Waterville Central School District – Network User Accounts and Information Technology Contingency Planning (2022M-111)

Issued Date

November 10, 2022

Audit Objective

Determine whether Waterville Central School District (District) officials adequately managed network user accounts and developed an information technology (IT) contingency plan.

Key Findings

District officials did not adequately manage network user accounts or develop a written IT contingency plan that details how District officials would respond to IT disruptions. As a result, officials had active but unneeded network user accounts that could be used as entry points for individuals to gain unauthorized access to the District’s IT systems, and the lack of a comprehensive written IT contingency plan impairs the District’s ability to recover from an unexpected IT disruption.

In addition to finding sensitive IT control weaknesses that were confidentially communicated to officials, we found that officials did not:

Develop written procedures for granting, changing and disabling user access rights to the network.
Perform periodic reviews of all network user accounts to determine whether they were appropriate or needed. As a result, 11 percent of the District’s non-student user accounts were unneeded and should have been disabled.

Key Recommendations

Develop written network user account access procedures and periodically review and evaluate all network user accounts.
Develop and adopt a comprehensive written IT contingency plan.

District officials generally agreed with our recommendations and indicated they have taken or plan to take corrective action.

Background

The District serves the Towns of Brookfield and Madison in Madison County and the Towns of Augusta, Kirkland, Marshall, Paris, Sangerfield and Vernon in Oneida County.

An elected seven-member Board of Education (Board) is responsible for the general management and control of financial and educational affairs. The Superintendent of Schools (Superintendent) is the chief executive officer and, along with other administrative staff, is responsible for day-to-day management under the Board’s direction.

The District’s Business Official serves as the IT Director (Director). The District contracts with the Mohawk Regional Information Center (MORIC) through the Oneida-Herkimer-Madison Board of Cooperative Educational Services (BOCES) to provide various IT services, including network configuration support. BOCES provides the District with a network administrator (Administrator) who is responsible for managing the District’s network and user accounts.

Audit Period

July 1, 2020 – April 4, 202