39 Provide training to all employees commensurate with their job duties and responsibilities. See the linked report for examples.
40 Develop and formalize an information technology (IT) security awareness program to reinforce employee responsibilities related to IT security.
41 Evaluate whether candidates are eligible, based on all applicable criteria, for posted employment positions prior to selecting candidates for interview or further consideration.
42 Provide the district’s itinerant staff with specific written job expectations and required duties where their work activities are documented daily.
43 Ensure all full-time and substitute employees work the allotted number of hours in accordance with the Board-approved salary schedule.
44 Implement adequate internal controls to ensure substitute teacher payments are accurate and supported by timesheets or another form that provides the date, the name of the substitute, the person for which the substitute is working, and the school or location worked.
45 Report to the Board, at least quarterly, the current amount of leave and the cumulative associated value of that leave for all staff members, including the Superintendent.
46 Develop a procedure, subject to Board approval, requiring all employees report the actual amount of leave time used regardless of any exemption status.
47 Implement changes to the Superintendent’s salary or benefits only after complete, written, and signed documentation is received from the Board.
48 Include the Superintendent’s professional leave in the standard monthly reporting to the Board.
49 Ensure that procurement contracts entered into by the district specify the services required to be performed and the amount to be paid with specific language outlining everything pertaining to all parties in the contract. Further, we recommend District policy prohibit gratuities, gifts, conflict of interests, and other issues involving procurement as specified in KRS 45A.455.
50 Monitor the contractor’s performance and review applicable invoices to ensure compliance with the contract.
51 Maintain a record of all contracts to facilitate review and monitoring activities.
52 Provide a detailed annual report to the Board of all vendor contract renewals and extensions.
53 Develop a procedure requiring teachers to be informed of the individual maximum amount in the budget available for reimbursement of personal funds used to purchase necessary supplies for classrooms and students.
54 If the Board adopts the per diem method for meal reimbursement as previously suggested, disallow and discourage other methods to incur meal expenses, such as the use of district credit cards or reimbursing the employee based on an actual receipt.
55 Maintain a list of employees attending conferences and training with a criterion on eligibility and limitations on attendance.
56 Inform appropriate payroll staff of employee take-home vehicle assignments so that the taxable benefit is properly reported on the employee’s W-2 tax documents, vehicle records are maintained, and responsibility is assessed accordingly in the case of misuse or improper filing.
57 Require maintenance/transportation departments to maintain an accurate, up-to-date inventory database.
58 All written district IT policies and procedures must reflect current processes and procedures. See the linked report for examples of district IT policies and procedures.
59 Ensure updated policies and procedures are maintained in a central location and made available to all district staff.
60 Ensure internal staff and the application vendor has properly configured IT devices to limit vulnerabilities that could be exploited.
61 Identify all services running on their critical servers housing student information or other personally identifiable information (PII) are strictly secured and encrypted.
62 Ensure a process is in place to identify incidents where breaches of district systems and data have occurred, including a remediation plan and formal process for notifying the affected individuals, credit bureaus, and appropriate law enforcement in compliance with KRS 61.931 to 61.934.
63 Develop a process for sanitizing and disposing of IT equipment in their central office and individual schools.
64 Develop a report to communicate sanitizations and disposals by the schools to the central office with any items that are removed from the district’s fixed asset listing accounted for and included in the report.
65 Develop a formal written procedure detailing the process for all employees, including central office staff, to request new access, change access, or remove access to applications.
66 Perform periodic review of the user accounts and security role groupings established within these applications and production servers to ensure they have a business purpose. Restrict access of outside vendors to the district network to defined periods of time with all actions taken monitored by IT staff.
67 Work with KDE to develop and formalize a password policy. See the linked report for a list of password requirements.
68 Apply the password policy to all applications used by the district. Any exceptions to the password policy should be retained.
69 Implement a standardized process to ensure password audits are performed on a periodic basis. Results of these password audits should be maintained.
70 Ensure that all new IT devices are consistently and periodically configured based on internally developed or KDE directed base- line configurations. Document any variations from the base-line configurations with justification and management’s authorization.
71 Take the necessary actions to ensure the services and open ports on their devices have a specific business purpose. Any unnecessary services are to be disabled or the associated ports should be closed.
72 Develop and finalize a DRP/BCP with adequate distribution to key staff within the process cycle. See the linked report for a list of what a DRP/BCP should include.
73 Develop, document, test and distribute written backup procedures to key staff responsible for this process and provide training in their specific responsibilities. See the linked report for recommended backup procedures.
74 Review the applicable record retention schedules established by the Kentucky Department of Libraries and Archives.