REPORT DIGEST

DEPARTMENT OF INNOVATION AND TECHNOLOGY
INFORMATION TECHNOLOGY HOSTING SERVICES
SYSTEM

SYSTEM AND ORGANIZATION CONTROLS REPORT
AND REPORT REQUIRED UNDER GOVERNMENT
AUDITING STANDARDS
FOR THE YEAR ENDED JUNE 30, 2026

Release Date:  November 5, 2026

FINDINGS THIS AUDIT: 1

CATEGORY:  NEW -- REPEAT – TOTAL
Category 1:  0 -- 1 -- 1
Category 2:  0 -- 0 -- 0
Category 3:  0 -- 0 -- 0
TOTAL:  0 -- 1 -- 1

FINDINGS LAST AUDIT: 1

State of Illinois, Office of the Auditor
General
CHRISTOPHER B. MEISTER, AUDITOR GENERAL

To obtain a copy of the Report contact:
Office of the Auditor General, 400 West
Monroe, Suite 306, Springfield, IL
62704-9849
(217) 782-6046 or TTY (888) 261-2887

This Report Digest and Full Report are
also available on the worldwide web at
www.auditor.illinois.gov

INTRODUCTION

This digest covers the System and
Organization Controls Report and the
Report Required under Government Auditing
Standards of the Department of Innovation
and Technology, Information Technology
Hosting Services System (Department) for
the period July 1, 2025, to June 30, 2026.

The System and Organization Controls
Report contained a qualified opinion due
to weaknesses associated with the
operating effectiveness of the
Department’s controls.  In addition, the
Report Required under Government Auditing
Standards (GAS) contains one finding.

SYNOPSIS

•  (26-1) The controls related to the
trust services criteria stated in the
description of the Department’s
“Information Technology Hosting Services
System” (description of system) did not
operate effectively to provide reasonable
assurance the trust services criteria
would be achieved.

FINDINGS, CONCLUSIONS, AND RECOMMENDATIONS


CONTROLS DID NOT OPERATE EFFECTIVELY

The controls related to the trust services
criteria stated in the “Management of the
State of Illinois, Department of
Innovation and Technology’s Description of
its Information Technology Hosting
Services System” (description), provided
by the Department of Innovation and
Technology (Department), did not operate
effectively to provide reasonable
assurance the trust services criteria
would be achieved.

Logical Access
During testing, we noted the logical
access controls were not operating
effectively to ensure access to Department
resources was authorized and approved.
Specifically, access was not revoked by
the end of the next business day following
the employee’s or contractor’s last day of
work in accordance with Department
procedures for three of 37 (8%) separated
users tested. Access was revoked three to
46 days late.

Physical Access
During testing, we noted the physical
access controls were not operating
effectively to ensure physical access to
Department facilities was restricted to
authorized personnel. Specifically:

• Background Check – For two of 24 (8%)
individuals tested, the Department could
not provide evidence of the required
attestation of a clear background check
completed within the five years preceding
badge issuance.

• Recertification of Access –
-- User access for individuals with access
to the Central Computing Facility (CCF),
Communications Building, and Warehouse was
not verified during the first quarter of
Fiscal Year 2026 access review in
accordance with the Department’s policy.
-- User access for individuals with access
to the CCF secured area was not verified
for one of three (33%) monthly reviews
tested.

System Operations
During testing, we noted the system
operations controls were not operating
effectively to ensure security events were
reviewed and critical information systems
were subject to required security
assessments. Specifically:

• Weekly Access Violation Report Reviews –
The Department was unable to provide
evidence that weekly access violation
reports were produced and reviewed in
accordance with established procedures for
two of seven (29%) weeks tested.

• Pre-Deployment Security Assessments –
The Department was unable to provide
evidence that pre-deployment information
security assessments were performed for
two of eight (25%) critical information
systems deployed.

Change Management
During testing, we noted change management
controls were not operating effectively to
ensure system changes were implemented in
accordance with established Department
procedures. Specifically, systems were not
patched during one of three (33%) months
tested. (Finding 1, pages 8-10)

We recommended the Department ensure the
controls are operating effectively over
the services provided to user agencies,
specifically involving logical and
physical access, system operations, and
change management.

Department officials agreed and stated
they will strengthen controls to ensure
that procedures are established and
followed to (1) provision, monitor, and
revoke physical and logical access, (2)
document report reviews and security
assessments, and (3) implement change
management controls.

SERVICE AUDITOR’S OPINION

The System and Organization Controls
Report contained a qualified opinion.
Specifically, the Service Auditors
determined, except for the matters
described in the System and Organization
Controls Report, in all material respects,
based on the criteria described in the
State of Illinois, Department of
Innovation and Technology’s assertion:

a. the description presents the
Department’s Information Technology
Hosting Services System that was designed
and implemented throughout the period July
1, 2025, to June 30, 2026 in accordance
with the description criteria.

b. the controls stated in the description
were suitably designed throughout the
period July 1, 2025, to June 30, 2026 to
provide reasonable assurance that the
Department’s service commitments and
system requirements would be achieved
based on the applicable trust services
criteria, if its controls operated
effectively throughout that period,  and
if the subservice organizations and user
entities applied the complementary
controls assumed in the design of the
Department’s controls throughout the
period.

c. the controls stated in the description
operated effectively throughout the period
July 1, 2025, to June 30, 2026, to provide
reasonable assurance that the Department’s
service commitments and system
requirements were achieved based on the
applicable trust services criteria, if
complementary subservice organization
controls and complementary user entity
controls assumed in the design of the
Department’s controls operated effectively
throughout the period.

This System and Organization Controls
Examination was conducted by Sikich CPA
LLC.

DENNIS M. GIBBONS
Division Director

This report is transmitted in accordance
with Section 3-14 of the Illinois State
Auditing Act.

CHRISTOPHER B. MEISTER
Auditor General

CBM:vrb