News

:

,

VIU board failed in oversight of cybersecurity management says auditor general

A man wearing a blue checkered shirt, a blue bow-tie and a white jacket stands at a lecture with the BC flag in the background.
Auditor General Michael Pickup said Vancouver Island University’s board of governors failed to provide proper oversight of the university’s cybersecurity practices in a report released on Tuesday. Undated file photo provided by the Office of the Auditor General of British Columbia.
Mick Sweetman - CHLY - Nanaimo • BC | 02-08-2023
Share on facebook
Share on twitter
Share on linkedin
Share on pinterest
Share on email
Share on print

Vancouver Island University’s board of governors failed to provide oversight of the university’s cybersecurity policies according to a new report by B.C’s Auditor General Michael Pickup on Tuesday.

With 12,000 students and 1,500 faculty and staff Pickup said it was vital for VIU to do everything it could to protect their information.

“We concluded that the VIU board of governors has not provided oversight of the university's cybersecurity risk management practices,” said Pickup.

The report made three key findings:

  • The board established oversight roles and responsibilities, but policies were out of date.
  • The board training on how to oversee cybersecurity risk management was inadequate.
  • A risk management framework was developed, but the board did not review the mitigation strategies until the end of the last fiscal year.

Vancouver Island University said in a statement that “VIU’s board of governors has accepted and is working on implementing the auditor general’s four recommendations.”

Those four recommendations are to:

  • Ensure that governance and policy documents defining roles and responsibilities for cybersecurity risk management are reviewed and approved as scheduled.
  • Create an annual development program and ensure board members receive annual training on cybersecurity risk management to support them in their oversight role.
  • Update the board orientation program to include information on the roles and responsibilities for oversight of cybersecurity risk management.
  • Review cybersecurity risk mitigation strategies annually.

The auditor general said he is pleased that VIU is working on addressing the shortcomings the audit found and will be following up to make sure that work is completed.

Pickup says that VIU was chosen for the audit because it is a similar size to other postsecondary institutions in the province. He hopes that the report will prompt other universities and public sector organizations to take a look at their own cybersecurity oversight policies.

“The area of cybersecurity, because it is so risky, because it is ever so changing, it is so impactful, you’ve got to do all you can reasonably be expected to do to help with the lines of defense,” he said. “Board oversight and governance of cybersecurity is one of those lines of defense.”

Listen to the CHLY story below:

Download Audio