2014-COH - Single Audit of Federal Financial Assistance Programs

Home

CORRECTIVE ACTION PLAN Financial Statement Findings: 2014-001 Logical Access & Access Security - Significant Deficiency Recommendation: We recommend that the County: 1. Strengthen password controls for the IAS and ReCo systems that include a combination of minimum length, complexity, expiration, history, and lockout policy and duration. As a compensating control to mitigate the lack of functionality in the IAS and ReCo systems, strengthen the domain password parameters and security settings to increase the minimum password age and lockout duration requirements. 2. Develop an information security policy, have the policy approved by the appropriate level of management and communicate the policy to employees. County's Comment: 1) Inadequate password parameters and security settings for IAS and ReCo, password age and lockout parameters that could be further strengthened. o To our knowledge the complexity restrictions are a limitation of the existing IAS and ReCo software. However, ReCo is scheduled to get a more complex password control in April 2015 and the County will be upgrading to a cloud based system in June 2015 for IAS, which will address this issue. 2) The County did not have any formally documented security administration policies and procedures. o The County's Department of Information Technology is sending staff for training in the coming weeks on how to write and implement rules and procedures to address the current limited written policies and procedures. Anticipated Completion Date: Some items will be corrected by June 30, 2015 and others will be an ongoing effort as we strive to improve our internal controls over information technology. Contact People: Don Jacobs, Director of Information Technology Stan Sitko, Real Property Tax Administrator 34