H.F. 1028 Section 1. Section 2.42, Code 2025, is amended by adding the 1 following new subsection: 2 NEW SUBSECTION . 17. To review and disapprove 3 interdepartmental transfers described in section 8.39, 4 subsection 4, paragraph “c” , as the council may determine. 5 Sec. 2. Section 8.39, subsections 2 and 4, Code 2025, are 6 amended to read as follows: 7 2. If the appropriation of a department, institution, 8 or agency is insufficient to properly meet the legitimate 9 expenses of the department, institution, or agency, the 10 director of the department of management , with the approval 11 of the governor, may make an interdepartmental transfer from 12 any other department, institution, or agency of the state 13 having an appropriation in excess of its needs, of sufficient 14 funds moneys to meet that deficiency. Such transfer shall 15 be to an appropriation made from the same funding source and 16 within the same fiscal year. The amount of a transfer made 17 from an appropriation under this subsection shall be limited 18 to not more than one-tenth of one percent of the total of all 19 appropriations made from the funding source of the transferred 20 appropriation for the fiscal year in which the transfer is 21 made. An interdepartmental transfer to an appropriation which 22 is not an entitlement appropriation is not authorized when 23 the general assembly is in regular session and, in addition, 24 the sum of interdepartmental transfers in a fiscal year to an 25 appropriation which is not an entitlement appropriation shall 26 not exceed fifty percent of the amount of the appropriation 27 as enacted by the general assembly. For the purposes of this 28 subsection , an entitlement appropriation is : 29 a. “Appropriation in excess of its needs” means that the 30 amount appropriated by the general assembly for a purpose is 31 determined by the department, institution, or agency receiving 32 the appropriation to be more than the amount necessary to carry 33 out that purpose. An appropriation for an unspecified dollar 34 amount, whether the appropriation is limited to be sufficient 35 -1- HF 1028 (4) 91 sc/ns/md 1/ 15

H.F. 1028 to carry out a particular purpose or is unlimited, shall not 1 be considered an appropriation in excess of a department’s, 2 institution’s, or agency’s needs. 3 b. “Entitlement appropriation” means a line item 4 appropriation to the state public defender for indigent defense 5 or to the department of health and human services for foster 6 care, state supplementary assistance, medical assistance, or 7 for the family investment program. 8 4. a. Prior to any transfer of funds moneys pursuant 9 to subsection 1 or 2 of this section , or a transfer of an 10 allocation from a subunit of a department which statutorily has 11 independent budgeting authority, the director of the department 12 of management shall notify the chairpersons of the standing 13 committees on appropriations of the senate and the house of 14 representatives and the chairpersons of subcommittees of such 15 committees of the proposed transfer. The notice from the 16 director shall include information concerning the amount of the 17 proposed transfer, the departments, institutions, or agencies 18 affected by the proposed transfer , and the reasons for the 19 proposed transfer. Chairpersons 20 b. Unless a transfer is governed under paragraph “c” , 21 chairpersons notified shall be given at least two weeks to 22 review and comment on the proposed transfer before the transfer 23 of funds is made. 24 c. (1) This paragraph applies to any transfer made for a 25 fiscal year under subsection 2 between July 1 of that fiscal 26 year and the subsequent first day of the regular session of the 27 general assembly occurring in that fiscal year. 28 (2) The director shall submit the notice required by this 29 subsection to the chairpersons at least three weeks before the 30 proposed transfer is made. 31 (3) In addition to the information otherwise required, the 32 notice required by this subsection and submitted under this 33 paragraph must also include all of the following: 34 (a) Information demonstrating that the appropriation from 35 -2- HF 1028 (4) 91 sc/ns/md 2/ 15

