Gov. Nikki Haley’s latest argument for replacing the Budget and Control Board with a new Department of Administration controlled by governors is that we need a muscular information technology division that can make sure state agencies protect their records from cyber attacks.

When she talked with editorial writers last month, she said requiring her Cabinet agencies to adopt more aggressive security measures not only protects those agencies, but also reminds legislators that “this is all I can do.”

In fact, it’s not.

We agree entirely that the governor should control the state’s central administrative agency, and that the agency should oversee the state’s information-technology network, rather than simply serving as a vendor. But like her three predecessors, Gov. Haley has significantly more power over state government than she acknowledges.

Governors have always been able to replace the members of a ridiculous number of agency governing boards once their terms expire. But one of the least-appreciated changes in the 1993 restructuring law allowed them to replace most of those people at any time, for any or no reason. That means that while the governor can’t fire the director of, say, the Department of Mental Health, she can tell her appointees to the agency’s governing board that she will replace them if they don’t fire the director. Or if they don’t see to it that the director carries out whatever policies she wants carried out.

It’s a bulky, difficult-to-execute sort of power, and needlessly so. And as Gov. Mark Sanford discovered when he tried to make the most limited use of it – not to directly influence policy but simply to replace some board members before their terms expired because that was what he wanted to do – the Legislature doesn’t like for governors to exercise it. (Lawmakers stripped governors of the power to replace their appointees to the Ports Authority and Santee Cooper when Mr. Sanford had the nerve to actually do that.)

But it’s power nonetheless. And while it obviously needs to be used judiciously if the governor wants to avoid further alienating the Legislature – and this is something she should want to do – it’s power that needs to be used from time to time. Like, for instance, when the state has discovered in the most embarrassing of ways that it has been far too lax about computer security and there are obvious steps that need to be taken.

When the governor ordered her Cabinet agencies to use the Division of State Information Technology’s 24/7 computer network monitoring services, which can spot unusual uploads or downloads and malicious programs within minutes, she also “encouraged” other state agencies to do likewise. And that is in fact all she can do with colleges and universities and handful of other agencies that are completely outside of her reach.

But she can and should make it clear to her appointees to the governing boards of most state agencies that she expects those agencies to take action as well, or else they should expect to be replaced. It would be a nice little test run of governors’ unacknowledged power over a large swath of state government.

We can’t imagine any legislator objecting to the governor using her removal authority in order to achieve that particular policy goal. And we have a feeling that the voters would deal harshly with any who did.