State of Idaho

A case study on how the State of Idaho replaced fragmented, decades-old legacy systems with a FedRAMP-authorized cloud environment, centralizing operations and building compliance and shared responsibility into the architecture from day one.

/live_board/v2/downloads?uid=36a6ae10-7266-41d5-a02f-429fc1bd85ed&redirect=true

Securing the Reset How Idaho strengthened security and governance in the cloud

A GOVERNING AND GOVERNMENT TECHNOLOGY CASE STUDY

SPONSORED BY

Resetting the Architecture

While many agencies modernize in stages, Idaho chose to replace everything all at once. Because the state’s previous system was fragmented and relied on a patchwork of solutions, leadership couldn’t update one process without disrupting others.

“If you are able to do everything all at once, like Idaho did, fantastic,” says Jonathan Hatmaker, public sector lead for AWS.2 “If you can’t, pick a workload and prove that as a concept.”

Deployed in AWS GovCloud, the system operates within a FedRAMP-authorized environment built for regulated government workloads. FedRAMP imposes continuous monitoring, standardized controls and independent third-party assessments. This ensures security is an ongoing operational discipline rather than a one-time milestone.

Operating in GovCloud requires clearly defined roles. AWS secures the underlying infrastructure and physical data centers. Infor manages application services and platform availability. Idaho governs identity, user provisioning and access controls.

Clearly defined roles lead to greater accountability and less risk.

To better safeguard resident data, the state of Idaho set out to rebuild its technology environment.

Decades of operating fragmented, homegrown systems had left the state struggling to keep pace with evolving cyber threats and regulatory expectations.

Leadership recognized that incremental updates would not be enough. Protecting resident data and strengthening compliance posture demanded a FedRAMP-authorized cloud environment with externally validated controls, continuous monitoring and a framework designed for regulated workloads.

Infor CloudSuite Public Sector, deployed in Amazon Web Services (AWS) GovCloud, delivered modernization for Idaho with built-in security discipline — centralizing oper- ations and embedding compliance into the architecture.

Now agencies and departments can easily share information and resources securely, something the previous system made difficult.

The Limitations of Legacy Systems

When states made massive efforts to upgrade their technology during the Y2K era, Idaho opted to configure its homegrown systems internally. Decades later, agencies were maintaining dozens of siloed systems, with many supported by obsolete programming.

“When our programmers started retiring, we realized there was no one left who could step in,” says Scott Smith, chief deputy controller for the State Controller of Idaho.1 “Schools stopped teaching these languages years ago. The industry had simply moved on.”

At the time, security was an obvious priority, but it required a disproportionate amount of attention from staff, leaving them with less time for other responsibilities.

Besides the skills shortage, Idaho faced enormous costs for the upkeep of separate mainframes, servers and the necessary security and access controls. The state needed a new strategy to protect constituents’ information.

“In state government, you’re trying to instill trust,” Smith says. “You need to give the public a sense of security regarding their data by knowing you’re doing the right things to protect it.”

“Using a shared responsibility model is critical,” says Mignona Cote, chief security and compliance officer at Infor.3 “We do not access customer data. The state provisions and governs access. Our role is to build and maintain the mechanisms that enable them to enforce those controls.”

The model also ensures usernames and passwords for access at a certain role level don’t permit unauthorized access to edge locations or other availability zones. If credentials are compromised, the impact is contained as much as possible.

The state’s new system was recently put to the test when Idaho changed health benefits providers and upgraded the system public employees use during open enrollment. Because the system operates within a governed cloud framework, the state was able to execute the transition without compromising governance controls or security posture.

Smith says the project would have been a tremendous undertaking if state leadership had been using legacy systems on their own. With access to a team of developers, Idaho accomplished the switchover in three months instead of 18.

“There’s this force multiplier in communicating and planning with others,” Smith says. “You can overcome a lot because you don’t have to do it by yourself.”

Expanding What’s Possible

Operating in GovCloud has changed how the state delivers services. Built-in redundancy replaced manually maintained backup systems, reducing infrastructure burden while strengthening resilience.

“Many of the systems we were maintaining had backups and tertiary systems,” Smith says. “By having that in a cloud-based environment, that service is already provided for you to ensure you can deliver to your end users in a sustainable way.”

By transforming with AWS GovCloud and the Infor Industry Cloud Platform, Idaho officials receive valuable insights when they need them.

These insights mean the agency has new ways to measure performance, too. For example, it can track how long a certain process takes to complete and if it can be streamlined.

Idaho became the first state to transition its full ERP suite into GovCloud all at once — a decision that required confidence in the security architecture, compliance discipline and shared responsibility.

“That was a big accomplishment,” Smith says. “Now a couple of years into the process, I’m pretty excited about where we’re at and the stability we’ve been able to achieve.”

“There’s this force multiplier in communicating and planning with others. You can overcome a lot because you don’t have to do it by yourself.” — Scott Smith, Controller, Idaho

1. webinars.govtech.com/Navigating-the-Future-of-Cloud-Security-and-Compliance-in-Government-143650.html?

2. Ibid.

3. Ibid.

State of Idaho

Item Type: pdf