Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - Massachusetts Bay Community College

This is a state audit checking whether public employees completed cybersecurity awareness training during the audit period.

“This audit covers the period July 1, 2021 through April 30, 2023 and includes the following agencies:”

The auditor wanted to know whether the covered public entities followed EOTSS cybersecurity training rules.

“The purpose of our audit was to determine whether EOTSS and the above executive branch agencies, state colleges and universities, and regional transit authorities ensured that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.”

When employees miss cybersecurity training, public agencies may be more vulnerable to cyberattacks, money losses, and damage to public trust.

“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

These agencies support services people use, including transportation, public health, taxes, motor vehicles, and other state services, so better cybersecurity training helps protect public systems and information.

“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”

The audit’s answer was no: the reviewed entities did not consistently ensure employees completed the required cybersecurity training.

“No; see Findings 1, 2, 3, and 4”

The auditor recommended stronger policies, better tracking, required training for all employees, and consequences when training is not completed; the office also plans follow-up review.

“We will follow up on this during our post-audit review process in approximately six months.”

The report treats cybersecurity training as a basic statewide safeguard, not a paperwork exercise, because trained employees help reduce cyber risk.

“Comprehensive employee training and shared responsibility are critical to mitigating potential cyber threats.”

EOTSS is the state technology and security office; IS.010 is the cybersecurity risk-management standard used as the benchmark for training requirements.

“EOTSS’s Information Security Risk Management Standard IS.010 states, “All new personnel must complete an Initial Security Awareness Training course,” and that EOTSS does not provide an exemption to this policy for employees who lack access to computers.”