H.F. 1028 which the transfer will be made is in excess of the entity’s 1 needs taking into account the date on which the transfer will 2 occur within the fiscal year, and the reason the excess was not 3 anticipated. 4 (b) Information demonstrating that the appropriation to 5 which the transfer will be made is insufficient to properly 6 meet the legitimate expenses of the entity taking into account 7 the date on which the transfer will occur within the fiscal 8 year, and the reason the deficiency was not anticipated. 9 (c) Information demonstrating that sufficient state moneys 10 are available in the single funding source involved in the 11 transfer, and citations to the law under which all entities 12 affected by the transfer were appropriated moneys from that 13 funding source for the applicable fiscal year. 14 (4) Prior to the date the proposed transfer will be made, 15 the legislative council may meet to consider the transfer. At 16 the meeting, the legislative council may vote to disapprove the 17 transfer. If the legislative council disapproves the transfer, 18 the transfer shall not occur. 19 Sec. 3. Section 8.57C, subsections 2, 3, and 4, Code 2025, 20 are amended to read as follows: 21 2. Moneys in the fund in a fiscal year shall be used as 22 appropriated by the general assembly for the acquisition 23 of computer hardware and software, software development, 24 telecommunications equipment, and maintenance and lease 25 agreements associated with technology components and for the 26 purchase of equipment intended to provide an uninterruptible 27 power supply are appropriated to the department of management 28 to provide a stable funding source for implementation costs 29 of state information technology projects that enhance the 30 state’s technology infrastructure, improve government services, 31 and promote innovation and economic development, including 32 but not limited to new information technology projects 33 and infrastructure replacement efforts of a department or 34 establishment . 35 -3- HF 1028 (4) 91 sc/ns/md 3/ 15

H.F. 1028 a. The department shall prioritize proposed projects based 1 on all of the following considerations: 2 (1) Whether the project aligns with the state’s strategic 3 priorities. 4 (2) Whether the project promotes or introduces new 5 technology or significantly improves an existing system. 6 (3) Whether the project is feasible and whether the 7 department or establishment has established readiness for the 8 project to proceed, including a clear assessment of timelines, 9 budgets, and measurable outcomes. 10 (4) Whether the project includes a clear change management 11 strategy to support user adoption and aligns with lean 12 enterprise principles to maximize value, minimize waste, and 13 ensure continuous improvement. 14 (5) Whether the project provides a positive return on 15 investment, considering both financial returns and nonfinancial 16 benefits such as improved public safety, education, or health 17 care. 18 (6) Whether the project results in infrastructure that is 19 scalable across the state enterprise. 20 (7) Whether the department or establishment has identified 21 how the completed project will be sustained beyond the initial 22 funding period. 23 (8) Whether the project improves access to governmental 24 services, particularly in rural communities. 25 (9) Whether the project involves an infrastructure project 26 as opposed to maintenance or standard upgrades of existing 27 technology. 28 b. The department shall provide a prioritized list of 29 proposed projects for funding to the governor, who shall use 30 the list in developing a budgetary recommendation for the 31 general assembly pursuant to section 8.21. 32 3. a. There is appropriated from the general fund of the 33 state to the technology reinvestment fund for the fiscal year 34 beginning July 1, 2025, and for each subsequent fiscal year 35 -4- HF 1028 (4) 91 sc/ns/md 4/ 15

H.F. 1028 thereafter, the sum of seventeen million five hundred thousand 1 dollars. 2 b. There is appropriated from the rebuild Iowa 3 infrastructure fund for the fiscal year beginning July 1, 2023, 4 and ending June 30, 2024, the sum of eighteen million three 5 hundred ninety thousand two hundred ninety dollars to the 6 technology reinvestment fund, notwithstanding section 8.57, 7 subsection 3 , paragraph “c” . 8 c. There is appropriated from the rebuild Iowa 9 infrastructure fund for the fiscal year beginning July 1, 2024, 10 and ending June 30, 2025, the sum of twenty-one million one 11 hundred thirty-one thousand eight hundred seventy-three dollars 12 to the technology reinvestment fund, notwithstanding section 13 8.57, subsection 3 , paragraph “c” . 14 b. Notwithstanding section 8.33, moneys in the fund 15 that remain unencumbered or unobligated at the close of a 16 fiscal year shall not revert but shall remain available for 17 expenditure for the purposes designated. Notwithstanding 18 section 12C.7, subsection 2, interest or earnings on moneys in 19 the fund shall be credited to the fund. 20 4. Annually, on On or before January 15 of each year, a 21 state agency that received an appropriation from this fund 22 the department of management shall report to the legislative 23 services agency and the department of management general 24 assembly the status of all projects funded under this section 25 that have been completed since the previous report was 26 submitted or that are in progress. The report shall must 27 include a description of the project, the progress of work 28 completed, the total estimated cost of the project, a list of 29 all revenue sources being used to fund the project, the amount 30 of funds moneys expended, the amount of funds moneys obligated, 31 and the date the project was completed or an estimated 32 completion date of the project, where applicable. 33 Sec. 4. Section 8.78, Code 2025, is amended to read as 34 follows: 35 -5- HF 1028 (4) 91 sc/ns/md 5/ 15

