Cybersecurity Audit of Exhibition Place - Phase One: Physical Security, User Access Management and Staff Training

Technology plays a vital role in all aspects of the Exhibition Place's operations and services. Given the size of the operations, and the services that Exhibition Place provides, the Auditor General included a cybersecurity audit of the Exhibition Place in her 2025 Work Plan. This audit is conducted in two phases. Phase One of this audit focused on: - Physical security at selected facilities, - User access management, and - Social engineering and staff awareness. Phase Two, which is in progress, will include an overall assessment of Exhibition Place's networks, systems, and application security and will be reported to the Board in April 2026. This report includes five administrative recommendations. The confidential findings and recommendations are contained in Confidential Attachment 1 to this report. A separate confidential detailed technical report has been provided to management with technical details to guide them in addressing the report findings and recommendations. Management agrees with the recommendations contained in the Confidential Attachment 1, which also includes management's response.