City Information Technology Application Access Audit (SB26-14021)
At a glance
- What: Biennial performance audit of Baltimore City Information Technology (BCIT), covering fiscal years 2023 to 2026, on how it grants and removes privileged access and security rights in city systems.
- Where it stands: noted by the board Oct 21, 2026. BCIT agreed with both recommendations.
- Next: a Workday financial-role procedure targeted for March 2027 and an annual access review of BCIT-managed applications.
Findings
- Sample of 60 employees (new hires and transfers): 225 of 327 Workday financial security role requests (69%) had no documentation.
- Other applications: 87 of 131 requests (66%) lacked documentation, across 12 of the 130 applications BCIT manages.
- Causes: applications set up before the SolarWinds ticketing system, urgent rollouts (the permit system was named), vendor-created accounts, and an old Workday request form that did not cover all applications (since updated).
- Four more findings were withheld from the public report for data security reasons, as government auditing standards allow.
Recommendations and response
- Route all Workday financial role requests through the request form, and have application administrators periodically review user lists.
- CIO Mayott agreed, reported progress on earlier recommendations (an application inventory of more than 500 applications; restoration testing of critical systems, including the directory that holds city users and permissions), and described the two new procedures.
Board discussion
- Council President Cohen asked whether anyone has access they should not have and stressed privacy for council, administration and Comptroller email.
- Mayor Scott and Mayott discussed domain-level (super-user) accounts, which cannot be fully tracked even by the software vendor; BCIT limits them under a least-privilege rule.
- Comptroller Henry asked whether anyone outside BCIT has super-user access; the captioned answer was yes, not a member of the legislative branch and not someone working for a board member. He stopped there pending the City Solicitor.
Sources
- Video: 2026-10-21 - Board of Estimates
- Audit presented by the Department of Audits (SB26-14021, as captioned).
Discussion time
About 24 minutes across 1 meeting (from transcript timestamps; approximate).
| Meeting | Minutes |
|---|---|
| 2026-10-21 - Board of Estimates | 24 |
Log
- 2026-10-21 - 2026-10-21 - Board of Estimates: audit presented, administration responded, questions from the Council President, Mayor and Comptroller; noted.