Office of the Legislative Auditor - Financial Audit Division

Finding 1

DEED and MNIT inaccurately concluded that the Unemployment Insurance system complied with all information security control requirements and did not report known issues within MNIT’s centralized risk and compliance tool. (p. 12)

Recommendations

• DEED and MNIT should document all known risks within their security control compliance self-assessments.
• DEED and MNIT should track information security risks, findings, weaknesses, and deficiencies—with mitigations and remediations—within MNIT’s central risk and compliance tool.

Finding 2

DEED and MNIT do not have a process for identifying and securely deleting data records within the Unemployment Insurance system that exceed defined retention periods. (p. 15)

Recommendations

• DEED should follow its records retention schedule or seek to have it changed to suit its business requirements.
• DEED and MNIT should implement the needed functionality within the Unemployment Insurance system to delete unnecessary records.

Finding 3

DEED and MNIT have not fully implemented one-quarter of the identity and access management requirements designed to help protect the Unemployment Insurance system. (p. 18)¹

Recommendations

For the Unemployment Insurance system, DEED and MNIT should:

• [REDACTED]
• [REDACTED]
• Prevent frequent reuse of the same passwords.
• [REDACTED]
• Implement required controls for its privileged administrative accounts.
• [REDACTED]
• [REDACTED]
• Terminate idle or unattended user sessions.
• Provide appropriate system-use notifications to all users prior to accessing the system.

1. In accordance with Minnesota Statutes 2023, 13.37, subd. 2, we have removed from the public version of our report language from Finding 3 that we deemed likely to substantially jeopardize the security of information in the UI system. We discussed the specific details with DEED and MNIT. ↩︎

Finding 4

DEED and MNIT do not comply with all provisions of MNIT’s Security Logging and Monitoring Standard for the Unemployment Insurance system. (p. 23)

Recommendation

DEED and MNIT should ensure that the Unemployment Insurance system’s logging and monitoring controls are implemented as required by MNIT’s Security Logging and Monitoring Standard.

Finding 5

DEED and MNIT do not adequately maintain scanning agents on essential technical devices that support the Unemployment Insurance system. (p. 25)

Recommendations

• DEED and MNIT should ensure that vulnerability and configuration scanning software is properly updated on the Unemployment Insurance system.
• MNIT should clarify system maintenance responsibilities for its cloud-hosted system to ensure that all supporting software remain up to date.

Finding 6

DEED and MNIT did not document their review, updates, or testing of the Unemployment Insurance system’s disaster recovery plan. (p. 27)

Recommendation

DEED and MNIT should ensure that disaster recovery plans for the Unemployment Insurance system are reviewed, updated, and tested annually.

Finding 7

DEED and MNIT did not fully document some key processes necessary to ensure full recovery of the Unemployment Insurance system in case of a disaster. (p. 28)

Recommendation

DEED and MNIT should ensure that its disaster recovery plan for the Unemployment Insurance system contains documentation of all key processes and procedures necessary to successfully recover and validate the system.

Finding 8

In some cases, DEED and MNIT did not implement recommended security configurations for the Unemployment Insurance system, nor did they document, within MNIT’s centralized risk and compliance tool, the rationale for deviating from the recommended configurations. (p. 29)

Recommendations

• DEED and MNIT should implement recommended security configurations when appropriate.
• DEED and MNIT should document, within MNIT’s centralized risk and compliance tool, system configuration exceptions that do not meet MNIT’s security standards.
• DEED and MNIT should not retain sensitive documents longer than is necessary.

Finding 9

DEED uses various external and manual processes to identify suspicious transactions and potentially ineligible individuals, rather than automating these processes within the Unemployment Insurance system. (p. 31)

Recommendations

• DEED and MNIT should evaluate its current manual data-matching processes and look to automate those processes into the Unemployment Insurance system.
• DEED and MNIT should perform and document their analysis of strengths and weaknesses when deciding whether to implement automated data integrity solutions.

Finding 10

DEED and MNIT do not report on all Unemployment Insurance system project-related costs. (p. 38)

Recommendations

• DEED and MNIT should track and report on all project-related costs, including those related to DEED and MNIT staff time.
• MNIT should develop guidance and recommendations for agencies developing budgets for large or multiyear IT projects.

Finding 11

DEED and MNIT continue to custom build identity and access management functionality into the Unemployment Insurance system, rather than modernizing to an off-the-shelf solution. (p. 39)

Recommendation

DEED and MNIT should consult with the Technology Advisory Council, and reaffirm its decision to custom build identity and access management functionality.