Comptroller: Valley Stream must improve IT controls

The New York State Comptroller’s office recently released its report on Valley Stream’s information technology controls, and made several recommendations for the village to improve its operations.

According to the report, the village did not have a comprehensive computer use policy in place for employees, and only had a acceptable email use policy. The village board has also failed to provide several employees with information security awareness training, the report stated.

Representatives from Comptroller Thomas DiNapoli’s office visited Valley Stream from Jan. 1, 2009, through July 20, 2010, reviewing the village’s information technology procedures and practices, testing 122 computers and analyzing the use of software. The village, within 90 days of the release of the audit, will have to create a Corrective Action Plan.

The report cites weaknesses in employee user account practices. It found that three former employees still had network access, and also that one current employee was given remote network access rights by accident.

Additionally, the report stated that the village did not have a proper data recovery plan, if the network ever went down. A draft disaster recovery plan lacked critical details, such as an alternate site to store information, and an expected time frame to resume business operations in the event of a network failure, according to the comptroller.

Deputy Mayor Vincent Grasso said that the village board members are taking the report very seriously. “We’ve already started implementing a lot of the suggestions they’ve made,” he said.

Grasso explained that the evolution of technology outpaces the rate that many municipal governments can keep with it in terms of practices, procedures and rules. However, he said that Valley Stream officials must do a better job at keeping current. Also, he said, if the village falls too far behind, it can be even more costly to taxpayers to catch up.