Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - Massachusetts Department of Transportation

This is a Massachusetts State Auditor performance audit about whether state-related organizations followed cybersecurity training rules.

“I am pleased to provide to you the results of the enclosed performance audit.”

Auditors checked whether employees finished required cybersecurity awareness training on time.

“The purpose of our audit was to determine whether EOTSS and the above executive branch agencies, state colleges and universities, and regional transit authorities ensured that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.”

When employees miss cybersecurity training, agencies may be more vulnerable to cyberattacks and costly damage to their reputation or finances.

“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

This matters to residents because these systems support public services used by taxpayers, drivers, businesses, families, visitors, and others.

“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”

The auditor concluded that the audited organizations did not fully make sure employees completed the required cybersecurity training.

“No; see Findings 1, 2, 3, and 4”

The auditor recommended stronger tracking, better onboarding controls, and making sure employees complete training within required timeframes.

“EOTSS should establish procedures to monitor employee cybersecurity awareness training completion rates throughout the training cycle and use historical data retained by HRD to ensure that employees meet training deadlines.”

The report is significant because EOTSS manages technology and digital services for many state agencies and tens of thousands of state employees.

“EOTSS also oversees and manages the enterprise technology and digital infrastructure and services for over 125 state agencies and over 43,000 state employees.”

Cybersecurity awareness training means teaching workers how to help protect government information from being exposed, unavailable, or tampered with.

“The objective of the Commonwealth information security training is to educate users on their responsibility to help protect the confidentiality, availability and integrity of the Commonwealth’s information assets.”