State auditor still gathering cybersecurity data at Cape public schools

Auditors for the state of Missouri are testing cybersecurity safeguards in the Cape Girardeau School District.

The process began March 21, and the on-site portion was expected to take six to seven weeks. But according to the state auditor’s office, staff still are completing the information-gathering part of the audit.

This is not an indication of potential issues within the district, however.

Gena Terlizzi, director of communications for the office of Missouri State Auditor Nicole Galloway, said the auditing process is complicated and different for each entity.

In some cases, audit staff will complete their fieldwork in one visit; other times it’s done in segments, and staff will return to the office between visits to gather information. That the work extended beyond the time expected is not a concern.

Details about the audit in Cape Girardeau are limited, and its unclear when the fieldwork will be completed.

“We don’t want to give away too much information that could impede the audit process,” Terlizzi said.

Once fieldwork is completed, a number of steps follow before the report can be released, including the drawing of an initial draft to which the school district will respond. Those responses will be included in the final report, which Terlizzi expects in the fall.

In September 2015, Galloway announced the Cape Girardeau School District would be one of five districts in Missouri undergoing Cyber Aware School Audits. The audits were designed to identify weaknesses and improve the safety of student information; other districts audited were Boonville School District in Cooper County, Orchard Farm School District in St. Charles County, Park Hill District in Platte County and the Waynesville District in Pulaski County.

The districts, Terlizzi said, were selected because they represent a broad cross-section of schools of different sizes across the state and different levels of technology.

So far, one audit has been completed and released for public viewing.

The audit, released by Galloway, identified a number of issues within the Boonville School District, including a lack of a security administrator and properly secured sensitive technology hardware.

The audit also stated concerns with basic data security controls, including password change requirements, staff access to a computerized system and monitoring of security logs to identify and address cyberthreats for investigation. Auditors made recommendations to improve information security, and recommended the district implement a security awareness training program for its staff.

The Boonville district concurred with the recommendations and provided details of its intentions to follow the auditors’ suggestions.

To not follow the recommendations could have repercussions far beyond the classroom, and “could potentially lead to sensitive information being exploited or falling into the wrong hands,” Terlizzi said.

The next district to have its audit released will be Waynesville in late May or early June. Cape Girardeau will follow in the fall.

A decision on whether the auditor’s office will carry out more audits will be made when all five initial findings are complete.

“At that point, we’ll have a better picture, and we can decide on the next step,” Terlizzi said.

bbrown@semissourian.com

(573) 388-3630

Pertinent address:

301 N. Clark Ave., Cape Girardeau, Mo.