Post Audit finds nearly half of audited entities fall short on basic IT security controls

The Kansas Legislative Division of Post Audit presented a two-year summary of IT security audits covering multiple state and local entities and reported repeated and widespread weaknesses.

The auditor said, "7 of the 15 entities that were audited in the past 2 years did not subsequently comply with applicable IT security standards and best practices," and noted the most common problem areas were vulnerability remediation, continuity of operations and incident response. Auditors found many entities did not perform credentialed vulnerability scans or timely patching, used unsupported software versions and lacked tested disaster recovery and business impact analyses.

The report attributed root causes to three consistent issues: insufficient management attention and oversight, inadequate IT resourcing, and poor contractor administration. The post audit presenter said follow-up audits and written responses are part of the oversight process, and that audited entities are expected to provide corrective plans and report progress in subsequent reviews.