H.F. 1028 8.78 Background checks. 1 An applicant for employment with the department, or 2 an applicant for employment with a supported entity for a 3 position as information technology staff, may be subject to a 4 background investigation by the department. The background 5 investigation may include, without limitation, a work history, 6 financial review, request for criminal history data, and 7 national criminal history check through the federal bureau of 8 investigation. In addition, a contractor, vendor, employee, or 9 any other individual performing work for the department, or an 10 individual on the information technology staff of a supported 11 entity, may be subject to a national criminal history check 12 through the federal bureau of investigation at least once 13 every ten five years, including, without limitation, any time 14 the department or supported entity has reason to believe an 15 individual has been convicted of a crime. The department may 16 request the national criminal history check and, if requested, 17 shall provide the individual’s fingerprints to the department 18 of public safety for submission through the state criminal 19 history repository to the federal bureau of investigation. 20 The individual shall authorize release of the results of the 21 national criminal history check to the department and the 22 applicable supported entity. The department shall pay the 23 actual cost of the fingerprinting and national criminal history 24 check, if any, unless otherwise agreed as part of a contract 25 between the department or supported entity and a vendor or 26 contractor performing work for the department or supported 27 entity. The results of a criminal history check conducted 28 pursuant to this section shall not be considered a public 29 record under chapter 22 . 30 Sec. 5. NEW SECTION . 8.94 Contracts —— prohibited terms. 31 Provisions included in a contract entered into pursuant to 32 this subchapter that impose terms or conditions prohibited by 33 this section are void as contrary to public policy. Such a 34 contract shall be interpreted and enforced as if the contract 35 -6- HF 1028 (4) 91 sc/ns/md 6/ 15

H.F. 1028 did not include the prohibited terms or conditions. Prohibited 1 terms and conditions include all of the following: 2 1. A provision requiring the department or a supported 3 entity to defend, indemnify, hold harmless another person, or 4 otherwise assume the debt or liability of another person in 5 violation of Article VII, section 1, of the Constitution of the 6 State of Iowa. 7 2. A provision that seeks to impose a term that is unknown 8 to the department or supported entity at the time of signing 9 the contract or that can be unilaterally changed by an entity 10 other than the department or a supported entity. 11 3. A provision that violates chapter 13 by not allowing 12 the department or a supported entity to participate in its own 13 defense through representation by the attorney general. 14 4. A provision that grants to a person other than the 15 attorney general the authority to convey to a court or litigant 16 the state’s consent to any settlement of a suit involving the 17 contract when such settlement could impose liability on the 18 state. 19 5. A provision that specifies that the contract is governed 20 by the laws of a foreign state or nation. 21 6. A provision that claims blanket confidentiality of the 22 contract’s terms. 23 7. A provision that claims that payment terms, including but 24 not limited to cost proposals or other pricing information, of 25 the contract are confidential. 26 8. A provision that authorizes or requires a venue for 27 litigation other than an appropriate state or federal court 28 sitting in Iowa. 29 9. A provision that requires the department or a supported 30 entity to pay attorney fees, court costs, or other litigation 31 expenses in the event of a contractual dispute. 32 10. A provision that imposes on the department or a 33 supported entity binding arbitration or any other binding 34 extrajudicial dispute resolution process in which the final 35 -7- HF 1028 (4) 91 sc/ns/md 7/ 15

