Seven Years On, a Texas School Hasn't Fixed 11 of 12 Cyber Failures
Summary
Texas gave the Texas School for the Deaf $1 million and it hired two cybersecurity analysts. Seven years after the State Auditor first flagged the problems, the school still hasn't fully fixed 11 of the 12 Priority- and High-rated cybersecurity weaknesses -- and now says the work won't be finished until the end of fiscal 2027.
Money and staff, but no fix
In 2025 the Legislature gave the school $1 million⧉ specifically to fix its cybersecurity weaknesses. By mid-2026 it had spent about half and hired two cybersecurity analysts -- answering its 2019 excuse that the work was an "add on" to one Systems Analyst with "no department with multiple staff." The count of open items stayed at 11. Six carry the auditor's Priority label, reserved for issues that "could critically affect" operations; the rest are High. The school blames turnover and "a lack of appropriately skilled personnel."
View data as table
| Fully implemented | 1 | Of the 12 Priority/High recommendations, one had been fully implemented. |
|---|---|---|
| Not implemented — Priority | 6 | Six of the still-open recommendations carry the auditor's most urgent rating. |
| Not implemented — High | 5 | Five of the still-open recommendations carry the next-highest rating. |
A follow-up that couldn't happen
The auditor had planned a full 2026 follow-up audit and issued this report in its place instead⧉: "the School has not completed the work required for our follow-up." Only one of the 12 recommendations was fully done. The school's new target -- the end of fiscal 2027 -- would land more than eight years after the original findings, and the auditor notes the school has repeatedly pushed that date back before.
The takeaway
- The follow-up audit couldn't happen because there was too little to follow up on. The State Auditor's Office planned a 2026 follow-up and instead issued a report saying the school had not done the work to make one possible -- 11 of 12 Priority/High recommendations were still not fully implemented seven years after they were made. High confidence -- stated directly in Report No. 26-033.
- Funding and hiring did not close the gap. The school received $1 million in 2025, spent about half, and hired two cybersecurity analysts, yet the count of unresolved Priority/High recommendations stayed at 11 of 12. The 2019 excuse -- cybersecurity as an 'add on' to one analyst's job -- has been answered with money and staff the findings have not.
- The school's own finish line keeps moving. Its current target, the end of fiscal 2027, would be more than eight years after the February 2019 findings, and the auditor records that the school has repeatedly pushed that date back before. On this record, another slip is likely.
The sensitive access-control specifics from the 2019 audit were withheld in a confidential companion report under Texas Government Code Section 552.139 and aren't described here. The recommendation count and July 2026 status are the auditor's own; the dollar, staffing, and fiscal-2027 figures are the school's self-reported assertions as recorded by the auditor, not independently audited. Neither report alleges a breach or data theft -- only controls not put in place.
Sources(2) ▾
- Texas State Auditor's Office, A Follow-up Audit of Cybersecurity at the School for the Deaf (2026-07-29) — The July 29, 2026 follow-up report. The State Auditor's Office had notified the Legislative Audit Committee on June 1, 2026 that it would conduct a follow-up audit, but issued this letter report instead because the School had not completed the work the follow-up required. It records that, as of July 2026, the School had not fully implemented 11 (92 percent) of the 12 Priority- and High-rated recommendations from the February 2019 audit and its confidential companion; that the School received $1 million from the 89th Legislature in June 2025 and had spent almost half; that it hired two cybersecurity analysts; and that the School's own target for full implementation is the end of fiscal year 2027. Source of every 2026-status figure in this article. sao.texas.gov · original document
- Texas State Auditor's Office, An Audit Report on Cybersecurity at the School for the Deaf (2019-02-28) — The original February 2019 audit. Its overall conclusion found the School had not adequately established and documented its information security policies, had not performed the required risk assessment of its information systems, had not implemented controls to ensure external service providers met its security requirements, and had significant weaknesses in access controls. Table 1 rates five chapters/subchapters: 1-A Priority, 1-B and 2-B High, 2-A and 3 Medium. Sensitive access findings were issued in a separate confidential companion report. The School's own written response noted cybersecurity was an 'add on' to one Systems Analyst's job with no dedicated staff. Source for the original findings and ratings. sao.texas.gov · original document
Comments
Always open. Logged-in readers can annotate paragraphs in place.
In February 2019, the Texas State Auditor's Office⧉ found the Texas School for the Deaf hadn't documented its security policies, hadn't run the required risk assessment, and had weak access controls. Seven years later, the auditor came back to check the fixes -- and couldn't⧉: as of July 2026, 11 of the 12 Priority- and High-rated recommendations were still not fully implemented. That's 92 percent still open.