Audit of Holyoke Community College (HCC)

This is a state performance audit of Holyoke Community College covering July 1, 2017 through March 31, 2019.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of Holyoke Community College (HCC) for the period July 1, 2017 through March 31, 2019.”

Auditors checked whether people with access to HCC computer systems had taken information security training and signed acceptable-use rules.

“In this performance audit, we reviewed HCC’s information security training and awareness practices to determine whether system users had completed information security training and signed acceptable use policies.”

If users are not trained and do not formally agree to safe computer-use rules, the college faces more risk from cyberattacks and possible financial or reputation damage.

“Without educating all system users on their responsibility of helping protect the security of information assets by requiring training and formal user acknowledgment of acceptable use policies, HCC is exposed to a higher risk of cybersecurity attacks and financial and/or reputation losses.”

For students, staff, and taxpayers, this matters because better cybersecurity practices help protect college systems and information from avoidable risks.

“HCC is a member of the Massachusetts public higher-education system, which consists of 15 community colleges, nine state universities, and five University of Massachusetts campuses.”

The college started cybersecurity training in 2018, but many sampled users still had not completed it, and the college could not produce all signed acceptable-use agreements.

“From our sample of 60 system users, 1 user was terminated before the training was rolled out, and 8 users (6 employees, 1 work-study student, and 1 contract employee) were not assigned training.”

The auditor recommended that HCC create and share a cybersecurity training policy, monitor training completion, keep signed acceptable-use policies for all users, and put training requirements into union agreements.

“HCC should negotiate collective bargaining agreements to include information security training requirements for all system users.”

The finding points to a basic cybersecurity control gap at a public college: people had access to systems without proof that all required training and signed use agreements were completed.

“For the same sample of 60 users, HCC could produce only 35 (58%) of the required signed acceptable use policies.”

An acceptable use policy is basically the written rulebook for how employees and other users may use the college’s computer equipment.

“According to the SysAdmin, Audit, Network, and Security Institute, acceptable use policies outline the acceptable use of computer equipment by an organization’s computer system users.”