Audit of the Attorney General’s Office - Review of Cybersecurity Awareness Training

This is a performance audit by the Massachusetts State Auditor reviewing whether the Attorney General’s Office handled cybersecurity awareness training properly from July 1, 2018 through July 31, 2020.

“This report details the audit objective, scope, methodology, finding, and recommendations for the audit period, July 1, 2018 through July 31, 2020.”

Auditors wanted to know whether Attorney General’s Office employees completed cybersecurity training and acknowledged information technology policies.

“In this performance audit, we reviewed AGO’s cybersecurity awareness training and practices to determine whether all employees had completed cybersecurity awareness training and signed information technology policies.”

If employees are not trained on cybersecurity, they may be more likely to fall for attacks, which can put the agency’s systems and information at risk.

“Lack of training for new employees and lack of refresher training for existing employees create a greater risk that employees and the agency may be vulnerable to a cyberattack.”

For residents, this matters because the Attorney General’s Office serves the public and handles work involving consumers, fraud, crime, workers, civil rights, and the environment, so strong cybersecurity helps protect public services and information.

“The Massachusetts Attorney General’s Office is an advocate and resource for the people of Massachusetts in many ways, including protecting consumers, combating fraud and corruption, investigating and prosecuting crime, and protecting the environment, workers, and civil rights.”

The office had cybersecurity training in place at some points, but there was a long break between its old training system and the new one, and some categories of users were not required to take the earlier training.

“Consequently, the transition from SANS to KnowBe4 resulted in a period when there was no cybersecurity awareness training in place at AGO.”

The auditor recommended that the office make sure cybersecurity training is always available for new hires and annually for current employees, including during transitions to a new vendor or program.

“AGO should ensure that initial cybersecurity awareness training for new hires and annual training thereafter for existing employees are always available.”

The finding was limited but important: the Attorney General’s Office only partially met the audit objective, and the auditor said the office later took steps to address the concern.

“Based on its response and the information provided to the Office of the State Auditor during the audit regarding AGO’s new cybersecurity awareness training policy, AGO has taken measures to address our concerns on this matter.”

Cybersecurity awareness training means training staff to recognize and avoid digital risks, such as phishing or unsafe computer practices; the audit used state and federal security standards as its yardstick.

“All personnel will be required to complete Annual Security Awareness Training.”