Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - Martha's Vineyard Regional Transit Authority

This is a State Auditor performance audit checking whether selected state agencies, public colleges, and regional transit authorities followed cybersecurity training standards from July 1, 2021 through April 30, 2023.

“This audit covers the period July 1, 2021 through April 30, 2023 and includes the following agencies:”

Auditors wanted to know whether employees at these public entities completed required cybersecurity training, including new-hire and annual refresher training.

“The purpose of our audit was to determine whether EOTSS and the above executive branch agencies, state colleges and universities, and regional transit authorities ensured that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.”

When employees miss cybersecurity training, agencies may be more vulnerable to cyberattacks and the costs or public trust damage that can follow.

“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

These agencies handle public services and government systems that residents rely on, so better cybersecurity training helps reduce risks to state services and information.

“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”

The audit found gaps across EOTSS, nine executive branch agencies, seven state colleges and universities, and three regional transit authorities.

“Below is our audit objective, indicating the question we intended our audit to answer; the conclusion we reached regarding our objective; and, if applicable, where our objective is discussed in the audit findings.”

The Auditor recommended that agencies require training, track completion, keep records, and add consequences or controls so employees finish on time.

“EOTSS should establish procedures to monitor employee cybersecurity awareness training completion rates throughout the training cycle and use historical data retained by HRD to ensure that employees meet training deadlines.”

The report treats cybersecurity training as a basic government safeguard, not just an internal paperwork requirement.

“Security awareness training is a critical component of the Commonwealth’s security compliance strategy.”

“Cybersecurity awareness training” means basic training that teaches workers their role in protecting government information systems and data.

“The objective of the Commonwealth information security training is to educate users on their responsibility to help protect the confidentiality, availability and integrity of the Commonwealth’s information assets.”