Skip to main content
Audit

Audit  Audit of the Division of Standards

Our office has conducted a performance audit of the Division of Standards (DOS) for the period July 1, 2021 through December 31, 2022.

Organization: Office of the State Auditor
Date published: March 19, 2024

Executive Summary

In accordance with Section 12 of Chapter 11 of the Massachusetts General Laws, the Office of the State Auditor has conducted a performance audit of the Division of Standards (DOS) for the period July 1, 2021 through December 31, 2022. In this performance audit, we determined the following:

  • whether DOS’s website met the accessibility standards established by the Executive Office of Technology Services and Security (EOTSS) and the Web Content Accessibility Guidelines 2.1 for user accessibility, keyboard accessibility, navigation accessibility, language accessibility, error identification, and color accessibility and
  • whether DOS established information technology (IT) governance policies and procedures that met the requirements of EOTSS’s Enterprise Information Security Policies and Standards for business continuity plans, disaster recovery plans, information security incident response plans and procedures, and cybersecurity awareness training.

Below is a summary of our findings and recommendations, with links to each page listed.

  
Finding 1
 		DOS’s website is not fully accessible for all Massachusetts residents.
Recommendation
 		DOS should review its webpages to ensure that all hyperlinks lead to related information to provide equitable access to critical information and services offered online by DOS to all Commonwealth residents.
Finding 2
 		DOS’s business continuity plan does not include all required elements, and it does not have a disaster recovery plan.
Recommendations
 
  1. DOS should update its business continuity plan to include all required elements. It should also update the plan annually and whenever a major organizational change occurs.
  2. DOS should develop and implement a disaster recovery plan.
Finding 3
 		DOS relies on an information security incident response plan and procedures that do not include all required elements.
Recommendation
 		DOS should rely on an information security incident response plan and procedures that include all required elements. Alternatively, DOS could establish a supplemental information security incident response plan and procedures that include guidance for implementing corrective action or post-incident analysis, criteria for business recovery, data backup processes, and an analysis of legal requirements for reporting IT system compromises.

Table of Contents

Downloads

Open PDF file, 843.33 KB,  Audit of the Division of Standards (English, PDF 843.33 KB)

Help Us Improve Mass.gov  with your feedback

Please do not include personal or contact information.
Feedback