Laserfiche WebLink
County of Hawaii, State of Hawaii <br />SCHEDULE OF FINDINGS AND QUESTIONED COSTS (Continued) <br />Fiscal Year Ended June 30, 2014 <br />SECTION II - FINANCIAL STATEMENT FINDINGS (Continued) <br />Ref. <br />No. Internal Control Findings <br />2014-001 Logical Access & Access Security - Significant Deficiency (Continued) <br />Recommendation <br />We recommend that the County: <br />1. Strengthen password controls for the IAS and ReCo systems that include a combination <br />of minimum length, complexity, expiration, history, and lockout policy and duration. As a <br />compensating control to mitigate the lack of functionality in the IAS and ReCo systems, <br />strengthen the domain password parameters and security settings to increase the <br />minimum password age and lockout duration requirements. <br />2. Develop an information security policy, have the policy approved by the appropriate level <br />of management and communicate the policy to employees. <br />26 <br />