The Massachusetts State Auditor has found that the Woods Hole, Martha’s Vineyard and Nantucket Steamship Authority lacks a “formal, documented cybersecurity awareness training program” to ensure all its employees complete cybersecurity training.
The finding is part of a routine audit of the period July 1, 2019 through December 31, 2021.
The audit goes on to recommend the SSA begin to monitor training, “and follow up in an appropriate timeframe with any employees who have not completed training.”
The Steamship Authority was hit by a cyber attack in early June of 2021, shortly before the Auditor began its review.
Steamship Authority spokesman Sean Driscoll tells CAI the matter is already being addressed internally.
“The scope of these audits is years. They were here quite a little bit ago, so those discussions have already happened, and we are already well underway in enhancing that training program and taking corrective action, so that is already in progress,” Driscoll said.
In a statement, state Auditor Diana DiZoglio acknowledged the progress already being made.
“Based on the Steamship Authority’s response to our cybersecurity finding, they have acknowledged and agreed with our recommendations to establish and maintain a comprehensive cybersecurity training program that follows best practices. We appreciate the swift action taken by the Steamship Authority to address our concerns on this,” Dizoglio said.
The audit praised the Authority for its handling of $9.8 million in federal COVID relief funds, which were spent in conjunction with the Cape Cod Regional Transit Authority.
“Our team reviewed the Steamship Authority’s Coronavirus Aid, Relief, and Economic Security (CARES) Act funds in accordance with the Federal Transit Administration (FTA) guidance and the Steamship Authority’s memorandum of understanding with Cape Cod Regional Transit to ensure proper documentation for all expense,” the audit stated. “The team concluded that the Steamship Authority spent CARES Act funds in accordance with the FTA.
Driscoll welcomed that information.
“Getting that COVID relief money was a huge thing for us, and we were very careful to make sure that we tracked all of that and spent it on the proper things. And our accounting department and our treasurer was in constant contact with the CCRTA about that,” Driscoll said.
The Auditor’s report also mentioned in its Other Matters section that Steamship Authority employees did not always follow established policies regarding passage on vessels for employees.
“Steamship Authority employees did not always follow the established policies to issue trip passes to current, retired, temporary, or seasonal employees and eligible nonemployees,” the audit said.
