In addition to insufficient oversight of the state's major IT projects, an audit also found weak information security practices across California.