The State Audit Office (SAO) has identified shortcomings in the design and implementation of preventive measures for information security at the Pension and Disability Insurance Fund of North Macedonia. According to the institution, there is a need to improve the controls that protect information and IT resources so that services for citizens can be provided without interruption.
The findings emerged from a performance audit titled “Implementation of preventive measures for information security in the IT system of the Pension and Disability Insurance Fund of North Macedonia.” The SAO assesses that the identified weaknesses directly affect the overall level of protection of data and technological resources used for administering pension and disability rights.
Të lidhura
None found
“The audit concluded that the implementation of preventive measures for information security in the IT system of the Pension and Disability Insurance Fund exhibits weaknesses that affect the overall level of effective protection of information and IT resources, through which the data of beneficiaries are managed, whose rights are realized exclusively through the Fund,” the SAO statement reads.
The audit revealed that the Fund lacks a strategic and integrated approach to IT security. The IT strategy has not been adopted, some procedures are outdated or unapproved, and legally required risk assessments have not been carried out. Problems were also found in human capacities, planning and provision of IT resources, implementation of protective controls, and preparedness for managing incidents or operational disruptions.
The Informatics Sector has an insufficient number of employees. Of the 57 systematized job positions, only 17 have been filled, or 30%. The situation is particularly problematic in the IT Infrastructure and Support Unit, where only one of 13 positions has been filled and there is no employee responsible for information security.
The SAO assesses that the lack of staff and professional expertise hampers the efficient administration of the IT system, timely resolution of problems, and the application of security measures.
Regarding professional development, the last training for IT skills was held in 2022. During 2023, an online training on information security awareness was published on the MKD-CIRT website. However, after this activity, no further awareness-raising trainings were conducted, nor were practical exercises held to test employees’ ability to identify and respond to security threats. Additionally, planned procurements for IT skills training for 2024 and 2025 were not realized.
Weaknesses were also identified in the planning and provision of funds for IT infrastructure and information security. During 2024, the total value of contracts concluded for public procurement in the IT field was 12,393 thousand denars, representing 2.04% of the Fund’s overall expenditures, excluding social benefits.
Due to financial constraints, the planned purchase of a data center for information storage, a disk system, and optical switches was not realized. According to the audit analysis, funds are spent mainly on routine system maintenance, while a significant portion of information security actions has not been included in planned investments.
In 2024, expenditures on information security amounted to only 1 denar for every 10,000 denars of calculated and paid pensions.
The failure to realize procurements limits the possibility of renewing outdated equipment and creates periods during which key equipment remains without maintenance. Servers and workstations were found in use with operating systems no longer supported by the manufacturer, as well as workstations where antivirus protection has not been updated. Deficiencies were also noted in access control mechanisms in the IT system.
Other problems relate to the administration of user accounts and security updates, network protection, and IT resource management. No additional layer of security is applied to user accounts, while the network is not properly segmented. Security patch updates have not been performed since 2023.
According to the SAO, these deficiencies increase the risk of data loss, hamper timely information recovery, and may cause longer interruptions in the functioning of the information system.
