HUDSON — The Hudson City School District’s Information Technology department has a $300,000 increase in the proposed 2021-22 district budget in the wake of security issues.
A state Comptroller’s Office report issued April 9 revealed the school district’s IT department did not take proper precautions to secure the district’s system. The district’s IT budget is proposed to increase more than $300,000 to replace outdated equipment.
The report found district officials inadequately secured and protected the district’s IT systems against unauthorized use, access and loss. The audit covers July 1, 2018, to Jan. 31, 2020.
The district did not adopt adequate IT policies or a disaster recovery plan, adequately manage network user accounts, monitor for acceptable use policy compliance and did not provide IT security awareness training, according to the report.
An acceptable use policy describes what constitutes appropriate and inappropriate use of IT resources. District officials did not develop IT policies for password security, wireless security and mobile and removable devices, which leads to a likelihood of undetected errors or fraud in the system, according to the report.
The lack of security policies in the district significantly increases the risk that data, hardware and software systems may be lost or damaged by inappropriate access and use, according to the report.
The school district will increase its IT budget by $309,600, Business Administrator Jesse Boehme said Monday.
The department’s salaries budget line will increase from $130,000 to $198,300; the equipment budget line will increase from $22,000 to $178,000; the software budget line will increase from $41,500 to $72,000; and the Board of Cooperative Educational Services e-rate purchases will increase from $590,900 to $645,700.
The contractual budget line which includes license fees from services and web filters, will remain the same, at $59,100 and the computer miscellaneous supplies and equipment will remain the same at $90,000.
The BOCES budget line includes new copiers for the district, a network engineer, two computer techs and a helpdesk service, according to Boehme. A new copy machine lease will provide new copiers, printers and toner to the district, a $108,000 value for $80,000, Boehme said at the March 16 budget workshop.
The district is planning to purchase $285,000 worth of equipment for $40,000, an 86% discount because of e-rate, a discounted telecommunications equipment program, he said. The server room needs to be upgraded, which will cost about $130,000 because there is no e-rate option.
The budget increase is an investment in the district’s security, Hudson School Superintendent Maria Lagana Suttmeier said at the March 16 workshop.
Suttmeier responded to the audit in a statement Monday. “We agree with the findings documented in the audit and find the facts contained within the report to be accurate and complete for the period of July 1, 2018, to Jan. 31, 2020. We have learned from the report and will be using state and federal money to improve our IT infrastructure and get new equipment to our students,” she said. “At the time of the audit, planning was already underway to address many of the identified deficiencies. Therefore, the district has already complied with many of the recommendations in the audit.
“The district was and still is in the process of transitioning and transforming its IT operations beginning with a change in staffing and related services. Significant resources have been applied to address the equipment, network, and operating deficiencies and the district will continue to improve our infrastructure to provide all users with a secure, stable, scalable, and sustainable IT environment.”
The district’s new IT manager, Cheryl Rabinowitz, began work after the comptroller’s audit period, in July 2020, Suttmeier said Monday. Core BTS, an IT vendor with locations across the country, worked for the district the year before, during part of the audit period. The district had two IT employees prior to Core BTS. Suttmeier did not identify the employees.
Other than Rabinowitz, the department is staffed by three IT employees contracted from Questar III, including a network engineer and two computer techs, according to Boehme. The district is in the process of looking for a data coordinator analyst.
District officials hired a certified public accountant to conduct an IT audit in May 2019, according to the comptroller’s report. The audit contained findings and recommendations and was completed while the district had in-house IT employees, before Core BTS was hired July 1, 2019.
Core BTS was made aware of the IT system risks and failed to implement recommendations from the CPA audit. When Core BTS did not implement the CPA audit’s recommendations, its contract was not renewed and Rabinowitz was hired. The service provider was paid $142,209, according to the report. Core BTS is not identified in the comptroller’s report, but Suttmeier identified the provider as Core BTS.