S.F. _____ H.F. _____ Section 1. Section 8.57C, subsections 2, 3, and 4, Code 1 2026, are amended to read as follows: 2 2. Moneys in the fund in a fiscal year shall be used as 3 appropriated by the general assembly for the acquisition 4 of computer hardware and software, software development, 5 telecommunications equipment, and maintenance and lease 6 agreements associated with technology components and for the 7 purchase of equipment intended to provide an uninterruptible 8 power supply to the department of management to provide 9 a stable funding source for implementation costs of state 10 information technology projects that enhance the state’s 11 technology infrastructure, improve government services, 12 and promote innovation and economic development, including 13 but not limited to new information technology projects 14 and infrastructure replacement efforts of a department or 15 establishment . 16 3. a. There is appropriated from the general fund of the 17 state to the technology reinvestment fund for the fiscal year 18 beginning July 1, 2026, and for each fiscal year thereafter, 19 the sum of seventeen million five hundred thousand dollars. 20 b. There is appropriated from the rebuild Iowa 21 infrastructure fund for the fiscal year beginning July 1, 2025, 22 and ending June 30, 2026, the sum of eighteen million two 23 hundred sixty-nine thousand two hundred seventeen dollars to 24 the technology reinvestment fund, notwithstanding section 8.57, 25 subsection 3 , paragraph “c” . 26 3. a. The department of management shall prioritize 27 proposed projects based on all of the following considerations: 28 (1) Whether the project aligns with the state’s strategic 29 priorities. 30 (2) Whether the project promotes or introduces new 31 technology or significantly improves an existing system. 32 (3) Whether the project is feasible and whether the 33 department or establishment has established readiness for the 34 project to proceed, including a clear assessment of timelines, 35 -1- LSB 5269XD (6) 91 sc/ns 1/ 15

S.F. _____ H.F. _____ budgets, and measurable outcomes. 1 (4) Whether the project includes a clear change management 2 strategy to support user adoption and aligns with lean 3 enterprise principles to maximize value, minimize waste, and 4 ensure continuous improvement. 5 (5) Whether the project provides a positive return on 6 investment, considering both financial returns and nonfinancial 7 benefits such as improved public safety, education, or health 8 care. 9 (6) Whether the project results in infrastructure that is 10 scalable across the state enterprise. 11 (7) Whether the department or establishment has identified 12 how the completed project will be sustained beyond the initial 13 funding period. 14 (8) Whether the project improves access to governmental 15 services, particularly in rural communities. 16 (9) Whether the project involves an infrastructure project 17 as opposed to maintenance or standard upgrades of existing 18 technology. 19 b. The department of management shall provide a prioritized 20 list of proposed projects for funding to the governor, who 21 shall use the list in developing a budgetary recommendation 22 for the general assembly pursuant to section 8.21 for the 23 fiscal year beginning July 1, 2027, and for each fiscal year 24 thereafter. 25 c. Notwithstanding section 8.33, moneys in the technology 26 reinvestment fund that remain unencumbered or unobligated at 27 the close of a fiscal year shall not revert but shall remain 28 available for expenditure for the purposes designated until 29 the close of the fiscal year that ends two years after the 30 end of the fiscal year for which the appropriation was made. 31 Notwithstanding section 12C.7, subsection 2, interest or 32 earnings on moneys in the fund shall be credited to the fund. 33 4. Annually, on On or before January 15 of each year, a 34 state agency that received an appropriation from this fund 35 -2- LSB 5269XD (6) 91 sc/ns 2/ 15

