Executive Order 504 Compliance Review Regarding the Security and Confidentiality of Personal Information at Executive Department Agencies

This is a State Auditor review of how well Massachusetts executive agencies followed Executive Order 504, a rule about protecting residents’ personal information.

“On September 19, 2008, Executive Order 504 (EO504) was issued regarding the security and confidentiality of personal information of residents of the Commonwealth.”

The auditor checked whether agencies were meeting EO504’s security and reporting rules for personal information.

“Our audit scope was to assess whether Executive Department agencies adequately addressed the security and reporting requirements of EO504 to ensure the security, confidentiality and integrity of personal information.”

The issue matters because state agencies hold sensitive information, and weak controls can expose residents to privacy breaches or misuse of their data.

“The security and confidentiality goals of EO504 include improving security awareness and strengthening responsibilities and controls for safeguarding personal information.”

For an ordinary resident, this report is about whether the state is doing enough to keep your personal details private and secure.

“Section 2 of EO504 states that it “shall be the policy of the Executive Department of the Commonwealth of Massachusetts to adopt and implement the maximum feasible measures reasonably needed to ensure the security, confidentiality and integrity of personal information, as defined in Chapter 93H, and personal data, as defined in Massachusetts General Law Chapter 66A, maintained by state agencies.”

The state had policies, training, and reporting in place, but it did not have enough independent checking to prove the protections were actually working.

“As a result, ITD management lacks (1) reliable feedback on the existence and performance of an operational process, activity, or combination of controls and (2) independent review processes to validate agency reports and verify the existence of controls necessary to protect personal information.”

The auditor recommended that ITD build a stronger review program and give agencies better guidance, and ITD generally agreed.

“ITD should establish an adequate assurance program framework to independently assess compliance with the requirements of EO504 and Chapter 93H and 93I of the General Laws, including the adequacy of controls to safeguard personal information.”

The audit is significant because identity theft is costly and widespread, and the state wanted standards at least as strong as private-sector rules.

“WHEREAS, identity theft is a serious crime that, according to current Federal Trade Commission statistics, affects as many as 9 million Americans each year and costs consumers and businesses approximately $52 billion annually;”

EO504 is the state order; ISOs are agency security officers; SAQs are self-audit questionnaires agencies submit about how they protect personal information.

“The agency head and the ISO are required to certify and submit to ITD an Information Security Program (ISP), an Electronic Security Plan (ESP), and a Self-Audit Questionnaire (SAQ) annually on September 19th.”