The New MSIS Audit Process

1
The New MSIS Audit Process

• MASS Summer Convention
• June 28, 2006

2
What started all this????

• In 2004, House Bill 1251 gave the Office of the
  State Auditor the authority to determine the
  correctness and accuracy of all reports made to
  the State Department of Education by any school
  district or school official concerning the number
  of educable students in any school district, the
  number of students enrolled in any school
  district, the number of students in average daily
  attendance in any school district, and the number
  of students being transported or entitled to
  transportation to any of the public schools of
  this state.

3
Data Collection Policy Template

• Requirements of HB 1251 led to the need for a
  Data Collection Policy in each district
• MDE developed a Policy template in consultation
  with
• MASS
• State Auditors Office
• School Districts
• Template was designed so that districts could
  substitute specific local information in
  electronic document

4
Data Collection Policy

• Policy provides auditors with local guidelines
  for
• Roles/Responsibilities of district personnel
• District-wide collection methods
• Data collection and reporting process
• Data validation and error correction
• Data protection and system security

5
A Meeting with OSA

• 2005-2006 fact-finding year for audit process
• Led to the realization a disconnect existed
• Meeting in May between MDE and OSA
• Formalize process over summer
• Personnel from OSA will attend the MIS Summer
  Data Conference
• Roll out formal process at the conference

6
Results of meeting

• Survey each district on attendance policies
• Develop Three Phase approach
• Pre-Audit Process
• On-Site Process
• Follow-up Process

7
Pre-Audit Process

• Letter of Engagement
• Letter explaining process to the district
• List of required reports
• SAP
• MSIS
• Oath of Confidentiality
• Supplied for any auditor working within the
  district

8
On-Site Process

• Entrance Meeting
• Exit Meeting

9
Follow-Up Process

• Summary of what was discovered during On-Site
  visit

10
Audit Items

• Absenteeism
• Definitions
• Determined by surveys for each district
• Process
• Manual
• Automatic
• Reporting
• Verification
• Approval
• Reconciliation

11
Audit Items

• Transfers/Withdrawals
• Discipline
• Alternative School

12
Q and A on Audit Process
13
MSIS and the World of MPLS

• Providing Data Security
• in an Insecure World

14
MPLS and K-12 World

• MPLS is changing the way we do business.
• MSIS will no longer be protected by the security
  of a private network
• Changes will have to be made to compensate for
  the changes in the network.
• Advice on how to handle the changes was sought
  from K-12 steering committee and in-house
  steering committee.

15
What will happen with MSIS?

• MSIS will be unavailable from June 30, 2006,
  1100 pm July 17, 2006, 900 am.
• Build ownership files for 2006-2007 school year.
• Roll data that needs to be rolled (personnel,
  etc).
• Install patches to application server to be ready
  for SSL (upgrade from v4.07 to v4.08) (separate
  server from database server.
• Changes will be active when system comes back up.

16
What are the Changes?

• MSIS will now use SSL to transmit data.
• New password policy.
• All passwords will be expired when MSIS comes
  back up.
• Inactivity will log you out of MSIS.

17
MSIS and SSL

• You will still need J-Initiator.
• You will still need Netscape 4.79.
• You will need to download one file to every
  machine that is going to access MSIS.
• The file is available on the MSIS Information
  page.
• http//www.mde.k12.ms.us/msis/resources.html
• New URL for accessing MSIS.
• https//msis.k12.ms.us81/msis/MSIS_MAIN.html
• You will be able to access MSIS from any computer
  as long as these conditions are met.

18
Password Policy

• Password must be at least eight characters in
  length.
• Password must contain at least one non-alpha
  character.
• Password must be at least two characters
  different from old password.
• Passwords will expire sixty days from date of
  change.

19
Password Policy (contd)

• Passwords not changed 30 days after date of
  expiration will be locked.
• Only MIS will be able to unlock locked accounts.
• Any account will be locked after three failed
  logon attempts and the user will have to contact
  MIS to unlock the account.

20
Password Reset Policy

• User contacts Primary contact or Secondary
  contact.
• Primary contact or Secondary contact requests
  password reset of MIS.
• Provide SSN of user needing password reset for
  verification.
• Prefer request through E-mail if possible.

21
Password Expiration

• Everyone will be forced to change their password
  when MSIS comes back up.
• Passwords must follow new password policy.
• MIS will send the primary contact a list of
  accounts locked after the initial 60 days.
• Those accounts who are not reset after the next
  30 days will be deleted.
• Users will have to file a new Oath of
  Confidentiality and MSIS-2 to create new accounts
  if the account is deleted.
• The deletion will only be for the initial
  password expiration. During subsequent periods,
  the accounts will only be locked.

22
Password Examples

• Bigdog
• NO
• Bigdog8!
• YES
• password
• NO
• pa29ssword
• YES
• bluebird
• NO
• blue89bird
• YES

23
Inactivity in MSIS

• MSIS sessions will be logged out after 30 minutes
  of inactivity
• A session where a save hasnt been executed or
  a screen change hasnt occurred is considered an
  inactive session.
• A session where a report is building is NOT
  considered an inactive session.
• If you are entering data but havent saved within
  the last 30 minutes will be considered inactive.
  You wont know it until you try to save the data.
• i.e., SAVE REGULARLY!!!

24
And in conclusion

• MSIS contains some of the most confidential and
  important information anywhere. Always treat
  MSIS like you would your bank account.
• Always make sure you close the browser when
  leaving the computer.
• Never let the computer remember the password for
  you.
• Never stick the password to the computer on a
  sticky.
• Never share your password with anyone else.

25
Q and A on Security Process
26
As always.

• Any questions, just let me know
• 601-359-2114
• 601-668-1171
• kthompson_at_mde.k12.ms.us