Southtowns Record

Hamburg Central School District - Information Technology (2019M-10)

Government
Hamburg Central School District
Posted by publisher
Jul 3, 2019
Kind
State audit
Topics
Audits and oversight, Parks and recreation

Publisher's summary

District officials did not provide information technology (IT) cybersecurity awareness training for individuals who used District IT assets. In addition, personal Internet use was found on computers assigned to four employees who routinely accessed personal, private and sensitive information (PPSI). Finally, the Board and District officials have not established a disaster recovery plan.

Original document

Text · page 2 of 16

Contents

Report Highlights .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 1

Information Technology.  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 2

  Why Should District Officials Provide IT Security Awareness Training?. 2

  IT Users Are Not Provided With Cybersecurity Training. .  .  .  .  .  .  .  . 2

  How Does an Acceptable Use Policy Protect IT Assets?.  .  .  .  .  .  .  . 3

  Some District Computers Were Used for Personal Activities.  .  .  .  .  . 3

  Why Should the District Have a Disaster Recovery Plan?. .  .  .  .  .  .  . 4

  The Board and District Officials Have Not Established a Disaster
  Recovery Plan. .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 4

  What Do We Recommend? . .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  . 4

Appendix A – Response From District Officials .  .  .  .  .  .  .  .  .  .  .  .  . 6

Appendix B – OSC Comment on the District’s Response.  .  .  .  .  .  .  10

Appendix C – Audit Methodology and Standards .  .  .  .  .  .  .  .  .  .  .  11

Appendix D – Resources and Services.  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  .  13