H.F. 1028 resolution is not determined by the state. 1 11. A provision that waives the department’s or a supported 2 entity’s right to a jury trial. 3 12. A provision that obligates the department or a supported 4 entity to pay late payment charges not consistent with section 5 8A.514, interest greater than allowed under section 8A.514 or 6 other applicable law, or any cancellation charges, as such 7 charges constitute pledges of the state’s credit. 8 13. A provision that obligates the department or a supported 9 entity to pay a tax. 10 14. A provision that imposes a prior notice obligation 11 on the department or a supported entity as a condition for 12 the automatic renewal of a software license. The department 13 or a supported entity may provide notice of its intent to 14 terminate a software license at any time before the renewal 15 date established in the contract. 16 15. A provision that obligates the department or a supported 17 entity to accept risk of loss before the receipt of items or 18 goods. 19 16. A provision that obligates the department or a supported 20 entity to have commercial insurance. 21 17. A provision that obligates the department or a supported 22 entity to grant to a nongovernmental entity full or partial 23 ownership of intellectual property developed pursuant to the 24 contract when the intellectual property is developed in whole 25 or in part using federal funding. 26 18. A provision that limits the time in which the department 27 or a supported entity may bring a legal claim under the 28 contract to a period shorter than that provided in Iowa law. 29 19. A boilerplate provision included in transactional 30 documents received by the department or a supported entity that 31 seeks to alter the terms of the contract or to impose new terms 32 in the contract. 33 Sec. 6. NEW SECTION . 8.95 Contracts —— required terms. 34 All of the following provisions shall be deemed to be 35 -8- HF 1028 (4) 91 sc/ns/md 8/ 15

H.F. 1028 included in a contract entered into by the department or a 1 supported entity under this subchapter: 2 1. Governing law. The contract shall be governed by 3 the laws of the state of Iowa, without giving effect to any 4 conflicts of law principles of Iowa law that may require the 5 application of another jurisdiction’s law. 6 2. Venue. Any litigation commenced in connection with the 7 contract shall be brought and maintained in an appropriate 8 state or federal court sitting in Iowa. 9 Sec. 7. NEW SECTION . 8.96 Contracts —— limitation of 10 liability —— prohibited terms. 11 Notwithstanding section 8A.311, subsection 22, and rules 12 adopted pursuant to that subsection, the director may include 13 a contractual limitation of vendor liability in information 14 technology goods and services contracts. A contractual 15 limitation of vendor liability must take into consideration the 16 public interest and the mitigation of risks associated with the 17 use of information technology goods or services. Any portion 18 of a contractual limitation of vendor liability that includes 19 a repudiation of all liability for cybersecurity incidents or 20 a limitation on the vendor’s liability for intentional torts, 21 criminal acts, fraudulent conduct, intentional or willful 22 misconduct, gross negligence, death, bodily injury, damage to 23 real or personal property, intellectual property violations, 24 liquidated damages, compliance with applicable laws, violations 25 of confidential information obligations, or contractual 26 obligations of the vendor pertaining to indemnification shall 27 be void as a matter of law as contrary to public policy. A 28 contractual limit of vendor liability that does not apply 29 equally to the contracted parties or that limits a vendor’s 30 liability to less than the contract value inclusive of all 31 possible extensions is void as a matter of law as contrary to 32 public policy. 33 Sec. 8. NEW SECTION . 8.97 Confidentiality of communications 34 with chief information security officer. 35 -9- HF 1028 (4) 91 sc/ns/md 9/ 15

H.F. 1028 In the interest of facilitating communication between 1 the chief information security officer and other entities 2 concerning security incidents and security breaches, all such 3 communications and any documents generated based in whole or in 4 part on such communications are confidential. Notwithstanding 5 chapter 22 or any other provision of law to the contrary, the 6 department shall not release such communications pursuant to 7 state open records laws, and such communications shall not be 8 received into evidence, subject to discovery, or otherwise 9 used in a trial, hearing, or other proceeding in or before any 10 court, regulatory body, or other authority of the state or a 11 political subdivision of the state, unless the communications 12 are subject to a protective order that prohibits further 13 disclosure of such communications and requires any court 14 filings of such communications to be made under seal. It is 15 the intent of the general assembly that these prohibitions and 16 restrictions also apply to federal courts, regulatory bodies, 17 and other authorities and for purposes of federal open records 18 laws, to the extent allowed by federal law and court rules. 19 The chief information security officer shall not release such 20 communications other than for any of the following purposes: 21 1. Identifying a cybersecurity threat, including the source 22 of the cybersecurity threat, or a security vulnerability, and 23 then only to government officials for purposes of addressing 24 the threat. 25 2. Responding to, or otherwise preventing or mitigating, 26 a specific threat of death, serious bodily harm, or serious 27 economic harm. 28 3. Responding to, investigating, prosecuting, or otherwise 29 preventing or mitigating a serious threat to a minor, including 30 sexual exploitation and threats to physical safety. 31 4. Preventing, investigating, disrupting, or prosecuting an 32 offense under state or federal law. 33 5. Providing a confidential cybersecurity briefing to the 34 governor or a member of the general assembly. 35 -10- HF 1028 (4) 91 sc/ns/md 10/ 15

