[read complete report - pdf]

Audit Objective

Determine whether the Board and District officials established information technology (IT) policies and procedures to adequately safeguard personal, private and sensitive information (PPSI).

Key Findings

• Employees did not comply with the District’s acceptable use policy (AUP).
• District officials did not disable unneeded user accounts in a timely manner.
• District officials did not provide IT security awareness training to employees.

In addition, sensitive IT control weaknesses were communicated confidentially to District officials.

Key Recommendations

• Monitor employees’ computer use to ensure compliance with the AUP.
• Disable user accounts as soon as they are no longer needed.
• Provide employees with periodic IT security awareness training.

District officials agreed with our recommendations and indicated they would initiate corrective action.