Text · page 5 of 12
Building Access: Finding and Recommendations Properly managing and monitoring building access is a fundamental security function and the responsibility of school district officials. Various resources, publications, and guides are available to help school district and Board of Cooperative Educational Services (BOCES) (together, “schools”) officials develop and implement necessary building access infrastructure and systems to create a safe and secure environment for their students, teachers, staff and visitors. More details on the criteria used in this report, as well as resources OSC makes available to local officials that can help them improve operations, are included in Appendix A. Finding 1 – District officials did not properly manage and monitor building access accounts and badges. During our fieldwork in February 2026, the District had 280 active accounts associated with 167 badges issued to current employees, and 113 badges issued to 90 individual non-employees including 23 shared badges. We determined: • 12 percent of active individual non-employee accounts and badges were unneeded, and • 26 percent of active shared accounts and badges were unneeded. Non-Employee Accounts – Of the 90 individual non-employee accounts, 79 were assigned to individuals who had legitimate business needs to access District school buildings, such as BOCES employees and service providers. However, the remaining 11 accounts and badges (12 percent) were not needed and District officials should have deactivated them: • Eight badges were assigned to former employees who separated from District employment including two badges that were unused since activation, • Two badges were assigned to third-party vendors that were no longer under contract with the District, and • One badge was assigned to a retired BOCES employee who previously provided services to the District. The Superintendent told us that the District implemented a process in June 2025 to deactivate all accounts and badges for employees at the end of each school year, then re-activate the accounts for active employees shortly before the new school year begins. However, this process was not operating effectively, because we found eight active accounts and badges for former employees. For example, we identified a former employee who separated from District employment in January 2023 with an active account and badge. If this process was functioning as intended, no former employees would have active accounts and badges that would provide access to District buildings. Additionally, the District Clerk stated that, also as of June 2025, District officials and employees started using a checklist for employees separating from the District that includes an action item for the technology department to deactivate the departing employees’ accounts. Prior to using this checklist, the District Clerk told us she requested that the technology department deactivate separating employees’ accounts either via email or in person. Furthermore, the Director of Technology (Director) stated that his department did not receive requests to deactivate unneeded accounts as evidenced by the three accounts that remained active for contracted vendors and a retired BOCES employee. Prompt deactivation of building access when it is no longer needed is an important component of access management and decreases the risk of unauthorized access. 3