Text · page 3 of 15
Report Highlights City of Lackawanna Audit Objective Background Determine whether City of Lackawanna (City) officials properly implemented information technology (IT) security The City is located in Erie County controls to safeguard the network against unauthorized and is governed by an elected access or disruption. Mayor and an elected five-member City Council (Council). The Council Key Findings is responsible for the general oversight of City operations City officials did not establish adequate controls to and finances. The Mayor is safeguard the network against unauthorized access or responsible, along with other disruption. officials and staff, for managing day-to-day operations. ll City officials did not regularly review, identify and disable unnecessary network user accounts. As a The Mayor hired an IT Specialist result, 14 unnecessary generic network user accounts (Specialist) in August 2020, shortly and 26 usernames associated with inactive or former before our audit began, to oversee employee accounts were not disabled. IT security and manage the ll City officials have not developed written IT policies City’s IT operations. Prior to this and did not provide users with IT security awareness appointment, the City relied on the training. purchasing agent with the help of a third-party vendor to provide IT ll City officials have not developed a written IT support for the City’s network. contingency plan. Sensitive IT control weaknesses were communicated Quick Facts confidentially to officials. IT Budget 2020-21 $138,300 Key Recommendations Number of Computers 44 ll Develop written policies and procedures for managing Network User Accounts 89 as of March 31, 2021 network access and disable unnecessary network user accounts. ll Provide periodic IT security awareness training to all Audit Period personnel who use IT resources. August 1, 2020 – September 7, 2021 ll Develop a comprehensive written IT contingency plan. City officials agreed with our recommendations and indicated they planned to initiate corrective action. Of f ic e of t he New York State Comptroller 1