S.F. _____ H.F. _____ the department of management shall report to the legislative 1 services agency and the department of management general 2 assembly the status of all projects funded under this section 3 that have been completed since the previous report was 4 submitted or that are in progress. The report shall must 5 include a description of the project, the progress of work 6 completed, the total estimated cost of the project, a list of 7 all revenue sources being used to fund the project, the amount 8 of funds moneys expended, the amount of funds moneys obligated, 9 and the date the project was completed or an estimated 10 completion date of the project, where applicable. 11 Sec. 2. Section 8.78, Code 2026, is amended to read as 12 follows: 13 8.78 Background checks. 14 An applicant for employment with the department, or 15 an applicant for employment with a supported entity for a 16 position as information technology staff, may be subject to a 17 background investigation by the department. The background 18 investigation may include, without limitation, a work history, 19 financial review, request for criminal history data, and 20 national criminal history check through the federal bureau of 21 investigation. In addition, a contractor, vendor, employee, or 22 any other individual performing work for the department, or an 23 individual on the information technology staff of a supported 24 entity, may be subject to a national criminal history check 25 through the federal bureau of investigation at least once 26 every ten five years, including, without limitation, any time 27 the department or supported entity has reason to believe an 28 individual has been convicted of a crime. The department may 29 request the national criminal history check and, if requested, 30 shall provide the individual’s fingerprints to the department 31 of public safety for submission through the state criminal 32 history repository to the federal bureau of investigation. 33 The individual shall authorize release of the results of the 34 national criminal history check to the department and the 35 -3- LSB 5269XD (6) 91 sc/ns 3/ 15

S.F. _____ H.F. _____ applicable supported entity. The department shall pay the 1 actual cost of the fingerprinting and national criminal history 2 check, if any, unless otherwise agreed as part of a contract 3 between the department or supported entity and a vendor or 4 contractor performing work for the department or supported 5 entity. The results of a criminal history check conducted 6 pursuant to this section shall not be considered a public 7 record under chapter 22 . 8 Sec. 3. NEW SECTION . 8.94 Contracts —— prohibited terms. 9 Provisions included in a contract entered into pursuant to 10 this subchapter that impose terms or conditions prohibited by 11 this section are void as contrary to public policy. Such a 12 contract shall be interpreted and enforced as if the contract 13 did not include the prohibited terms or conditions. Prohibited 14 terms and conditions include all of the following: 15 1. A provision requiring the department or a supported 16 entity to defend, indemnify, hold harmless another person, or 17 otherwise assume the debt or liability of another person in 18 violation of Article VII, section 1, of the Constitution of the 19 State of Iowa. 20 2. A provision that seeks to impose a term that is unknown 21 to the department or supported entity at the time of signing 22 the contract or that can be unilaterally changed by an entity 23 other than the department or a supported entity. 24 3. A provision that violates chapter 13 by not allowing 25 the department or a supported entity to participate in its own 26 defense through representation by the attorney general. 27 4. A provision that grants to a person other than the 28 attorney general the authority to convey to a court or litigant 29 the state’s consent to any settlement of a suit involving the 30 contract when such settlement could impose liability on the 31 state. 32 5. A provision that specifies that the contract is governed 33 by the laws of a foreign state or nation. 34 6. A provision that claims blanket confidentiality of the 35 -4- LSB 5269XD (6) 91 sc/ns 4/ 15

S.F. _____ H.F. _____ contract’s terms. 1 7. A provision that claims that payment terms, including but 2 not limited to cost proposals or other pricing information, of 3 the contract are confidential. 4 8. A provision that authorizes or requires a venue for 5 litigation other than an appropriate state or federal court 6 sitting in Iowa. 7 9. A provision that requires the department or a supported 8 entity to pay attorney fees, court costs, or other litigation 9 expenses in the event of a contractual dispute. 10 10. A provision that imposes on the department or a 11 supported entity binding arbitration or any other binding 12 extrajudicial dispute resolution process in which the final 13 resolution is not determined by the state. 14 11. A provision that waives the department’s or a supported 15 entity’s right to a jury trial. 16 12. A provision that obligates the department or a supported 17 entity to pay late payment charges not consistent with section 18 8A.514, interest greater than allowed under section 8A.514 or 19 other applicable law, or any cancellation charges, as such 20 charges constitute pledges of the state’s credit. 21 13. A provision that obligates the department or a supported 22 entity to pay a tax. 23 14. A provision that imposes a prior notice obligation 24 on the department or a supported entity as a condition for 25 the automatic renewal of a software license. The department 26 or a supported entity may provide notice of its intent to 27 terminate a software license at any time before the renewal 28 date established in the contract. 29 15. A provision that obligates the department or a supported 30 entity to accept risk of loss before the receipt of items or 31 goods. 32 16. A provision that obligates the department or a supported 33 entity to have commercial insurance. 34 17. A provision that obligates the department or a supported 35 -5- LSB 5269XD (6) 91 sc/ns 5/ 15

