Single Audit of Federal Financial Assistance Programs for Fiscal Year 2014 - 2015

Home

County of Hawai‘i, State of Hawai‘i CORRECTIVE ACTION PLAN Fiscal year Ended June 30, 2015 Financial Statement Findings: 2015-001 Information Security Policy Recommendation: Management should develop standardized information security policies and procedures that are followed by all departments and agencies of the County. County’s Comment: At the last quarterly Information Technology (IT) meeting, the reviewing of all agency Information Security policies and developing standardized baseline security policies for all IT groups was discussed by the group, which consists of the County’s IT Department and other County IT sections. Agencies are to provide their security policies for review and a standardized Information Security Policy will be developed and followed by all County departments and agencies. 2015-002 Physical Security Recommendation: We recommend that the County develop formal policies over the physical security of IT systems at the Center and to implement them. The server room should be locked and access to keys or codes should be limited to authorized personnel. A fire suppression system should be installed to prevent or limit the loss of data from fire. County’s Comment: As explained in prior years, although the specific room that houses the servers is left open, the general Civil Defense facility is restricted to authorized personnel and access to the facility itself is limited. Visitors are required to sign in before being allowed entry to Civil Defense and are typically escorted. The current air conditioning (AC) capabilities of the Server Room are not adequate to allow for the door to be closed without risking damage to the systems. The system specification requirements for a new AC system are being compiled to replace the existing system, which should allow the Server Room door to be closed and locked. We are considering several possibilities which would enable the County to secure the servers while still allowing airflow for cooling is also being considered. Although a fire suppression system has not been selected as of yet, all data is backed up nightly from these servers to a different physical location to reduce the risk of data loss due to fire and other potential hazards. 33