Comptroller recommends updating regulations and processes in the information systems of the Medical Sciences Campus
The Office of the Comptroller of Puerto Rico (OCPR) issued a qualified opinion on the operations of the computerized information systems of the Office of Information Systems of the Medical Sciences Campus of the University of Puerto Rico. A qualified opinion is issued when the noncompliance, individually or in the aggregate, is significant but not pervasive.
The Report reveals that, as of June 26, 2023, the Campus did not have a risk analysis report of the computerized information systems. This analysis, which allows the identification of the assets of the information systems, as well as their vulnerabilities and threats, must be updated every 24 months.
This situation has the effect that the impact of the risk elements on the information systems cannot be estimated. Some of these risks are modifying, interrupting, or destroying information of the systems, or unauthorized access. A similar situation had been commented on 11 years ago in Audit Report TI-13-12 of 2013.
The two-finding audit points out that the Information Technology Security Policy, approved 11 years ago, is not updated to the changes in organizational security. The Network Security Plan, approved 18 years ago, was also not updated to the operational changes.
In addition, the Standard for the Management of Security Incidents does not mention the current processes to request, renew, or change the password. These situations can make it easier for errors or irregularities to be committed without being detected in time.
The budget of the Medical Sciences Campus rose from $283,444,125 for 2022, to $316,712,662 for 2023, and to $331,121,900 for 2024.
The Report recommends that the Chancellor ensure that the interim director of the Office of Information Systems finalize the evaluation of the quotation of a private company to perform the Risk Analysis. In addition, that she carry out the efforts to update and approve the regulations indicated in the findings.
This first report covers the period from July 1, 2021 to May 24, 2024.
Audit Report OC-25-35 can be obtained on our website.
Some documents on this page are saved in PDF format.
To view these documents, you must have the following free program installed.
