Audit of the University of Massachusetts Boston (December 26, 2024)

This is a state performance audit of UMass Boston covering July 1, 2022 through August 31, 2023.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the University of Massachusetts (UMass) Boston for the period July 1, 2022 through August 31, 2023.”

Auditors checked whether UMass Boston’s website and Blackboard met accessibility standards and whether employees completed required cybersecurity awareness training.

“The purpose of this performance audit was to determine whether UMass Boston’s website and its learning management system (LMS), Blackboard, adhered to the accessibility standards established by the Web Content Accessibility Guidelines (WCAG) 2.0 and 2.1, respectively, for user accessibility, keyboard accessibility, navigation accessibility, language, error identification, and color accessibility.”

Accessibility problems can block students and residents from getting important online information and services; weak training compliance can raise cybersecurity risk.

“Broken or faulty hyperlinks limit users from having equitable access to critical information and key online services offered by UMass Boston.”

If you are a student, employee, applicant, parent, or resident using UMass Boston online services, the audit is about whether you can access information reliably and whether the university is protecting its systems.

“WCAG ensures that all users, regardless of ability, can access the content and functions of UMass Boston’s website and LMS.”

The audit found three main problems: website accessibility issues, Blackboard accessibility issues, and incomplete cybersecurity training.

“UMass Boston did not always ensure that its employees completed cybersecurity awareness training.”

The Auditor recommends that UMass Boston keep checking its webpages, work with its learning system vendor on accessibility, and enforce cybersecurity training requirements.

“UMass Boston should revise its policy to implement a mechanism that requires employees to complete cybersecurity awareness training at hire and at least annually thereafter; UMass Boston should consider cutting off user access if an employee does not complete their training by a stated deadline.”

This matters because UMass Boston is a public university serving thousands of students and employees, and its online systems are central to learning, services, and security.

“As of fall 2023, UMass Boston had a total enrollment of 15,671 students (12,234 undergraduate and 3,437 graduate students), and approximately 2,579 employees (1,816 full-time and 763 part-time employees).”

WCAG means web accessibility rules meant to help people with disabilities use websites and online tools.

“In 1999, the World Wide Web Consortium (W3C), an international organization overseeing internet standards, released WCAG 1.0.”