Objective

To determine whether the Battery Park City Authority’s (BPCA) access controls and vulnerability management over its critical systems are sufficient to minimize the various risks associated with unauthorized access to systems and data. The audit covered the period from May 2024 through October 2025.

About the Program

BPCA, established in 1968, is a New York State public benefit corporation responsible for the planning, development, and maintenance of the 92-acre Battery Park City neighborhood in lower Manhattan. BPCA is governed by a seven-member Board of Directors whose members serve staggered terms and remain in office until successors are appointed and confirmed. BPCA is supported by a professional workforce of 151 full-time employees who support BPCA’s operational, financial, legal, human resources, and information technology functions.

BPCA plays a vital role in managing residential, commercial, and public spaces within the community. BPCA generates revenue primarily through ground leases and event permits, managing the latter through its own system, while various other functions utilize third-party vendors.

We evaluated BPCA’s information technology governance and security posture against recognized industry best practices and frameworks including the National Institute of Standards and Technology and the Payment Card Industry Data Security Standard. We also used BPCA’s own internal policies and procedures.

Key Findings

We identified areas where BPCA could improve overall governance and certain security controls to minimize the risks associated with unauthorized access to its system and data. Due to the confidential nature of our audit findings, we communicated the details of these findings with seven recommendations in a separate, confidential report to BPCA officials for their review and comment. BPCA officials generally agreed with our findings and indicated actions to implement our recommendations.

Key Recommendation

Implement the recommendations included in our confidential draft report.