Summary

Lake-Sumter Community College (College) uses the SCT Banner System to support various student and administrative functions.  Our audit focused on evaluating general information technology (IT) controls over access to the College’s computer resources, the development of an IT security awareness program, and the development and testing of a disaster recovery plan for the period July 2005 through June 2006 and selected College actions taken through January 2007; and determining the status of the College’s corrective actions regarding deficiencies disclosed in audit report No. 2005-027.

The results of our audit are summarized below:

Finding No. 1:          The College did not have an approved Strategic Technology Plan.  

Finding No. 2:         The College had not finalized a security program to ensure that exposures and vulnerabilities of IT resources had been sufficiently assessed by management and addressed through enforced user and system security controls.

Finding No. 3:         Physical security and environmental controls needed improvement with regard to protection from fire and loss of power and the recording of visitor entry to the server room. 

Finding No. 4:         There was no written business continuity and IT disaster recovery plan. 

The College's response is included at the end of this report as Appendix A.