting a $15,000 threshold for direct agency purchases, and mandating statewide . The act takes effect on July 1, 2026, under an emergency declaration.
State agencies face new statutory procurement rules, mandatory employee cybersecurity training, required for network access, and background checks for certain IT personnel.
- The Office of Information Technology Services serves as the central technology authority for Idaho state government agencies. context
Who It Would Affect
Groups the bill's text would affect if enacted, as described in the record. Being affected is not a position for or against it.
state agencies and departments
State agencies must comply with centralized IT acquisition rules, implement mandatory multifactor authentication, and ensure employee cybersecurity training.
prospective IT employees and contractors
Applicants and contractors for specific IT disciplines within the Office of Information Technology Services must submit to criminal history background checks.
Military Division
The military division maintains control over the acquisition and installation of public safety and microwave equipment.
Key Facts
- The Office of Information Technology Services may use third-party brokers for technical and financial analysis of IT acquisitions, provided the broker maintains a fiduciary duty, is not a direct vendor, avoids conflicts of interest, and charges only vendor commissions.
- IT procurements under $15,000 are exempt from standard office review and may be purchased directly by state departments and institutions.
- All state agencies are required to implement and use multifactor authentication to access IT devices, services, email accounts, cloud storage, web applications, networks, databases, and servers.
- Criminal history checks based on a 10-finger fingerprint card are required for prospective employees and contractors providing IT services in disciplines such as network engineering, software engineering, and database administration.
Show all 7 facts
- The Military Division retains control over the acquisition, purchase, and installation of all public safety and microwave equipment.
- The office is authorized to oversee cybersecurity policies, direct penetration tests and vulnerability scans, and ensure mandatory employee training.
- The act takes effect on July 1, 2026, under an emergency declaration.
Frequently Asked Questions
What purchases are exempt from the Office of Information Technology Services' review?
Who must undergo a criminal history check under this bill?
Are state agencies required to use multifactor authentication?
What else do you want to know?
News Coverage
Follow the record
Votes, people, money & the original sourceWhere This Stands
Currently passed both. The next step in the legislative lifecycle is Law.
Procedural history
12 actions- Mar 31, 2026Read third time in full – Recommitted to State Affairs
- Mar 27, 2026Read second time; filed for Third Reading
- Mar 26, 2026Reported out of Committee with Do Pass Recommendation; Filed for second reading
- Mar 25, 2026IntroducedIntroduced, read first time; referred to: State Affairs
- Mar 25, 2026FloorReceived from the House passed; filed for first reading
- Mar 24, 2026FloorRules Suspended: Ayes 67 Nays 0 Abs/Excd 3, read in full as required – PASSED - 52-16-2 AYES – Alfieri, Barbieri, Berch, Boyle, Bruce, Burgoyne, Cannon, Cheatum, Cornilles, Crane(13), Dygert, Egbert, Ehardt, Ehlers, Erickson, Fuhriman, Furniss, Gannon, Green, Hall(Stone), Handy, Healey, Hill, Holtzclaw, Hostetler, Leavitt, Marmon, Mathias, McCann, Mendive, Miller, Mitchell, Monks, Nelsen, Palmer, Petzke, Pickett, Pohanka, Raymond, Rubel, Sauter, Shepherd, Shirts, Skaug, Tanner(13), Tanner(14), Thompson, Veile, Weber, Wheeler, Wisniewski, Mr. Speaker NAYS – Beiswenger, Bingham, Cayler, Church, Crane(12), Galaviz, Garner, Harris, Hawkins, Haws, Manwaring, Mickelsen, Price, Rasor, Raybould, Scott Absent – Redman, Vander Woude Floor Sponsor - Palmer Title apvd - to Senate
Show 6 earlier actions
- Mar 24, 2026Read second time; Filed for Third Reading
- Mar 23, 2026Reported out of Committee with Do Pass Recommendation, Filed for Second Reading
- Mar 16, 2026CommitteeReferred to State Affairs
- Mar 16, 2026Reported out of Committee, Returned to the Desk for re-referral
- Mar 13, 2026CommitteeReported Printed and Referred to Commerce & Human Resources
- Mar 12, 2026IntroducedIntroduced, read first time, referred to JRA for Printing
Version history
Only one version on file - nothing to compare yet. As later stages (committee substitute, engrossed, enrolled) are captured, the redline appears here.
View official text →Lobbying Activity
No state lobbying filings in our records match this bill. Federal lobbying reports (LDA) cover Congress, so they are not listed on state bills.
Full breakdown
Who this bill affects and the strongest case for and against it, written only from the bill’s own text.
Discoveries
Patterns POLISCOPE noticed across the record. These are observations to investigate, not conclusions.
Expanded Cybersecurity and Screening Mandates
The bill moves Idaho state IT governance toward stricter mandatory security controls, requiring both agency-wide multifactor authentication and fingerprint-based background checks for key IT personnel.
Connected Entities
Sources
legislature.idaho.gov
Analysis Score
0–100- Significance65How much this matters to a regular citizen
- Controversy15Intensity of disagreement among stakeholders
- Entertainment5Compellingness for a non-policy-wonk reader
- Buzz25Current news / social attention level
Publisher tools