Oregon SOS Audit Finds Gaps in State IT Oversight and Disaster Recovery Planning

Salem, OR. — Oregon’s centralized technology organization has established an adequate cybersecurity foundation and stable computing operations, but weaknesses in accountability, risk oversight and disaster recovery planning could increase the risk of prolonged outages and recurring service disruptions, according to an October audit.

The Oregon Secretary of State’s Audits Division examined Enterprise Information Services, or EIS, focusing on its Data Center Services and Cyber Security Services programs during 2025 and early 2026.

Auditors found that 355 of 399 applicable cybersecurity safeguards, approximately 89%, were at least partially implemented. All 44 operational controls evaluated were also at least partially implemented. Those figures include both partial and full implementation.

However, auditors found that responsibilities were not always clearly assigned, recovery plans varied in completeness, and leadership lacked consistent information to evaluate risks and performance across the state’s shared technology services.

The report issued 16 public recommendations and nine additional recommendations in a confidential appendix. EIS agreed with all recommendations.

Become a Paid Subscriber for Exclusive Content Access and Support Independent News

Unclear responsibilities and incomplete risk assessments

EIS operates within the Department of Administrative Services, while the state chief information officer reports directly to the governor. EIS and Data Center Services have a combined budget of approximately $345 million for the 2025–27 biennium and 282 staff, according to the audit.

Their technology services support government functions including health care, public safety and economic programs.

Auditors found that the state’s Information Security Program Plan outlines broad authority but does not clearly assign responsibility for individual security controls among cybersecurity staff, data center personnel and customer agencies.

That ambiguity creates a risk that protections will be inconsistently implemented or monitored because teams interpret their responsibilities differently.

EIS also had not completed a comprehensive assessment establishing a baseline of risks across its enterprise technology environment. Risk identification and prioritization occurred unevenly across programs and platforms, with limited integration of privacy risks.

Although EIS conducts security assessments and undergoes external audits, auditors found it lacked a recurring, independent internal assessment program covering controls across the enterprise. Its process for tracking corrective actions was largely reactive and lacked consistent statewide performance measures.

Auditors recommended clearly documenting responsibilities, completing a comprehensive security and privacy risk assessment, establishing recurring independent assessments, and improving reporting on corrective actions.

Disaster recovery plans need stronger testing and coordination

The audit identified several weaknesses in preparations to restore services after a major disruption.

Recovery objectives were not consistently documented or approved across critical systems. These objectives establish how quickly services should return and how much data loss is acceptable. Some were based on informal assumptions or verbal understandings.

Disaster recovery plans also varied substantially in detail and completeness. Documentation was spread across multiple locations, and some procedures relied on employee knowledge rather than comprehensive, approved plans.

Testing did not consistently demonstrate that entire services could be restored. Some exercises focused on individual components without validating data integrity, application functionality and the dependencies needed for full recovery.

Recovery responsibilities and training were also inconsistently documented, potentially complicating responses when experienced personnel are unavailable.

Additionally, recovery plans sometimes assumed network connectivity would remain available instead of treating network restoration as a necessary part of recovery.

Auditors recommended approved recovery targets for all critical systems, standardized and centrally maintained plans, broader recovery testing, formal staff responsibilities and training, and exercises validating network recovery.

Operational oversight needs greater consistency

Auditors found established monitoring and response processes supporting daily operations, but inconsistent oversight of automated processing, system capacity and service disruptions.

Scheduled jobs perform functions such as financial processing, data transfers and reporting. Their ownership, dependencies and recovery procedures were not always consistently documented, increasing the risk that failures could delay processing or affect connected systems.

Performance and capacity monitoring also relied on individual teams and platform-specific practices without a unified framework for forecasting demand and reporting emerging constraints to leadership.

The audit further found that efforts to identify and eliminate recurring problems had been primarily reactive. EIS was beginning to implement a formal problem management process documented in June 2025, but auditors did not evaluate whether that new process was consistently implemented or operating effectively.

Recommendations included assigning accountable owners, documenting automated processing requirements, improving capacity forecasting, requiring root cause analysis and tracking whether corrective actions prevent repeat problems.

For service incidents, auditors recommended common severity classifications, clear escalation and executive notification requirements, and measures showing how quickly problems are detected and services restored.

Physical protections established, documentation incomplete

The state’s data center uses layered security measures, continuous monitoring, backup power and environmental protections.

Auditors described the physical security program as largely functioning well. Their findings concerned fragmented policies and inconsistent documentation of physical access reviews.

They recommended a formally approved physical and environmental protection policy, along with standardized records, retention requirements and management approval for access reviews.

Detailed cybersecurity findings were withheld in two confidential appendices because public disclosure could expose security weaknesses.

EIS accepts recommendations, sets implementation targets

In an October 7 response signed by State Chief Information Officer Terrence Woods, EIS committed to clarifying responsibilities, strengthening risk assessments and formalizing oversight across its programs.

The agency set June 30, 2027, targets for updating its security responsibility plan, enhancing internal assessments and improving physical security policies and access-review documentation.

Its comprehensive security and privacy risk assessment is targeted for September 30, 2027. Disaster recovery improvements have targets in October and December 2027.

EIS scheduled incident and problem management improvements for July 31, 2027, and the enterprise performance and capacity management framework for June 30, 2028.