Audit of the Department of Fire Services (March 20, 2024)

This is a state performance audit of the Massachusetts Department of Fire Services covering July 1, 2021 through December 31, 2022.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Department of Fire Services (DFS) for the period July 1, 2021 through December 31, 2022.”

Auditors checked whether DFS's website met accessibility rules and whether its technology policies met state requirements for continuity planning, incident response, disaster recovery, and cybersecurity training.

“In this performance audit, we determined the following:”

DFS handles fire safety information and services, so problems with website access or cybersecurity planning can affect residents, especially people with disabilities and anyone relying on DFS during disruptions or emergencies.

“They can also limit some users from having equitable access to critical information and key online services offered by DFS (e.g., proper fire safety equipment use or how to be prepared for fire emergencies).”

If DFS fixes these issues, residents should have better access to online fire safety information, and the agency should be better prepared to keep operating and protect information during emergencies or cyber incidents.

“Government websites are an important way for the general public to access government information and services.”

DFS had weaknesses in web accessibility and IT governance, and the auditor recommended updates, better plans, and cybersecurity training access for contractors.

“DFS did not provide its contractors with cybersecurity awareness training.”

DFS said it corrected the formatting issue, is updating its continuity plan, will develop a supplemental incident response plan, and now ensures contractors can complete required training.

“Based on its response, DFS has taken measures to address our concerns on this matter.”

The biggest practical concern is that many DFS workers are contractors, and they were not given cybersecurity awareness training during the audited training cycle, which could raise risk for DFS systems and protected information.

“Contractors make up approximately 87% of the DFS workforce.”

IT governance means the rules and processes an agency uses to manage technology, including backup planning, disaster recovery, cyberattack response, and cybersecurity training.

“IT governance refers to the processes that state agencies use to manage their IT resources.”