S.F. _____ H.F. _____ entity to grant to a nongovernmental entity full or partial 1 ownership of intellectual property developed pursuant to the 2 contract when the intellectual property is developed in whole 3 or in part using federal funding. 4 18. A provision that limits the time in which the department 5 or a supported entity may bring a legal claim under the 6 contract to a period shorter than that provided in Iowa law. 7 19. A boilerplate provision included in transactional 8 documents received by the department or a supported entity that 9 seeks to alter the terms of the contract or to impose new terms 10 in the contract. 11 Sec. 4. NEW SECTION . 8.95 Contracts —— required terms. 12 All of the following provisions shall be deemed to be 13 included in a contract entered into by the department or a 14 supported entity under this subchapter: 15 1. Governing law. The contract shall be governed by 16 the laws of the state of Iowa, without giving effect to any 17 conflicts of law principles of Iowa law that may require the 18 application of another jurisdiction’s law. 19 2. Venue. Any litigation commenced in connection with the 20 contract shall be brought and maintained in an appropriate 21 state or federal court sitting in Iowa. 22 3. State data. “State data” means all data, records, 23 information, or content, in any form, that is provided by a 24 state governmental entity to a vendor or that is collected, 25 generated, or otherwise obtained by the vendor in the course of 26 providing a good or service to the state governmental entity. 27 “State data” does not include aggregated or deidentified data 28 collected by the vendor and used exclusively for the vendor’s 29 internal purposes directly related to evaluating or improving 30 system performance, ensuring reliability, evaluating product 31 functionality, conducting system analytics, projecting needs 32 through capacity planning, ensuring license compliance, or 33 evaluating security. State data shall at all times remain the 34 sole and exclusive property of the state, and the vendor shall 35 -6- LSB 5269XD (6) 91 sc/ns 6/ 15

S.F. _____ H.F. _____ use state data only as necessary to provide the contracted 1 services to the state. Upon request, the vendor shall provide 2 the state, at no cost, a current copy of all state data in a 3 commercially reasonable and state-acceptable digital format 4 that enables the state to readily use, transfer, or migrate 5 the state data. Except to the extent retention of state data 6 is required by law, the vendor shall, after confirming that 7 the state has received a copy of the state data, permanently 8 delete all state data upon the conclusion or termination of 9 the contract. At all times, including any post-contract 10 period in which state data is retained due to record retention 11 obligations, the vendor shall protect state data in accordance 12 with current state data protection policies. 13 Sec. 5. NEW SECTION . 8.96 Contracts —— limitation of 14 liability —— prohibited terms. 15 Notwithstanding section 8A.311, subsection 22, and rules 16 adopted pursuant to that subsection, the director may include 17 a contractual limitation of vendor liability in information 18 technology goods and services contracts. A contractual 19 limitation of vendor liability must take into consideration the 20 public interest and the mitigation of risks associated with the 21 use of information technology goods or services. Any portion 22 of a contractual limitation of vendor liability that includes 23 a repudiation of all liability for cybersecurity incidents or 24 a limitation on the vendor’s liability for intentional torts, 25 criminal acts, fraudulent conduct, intentional or willful 26 misconduct, gross negligence, death, bodily injury, damage to 27 real or personal property, intellectual property violations, 28 liquidated damages, compliance with applicable laws, violations 29 of confidential information obligations, or contractual 30 obligations of the vendor pertaining to indemnification shall 31 be void as a matter of law as contrary to public policy. A 32 contractual limit of vendor liability that does not apply 33 equally to the contracted parties or that limits a vendor’s 34 liability to less than the contract value inclusive of all 35 -7- LSB 5269XD (6) 91 sc/ns 7/ 15

