Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - Massasoit Community College

This is a state performance audit about whether public agencies followed cybersecurity training rules during the period from July 1, 2021 through April 30, 2023.

“This audit covers the period July 1, 2021 through April 30, 2023 and includes the following agencies:”

The audit checked whether EOTSS and other public entities made sure employees completed cybersecurity awareness training required by EOTSS standards.

“The purpose of our audit was to determine whether EOTSS and the above executive branch agencies, state colleges and universities, and regional transit authorities ensured that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.”

Cybersecurity training matters because untrained employees can increase the risk of cyberattacks and financial or reputational harm to public agencies.

“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

For residents, this matters because these agencies provide public services and handle government systems, data, and digital services people rely on.

“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”

The audit’s answer was no: the audited agencies did not consistently ensure employees completed the required cybersecurity training.

“No; see Findings 1, 2, 3, and 4”

The auditor recommended stronger policies, better tracking, required training for all employees, and consequences when training is not completed.

“EOTSS should establish procedures to monitor employee cybersecurity awareness training completion rates throughout the training cycle and use historical data retained by HRD to ensure that employees meet training deadlines.”

This report is significant because it covers 23 entities across state agencies, public colleges, and regional transit authorities, not just one office.

“This report covers 22 additional agencies’ compliance with EOTSS’s cybersecurity awareness training standard.”

Cybersecurity awareness training means basic training that teaches employees their role in protecting government information systems and data.

“The objective of the Commonwealth information security training is to educate users on their responsibility to help protect the confidentiality, availability and integrity of the Commonwealth’s information assets.”