Audit of Office of Emergency Management and Communications Public Safety Cameras

Executive Summary

OIG’s audit focused on functionality and maintenance of City-owned public safety cameras, as well as whether OEMC provided camera network access to only the appropriate personnel. We found that OEMC did not comply with, and did not require other departments to comply with, Citywide policies regulating access to information systems. We also found that OEMC did not establish and enforce operational objectives for the public safety camera program and that, as a result, OEMC cannot evaluate the adequacy of current operational levels. Finally, OIG found that while OEMC’s camera system project manager—the Public Building Commission (PBC)—received and reviewed vendor deliverables, adjustments could meaningfully improve PBC’s vendor oversight. OIG recommends that OEMC implement robust IT security practices, develop performance measures for system operability, and review PBC’s vendor oversight.

In response to the audit, OEMC agrees with our recommendations and has already initiated some corrective actions. In late 2015, OEMC began improving network access controls by replacing group logins with unique usernames and passwords. OEMC also plans to work with PBC to develop performance measures for the camera network and improve contractor oversight, while exploring alternative arrangements for program management.