Chester Union Free School District – Information Technology (2021M-107)

Issued Date

March 11, 2022

Audit Objective

Determine whether Chester Union Free School District (District) officials adequately managed and monitored network user accounts.

Key Findings

District officials did not adequately manage and monitor network user accounts. District officials should have:

Disabled unneeded network user accounts when there was no longer a need for them.
Monitored network user compliance with the District’s computer acceptable use policy (AUP) by reviewing computer website history logs for appropriateness.

Sensitive information technology (IT) control weaknesses were communicated confidentially to officials.

Key Recommendations

Routinely evaluate and disable any unneeded network user accounts.
Monitor Internet use to ensure network users comply with the AUP.

District officials agreed with our recommendations and have initiated or indicated they planned to initiate corrective action.

Background

The District is located in the Town of Chester. It serves portions of the Towns of Chester, Goshen and Blooming Grove and the Village of Chester in Orange County.

The District is governed by a Board of Education (Board), which includes five elected members.

The Superintendent of Schools (Superintendent) is appointed by the Board and is responsible for the District’s day-to-day management.

The District’s Data Administrator IT Director (IT Director) is responsible for all District IT functions and manages all IT infrastructure.

Quick Facts
Network User Accounts Reviewed
Employee Accounts	159
Nonemployee Accounts	17
Generic Accounts	26

Audit Period

July 1, 2019 – January 11, 2021. We extended our audit scope through March 18, 2021 to complete our IT testing.