We also issued individual reports for the following municipalities: Auburn Enlarged City School District, Batavia City School District, Brentwood Union Free School District, Broadalbin-Perth Central School District, Central Square Central School District, East Rochester Union Free School District, Eldred Central School District, Greene Central School District, Green Island Union Free School District, Groton Central School District, Holley Central School District, Malverne Union Free School District, New York Mills Union Free School District, Niskayuna Central School District, North Collins Central School District, Onondaga Cortland Madison Board of Cooperative Educational Services, Orange-Ulster Board of Cooperative Educational Services, Red Hook Central School District, Union-Endicott Central School District, Waterloo Central School District
Summary
We selected 20 school districts and boards of cooperative educational services (Schools) to determine whether the Schools’ officials properly managed and monitored building access accounts (accounts) and devices. We visited the Schools between December 2025 and May 2026 and identified that officials did not disable all unneeded building access accounts and devices.
Specifically, of the accounts and devices we reviewed:
- All 20 Schools (100 percent) had unneeded active accounts and devices.
- 19 Schools (95 percent) did not properly monitor and track shared devices.
- 18 Schools (90 percent) had employees with duplicate active devices.
- 12 Schools (60 percent) did not have any written policies and procedures outlining who is responsible for managing and monitoring accounts.
- 10 Schools (50 percent) had non-employees with duplicate active devices.
As a result, because accounts and devices were not properly managed and monitored, there were potential risks for unauthorized access to the Schools’ buildings, compromising building security and safety for students, teachers, staff and visitors.
Background
Building access controls are essential for enhancing security and enabling school officials to manage and monitor entry points within educational institutions. These systems authenticate an individual or user through devices such as key fobs, keycards, badges, or similar technologies, helping to ensure only authorized individuals can enter school buildings. By limiting access this way, schools can better safeguard their facilities and maintain a safe and secure environment for students, teachers, staff and visitors.
Conclusion
School officials are responsible for ensuring the safety of students, staff, and visitors while using School facilities. They should establish and follow policies that clearly assign responsibility for managing and monitoring building access, including entry protocols for all individuals.