Develop and document methodologies on how OCHCO calculates hiring metrics to ensure that its hiring metrics and hiring goals align across all of its data sources, including the POL, the human capital dashboard, and the HCOP.

Track the quality of candidates as measured by the hiring officials.

Track the number of recruit attempts that result in a selection, the number of recruit attempts that result in a successful hire, and the number of positions that are reposted due to unsuccessful first recruit attempts.

Develop an enterprise-wide IT modernization strategy that establishes a framework to align with the IT modernization roadmap.

Corrective Action Taken

In January, 2024, HUD provided an OCIO approved an IT Modernization strategy that established a framework that aligned with its IT modernization roadmap. The strategy addressed each of the recommendation components (a. roles and responsibilities, b. prioritization of modernization initiatives, c. coordination process between OCIO and program offices, d. phased approach, and e. how lessons learned will be captured.

Obtain the proper approval and communicate the IT modernization strategy to all appropriate stakeholders, including HUD program offices.

Develop and issue a departmentwide policy that notes that radon is a radioactive substance and outlines HUD's requirements to test for and mitigate excessive radon levels in accordance with 24 CFR 50.3(i)(1) and 58.5(i)(2)(i).

Corrective Action Taken

None Given.

Develop and provide training for applicable program staff, grantees, and PHAs on radon testing and mitigation requirements.

Develop and implement an effective radon policy to ensure that CPD program activities comply with the departmentwide policy on radon testing and mitigation requirements.

Update the current Multifamily radon policy to ensure that program activities comply with the departmentwide policy on radon testing and mitigation requirements.

Revise the current PIH radon policy to align with 24 CFR 50.3(i)(1) and 58.5(i)(2)(i).

Update the PIH radon policy to ensure that program activities comply with the departmentwide policy on radon testing and mitigation requirements.

Provide the MOU with EPA designed to address radon contamination.

Develop and implement a strategy to review Multifamily-funded properties with potential contamination to determine whether site contamination should be considered in future environmental reviews.

Monitor environmental reviews of Multifamily-funded properties with potential contamination.

Develop and implement a strategy to review PIH-funded properties with potential contamination to determine whether site contamination should be considered in future environmental reviews.

Monitor environmental reviews of PIH-funded properties with potential contamination.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

Implement a software asset management capability for software and operating systems to ensure that software executes only from the authorized software inventory and all unauthorized software is blocked from executing on HUD's network.

Status

In April 2024, the Office of the Chief Information Officer reported that it was in the process of implementing a software management tool that would allow it to control which software is authorized to access the network. This is the first step to create rules for allowing only authorized software to be used through HUD's endpoint security software. Final implementation of this new tool is expected by Quarter 2 of FY 2025.

Analysis

To fully address this recommendation, HUD must provide evidence that it has an automated whitelist and implement as per the NIST Special Publication 800-167 or accept the risk and document mitigating measures via a Risk Based Decision memorandum.

Implementation of this recommendation will result in HUD having the capability to ensure only authorized software is used on HUD’s network based on its software asset listing.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.

The OIG has determined that the contents of this recommendation would not be appropriate for public disclosure and has therefore limited its distribution to selected officials.