Jail Management System - Maricopa County

Executive Summary
IT Control Environment (Page 7)
The Maricopa County Sheriff’s Office (MCSO) information technology (IT) control
environment generally follows industry standards in key areas.
Network Security (Page 9)
We tested network security controls in four key areas: (1) The Criminal Justice Network, (2)
password management, (3) remote access security, and (4) patch management. Strong network
security controls reduce the likelihood of system vulnerabilities and breaches. Due to the
sensitive nature of this work, we provided MCSO management with detailed findings in a
separate report.
Personnel Screening and Access Reviews (Page 10)
MCSO personnel screening, security awareness training, and account access review processes
could be improved. Incomplete personnel screening and training processes may leave MCSO
vulnerable to potential abuse of sensitive data. Undocumented user access procedures increase
the risk that unauthorized users may inappropriately access or modify criminal justice
information. MCSO should consider strengthening personnel screening policies, provide user
awareness training, and conduct user access reviews.
Change Management (Page 12)
MCSO does not have a formalized change management process for authorizing, testing, and
approving the Jail Management System (JMS) changes. JMS developers have unrestricted
access to the application. If unauthorized or untested changes are introduced into JMS, they
could create data integrity and system availability issues. MCSO should strengthen its change
management controls.
IT Strategic Planning and Project Management (Page 13)
MCSO does not have a formal IT strategic plan or project management process that effectively
aligns IT resource spending with MCSO’s core mission. A strategic plan helps ensure that
critical IT projects are completed efficiently and economically. MCSO should consider
developing an IT strategic plan and project management framework.
IT Policies and Procedures (Page 15)
MCSO does not have formal JMS security policies and procedures that should address Criminal
Justice Information Services Security Policy requirements. Formalized IT procedures can help
MCSO implement security and other control activities during personnel absences and turnover.
MCSO should develop formalized JMS IT policies and procedures.
Maricopa County Internal Audit 1 Jail Management System–May 2012