|STATE OF CONNECTICUT|
THE STATE COMPTROLLER
55 ELM STREET
HARTFORD, CONNECTICUT 06106-1775
MEMORANDUM NO. 95 - 66
December 29, 1995
TO THE HEADS OF ALL STATE AGENCIES
|Attention:|| Commissioners, Chief Financial Officers, Business|
Managers, and Payroll Officers
|Subject:||Comptroller's Financial Systems Security|
The purpose of this memo is to advise all State Agencies of the importance of having appropriate internal controls over and within automated systems to ensure that transactions are properly authenticated and authorized.
A key security issue in an automated system is unauthorized transaction processing. Guarding against unauthorized or inappropriate transaction processing is critical because of the integration of automated systems.
An automated system concentrates accounting records and transaction processing capabilities in one system. Unrestricted access to automated systems compromises the controls provided by segregating duties and other safeguards that are usually part of manually operated systems.
Security in automated systems is imperative so that only those individuals authorized have access to on-line transaction processing capabilities. The initial request for user access to systems is done via Form CO-1057, Agency OnLine Security Form.
Each agency must monitor the following to ensure that identification codes and passwords are properly effective:
The Office of the State Comptroller is requesting each agency head to designate a single contact person and backup for the Comptroller's Financial Systems (Central Accounting System, Payroll System, and Retirement Data Base System). A list of designated agency contact individuals will be on file with the Comptroller's Computer Services Division.
Complete the attached form and list the person(s) that should be contacted regarding User Identification and Password access to the Comptroller's Financial Systems. This form must be completed and received by the Comptroller's Office by January 31, 1995.
When an agency needs to submit an Agency On-Line Security Form (CO-1057), the designated agency liaison should fax or mail the CO-1057 to:
Office of the State Comptroller,
Computer Services Division,
55 Elm Street, Hartford, CT 06106
Att: Carolyn LoGiudice
or Fax No. (860) 566-1650
The agency liaison will be contacted by the Comptroller's Computer Services Division when the Agency On-Line Security Form (CO-1057) has been approved and the identification code/password has been assigned. The liaison must then give this information to the designated user.
In the event of a password problem, the designated user should inform the agency liaison, who should then contact the Comptroller's Office.
Questions may be directed as follows:
|On-Line Security:||Office of the State Comptroller|
Computer Services Division
|Carolyn LoGiudice||(860) 566-2160|
|Diane Irwin||(860) 566-2160|
|Nayda Flores||(860) 566-2160|
|Policy Evaluation & Review Division||(860) 566-5981|
COMPTROLLER'S FINANCIAL SYSTEMS
AGENCY CONTACT PERSON
FOR AGENCY ON-LINE SECURITY
In the space that follows, please list the person(s) that should be contacted regarding Agency On-Line Security for the Comptroller's Financial Systems (Central Accounting System, Payroll System, and Retirement System). Payroll System add Level (2). Accounting System add agency number. Attach copies, if necessary, to provide for additional liaisons. One sheet per system.
Level(2)/Agency No. __________
Accounting_________ Payroll____________ Retirement_____________
Please return this response form by January 31, 1996. You can mail the form to:
Computer Services Division
Office of the State Comptroller
55 Elm Street
Hartford, Connecticut 06106
Or fax it to Carolyn LoGiudice at (860)-566-1650. Thank you for your cooperation and assistance.
ACCOUNTING, PAYROLL AND RETIREMENT SYSTEM SECURITY POLICY AT THE OFFICE OF THE STATE COMPTROLLER AND CATER
To control user access to on-line systems, restricted identification codes and passwords are assigned. The security for an on-line system should be controlled at the agency level. Internal controls are required to ensure that transactions are properly authenticated and authorized, and to ensure the accuracy, confidentiality, and integrity of data that is input and resides on automated systems. Consequently, appropriate internal controls are necessary over and within automated systems to eliminate or reduce the risk of exposure.
The following security policy is a guideline for protecting the information stored on the Central Accounting, Payroll and Retirement computer system. All agencies must adhere to these guidelines.
Request for User ID/Password/Access Modification
Back to Comptroller's Home Page
Back to Index of Comptroller's Memoranda