Overview
During our assessment of SRA’s computer information system network, we found that SRA does not have a documented information technology policies and procedures manual that dictates access control, security awareness and training, audit and accountability, identification and authentication, and employee security. Further, SRA did not provide its employees any cybersecurity awareness training.
If SRA does not educate all employees on their responsibility to protect its information assets by creating an information technology policies and procedures manual or providing cybersecurity awareness training to all its employees, then SRA may be exposed to a higher-than-acceptable risk of cyberattacks, resulting in potential financial and/or reputational losses.
Authoritative Guidance
Sections AC-1, AT-1, AU-1, IA-1, PS-1, and AT-3 of the National Institute of Standards and Technology’s Security and Privacy Controls for Information Systems and Organizations state that organizations should develop and provide to employees cybersecurity awareness training and policies on access control, audit and accountability, identification and authentication, and employee security.
While SRA is not required to follow these guidelines, we consider them to be a best practice.
Reasons for Issue
SRA management stated that the BOD was unaware that an information technology policies and procedures manual or cybersecurity awareness training were required for a small organization.
Recommendations
- SRA should develop, disseminate, and periodically review and update a documented information technology policies and procedures manual. The manual should address the purpose, scope, roles, responsibilities, management commitment, and coordination among employees. The manual should also contain an access control policy, a cybersecurity awareness and training policy, an audit and accountability policy, an identification and authentication policy, and an employee security policy.
- SRA should ensure that it provides annual cybersecurity awareness training to all employees who have access to its computer network system.
Auditee’s Response
The Authority agrees with the recommendations and will work to implement them in coordination with our [information technology] consultant. Both staff members completed Cybersecurity Awareness Training in April of 2024, and have marked their calendars for the first Monday in April to continue the training.
Auditor’s Reply
SRA states that it agrees with our recommendations and is taking action to implement them.
| Date published: | December 20, 2024 |
|---|