Single Audit of Federal Financial Assistance Programs for Fiscal Year 2014 - 2015

Home

County of Hawai‘i, State of Hawai‘i STATUS REPORT Fiscal year Ended June 30, 2015 This section contains the current status of prior audit recommendations. The recommendations are referenced to the pages of the previous audit report for the fiscal year ended June 30, 2014, dated January 12, 2015. SECTION II - FINANCIAL STATEMENT FINDINGS Reference NumberRecommendationCurrent Status 2014-001 Logical Access & Access Security (pages 25 - 26) Strengthen password controls for the IAS and ReCo Accomplished. As of systems that include a combination of minimum June 30, 2015, password length, complexity, expiration, history, and lockout requirements for both the policy and duration. As a compensating control to ReCo system and IAS have mitigate the lack of functionality in the IAS and ReCo been strengthened. systems, strengthen the domain password parameters and security settings to increase the minimum password age and lockout duration requirements. Develop an information security policy, have the policy Not accomplished. Refer to approved by the appropriate level of management and current year finding 2015- communicate the policy to employees. 001 for management’s response. 2014-002 Physical Security (page 27) The County should develop formal policies over the Not accomplished. Refer to physical security of IT systems at the Civil Defense current year finding 2015- Center and to implement them. The server room 002 for management’s should be locked and access to keys or codes should response. be limited to authorized personnel. A fire suppression system should be installed to prevent or limit the loss of data from fire. 2014-003 Information Technology (IT) Governance (page 28) The County should formally establish an IT Accomplished. The County management steering committee that meets on a implemented quarterly IT regular basis in order to evaluate IT risks and to management committee ensure that identified risks are appropriately meetings to facilitate addressed on a timely basis. information sharing and collaboration between the various departments supporting the County’s information technology function. 30