Halifax IT system implements many cybersecurity recommendations, but gaps remain: report

A man uses a keyboard in this stock image (Pexels/Soumil Kumar)

Halifax’s information technology (IT) system has addressed many of the recommendations in the municipality’s auditor general report from 2023, but some improvements are still needed, according to a follow-up review.

From Jan. 1, 2021 to Dec. 31, 2022, the Halifax Regional Municipality auditor general conducted a performance audit on the IT system’s management of cybersecurity. It released the results in August 2023.

“The purpose of the audit was to determine whether HRM appropriately manages cybersecurity risks to its network,” the report read. “The objective of this audit was to assess whether Information Technology management provides appropriate oversight to manage cybersecurity risks and has adequate processes to support network cybersecurity.”

The audit determined the IT management was not providing “appropriate oversight to manage cybersecurity risks,” noting that it has limited policies and processes to deal with them.

The audit issued 16 recommendations to improve cybersecurity. A follow-up review from the auditor general on Wednesday found 13 of those recommendations have been implemented in the last two years.

Some of the implemented recommendations include:

• hiring additional resources
• developing a cybersecurity risk register
• documenting patch management procedures
• monitoring physical data centres access

The audit’s three remaining recommendations are:

• developing policies to address key cybersecurity risks
• implementing a process to receive and review vendor security submissions in a timely manner
• developing a process to ensure assets are identified, inventoried and managed

For more Nova Scotia news, visit our dedicated provincial page