State auditor: Texas School for the Deaf still hasn’t implemented cybersecurity fixes from 2019 audit

The committee heard that the Texas School for the Deaf had not implemented most cybersecurity recommendations from a 2019 State Auditor audit, prompting a follow-up review this summer.

"We were unable to complete our audit work because the school had not implemented any of those recommendations that we had provided," the State Auditor's Office told the committee, saying the office conducted follow-ups in 2022 and again in 2026 and issued its latest report on July 29. The auditor described 12 recommendations in 2019, seven rated priority and five rated high priority, addressing weaknesses that placed student and health data at risk.

School officials said they have begun substantial technical work and have added cybersecurity staff but acknowledged documentation gaps. "Of the 12 initiatives, while 11 of them are not fully implemented, 8 are substantially implemented and the remaining 3 do have significant progress underway," Beth Polo, director of operations at the Texas School for the Deaf, told the committee and pledged to finish several findings by December 2026 and the rest by August 2027.

Members pressed the auditors on whether repeated missed deadlines should trigger stronger remediation than continued follow-up audits; the auditor said his office elevates persistent delays and informs the legislature but has no direct enforcement stick.

What’s next: the committee’s interim oversight work will continue to track the school’s submitted implementation status and documentation, and members requested follow-up reports that the school complete required documentation showing controls are in place.