Summary

Our operational audit for the fiscal year ended June 30, 2008, disclosed the following:

Finding No. 1: The College did not conduct a review and evaluation of social security numbers it collected or notify individuals of the purpose for collection of the numbers, contrary to Section 119.071(5)(a), Florida Statutes.

Finding No. 2: The College had not developed an ongoing information technology (IT) security awareness program to periodically remind personnel of the importance of preserving the integrity, confidentiality, and availability of data and IT resources entrusted to them.

Finding No. 3: The College lacked written policies and procedures for certain IT functions.

Finding No. 4: Certain security controls relating to user authentication needed improvement.

Finding No. 5: Certain application access and authorization controls needed improvement. 

The College's response is included as Exhibit C of this report.