H.F. 1028 Sec. 9. NEW SECTION . 8.98 Criminal justice information. 1 1. The department is authorized to maintain an integrated 2 information system that enables automated data sharing among 3 the executive branch, judicial branch, and local agencies. 4 2. The department is designated as the Iowa statistical 5 analysis center for the purpose of coordinating with data 6 resource agencies to provide data and analytical information 7 to federal, state, and local governments. Notwithstanding any 8 other provision of state law to the contrary, unless prohibited 9 by federal law or regulation, the department shall be granted 10 access, for purposes of research and evaluation, to all of 11 the data listed in this subsection, except that intelligence 12 data and peace officer investigative reports maintained 13 by the department of public safety shall not be considered 14 data for the purposes of this section. The department of 15 management and any record, data, or information obtained by the 16 department under this subsection is subject to the federal and 17 state confidentiality laws and rules, including as described 18 in chapter 22, applicable to the original record, data, or 19 information, and to the original custodian of the record, 20 data, or information. Authorized access under this subsection 21 includes but is not limited to all of the following: 22 a. Juvenile court records and all other information 23 maintained under sections 232.147 through 232.151. 24 b. Child abuse information under sections 235A.15 through 25 235A.19. 26 c. Dependent adult abuse records maintained under chapter 27 235B. 28 d. Criminal history data maintained under chapter 692. 29 e. Sex offender registry information maintained under 30 chapter 692A. 31 f. Presentence investigation reports maintained under 32 section 901.4. 33 g. Corrections records maintained under sections 904.601 and 34 904.602. 35 -11- HF 1028 (4) 91 sc/ns/md 11/ 15

H.F. 1028 h. Community-based correctional program records maintained 1 under chapter 904. 2 i. Parole records maintained under chapter 906. 3 j. Deferred judgment, deferred or suspended sentence, and 4 probation records maintained under chapter 907. 5 k. Violation of parole or probation records maintained under 6 chapter 908. 7 l. Fine and victim restitution records maintained under 8 chapters 909 and 910. 9 m. Child welfare records maintained under chapter 235. 10 3. The department is authorized to provide data analysis and 11 reporting on issues that may affect the state’s correctional 12 population and various subgroups of the population. This 13 reporting may include the review of filed, public legislative 14 bills, joint resolutions, and amendments, and compiling 15 criminal justice data for completion of correctional impact 16 statements under section 2.56, racial impact statements, and an 17 annual prison population forecast. 18 4. The department is authorized to maintain a multiagency 19 information system to track the progress of juveniles and 20 adults who have been charged with a criminal offense in 21 the court system through various state and local agencies 22 and programs. This system must utilize existing databases, 23 including the Iowa court information system, the Iowa 24 corrections offender network, the child welfare information 25 system of the department of health and human services, 26 the federally mandated national adoption and foster care 27 information system, and other state and local databases 28 pertaining to juveniles and to adults who have been charged 29 with a criminal offense in the court system, to the extent 30 practicable. 31 5. The multiagency information system is authorized to 32 count and track decision points for juveniles in the juvenile 33 justice system and minors in the child welfare system, evaluate 34 the experiences of the juveniles and minors, and evaluate 35 -12- HF 1028 (4) 91 sc/ns/md 12/ 15

