Audit of the Bridgewater State University

This is a state performance audit of Bridgewater State University covering March 1, 2020 through March 31, 2021.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of Bridgewater State University (BSU) for the period March 1, 2020 through March 31, 2021.”

Auditors checked whether BSU properly used federal COVID-19 education relief funds and followed state guidance on internal controls and cybersecurity training.

“The purpose of our audit was to determine whether BSU administered the federal assistance it received in accordance with the criteria established by US DOE and MDHE.”

Cybersecurity training matters because untrained employees can increase the risk of cyberattacks and financial or reputational harm.

“Without educating all employees on their responsibility of protecting information assets by requiring training, BSU is exposed to a higher risk of cybersecurity attacks and financial and/or reputation losses.”

If you are a student, employee, taxpayer, or community member, the audit says COVID-19 relief money was reviewed and the main problem found was a cybersecurity training gap that could affect protection of university systems and information.

“Below is a summary of our findings and recommendations, with links to each page listed.”

BSU passed the audit questions about COVID-19 relief fund administration and pandemic internal controls, but failed the question about required cybersecurity awareness training.

“Did BSU adhere to Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s (EOTSS’s) Information Security Risk Management Standard IS.010 with regard to cybersecurity awareness training?”

The auditor recommended that BSU create and enforce cybersecurity training policies for all employees and work with unions so union employees are included.

“BSU officials should negotiate with union officials to establish initial and annual cybersecurity awareness training requirements for all employees who are union members.”

The significant finding was not misuse of COVID-19 relief funding; it was that BSU lacked a complete system to require, monitor, and document cybersecurity training for all workers.

“However, the policy does not include requirements for initial and annual cybersecurity awareness training or internal controls to monitor and document completion of such training.”

The report uses many acronyms; one key term is HEERF, which means the Higher Education Emergency Relief Fund, a federal COVID-19 aid program for colleges and universities.

“HEERF consists of three separate grants related to the 2019 coronavirus pandemic emergency that were directly funded from US DOE under the CARES Act (HEERF I), CRRSAA (HEERF II), and American Rescue Plan Act (HEERF III).”