S.F. _____ H.F. _____ possible extensions is void as a matter of law as contrary to 1 public policy. 2 Sec. 6. NEW SECTION . 8.97 Confidentiality of communications 3 with chief information security officer. 4 In the interest of facilitating communication between 5 the chief information security officer and other entities 6 concerning security incidents and security breaches, all such 7 communications and any documents generated based in whole or in 8 part on such communications are confidential. Notwithstanding 9 chapter 22 or any other provision of law to the contrary, the 10 department shall not release such communications pursuant to 11 state open records laws, and such communications shall not be 12 received into evidence, subject to discovery, or otherwise 13 used in a trial, hearing, or other proceeding in or before any 14 court, regulatory body, or other authority of the state or a 15 political subdivision of the state, unless the communications 16 are subject to a protective order that prohibits further 17 disclosure of such communications and requires any court 18 filings of such communications to be made under seal. It is 19 the intent of the general assembly that these prohibitions and 20 restrictions also apply to federal courts, regulatory bodies, 21 and other authorities and for purposes of federal open records 22 laws, to the extent allowed by federal law and court rules. 23 The chief information security officer shall not release such 24 communications other than for any of the following purposes: 25 1. Identifying a cybersecurity threat, including the source 26 of the cybersecurity threat, or a security vulnerability, and 27 then only to government officials for purposes of addressing 28 the threat. 29 2. Responding to, or otherwise preventing or mitigating, 30 a specific threat of death, serious bodily harm, or serious 31 economic harm. 32 3. Responding to, investigating, prosecuting, or otherwise 33 preventing or mitigating a serious threat to a minor, including 34 sexual exploitation and threats to physical safety. 35 -8- LSB 5269XD (6) 91 sc/ns 8/ 15

S.F. _____ H.F. _____ 4. Preventing, investigating, disrupting, or prosecuting an 1 offense under state or federal law. 2 5. Providing a confidential cybersecurity briefing to the 3 governor or a member of the general assembly. 4 Sec. 7. NEW SECTION . 8.98 Criminal justice information. 5 1. The department is authorized to maintain an integrated 6 information system that enables automated data sharing among 7 the executive branch, judicial branch, and local agencies. 8 2. The department is designated as the Iowa statistical 9 analysis center for the purpose of coordinating with data 10 resource agencies to provide data and analytical information 11 to federal, state, and local governments. Notwithstanding any 12 other provision of state law to the contrary, unless prohibited 13 by federal law or regulation, the department shall be granted 14 access, for purposes of research and evaluation, to all of 15 the data listed in this subsection, except that intelligence 16 data and peace officer investigative reports maintained 17 by the department of public safety shall not be considered 18 data for the purposes of this section. The department of 19 management and any record, data, or information obtained by the 20 department under this subsection is subject to the federal and 21 state confidentiality laws and rules, including as described 22 in chapter 22, applicable to the original record, data, or 23 information, and to the original custodian of the record, 24 data, or information. Authorized access under this subsection 25 includes but is not limited to all of the following: 26 a. Juvenile court records and all other information 27 maintained under sections 232.147 through 232.151. 28 b. Child abuse information under sections 235A.15 through 29 235A.19. 30 c. Dependent adult abuse records maintained under chapter 31 235B. 32 d. Criminal history data maintained under chapter 692. 33 e. Sex offender registry information maintained under 34 chapter 692A. 35 -9- LSB 5269XD (6) 91 sc/ns 9/ 15

S.F. _____ H.F. _____ f. Presentence investigation reports maintained under 1 section 901.4. 2 g. Corrections records maintained under sections 904.601 and 3 904.602. 4 h. Community-based correctional program records maintained 5 under chapter 904. 6 i. Parole records maintained under chapter 906. 7 j. Deferred judgment, deferred or suspended sentence, and 8 probation records maintained under chapter 907. 9 k. Violation of parole or probation records maintained under 10 chapter 908. 11 l. Fine and victim restitution records maintained under 12 chapters 909 and 910. 13 m. Child welfare records maintained under chapter 235. 14 3. The department is authorized to provide data analysis and 15 reporting on issues that may affect the state’s correctional 16 population and various subgroups of the population. This 17 reporting may include the review of filed, public legislative 18 bills, joint resolutions, and amendments, and compiling 19 criminal justice data for completion of correctional impact 20 statements under section 2.56, minority impact statements, and 21 an annual prison population forecast. 22 4. The department is authorized to maintain a multiagency 23 information system to track the progress of juveniles and 24 adults who have been charged with a criminal offense in 25 the court system through various state and local agencies 26 and programs. This system must utilize existing databases, 27 including the Iowa court information system, the Iowa 28 corrections offender network, the child welfare information 29 system of the department of health and human services, 30 the federally mandated national adoption and foster care 31 information system, and other state and local databases 32 pertaining to juveniles and to adults who have been charged 33 with a criminal offense in the court system, to the extent 34 practicable. 35 -10- LSB 5269XD (6) 91 sc/ns 10/ 15

