Audit of the Woods Hole, Martha’s Vineyard and Nantucket Steamship Authority (February 5, 2024)

This is a Massachusetts State Auditor performance audit of the ferry authority that serves Martha’s Vineyard and Nantucket, covering mainly 2020 and 2021.

“In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Woods Hole, Martha’s Vineyard and Nantucket Steamship Authority (the Steamship Authority) for the period January 1, 2020 through December 31, 2021.”

The audit checked two main things: whether federal COVID relief funds were spent properly, and whether employees completed cybersecurity awareness training.

“We also determined whether the Steamship Authority ensured that its employees completed cybersecurity awareness training in accordance with its internal practice.”

The Steamship Authority runs essential ferry service to Martha’s Vineyard and Nantucket, so weak cybersecurity practices could create real operational, financial, and reputational risks.

“If the Steamship Authority does not ensure that all employees are trained on their responsibility to protect information assets, then the Steamship Authority is exposed to a higher risk of cybersecurity attacks and financial and/or reputational losses.”

If you rely on these ferries, the audit matters because it looks at whether public money was handled properly and whether the ferry operator is reducing cyber risks that could affect services.

“These vessels provide ferry transportation services for passengers and vehicles between the Massachusetts mainland and the islands of Martha’s Vineyard and Nantucket.”

The biggest formal finding was that the Steamship Authority lacked a written cybersecurity training program and did not make sure employees were assigned and completed required training.

“The Steamship Authority does not have a formal, documented cybersecurity awareness training program and does not monitor the assignment and completion of cybersecurity awareness training courses.”

The auditor recommended that the Steamship Authority create a formal cybersecurity training program, track completion, assign responsibility, and make sure employees can access the training.

“The Steamship Authority should replace its current, undocumented cybersecurity awareness training practice with a formal, documented cybersecurity awareness training program that follows best practices for these programs.”

The report is significant because it found no problem with the tested COVID relief spending, but it did find serious weaknesses in how the ferry authority handled cybersecurity training and noted additional concerns about free ferry passage controls.

“In addition to the conclusions we reached regarding our objectives, we also identified issues unrelated to our objectives regarding internal controls over the Steamship Authority’s employee and eligible nonemployee free ferry passage benefit and the Steamship Authority’s accountability for employee and eligible nonemployee identification badges.”

CARES Act funds were federal COVID relief dollars; FTA means the Federal Transit Administration; CCRTA means Cape Cod Regional Transit Authority; and a UZA is an urbanized area with at least 50,000 people.

“According to FTA’s website, “An urbanized area is an incorporated area with a population of 50,000 or more that is designated as such by the U.S. Department of Commerce, Bureau of the Census.””