Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - Department of Public Health (November 8, 2024)

This is a State Auditor performance audit about whether public employees completed cybersecurity awareness training during the audit period.

“This audit covers the period July 1, 2021 through April 30, 2023 and includes the following agencies:”

The Auditor checked whether EOTSS and 22 other public entities followed cybersecurity training standards for employees.

“The purpose of our audit was to determine whether EOTSS and the above executive branch agencies, state colleges and universities, and regional transit authorities ensured that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.”

When employees are not trained, agencies may be more vulnerable to cyberattacks, money losses, and damage to public trust.

“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

For ordinary residents, this matters because these agencies handle public services and information systems that people rely on, including services for motorists, taxpayers, businesses, families, and visitors.

“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”

The Auditor concluded that the audited entities did not fully ensure employees completed cybersecurity training as required or expected.

“No; see Findings 1, 2, 3, and 4”

The report recommends stronger policies, better tracking, required training for all employees, and consequences such as limiting access until training is finished.

“The aforementioned three regional transit authorities should do the following:”

This was not a narrow issue at one office; the audit covered EOTSS plus other executive branch agencies, public colleges and universities, and regional transit authorities across Massachusetts.

“Pursuant to our governing statute, Section 12 of Chapter 11 of the General Laws, our audit covers multiple entities’ compliance with EOTSS’s cybersecurity training standards.”

Cybersecurity awareness training means teaching employees how to help protect government information from being exposed, unavailable, or changed improperly.

“The objective of the Commonwealth information security training is to educate users on their responsibility to help protect the confidentiality, availability and integrity of the Commonwealth’s information assets.”