New York State Comptroller Releases New Municipal Cybersecurity Audits Highlighting Local Deficiencies

Background and Audit Findings

New York State Comptroller Thomas P. DiNapoli has published a fresh batch of municipal audit reports, focusing specifically on cybersecurity controls in local government entities such as the Town of Wilton. Across several jurisdictions, the audits examined access control mechanisms, user account lifecycle management, disaster recovery readiness, and employee security awareness training covering operational periods through mid-2025.

The findings point out persistent weaknesses that frequently afflict municipal and public sector entities. Common oversights include unmanaged administrator privileges, lack of multi-factor authentication (MFA) across internal systems, outdated software inventories, and inconsistent data backup testing. Without adequate controls, these municipal systems remain susceptible to ransomware deployment and data exfiltration.

FORTSECURE GLOBAL Recommendations for Local Governments

To remediate these compliance gaps and lower exposure to cyber threats, municipal IT teams should take the following strategic steps:

• Implement the Principle of Least Privilege: Regularly audit privileged active directory accounts and decommission inactive accounts immediately upon employee departure.
• Mandate Multi-Factor Authentication: Enforce MFA across all administrative consoles, remote access pathways, and email services to mitigate credential-based intrusions.
• Establish Routine Internal Audits: Adopt standardized frameworks such as the NIST Cybersecurity Framework (CSF) or CIS Critical Security Controls to systematically evaluate infrastructure resilience.
• Conduct Disaster Recovery Exercises: Test offline and cloud backups quarterly to guarantee business continuity during a ransomware emergency.

---

แหล่งที่มา: DataBreaches.net เผยแพร่ครั้งแรก: Sun, 06 Sep 2026 11:54:51 +0000 บทความต้นฉบับ: อ่านต้นฉบับ