S.F. _____ H.F. _____ 5. The multiagency information system is authorized to 1 count and track decision points for juveniles in the juvenile 2 justice system and minors in the child welfare system, evaluate 3 the experiences of the juveniles and minors, and evaluate 4 the success of the services provided. The system is also 5 authorized to count and track decision points for adults who 6 have been charged with a criminal offense in the court system, 7 including but not limited to dismissed charges, convictions, 8 deferred judgments, and sentence information. 9 6. If the department has insufficient moneys or resources 10 to implement this section, the department is authorized to 11 determine which portion of this section may be implemented, if 12 any, and the remainder of this section shall not apply. 13 Sec. 8. NEW SECTION . 8.99 Confidentiality of data. 14 1. For purposes of chapter 22, the department shall not be 15 deemed to be the lawful custodian of records the department 16 maintains for another department or establishment under this 17 subchapter, to the extent the records in question are held 18 by the department as an automated data processing unit of 19 government or held by the department solely for storage for 20 another department or establishment. Such records include but 21 are not limited to all of the following: 22 a. Electronic messaging system data. 23 b. Mainframe data. 24 c. Storage solutions or other electronic information, such 25 as on-premises server data storage and cloud data storage. 26 2. If the department receives a request pursuant to chapter 27 22 for records over which the department has determined it is 28 not the lawful custodian, the department shall deny the request 29 and inform the requester to seek the information from the 30 lawful custodian as provided in chapter 22. The department’s 31 determination that it is not the lawful custodian of records is 32 presumed valid. The presumption may be rebutted by clear and 33 convincing evidence to the contrary. 34 3. The department shall provide assistance to the lawful 35 -11- LSB 5269XD (6) 91 sc/ns 11/ 15

S.F. _____ H.F. _____ custodian of records held by the department so that the lawful 1 custodian can comply with the production obligations of chapter 2 22. 3 4. If the department receives a subpoena in an 4 administrative, civil, or criminal case for records for which 5 the department is not the lawful custodian, the department 6 shall notify the lawful custodian and the attorney general’s 7 office and cooperate in any efforts to resist the subpoena. 8 Sec. 9. Section 216A.131A, Code 2026, is amended to read as 9 follows: 10 216A.131A Criminal and juvenile justice planning. 11 The department shall fulfill the responsibilities of 12 this subchapter , including the duties specified in sections 13 216A.133, 216A.135, 216A.136 , 216A.137 , 216A.138 , and 216A.140 . 14 Sec. 10. Section 216A.133, subsection 1, paragraphs d, e, f, 15 l, and t, Code 2026, are amended by striking the paragraphs. 16 Sec. 11. Section 216A.133, subsection 1, paragraph q, 17 subparagraphs (1) and (6), Code 2026, are amended by striking 18 the subparagraphs. 19 Sec. 12. Section 216A.133, subsection 1, paragraph s, Code 20 2026, is amended to read as follows: 21 s. Provide expertise and advice to the legislative 22 services agency, the department of management, the department 23 of corrections, the judicial branch, and others charged 24 with formulating fiscal, correctional, or minority impact 25 statements. 26 Sec. 13. Section 216A.135, subsection 2, paragraph e, Code 27 2026, is amended by striking the paragraph. 28 Sec. 14. Section 232.147, subsection 2, paragraph i, Code 29 2026, is amended to read as follows: 30 i. The statistical analysis center for the purposes stated 31 in section 216A.136 8.98 . 32 Sec. 15. Section 232.147, subsection 3, paragraph n, Code 33 2026, is amended to read as follows: 34 n. The statistical analysis center for the purposes stated 35 -12- LSB 5269XD (6) 91 sc/ns 12/ 15

