Massachusetts State Auditor Diana DiZoglio’s office recently released an audit report of the Office of Consumer Affairs and Business Regulation (OCABR).
During the audit period of July 1, 2022, through June 30, 2023, the audit found that OCABR’s website was not fully accessible for all Massachusetts residents and users. This impacts user experience and undermines OCABR’s ability to provide equitable access and digital inclusiveness. The audit also found that OCABR did not have an information classification policy and did not classify its data. Without effective data policies in place, sensitive data may be more vulnerable to unauthorized access, theft, or misuse.
Also related to security, OCABR did not have procedures for disposing information, creating additional risks such as theft, mismanagement, and unauthorized access of data in its custody. OCABR did not ensure that access to personally identifiable information (PII) was limited to approved personnel members who have business needs to access it. Granting personnel access to PII without requiring formal approval of their business need, as well as appropriate training, exposes OCABR to significant risks, such as data breaches.
Click HERE to read the full audit report.
