Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - North Shore Community College

This is a Massachusetts State Auditor performance audit of cybersecurity awareness training compliance across EOTSS and 22 other public entities.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Executive Office of Technology Services and Security (EOTSS), as well as 22 other executive branch agencies, state colleges and universities, and regional transit authorities.”

Auditors checked whether these public entities made employees complete cybersecurity training required by EOTSS standards.

“The purpose of our audit was to determine whether EOTSS and the above executive branch agencies, state colleges and universities, and regional transit authorities ensured that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.”

When workers miss cybersecurity training, agencies may be more vulnerable to cyberattacks, money losses, and damage to public trust.

“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

This matters to residents because EOTSS supports digital government services used by taxpayers, drivers, businesses, visitors, families, and others.

“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”

The auditor concluded the reviewed entities did not fully ensure employees completed the required cybersecurity training.

“No; see Findings 1, 2, 3, and 4”

The Auditor’s office says it will check back in about six months to see whether EOTSS addressed the problem.

“We will follow up on this during our post-audit review process in approximately six months.”

The report treats EOTSS’s cybersecurity training rule as a statewide baseline for good security practice, even for colleges, universities, and transit authorities reviewed in the audit.

“We regard EOTSS’s Information Security Risk Management Standard IS.010 as the baseline for best practices in cybersecurity awareness training across the Commonwealth’s agencies, and therefore, we used this as our audit criteria.”

Cybersecurity awareness training means basic training that teaches employees how to help protect state information systems and data.

“The objective of the Commonwealth information security training is to educate users on their responsibility to help protect the confidentiality, availability and integrity of the Commonwealth’s information assets.”