Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - Bureau of the State House (November 8, 2024)
November 8, 2024 · Bureau of the State House · Read the full official report on mass.gov ↗
Published November 8, 2024 Audit covers July 1, 2021 – April 30, 2023 Under Diana DiZoglio · 2023–present
source
“EOTSS did not ensure that all of its employees completed cybersecurity awareness training.”
Read the plain-English breakdown
This is a State Auditor performance audit of cybersecurity awareness training compliance at EOTSS and 22 other public entities.
“This audit covers the period July 1, 2021 through April 30, 2023 and includes the following agencies:”
Auditors checked whether these agencies followed EOTSS cybersecurity training standards for employees.
“The purpose of our audit was to determine whether EOTSS and the above executive branch agencies, state colleges and universities, and regional transit authorities ensured that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.”
Cybersecurity training matters because missed training can leave agencies more vulnerable to attacks, money losses, and damage to public trust.
“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”
For residents, this matters because state technology systems support services used by taxpayers, drivers, businesses, visitors, families, and other citizens.
“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”
The Auditor concluded that the audited entities did not fully meet the cybersecurity training requirement.
“Did EOTSS and other executive branch agencies, state colleges and universities, and regional transit authorities ensure that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010?”
The report recommends stronger policies, better tracking, required training for all employees, and consequences when training is not completed.
“EOTSS should establish procedures to monitor employee cybersecurity awareness training completion rates throughout the training cycle and use historical data retained by HRD to ensure that employees meet training deadlines.”
The report is significant because EOTSS oversees technology and security services for a large part of state government, so gaps in training can affect many public systems.
“EOTSS also oversees and manages the enterprise technology and digital infrastructure and services for over 125 state agencies and over 43,000 state employees.”
“Cybersecurity awareness training” means teaching employees their role in protecting state information systems and data.
“The objective of the Commonwealth information security training is to educate users on their responsibility to help protect the confidentiality, availability and integrity of the Commonwealth’s information assets.”
What the Auditor checked
- Did not comply Did EOTSS and other executive branch agencies, state colleges and universities, and regional transit authorities ensure that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010?
What the Auditor found
Why it matters: EOTSS may face increased risk of cybersecurity attacks and financial or reputational losses.
Standard: Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010 ( EOTSS’s Information Security Risk Management Standard IS.010, Section 6.2.3; EOTSS’s Information Security Risk Management Standard IS.010, Section 6.2.4 )
4 recommendations
- EOTSS should strengthen its policy to improve oversight of executive branch state agencies, including timely completion of cybersecurity awareness trainings.
- EOTSS should maintain employee training transcripts for all employees, including cybersecurity awareness training completion records.
- EOTSS should ensure all employees complete cybersecurity awareness training within 30 days of orientation and annually thereafter.
- EOTSS should monitor cybersecurity awareness training completion rates throughout the training cycle and use HRD historical data to ensure employees meet deadlines.
Agency response & Auditor reply
Agency: "Moving forward, EOTSS will evaluate its internal processes to identify areas for improvement related to new hire orientation and contractor onboarding."
Auditor: "Based on its response, EOTSS has indicated that it will take steps to address our concerns on this matter."
Why it matters: The agencies may face increased risk of cybersecurity attacks and financial or reputational losses.
Standard: Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010 ( EOTSS’s Information Security Risk Management Standard IS.010, Section 6.2.3; EOTSS’s Information Security Risk Management Standard IS.010, Section 6.2.4 )
3 recommendations
- The nine agencies should provide initial and annual refresher cybersecurity awareness training to all full-time employees, contractors, and interns.agency: partially agreed
- The nine agencies should monitor cybersecurity awareness training completion rates throughout the training cycle and use HRD historical data to ensure employees meet deadlines.agency: partially agreed
- The nine agencies should implement controls so new hire onboarding includes all required cybersecurity awareness training coursework.agency: partially agreed
Agency response & Auditor reply
Agency: "DOR agrees with the results of the audit."
Auditor: "Based on its response, DOR has taken, and will continue to take, measures to address our concerns regarding this matter."
Why it matters: The colleges and universities may face increased risk of cybersecurity attacks and financial or reputational losses.
Standard: Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010 ( EOTSS’s Information Security Risk Management Standard IS.010, Section 6.2.3; EOTSS’s Information Security Risk Management Standard IS.010, Section 6.2.4 )
2 recommendations
- The seven state colleges and universities should update cybersecurity awareness training policies to require training for all employees.agency: partially agreed
- The seven state colleges and universities should update policies to include consequences for non-completion.agency: partially agreed
Agency response & Auditor reply
Agency: "The College agrees that cybersecurity training is critical and important."
Auditor: "As noted above within the auditees’ responses, many colleges and universities have already started addressing our concerns in this area."
Why it matters: The regional transit authorities may face increased risk of cybersecurity attacks and financial or reputational losses.
Standard: Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010 ( EOTSS’s Information Security Risk Management Standard IS.010, Section 6.2.3; EOTSS’s Information Security Risk Management Standard IS.010, Section 6.2.4 )
2 recommendations
- The three regional transit authorities should update cybersecurity awareness training policies to require training for all employees.agency: partially agreed
- The three regional transit authorities should update cybersecurity training policies to include consequences for non-completion.agency: partially agreed
Agency response & Auditor reply
Agency: "The Cape Ann Transportation Authority agrees with the recommendations."
Auditor: "We appreciate the responses provided by the regional transit authorities we audited."
More audits of this entity
Other Office of the State Auditor reports on Bureau of the State House .
- Audit of the Bureau of the State House (BSH)State Agency / Office · June 24, 2021