Massachusetts Department of Transportation Aeronautics Division

This is a State Auditor review of selected IT operations and aircraft registration controls at MassDOT’s Aeronautics Division for roughly July 2014 through December 2015, with some testing extended into 2016.

“In this audit, we reviewed certain IT general controls over the Aeronautics Division’s Airport Information Resource Portal (Air-PORT) application that were related to IT project management, IT governance, and logical access security.”

Auditors checked whether the division had proper controls over its main Air-PORT system, user access, business continuity, security training, and aircraft registration revenue.

“We also followed up on the issues identified in our previous audit of the Aeronautics Division (No. 2008-0044-4T) regarding the implementation of controls related to aircraft registrations and the revenue generated.”

These weaknesses could put government data and systems at risk, disrupt operations, and affect whether aircraft registration fees are properly billed and collected.

“The deficiencies could have compromised the integrity, availability, and confidentiality of the Aeronautics Division’s information.”

For an ordinary resident, this matters because weak records and IT controls can waste public money, reduce accountability, and leave aviation-related fees or safety-related information poorly tracked.

“This would result in a significant waste of staff resources and of the more than $600,000 that was spent in developing Air-PORT.”

The division’s main IT system did not fully meet business needs, access controls were weak, backup planning was incomplete, employees lacked required security training, and aircraft registration data was not reliable enough.

“Further, Aeronautics Division and Massachusetts Department of Transportation (MassDOT) IT management told us that Air-PORT, as developed, does not fully meet the Aeronautics Division’s business needs and may need to be replaced.”

The Auditor recommended better IT project staffing, clearer requirements, stronger vendor and user-access reviews, a tested business-continuity plan, annual security training, and stronger aircraft-reporting and reconciliation procedures.

“The Aeronautics Division should ensure that all future IT projects are staffed with personnel with expertise in IT project management.”

The report is significant because the problems were broad: they involved IT security, disaster planning, access permissions, contractor oversight, and the accuracy of aircraft registration records used for billing and management decisions.

“As a result, Air-PORT could not be updated and the number and type of commercial aircraft based at airports supported by the Aeronautics Division were not properly accounted for, which could affect the division’s ability to make informed business decisions.”

Air-PORT is the division’s web-based system for airport information, projects, grants, aircraft registrations, and related data.

“According to Air-PORT’s user manual, Air-PORT is a “web-based application . . . [that] facilitates the management of facility information, projects and grants, and other activity data across the MassDOT system, and . . . supports cloud data storage and retrieval.””