[read complete report - pdf]

Audit Objective

Determine whether Town officials ensured the Town’s Information Technology (IT) systems were adequately secured and protected against unauthorized use, access and loss.

Key Findings

• Employees accessed nonbusiness websites for personal use.
• The Board did not provide IT security awareness training for employees who used Town IT assets.
• Town officials (Officials) did not adopt a disaster recovery plan or develop written data backup procedures.

In addition, sensitive IT control weaknesses were communicated confidentially to Officials.

Key Recommendations

• Monitor compliance with the acceptable use policy.
• Provide IT security awareness training to personnel who use IT resources.
• Adopt written IT policies and procedures to address disaster recovery and data backup.

Officials indicated that they have initiated corrective action.