Objective

To assess the extent of implementation of the two recommendations included in our initial audit report, Use of Vendor-Supported Technology (2019-S-40).

About the Program

Niagara Frontier Transportation Authority (NFTA) is a New York State public benefit corporation responsible for the oversight of public transportation in Erie and Niagara counties, including the NFTA Metro Bus and Rail System, the Buffalo-Niagara International Airport, and Niagara Falls International Airport. NFTA has approximately 1,500 employees, including an information technology (IT) department that operates out of its main office. To help carry out its mission, NFTA owns IT resources, including approximately 546 desktops/workstations and 250 servers that support 30 databases.

As a public benefit corporation, NFTA must adhere to the New York State Information Technology Security Policy (Policy) established by the New York State Office of Information Technology Services. The Policy defines the minimum information security requirements that all state agencies (including all public benefit corporations) must follow to secure and protect the confidentiality, integrity, and availability of information. This includes requirements for ensuring systems are up to date and maintained at vendor-supported levels.

Our initial audit report, covering the period June 24, 2019 through August 29, 2019, examined whether NFTA was complying with requirements to maintain its systems at vendor-supported levels. We evaluated selected systems and determined that, generally, NFTA maintained its systems at vendor-supported levels. However, we identified unsupported systems used by NFTA on 66 devices. We found that NFTA officials did not develop policies and procedures to ensure that their systems were regularly reviewed and kept up to date, nor did they maintain a single clear inventory of IT assets to aid in tracking their systems. NFTA officials indicated they were in the process of or had plans to upgrade certain systems identified as no longer supported by the vendors. We recommended NFTA officials ensure those actions and plans were completed and find solutions for systems that remain unaddressed. Generally, NFTA officials agreed with our recommendations and indicated they would take actions to implement them.

Key Finding

NFTA officials have made significant progress in addressing the problems we identified in the initial audit. Both recommendations have been implemented.