Audit of Cybersecurity Awareness Training Compliance Across Multiple State Agencies - Parole Board

Auditors checked whether the agencies followed EOTSS rules requiring cybersecurity training for employees.

“The purpose of our audit was to determine whether EOTSS and the above executive branch agencies, state colleges and universities, and regional transit authorities ensured that their employees completed cybersecurity awareness training in accordance with Sections 6.2.3 and 6.2.4 of EOTSS’s Information Security Risk Management Standard IS.010.”

When employees miss cybersecurity training, agencies may be more vulnerable to cyberattacks, money losses, and damage to public trust.

“If executive branch agencies do not ensure that all of their employees complete cybersecurity awareness training, then they may expose themselves to an increased risk of cybersecurity attacks and financial and/or reputational losses.”

This matters to residents because state technology systems support everyday services for taxpayers, drivers, businesses, families, and other people using state government.

“EOTSS provides responsive digital and security services that enable taxpayers, motorists, businesses, visitors, families, and other citizens to do business with the Commonwealth.”

The audit’s main conclusion was that several public entities had gaps: some employees finished training late, and some did not finish it at all.

“Regarding the completion rates for the initial cybersecurity awareness training, we observed that 445 newly hired employees completed training late, while 601 did not complete training at all.”

The Auditor recommended stronger tracking, required training for all employees, and consequences when employees do not complete it.

“EOTSS should establish procedures to monitor employee cybersecurity awareness training completion rates throughout the training cycle and use historical data retained by HRD to ensure that employees meet training deadlines.”

The report is significant because it says cybersecurity training should be treated as a basic safeguard across state government, not as an optional task.

“We regard EOTSS’s Information Security Risk Management Standard IS.010 as the baseline for best practices in cybersecurity awareness training across the Commonwealth’s agencies, and therefore, we used this as our audit criteria.”

“Cybersecurity awareness training” means basic training that teaches employees how to help protect state information systems and data.

“The objective of the Commonwealth information security training is to educate users on their responsibility to help protect the confidentiality, availability and integrity of the Commonwealth’s information assets.”