Audit finds IT weaknesses at Pension and Disability Insurance Fund (PIOM)

The state auditors found multiple weaknesses in data protection and IT management at the Pension and Disability Insurance Fund (PIOM), citing outdated computers, weak safeguards and a shortage of IT staff that leaves the institution exposed to interruptions and data loss.

According to the audit, PIOM has not approved a development plan for its computer system. Of 57 IT positions, only 17 are filled.

“The situation in the IT infrastructure and support department is particularly unfavorable, where only one of 13 positions is filled, and there are no employees responsible for information security. The shortage of staff and expertise limits the ability to effectively manage the IT system, timely resolve problems and implement security controls.”

Technical gaps, missing backups and weak physical protection

The audit report notes that some computers still run programs that no longer receive technical support and several machines lack up-to-date antivirus protection. Planned purchases of new data-storage equipment were not carried out because of lack of funds. There is no approved plan to restore systems after a major failure or attack.

“These conditions constitute a risk of data loss, inability to timely restore information and a longer interruption in the operation of the information system. In terms of physical security, access to server rooms is not accompanied by electronic records or video surveillance, fire suppression systems are not maintained regularly, and in some branch units backup power supplies are defective.”

Auditors recommended hiring more specialists, strengthening data protection and establishing business continuity plans. Of the six findings that PIOM responded to, the fund fully accepted only the note about an expired security certificate on its website and has already renewed it. It partially accepted recommendations on system access, backup protection, continuity plans and securing premises. PIOM rejected the finding that the computer network is insufficiently segmented, saying it already maintains separate parts for different purposes.

The pension fund has been in public focus also because the Fiscal Council warned that linear pension increases widen the financing gap. Director Nikola Memov defended the increases as help to low-pension beneficiaries and proposed gradual rises in contributions, insisting that pension payments are secure because the state covers missing funds.

Photo: press material from the event