Finding Text
Criteria: The State of North Carolina’s information and information systems are valuable assets that must be protected. Each information asset must be evaluated and classified with protective controls assigned that are commensurate to its established value. Appropriate security measures, including policies and procedures, must be in place to protect all information assets from accidental or unauthorized use, theft, modification, destruction, and to prevent the unauthorized disclosure of restricted information. These measures must ensure the confidentiality (as applicable), integrity, and availability of information assets. Each County DSS Agency, through its management, is required to protect and secure the information assets under its control. Condition: There were multiple instances noted during our procedures in which confidential participant information was not properly protected and secured to prevent unauthorized use, modification, and theft. The instances were as follows: Personal computers of caseworkers were left unattended while showing confidential participant information. Context: While on-site at DSS, we performed walkthroughs through 5-10 offices, those of which were vacant at the present time, to ensure the personal computers in those offices left unattended were either locked or logged out, and not showing participant information. Effect: Personal computers of caseworkers contain confidential information for respective participants. Improper security and protection of this information could result in unauthorized use, modification, and theft- potentially leading to negative consequences for the participant. Cause: Employees being preoccupied with daily job responsibilities; general human nature. Recommendation: When leaving personal computers unattended, double-check to make sure computer is either locked or logged off.