H.F. 1028 the success of the services provided. The system is also 1 authorized to count and track decision points for adults who 2 have been charged with a criminal offense in the court system, 3 including but not limited to dismissed charges, convictions, 4 deferred judgments, and sentence information. 5 6. If the department has insufficient moneys or resources 6 to implement this section, the department is authorized to 7 determine which portion of this section may be implemented, if 8 any, and the remainder of this section shall not apply. 9 Sec. 10. NEW SECTION . 8.99 Confidentiality of data. 10 1. For purposes of chapter 22, the department shall not be 11 deemed to be the lawful custodian of records the department 12 maintains for another department or establishment under this 13 subchapter, to the extent the records in question are held 14 by the department as an automated data processing unit of 15 government or held by the department solely for storage for 16 another department or establishment. Such records include but 17 are not limited to all of the following: 18 a. Electronic messaging system data. 19 b. Mainframe data. 20 c. Storage solutions or other electronic information, such 21 as on-premises server data storage and cloud data storage. 22 2. If the department receives a request pursuant to chapter 23 22 for records over which the department has determined it is 24 not the lawful custodian, the department shall deny the request 25 and inform the requester to seek the information from the 26 lawful custodian as provided in chapter 22. The department’s 27 determination that it is not the lawful custodian of records is 28 presumed valid. The presumption may be rebutted by clear and 29 convincing evidence to the contrary. 30 3. The department shall provide assistance to the lawful 31 custodian of records held by the department so that the lawful 32 custodian can comply with the production obligations of chapter 33 22. 34 4. If the department receives a subpoena in an 35 -13- HF 1028 (4) 91 sc/ns/md 13/ 15

H.F. 1028 administrative, civil, or criminal case for records for which 1 the department is not the lawful custodian, the department 2 shall notify the lawful custodian and the attorney general’s 3 office and cooperate in any efforts to resist the subpoena. 4 Sec. 11. Section 216A.131A, Code 2025, is amended to read 5 as follows: 6 216A.131A Criminal and juvenile justice planning. 7 The department shall fulfill the responsibilities of 8 this subchapter , including the duties specified in sections 9 216A.133, 216A.135 , 216A.136 , 216A.137 , 216A.138 , and 216A.140 . 10 Sec. 12. Section 216A.133, subsection 1, paragraphs d, e, f, 11 l, and t, Code 2025, are amended by striking the paragraphs. 12 Sec. 13. Section 216A.133, subsection 1, paragraph q, 13 subparagraphs (1) and (6), Code 2025, are amended by striking 14 the subparagraphs. 15 Sec. 14. Section 216A.133, subsection 1, paragraph s, Code 16 2025, is amended to read as follows: 17 s. Provide expertise and advice to the legislative 18 services agency, the department of management, the department 19 of corrections, the judicial branch, and others charged 20 with formulating fiscal, correctional, or minority impact 21 statements. 22 Sec. 15. Section 216A.135, subsection 2, paragraph e, Code 23 2025, is amended by striking the paragraph. 24 Sec. 16. Section 232.147, subsection 2, paragraph i, Code 25 2025, is amended to read as follows: 26 i. The statistical analysis center for the purposes stated 27 in section 216A.136 8.98 . 28 Sec. 17. Section 232.147, subsection 3, paragraph n, Code 29 2025, is amended to read as follows: 30 n. The statistical analysis center for the purposes stated 31 in section 216A.136 8.98 . 32 Sec. 18. Section 232.147, subsection 4, paragraph i, Code 33 2025, is amended to read as follows: 34 i. The statistical analysis center for the purposes stated 35 -14- HF 1028 (4) 91 sc/ns/md 14/ 15

H.F. 1028 in section 216A.136 8.98 . 1 Sec. 19. Section 232.149, subsection 5, paragraph f, Code 2 2025, is amended to read as follows: 3 f. The statistical analysis center for the purposes stated 4 in section 216A.136 8.98 . 5 Sec. 20. Section 232.149A, subsection 3, paragraph m, Code 6 2025, is amended to read as follows: 7 m. The statistical analysis center for the purposes stated 8 in section 216A.136 8.98 . 9 Sec. 21. REPEAL. Sections 216A.136, 216A.137, and 10 216A.138, Code 2025, are repealed. 11 Sec. 22. APPLICABILITY. The following apply to contracts 12 entered into or renewed on or after the effective date of this 13 Act: 14 1. The section of this Act enacting section 8.94. 15 2. The section of this Act enacting section 8.95. 16 3. The section of this Act enacting section 8.96. 17 -15- HF 1028 (4) 91 sc/ns/md 15/ 15