S.F. _____ H.F. _____ in section 216A.136 8.98 . 1 Sec. 16. Section 232.147, subsection 4, paragraph i, Code 2 2026, is amended to read as follows: 3 i. The statistical analysis center for the purposes stated 4 in section 216A.136 8.98 . 5 Sec. 17. Section 232.149, subsection 5, paragraph f, Code 6 2026, is amended to read as follows: 7 f. The statistical analysis center for the purposes stated 8 in section 216A.136 8.98 . 9 Sec. 18. Section 232.149A, subsection 3, paragraph m, Code 10 2026, is amended to read as follows: 11 m. The statistical analysis center for the purposes stated 12 in section 216A.136 8.98 . 13 Sec. 19. REPEAL. Sections 216A.136, 216A.137, and 14 216A.138, Code 2026, are repealed. 15 Sec. 20. EFFECTIVE DATE. The following take effect July 1, 16 2027: 17 The portions of the section of this Act amending section 18 8.57C, subsections 2 and 4. 19 Sec. 21. APPLICABILITY. The following apply to contracts 20 entered into or renewed on or after July 1, 2026: 21 1. The section of this Act enacting section 8.94. 22 2. The section of this Act enacting section 8.95. 23 3. The section of this Act enacting section 8.96. 24 EXPLANATION 25 The inclusion of this explanation does not constitute agreement with 26 the explanation’s substance by the members of the general assembly. 27 This bill relates to matters under the purview of the 28 department of management (DOM). 29 The bill strikes current law providing for the use of moneys 30 in the technology reinvestment fund for certain technology 31 projects and instead requires DOM to use moneys in the fund for 32 technology projects using factors set forth in the bill. The 33 bill requires DOM to provide a prioritized list of proposed 34 projects to the governor, who must use the list to develop 35 -13- LSB 5269XD (6) 91 sc/ns 13/ 15

S.F. _____ H.F. _____ a budgetary recommendation to the general assembly, and to 1 report completed and ongoing projects to the general assembly 2 annually. The bill strikes the standing appropriations to 3 the technology reinvestment fund and provides that any moneys 4 in the fund shall remain available for two years after the 5 appropriation is made. 6 The bill increases the frequency at which a person 7 performing work for DOM or an individual on the information 8 technology staff of a supported entity may be subject to a 9 national criminal history check through the federal bureau of 10 investigation from at least once every 10 years to every 5 11 years. 12 The bill prohibits the inclusion of certain provisions in 13 information technology contracts and declares those provisions 14 void if present in such contracts. The bill also provides 15 that such contracts are deemed to include provisions relating 16 to state data, requiring the contract to be governed by Iowa 17 law, and requiring litigation related to the contract to be 18 brought and maintained in a state or federal court sitting 19 in Iowa. The bill authorizes the director of DOM to include 20 limitations of vendor liability in information technology goods 21 and services contracts, but sets forth prohibited terms in such 22 limitations of liability. 23 The bill makes all communication concerning cybersecurity 24 between the chief information security officer and other 25 entities confidential and allows the communications to be 26 released only for specific purposes. 27 Under current law, the department of health and human 28 services serves as the Iowa statistical analysis center and 29 maintains an integrated information system for data sharing 30 among federal, state, and local governments. The bill 31 transfers these powers and duties to DOM and grants DOM access 32 to criminal justice information other than intelligence data 33 and peace officer investigative reports maintained by the 34 department of public safety. DOM is authorized to provide 35 -14- LSB 5269XD (6) 91 sc/ns 14/ 15

S.F. _____ H.F. _____ data analysis and reporting on issues that may affect the 1 state’s correctional population and various subgroups of the 2 population, to maintain a multiagency information system to 3 track the progress of juveniles and adults charged with a 4 criminal offense through state and local agencies and programs, 5 and to count and track decision points for individuals in 6 the juvenile justice system, child welfare system, and 7 court system. If DOM lacks sufficient moneys to perform the 8 authorized tasks of the Iowa statistical analysis center, the 9 bill allows DOM to determine which, if any, to implement. 10 The bill states that DOM is not the lawful custodian under 11 Code chapter 22 (open records) for records DOM maintains in 12 DOM’s information technology capacity for other state entities 13 as an automated data processing unit of government or when 14 held by DOM solely for storage for another department or 15 establishment. The bill requires DOM to deny requests for 16 information for which DOM is not the lawful custodian, to 17 provide assistance to the lawful custodian to comply with 18 production obligations, and to cooperate in any efforts to 19 resist associated subpoenas. 20 -15- LSB 5269XD (6) 91 sc/ns 15/ 15