Charter School of Educational Excellence – Information Technology (2023M-174)

Issued Date

June 07, 2024

Audit Objective

Determine whether the Charter School of Educational Excellence (School) Board of Trustees (Board) and officials secured student data to help protect it from unauthorized access and developed and adopted a comprehensive information technology (IT) contingency plan.

Key Findings

The Board and officials did not adequately secure student data to help protect it from unauthorized access or develop an IT contingency plan. As a result, there was an increased risk of unauthorized access to student personal, private and sensitive information (PPSI) and personally identifiable information (PII), and that the School could suffer a serious interruption to operations since its ability to communicate during a disruption or disaster could affect the timely processing of its business functions. In addition to sensitive IT control weaknesses which we communicated confidentially to School officials, we found:

School employees did not have guidance on how to properly identify and secure sensitive student data.
Three out of six tested users of the cloud-based application used for School operations stored sensitive student data without adequate protection, and 12 of the 125 users of the cloud-based Student Information System (SIS) had excessive or unnecessary access to view and modify sensitive student data.

Key Recommendations

Review, revise (if necessary), adopt and communicate the data classification policy to employees.
Ensure all access to sensitive student data is based on needs and job responsibilities.
Develop a written IT contingency plan.

School officials agreed with our recommendations and have initiated, or indicated they planned to initiate, corrective action.

Audit Period

July 1, 2021 – May 24, 2023

Background

The School is located in the City of Yonkers in Westchester County. The New York State (State) Board of Regents approved the School’s charter in December 2003 and the School was opened in July 2005.

The seven-member Board is responsible for managing and controlling the School’s financial and educational affairs. The Superintendent is responsible, along with other administrative staff, for the School’s day-to-day management under the Board’s direction.

The Superintendent designated the Director of Student Data (Director) as the Data Protection Officer (DPO), who is responsible for implementing data privacy and security policies and procedures and serves as the School’s point of contact for data security and privacy.

The School has a Service Level Agreement (SLA) with an IT vendor to manage the School’s day-to-day IT operations, including shared application folders and SIS, and ensuring appropriate IT contingency measures are in place and tested.