ALBANY – A state comptroller’s office audit of the Town of Plattekill’s information technology system found that town officials did not manage network user accounts and develop adequate controls to minimize the risk of unauthorized use, access and loss.
The audit was conducted for the period of January 1, 2023 through August 12, 2024.
The audit found that the town board and supervisor did not adequately manage network user accounts or develop adequate controls to safeguard IT resources.
As a result, the auditors said the town officials could not be assured that town IT systems are secured and protected against unauthorized use, access or loss, and there is an increased risk of losing important data and suffering a serious interruption in operations.
The audit found that 14 unneeded network user accounts of former town employees were not disabled.
It also found the town did not develop and adopt a breach notification policy as required by state law, and that it did not develop and adopt an IT contingency plan for unexpected IT disruptions or disasters.
The audit also said the town did not require all employees to take IT security awareness training and that it did not enter into a written contract or service level agreement with the town’s IT service provider.
The report included six recommendations that, if implemented, would improve the town’s IT practices. The town generally agreed with the recommendations.
Comments