Auditor General report highlights IT risks at JUTC and RGD

The Registrar General’s Department (RGD) and the Jamaica Urban Transit Company Limited (JUTC) are vulnerable to information security threats owing to inadequate information system security controls and poor information technology governance, according to Auditor General Pamela Monroe Ellis.

An IT audit conducted by the Auditor General's Department showed that both entities have a high information technology (IT) risk exposure and may not be able to respond appropriately in the event of a threat affecting their IT environment.

Monroe Ellis reported that information systems that maintain and process highly sensitive and confidential information require effective data protection and security controls as well as appropriate policies to reduce the risk of unauthorised access, exposure or loss.

“Although RGD had developed security policies for its network and servers and JUTC had developed a ‘Computer, Network and Internet Acceptable Policy’ neither entity had established an enterprise IT security policy to manage access to all their IT resources and to ensure appropriate preservation of data confidentiality, integrity, and availability,” Monroe Ellis disclosed.

Further, the Auditor General said that the RDG, which is responsible for the safe custody of vital records such as birth, death, and marriage records, did not develop a data classification system in order to establish appropriate baseline security controls for the protection of these critical data.

Monroe Ellis recommended that the RGD and the JUTC should strengthen their information system security and related controls and IT governance to safeguard the confidentiality, integrity, and availability of their information and information systems from IT security threats that may compromise their operations.

We want to hear from you! Send us a message on WhatsApp at 18765508783, email us at editors@gleanerjm.com or onlinefeeback@gleanerjm.com.