Overview
During the audit, we became aware that MassVentures (MV) employees did not receive any cybersecurity awareness training. If MV does not ensure that all employees complete cybersecurity awareness training, then MV may expose itself to an increased risk of cybersecurity attacks and financial and/or reputational losses.
Sections 6.2.3 and 6.2.4 of the Executive Office of Technology Services and Security’s Information Security Risk Management Standard IS.010, effective October 15, 2018, stated that an initial cybersecurity awareness training course is required for all newly hired employees and annual refresher cybersecurity awareness training is required for existing employees. Although MV is not an executive branch state agency that is required to comply with the Executive Office of Technology Services and Security’s standards, we consider it best practice.
MV’s employees did not receive any cybersecurity awareness training because, as MV stated, no one notified it or let it know that cybersecurity awareness training was even available.
MV should develop and implement a policy that requires its employees to complete cybersecurity awareness training upon hire and annually thereafter. MV should track and monitor its employees’ completion of cybersecurity awareness training.
Auditee’s Response
MassVentures agrees with the auditor’s assessment that MassVentures should formally track and monitor employees’ completion of cybersecurity awareness training.
Subsequent to the completion of the audit, all staff members completed cybersecurity awareness training offered by Amazon and a cybersecurity awareness training policy is being drafted and implemented.
Auditor’s Reply
Based on its response, MV has taken measures to address our concerns regarding this matter.
| Date published: | June 17, 2025 |
|---|