An IT Security Audit  is a method for the state to validate an organization’s ability to meet state requirements for protecting state controlled information, communications and systems. The state IT audit covers most of the technology and communications services that are provided at the college. Generally, the scope of the audit is to review our processes, procedures, equipment configurations of workstations, servers, firewalls, virus protection, databases, physical security and environment in data closets and server rooms. Procedural controls around software compliance, access control, and access to data.

What happens if the college is found not in compliance?

Only the Washington State Department of Information Services has the authority to procure IT equipment and services for the state. DIS delegates the authority to the colleges via the Center for Information Services (CIS). Colleges not in compliance would loose their delegated authority which would halt the procurement of IT goods and services. Additionally, the colleges use the K20 network to communicate with state agencies and to access the internet. Part of K20 use agreement says that subscribers will be compliant with many of the items and practices in the Security Audit Requirements.

Like all audits, the IT Audit requires an enormous amount of preparation and documentation to develop the audit submission and support the auditors thorough the on-site process.