Single Audit of Federal Financial Assistance Programs for Fiscal Year 2015 - 2016

Home

Harry Kim Mayor Wil Okabe Managing Director March 29, 2017 County of Hawaii DEPARTMENT OF INFORMATION TECHNOLOGY 25 Aupuni Street • Hilo, Hawaii 96720-4252 (808) 932-2960 • Fax (sos) 961-8089 Subject: Corrective Action Plan in response to 2016 Single Audit Internal Control Finding Reference Number 2016-001 Recommendation: Jules Ung Director We recommend that the County develop formal policies over the physical security of IT systems at the Center and to implement them. The server room should be locked and access to keys or codes should be limited to authorized personnel. A fire suppression system should be installed to prevent or limit the loss of data from fire. County's Comment: Management agrees with the finding and recommendations regarding the development of formal policies over the physical security of IT systems. In response, DIT has created and implemented 6 IT policies including: 1) Internet Network Email Policy 2) Password Policy 3) E -Mail Retention Policy 3) Electronic Data Destruction Policy 5) Mobile Device Policy 6) Social Media Policy. These policies outline best practices to protect the County's devices, network, and information systems from unauthorized access, damage, and tampering. However, as in prior years, the County contends that its current policies outlined below serve as mitigating controls that address the findings of the server room. Although the specific room at Civil Defense that houses the servers is left open, the general Civil Defense facility is restricted to authorized personnel and access to the facility itself is limited. Visitors are required to sign in before being allowed entry to Civil Defense and are typically escorted. Although a fire suppression system has not been selected as of yet, the County has implemented mitigating controls to reduce the risk of data loss due to fire and other potential hazards by ensuring that all data is backed up nightly from these servers to a different physical location. In addition, the following plan is also currently being implemented. Researching the possibility of partnering with Civil Defense to construct a new shelter to contain the server room that will be situated adjacent to Civil Defense, with an underground conduit for fiber to preserve the integrity of the County Network during times of disaster. Hawai `i County is an Equal Opportunity Provider and Employer 30