Audit of the University of Massachusetts Amherst (December 30, 2024)

This is a state performance audit of UMass Amherst covering July 1, 2022 through June 30, 2023.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the University of Massachusetts (UMass) Amherst for the period July 1, 2022 through June 30, 2023.”

Auditors checked whether UMass Amherst’s website and Blackboard met accessibility standards, and whether employees completed cybersecurity awareness training.

“The purpose of this performance audit was to determine whether UMass Amherst’s website and its learning management system (LMS), Blackboard, adhered to the accessibility standards established by the Web Content Accessibility Guidelines (WCAG) 2.1 for user accessibility, keyboard accessibility, navigation accessibility, language, error identification, and color accessibility.”

Accessibility problems can stop students, residents, and other users from getting information, using online services, watching videos with captions, or navigating systems effectively.

“Broken or faulty hyperlinks limit users from having equitable access to critical information and key online services offered by UMass Amherst and increase the likelihood that Massachusetts residents and students will either access outdated or incorrect information or be directed to webpages that no longer exist.”

If you are a student, employee, applicant, parent, or resident using UMass Amherst online services, these fixes could make pages easier to find, read, navigate, and use, especially for people with disabilities.

“WCAG ensures that all users, regardless of ability, can access the content and functions of UMass Amherst’s website and LMS.”

The audit says UMass Amherst needs stronger follow-through on accessibility and cybersecurity training, even though the university said it has fixed some issues and is moving from Blackboard to Canvas.

“UMass Amherst has not implemented cybersecurity awareness training in accordance with Center for Internet Security (CIS) Control 14.”

UMass Amherst said it will require cybersecurity training for new employees and annual refresher training, and the Auditor said the office will follow up in about six months.

“We note that the requirement to provide this training is not new and will follow up on this in approximately six months as part of our post audit review process.”

This matters because public universities have legal accessibility duties, and weak cybersecurity training can raise the risk of cyberattacks, financial loss, and reputational damage.

“Title II of the Americans with Disabilities Act requires that state universities’ and colleges’ websites be accessible.”

WCAG means web accessibility rules; LMS means a learning management system like Blackboard; WISP means the university’s written information security policy; bypass blocks are links that let keyboard users skip repeated page content and get to the main content.

“A learning management system, or LMS, is a web-based application that functions like a website.”