Rockville Centre Union Free School District – Information Technology (2023M-140)

Issued Date

March 08, 2024

Audit Objective

Determine whether Rockville Centre Union Free School District (District) officials monitored users’ compliance with the District’s acceptable Internet use policy (AUP).

Key Findings

District officials did not monitor users’ compliance with the District’s AUP. Of the 37 network users we reviewed:

Fifteen network users (41 percent) accessed websites, such as shopping, entertainment and social media, on District computers although the District’s regulations for acceptable Internet use and computer resources and data management state that personal use is prohibited. As a result, the likelihood that a user’s Internet browsing exposes the District to malicious software that may compromise data confidentiality, integrity or availability is increased.
Fifteen network users (41 percent) did not have signed forms acknowledging they received and reviewed the District’s AUP. This diminishes accountability and the District’s ability to protect District computers and the data contained therein.
Six nonstudent network users (22 percent) did not receive information technology (IT) security awareness training. As a result, the risk that users will not understand their responsibilities and put personal, private and sensitive information (PPSI) on District computers at greater risk of misuse or loss is increased.

Key Recommendations

Monitor network users’ Internet use on District computers and enforce compliance with the acceptable Internet use and computer resources and data management regulations.
Limit the use of IT resources to only include District activities.

District officials generally agreed with our recommendations and indicated they have initiated or plan to initiate corrective action.

Audit Period

July 1, 2021 – December 22, 2022. We extended our audit period back to June 19, 2019 to review Internet history data.

Background

The District serves the Town of Hempstead in Nassau County. The District is governed by a five-member Board of Education (Board) that is responsible for managing and controlling the District’s financial and educational affairs. The Superintendent of Schools (Superintendent) is the District’s chief executive officer and is responsible, along with other administrative staff, for the District’s day-to-day management under the Board’s direction.

The District’s IT environment is managed by the IT Director who is the designee responsible for monitoring and examining all network activities to ensure the proper use of all IT systems. The IT Director reports to the Central Administration, which includes the Superintendent and the Assistant Superintendents for Finance and Operations; Special Education and Pupil Personnel Services; Curriculum and Instruction; and Human Resources.